make sure we catch 0 iterations in the $PBKDF2$... format, too

diff --git a/src/modules/rlm_pap/rlm_pap.c b/src/modules/rlm_pap/rlm_pap.c
index 5b0fd8a42a5d671c2fb30a663ac6d18b7714dd93..d6de7c02f2d6096edca727105c0b69ad699022dd 100644 (file)
--- a/src/modules/rlm_pap/rlm_pap.c
+++ b/src/modules/rlm_pap/rlm_pap.c
@@ -589,14 +589,14 @@ static inline CC_HINT(nonnull) unlang_action_t pap_auth_pbkdf2_parse(rlm_rcode_t
 
                iterations = ntohl(iterations);
 
-               /*
-                *      0 iterations is invalid (we need at least one)
-                */
-               if (iterations == 0) iterations = 1;
-
                p = q + 1;
        }
 
+       /*
+        *      0 iterations is invalid (we need at least one)
+        */
+       if (iterations == 0) iterations = 1;
+
        if (((end - p) < 1) || !(q = memchr(p, salt_sep, end - p))) {
                REDEBUG("PBKDF2-Password missing salt component");
                goto finish;