Code:  int extract_status_code(char *buffer, size_t size)
 {
	char *buf_code;
	char *begin;
 	char *end = buffer + size;
	size_t inc = 0;
	int code;
	/* Allocate the room */
	buf_code = (char *)MALLOC(10);
 
 	/* Status-Code extraction */
	while (buffer < end && *buffer++ != ' ') ;
	begin = buffer;
	while (buffer < end && *buffer++ != ' ')
		inc++;
	strncat(buf_code, begin, inc);
	code = atoi(buf_code);
	FREE(buf_code);
 	return code;
 }

Vulnerability Type: Overflow 
CWE ID: CWE-119
Summary: keepalived before 2.0.7 has a heap-based buffer overflow when parsing HTTP status codes resulting in DoS or possibly unspecified other impact, because extract_status_code in lib/html.c has no validation of the status code and instead writes an unlimited amount of data to the heap.
Commit Message: Fix buffer overflow in extract_status_code()

Issue #960 identified that the buffer allocated for copying the
HTTP status code could overflow if the http response was corrupted.

This commit changes the way the status code is read, avoids copying
data, and also ensures that the status code is three digits long,
is non-negative and occurs on the first line of the response.

Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>