more sanity checks on the packet

diff --git a/src/lib/util/radius.c b/src/lib/util/radius.c
index 4c23e76db9b3d5522d248885b4fd9c281d4f1773..04c6f833caccb66ac01f4406e2055543985d76e1 100644 (file)
--- a/src/lib/util/radius.c
+++ b/src/lib/util/radius.c
@@ -410,6 +410,8 @@ static int fr_radius_sign(uint8_t *packet, uint8_t const *original,
        end = packet + packet_len;
 
        while (msg < end) {
+               if ((end - msg) < 2) goto invalid_attribute;
+
                if (msg[0] != PW_MESSAGE_AUTHENTICATOR) {
                        if (msg[1] < 2) goto invalid_attribute;
 
@@ -1102,6 +1104,8 @@ static int fr_radius_verify(uint8_t *packet, uint8_t const *original,
        end = packet + packet_len;
 
        while (msg < end) {
+               if ((end - msg) < 2) goto invalid_attribute;
+
                if (msg[0] != PW_MESSAGE_AUTHENTICATOR) {
                        if (msg[1] < 2) goto invalid_attribute;