update comments and sanity checks

diff --git a/src/protocols/radius/decode.c b/src/protocols/radius/decode.c
index 7ece8294698b634c079ee604cc881d0d3608bf90..72b4c3d7b3b3e4aad63481cc765925e44d7329c3 100644 (file)
--- a/src/protocols/radius/decode.c
+++ b/src/protocols/radius/decode.c
@@ -322,10 +322,12 @@ static ssize_t decode_concat(TALLOC_CTX *ctx, vp_cursor_t *cursor,
        attr = ptr[0];
 
        /*
-        *      The packet has already been sanity checked, so we
-        *      don't care about walking off of the end of it.
+        *      See how many consecutive attributes there are.
         */
        while (ptr < end) {
+               if (ptr[1] <= 2) return -1;
+               if ((ptr + ptr[1]) > end) return -1;
+
                total += ptr[1] - 2;
 
                ptr += ptr[1];