check lengths, too

diff --git a/src/protocols/radius/decode.c b/src/protocols/radius/decode.c
index 50797a3f0f23edda6e256633026dc3d8fd91af54..803270fd5c9da77809cedd99d1338da9f0e7252d 100644 (file)
--- a/src/protocols/radius/decode.c
+++ b/src/protocols/radius/decode.c
@@ -633,7 +633,7 @@ redo:
         *      Decode consecutive ones into the same parent.
         */
        p += p[1];
-       if (((p + 2) < end) && (p[0] == FR_DIGEST_ATTRIBUTES)) {
+       if (((p + 2) < end) && ((p[0] == FR_DIGEST_ATTRIBUTES) && (p[1] > 2))) {
                goto redo;
        }