bound "len". CID #1503923

after rounding up, and adding room for the headers

diff --git a/src/protocols/radius/encode.c b/src/protocols/radius/encode.c
index 2f503e6df135be2861f43256e4fa997d216df815..f689d08ecec76a59f6be09c5294ed6cabd99465b 100644 (file)
--- a/src/protocols/radius/encode.c
+++ b/src/protocols/radius/encode.c
@@ -174,6 +174,7 @@ static ssize_t encode_tunnel_password(fr_dbuff_t *dbuff, fr_dbuff_marker_t *in,
        fr_dbuff_set_to_start(&work_dbuff);
 
        len = encrypted_len + 2;        /* account for the salt */
+       if (len > RADIUS_MAX_STRING_LENGTH) len = RADIUS_MAX_STRING_LENGTH;
 
        /*
         *      Copy the password over, and fill the remainder with random data.