net_get assigns negative integer to len argument

net_get reads nh structure which contains a length field. The length field is assigned to len argument and gets returned by reference. A segmentation fault can occur if a malicious server sends back a negative length. As a result net_get will return with a negative length which may be used erroneously as valid. As an example the function net_get_nopacket:
net_get( pn->pn_s, buf, &l);
memcpy(arg, buf, l);