From: Alan T. DeKok <aland@freeradius.org>
Date: Mon, 29 May 2017 15:26:00 +0000 (-0400)
Subject: we want the length of the uint8_t data, not eap_packet_raw_t
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=458b8cc340cdc8d59b5f814e4542874afcf704e8;p=thirdparty%2Ffreeradius-server.git

we want the length of the uint8_t data, not eap_packet_raw_t
---

diff --git a/src/modules/rlm_eap/eap.c b/src/modules/rlm_eap/eap.c
index b61a2401404..12d3ea16983 100644
--- a/src/modules/rlm_eap/eap.c
+++ b/src/modules/rlm_eap/eap.c
@@ -510,8 +510,9 @@ static int eap_validation(REQUEST *request, eap_packet_raw_t **eap_packet_p)
 	 *	but that's OK.  The static analysis tools aren't smart
 	 *	enough to figure that out.
 	 */
-	packet_len = talloc_array_length(*eap_packet_p);
-	if (packet_len < EAP_HEADER_LEN) {
+	packet_len = talloc_array_length((uint8_t *) eap_packet);
+	if (packet_len <= EAP_HEADER_LEN) {
+		REDEBUG("Invalid EAP data lenth %zd <= 4", packet_len);
 		return -1;
 	}