More thorough tainted scalar checks

diff --git a/src/modules/proto_vmps/vqp.c b/src/modules/proto_vmps/vqp.c
index 4daf580bc0d4a98a090dafc630b34796410dfdaa..3e76ad079c3b1453c6804932348e566a893978e3 100644 (file)
--- a/src/modules/proto_vmps/vqp.c
+++ b/src/modules/proto_vmps/vqp.c
@@ -344,18 +344,22 @@ int vqp_decode(RADIUS_PACKET *packet)
 
                default:
                case FR_TYPE_OCTETS:
-                       if ((ptr + attr_len) >= end) {
+                       if (attr_len > (end - ptr)) {
                                fr_strerror_printf("Attribute length exceeds received data");
                                goto error;
                        }
+                       if (attr_len == 0) break;
+
                        fr_pair_value_memcpy(vp, ptr, attr_len);
                        break;
 
                case FR_TYPE_STRING:
-                       if ((ptr + attr_len) >= end) {
+                       if (attr_len > (end - ptr)) {
                                fr_strerror_printf("Attribute length exceeds received data");
                                goto error;
                        }
+                       if (attr_len == 0) break;
+
                        fr_pair_value_bstrncpy(vp, ptr, attr_len);
                        break;
                }