Do not overrun plugin string when copying it.

parse_plugin() expands the % in plugin string to plugin_copy.  It
checks that is does not write behind the end of the destination
memory, but the source length was not checked.  This resulted in
reading from a possibly invalid memory location which may cause a
segmentation fault.  Add a check for the string length of the source.

1 files changed, 1 insertions, 1 deletions

diff --git a/socket.c b/socket.c
index 546a6bd4..93e43e69 100644
--- a/socket.c
+++ b/socket.c
@@ -111,7 +111,7 @@ static char *const *parse_plugin(const char *plugin, const char *host, const cha
 		return NULL;
 	}
 
-	while (plugin_copy_offset < plugin_copy_len)
+	while (plugin_offset < plugin_len && plugin_copy_offset < plugin_copy_len)
 	{	if ((plugin[plugin_offset] == '%') && (plugin[plugin_offset + 1] == 'h'))
 		{	strcpy(plugin_copy + plugin_copy_offset, host);
 			plugin_offset += 2;