From: Alan T. DeKok <aland@freeradius.org>
Date: Fri, 9 Feb 2024 14:52:14 +0000 (-0500)
Subject: nope.  header length is 4
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=88a38d68f077a66150712c449b4a2b667703bae4;p=thirdparty%2Ffreeradius-server.git

nope.  header length is 4
---

diff --git a/src/protocols/radius/decode.c b/src/protocols/radius/decode.c
index d7faf796573..2566775f5b5 100644
--- a/src/protocols/radius/decode.c
+++ b/src/protocols/radius/decode.c
@@ -887,7 +887,7 @@ static ssize_t decode_extended_fragments(TALLOC_CTX *ctx, fr_pair_list_t *out,
 	last_frag = false;
 
 	while (frag < end) {
-		if (last_frag || ((end - frag) < 2) ||
+		if (last_frag || ((end - frag) < 4) ||
 		    (frag[0] != attr[0]) ||
 		    (frag[1] < 4) ||		       /* too short for long-extended */
 		    (frag[2] != attr[2]) ||