Double-check that we don't over-run the buffer

diff --git a/src/lib/vqp.c b/src/lib/vqp.c
index 6a8dd1cec23f4945d7d9cf8cba7717fa56cbf46c..1250c4efd674680e0834d6a8959fc430143ca6df 100644 (file)
--- a/src/lib/vqp.c
+++ b/src/lib/vqp.c
@@ -651,6 +651,8 @@ int vqp_encode(RADIUS_PACKET *packet, RADIUS_PACKET *original)
         */
        for (i = 0; i < VQP_MAX_ATTRIBUTES; i++) {
                if (!vps[i]) break;
+               if ((ptr - packet->data) >= packet->data_len) break;
+
                vp = vps[i];
 
                debug_pair(vp);