From: Alan T. DeKok <aland@freeradius.org>
Date: Fri, 22 Apr 2022 14:49:21 +0000 (-0400)
Subject: catch the case of zero returns
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6fc12c6dac5e859902db9913b6a1a5790bed90d4;p=thirdparty%2Ffreeradius-server.git

catch the case of zero returns

it's either allowed, and we do nothing, or it means that we didn't
decode any data, and the input is malformed
---

diff --git a/src/lib/util/decode.c b/src/lib/util/decode.c
index 14b175b69cb..77b6b4b3684 100644
--- a/src/lib/util/decode.c
+++ b/src/lib/util/decode.c
@@ -51,9 +51,14 @@ ssize_t fr_pair_array_from_network(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict
 				"%s: Internal sanity check failed, attribute \"%s\" does not have array bit set",
 				__FUNCTION__, parent->name)) return PAIR_DECODE_FATAL_ERROR;
 
+	/*
+	 *	Catch stupidities.
+	 */
+	if (data_len == 0) return data_len;
+
 	while (p < end) {
 		slen = decode_value(ctx, out, parent, p, (end - p), decode_ctx);
-		if (slen < 0) return slen - (p - data);
+		if (slen <= 0) return slen - (p - data);
 
 		p += slen;
 	}
@@ -97,11 +102,16 @@ ssize_t fr_pair_raw_from_network(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_a
 	fr_dict_unknown_free(&child); /* const issues */
 	if (!vp) return -1;
 
-	slen = fr_value_box_from_network(vp, &vp->data, vp->da->type, vp->da,
-					 &FR_DBUFF_TMP(data, data_len), data_len, true);
-	if (slen < 0) {
-		talloc_free(vp);
-		return slen;
+	/*
+	 *	Don't bother getting data from the network if there's no data.
+	 */
+	if (data_len > 0) {
+		slen = fr_value_box_from_network(vp, &vp->data, vp->da->type, vp->da,
+						 &FR_DBUFF_TMP(data, data_len), data_len, true);
+		if (slen < 0) {
+			talloc_free(vp);
+			return slen;
+		}
 	}
 
 	/*
@@ -177,7 +187,7 @@ ssize_t fr_pair_tlvs_from_network(TALLOC_CTX *ctx, fr_pair_list_t *out,
 		ssize_t slen;
 
 		slen = decode_tlv(child_ctx, list, parent, p, (end - p), decode_ctx);
-		if (slen < 0) {
+		if (slen <= 0) {
 			FR_PROTO_TRACE("    tlv decode failed at offset %zu - converting to raw", (size_t) (p - data));
 			fr_pair_list_free(list);
 			talloc_free(vp);