From: Nick Porter <nick@portercomputing.co.uk>
Date: Wed, 15 Oct 2025 18:51:31 +0000 (+0100)
Subject: Verify the relationship between the pair to encode and the root ctx
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c90713ca9f99b331ee1ed7f83c2b8124e55935ba;p=thirdparty%2Ffreeradius-server.git

Verify the relationship between the pair to encode and the root ctx
---

diff --git a/src/lib/unlang/xlat_builtin.c b/src/lib/unlang/xlat_builtin.c
index 0df32d75bc..b7a0205304 100644
--- a/src/lib/unlang/xlat_builtin.c
+++ b/src/lib/unlang/xlat_builtin.c
@@ -4200,6 +4200,18 @@ static xlat_action_t protocol_encode_xlat(TALLOC_CTX *ctx, fr_dcursor_t *out,
 		}
 	}
 
+	if (root_da) {
+		if (!fr_type_is_structural(root_da->vb_attr->type)) {
+			REDEBUG2("Encoding context must be a structural attribute reference");
+			return XLAT_ACTION_FAIL;
+		}
+		vp = fr_dcursor_current(cursor);
+		if (!fr_dict_attr_common_parent(root_da->vb_attr, vp->da, true) && (root_da->vb_attr != vp->da)) {
+			REDEBUG2("%s is not a child of %s", vp->da->name, root_da->vb_attr->name);
+			return XLAT_ACTION_FAIL;
+		}
+	}
+
 	/*
 	 *	Loop over the attributes, encoding them.
 	 */