From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Fri, 26 May 2017 20:26:38 +0000 (-0400)
Subject: More thorough tainted scalar checks
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ab10ce90b703d6bcda16421c3a97652fb39bce2c;p=thirdparty%2Ffreeradius-server.git

More thorough tainted scalar checks
---

diff --git a/src/modules/proto_vmps/vqp.c b/src/modules/proto_vmps/vqp.c
index 4daf580bc0d..3e76ad079c3 100644
--- a/src/modules/proto_vmps/vqp.c
+++ b/src/modules/proto_vmps/vqp.c
@@ -344,18 +344,22 @@ int vqp_decode(RADIUS_PACKET *packet)
 
 		default:
 		case FR_TYPE_OCTETS:
-			if ((ptr + attr_len) >= end) {
+			if (attr_len > (end - ptr)) {
 				fr_strerror_printf("Attribute length exceeds received data");
 				goto error;
 			}
+			if (attr_len == 0) break;
+
 			fr_pair_value_memcpy(vp, ptr, attr_len);
 			break;
 
 		case FR_TYPE_STRING:
-			if ((ptr + attr_len) >= end) {
+			if (attr_len > (end - ptr)) {
 				fr_strerror_printf("Attribute length exceeds received data");
 				goto error;
 			}
+			if (attr_len == 0) break;
+
 			fr_pair_value_bstrncpy(vp, ptr, attr_len);
 			break;
 		}