Don’t segv on zero length boxes in value_box_copy

diff --git a/src/lib/util/value.c b/src/lib/util/value.c
index 98cb1ee729c4f6075ae5e1164d452780f290a62c..7ccf58803c6edb7782d233c8d067eb198cbd28d6 100644 (file)
--- a/src/lib/util/value.c
+++ b/src/lib/util/value.c
@@ -1626,8 +1626,11 @@ inline int value_box_copy(TALLOC_CTX *ctx, value_box_t *dst, const value_box_t *
 
        case PW_TYPE_STRING:
        {
-               char *str;
+               char *str = NULL;
 
+               /*
+                *      Zero length strings still have a one byte buffer
+                */
                str = talloc_bstrndup(ctx, src->datum.strvalue, src->length);
                if (!str) {
                        fr_strerror_printf("Failed allocating string buffer");
@@ -1639,11 +1642,16 @@ inline int value_box_copy(TALLOC_CTX *ctx, value_box_t *dst, const value_box_t *
 
        case PW_TYPE_OCTETS:
        {
-               uint8_t *bin;
+               uint8_t *bin = NULL;
 
-               bin = talloc_memdup(ctx, src->datum.octets, src->length);
-               talloc_set_type(bin, uint8_t);
-               if (!bin) return -1;
+               if (src->length) {
+                       bin = talloc_memdup(ctx, src->datum.octets, src->length);
+                       if (!bin) {
+                               fr_strerror_printf("Failed allocating octets buffer");
+                               return -1;
+                       }
+                       talloc_set_type(bin, uint8_t);
+               }
                dst->datum.octets = bin;
        }
                break;