From b4520aaf2cb56cd14519e2df9d99ea6efc8ddd03 Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Mon, 16 Dec 2019 16:09:28 +0000
Subject: [PATCH] Need to include message size in the maximum buffer
 calculation.

---
 client.c | 4 ++--
 file.c   | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/client.c b/client.c
index 38fe52cd..a36c6471 100644
--- a/client.c
+++ b/client.c
@@ -601,8 +601,8 @@ client_read_callback(__unused struct bufferevent *bev, void *arg)
 
 		if (bsize == 0)
 			break;
-		if (bsize > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
-			bsize = MAX_IMSGSIZE - IMSG_HEADER_SIZE;
+		if (bsize > MAX_IMSGSIZE - IMSG_HEADER_SIZE - sizeof *msg)
+			bsize = MAX_IMSGSIZE - IMSG_HEADER_SIZE - sizeof *msg;
 		log_debug("read %zu from file %d", bsize, cf->stream);
 
 		msglen = (sizeof *msg) + bsize;
diff --git a/file.c b/file.c
index 7e1f1879..9a3e79de 100644
--- a/file.c
+++ b/file.c
@@ -376,8 +376,8 @@ file_push(struct client_file *cf)
 	left = EVBUFFER_LENGTH(cf->buffer);
 	while (left != 0) {
 		sent = left;
-		if (sent > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
-			sent = MAX_IMSGSIZE - IMSG_HEADER_SIZE;
+		if (sent > MAX_IMSGSIZE - IMSG_HEADER_SIZE - sizeof *msg)
+			sent = MAX_IMSGSIZE - IMSG_HEADER_SIZE - sizeof *msg;
 
 		msglen = (sizeof *msg) + sent;
 		msg = xrealloc(msg, msglen);