check length before memcpy()

diff --git a/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c b/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c
index 69070e5e288a888eab2ce90f4025f61b3a9a5223..c483e501842c370b58346c2278c37d6c9d273136 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c
+++ b/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c
@@ -1084,7 +1084,7 @@ static PW_CODE eap_fast_process_tlvs(REQUEST *request, eap_handler_t *eap_sessio
                                t->stage = PROVISIONING;
                                break;
                        case EAP_FAST_TLV_CRYPTO_BINDING:
-                               if (!binding) {
+                               if (!binding && (vp->vp_length >= (sizeof(eap_tlv_crypto_binding_tlv_t) - 4))) { {
                                        binding = talloc_zero(request->packet, eap_tlv_crypto_binding_tlv_t);
                                        memcpy(binding, vp->vp_octets, sizeof(*binding));
                                        binding->tlv_type = htons(EAP_FAST_TLV_MANDATORY | EAP_FAST_TLV_CRYPTO_BINDING);