Fix WiMAX encoding bug introduced in 326a68b90a1a

diff --git a/src/lib/radius.c b/src/lib/radius.c
index 326ed52172373180dc1e8bef969a8ae4bf075d43..53333033e30d837a6038846d1608aee96c41198e 100644 (file)
--- a/src/lib/radius.c
+++ b/src/lib/radius.c
@@ -852,14 +852,15 @@ static VALUE_PAIR *rad_vp2tlv(VALUE_PAIR *vps)
                }
 
                length = (end - ptr);
+               if (length > 255) return NULL;
 
                /*
                 *      Pack the attribute.
                 */
                ptr[0] = (vp->attribute & 0xff00) >> 8;
-               ptr[1] = (length & 0xff) + 2;
+               ptr[1] = length;
 
-               ptr += vp->length + 2;
+               ptr += ptr[1];
                vp->flags.encoded = 1;
        }