let's check availability before dereferencing, m'kay?

diff --git a/src/lib/util/struct.c b/src/lib/util/struct.c
index 4ff7ffa7a5b134c77477f288c86e7b3867a1a247..b74876aa9e737721724ddba0a9a2e65bc8689e79 100644 (file)
--- a/src/lib/util/struct.c
+++ b/src/lib/util/struct.c
@@ -114,6 +114,11 @@ ssize_t fr_struct_from_network(TALLOC_CTX *ctx, fr_dcursor_t *cursor,
        if (da_is_length_field(parent)) {
                size_t struct_len;
 
+               if ((end - p) < 2) {
+                       FR_PROTO_TRACE("Insufficient room for length header");
+                       goto unknown;
+               }
+
                struct_len = (p[0] << 8) | p[1];
                if ((p + struct_len + 2) > end) {
                        FR_PROTO_TRACE("Length header is larger than remaining data");