fr_tacacs_length() can return negative. CID #1469155

diff --git a/src/listen/tacacs/proto_tacacs_tcp.c b/src/listen/tacacs/proto_tacacs_tcp.c
index a0a62ebcf6bfd26d1d81f13049fc9cb882e6c6a2..476b3186cace88d16c59bc0cec26a9b5c0f4d491 100644 (file)
--- a/src/listen/tacacs/proto_tacacs_tcp.c
+++ b/src/listen/tacacs/proto_tacacs_tcp.c
@@ -141,6 +141,8 @@ static ssize_t mod_read(fr_listen_t *li, UNUSED void **packet_ctx, fr_time_t *re
         *      caller that we need to read more.
         */
        packet_len = fr_tacacs_length(buffer, in_buffer);
+       if (packet_len < 0) return -1;
+
        if (in_buffer < packet_len) {
                *leftover = in_buffer;
                return 0;