From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Fri, 26 May 2017 13:39:02 +0000 (-0400)
Subject: CID 1206505: Check octet/string attribute lengths.  This is already done in VQP verify
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9c594e2ff1a5af75da1d9098d4329685c8dff8ce;p=thirdparty%2Ffreeradius-server.git

CID 1206505: Check octet/string attribute lengths.  This is already done in VQP verify
---

diff --git a/src/modules/proto_vmps/vqp.c b/src/modules/proto_vmps/vqp.c
index ef36570aec7..4daf580bc0d 100644
--- a/src/modules/proto_vmps/vqp.c
+++ b/src/modules/proto_vmps/vqp.c
@@ -313,9 +313,10 @@ int vqp_decode(RADIUS_PACKET *packet)
 		attr |= 0x2000;
 		vp = fr_pair_afrom_num(packet, 0, attr);
 		if (!vp) {
-			fr_pair_list_free(&packet->vps);
-
 			fr_strerror_printf("No memory");
+
+		error:
+			fr_pair_list_free(&packet->vps);
 			return -1;
 		}
 
@@ -343,10 +344,18 @@ int vqp_decode(RADIUS_PACKET *packet)
 
 		default:
 		case FR_TYPE_OCTETS:
+			if ((ptr + attr_len) >= end) {
+				fr_strerror_printf("Attribute length exceeds received data");
+				goto error;
+			}
 			fr_pair_value_memcpy(vp, ptr, attr_len);
 			break;
 
 		case FR_TYPE_STRING:
+			if ((ptr + attr_len) >= end) {
+				fr_strerror_printf("Attribute length exceeds received data");
+				goto error;
+			}
 			fr_pair_value_bstrncpy(vp, ptr, attr_len);
 			break;
 		}