Double-check that we don't over-run the buffer

diff --git a/src/lib/vqp.c b/src/lib/vqp.c
index b60c84d858d3f79a23626746512a9ff046dd0341..3ceb20c59ea7047788fa9229fdec2bed231d35e2 100644 (file)
--- a/src/lib/vqp.c
+++ b/src/lib/vqp.c
@@ -651,6 +651,8 @@ int vqp_encode(RADIUS_PACKET *packet, RADIUS_PACKET *original)
         */
        for (i = 0; i < VQP_MAX_ATTRIBUTES; i++) {
                if (!vps[i]) break;
+               if ((ptr - packet->data) >= packet->data_len) break;
+
                vp = vps[i];
 
                debug_pair(vp);