From: Alan T. DeKok <aland@freeradius.org>
Date: Mon, 1 May 2017 20:14:18 +0000 (-0400)
Subject: more sanity checks on the packet
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2ca6a9cca691f4e2bf5ac7073c1603685088a2ba;p=thirdparty%2Ffreeradius-server.git

more sanity checks on the packet
---

diff --git a/src/lib/util/radius.c b/src/lib/util/radius.c
index 4c23e76db9b..04c6f833cac 100644
--- a/src/lib/util/radius.c
+++ b/src/lib/util/radius.c
@@ -410,6 +410,8 @@ static int fr_radius_sign(uint8_t *packet, uint8_t const *original,
 	end = packet + packet_len;
 
 	while (msg < end) {
+		if ((end - msg) < 2) goto invalid_attribute;
+
 		if (msg[0] != PW_MESSAGE_AUTHENTICATOR) {
 			if (msg[1] < 2) goto invalid_attribute;
 
@@ -1102,6 +1104,8 @@ static int fr_radius_verify(uint8_t *packet, uint8_t const *original,
 	end = packet + packet_len;
 
 	while (msg < end) {
+		if ((end - msg) < 2) goto invalid_attribute;
+
 		if (msg[0] != PW_MESSAGE_AUTHENTICATOR) {
 			if (msg[1] < 2) goto invalid_attribute;