From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Sat, 27 May 2017 13:17:29 +0000 (-0400)
Subject: Tainted scalar fix
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b2e99d5d1748e24908e8386b544e1e989d4bcff5;p=thirdparty%2Ffreeradius-server.git

Tainted scalar fix
---

diff --git a/src/lib/util/pair.c b/src/lib/util/pair.c
index 71fee115ac8..09c944d9003 100644
--- a/src/lib/util/pair.c
+++ b/src/lib/util/pair.c
@@ -2531,10 +2531,10 @@ FR_TOKEN fr_pair_raw_from_str(char const **ptr, VALUE_PAIR_RAW *raw)
 		 *	This is arguably easier than trying to figure
 		 *	out which operators come after the attribute
 		 *	name.  Yes, our "lexer" is bad.
+		 *
+		 *  sizeof() is for coverity.
 		 */
-		if (!fr_dict_attr_allowed_chars[*t]) {
-			break;
-		}
+		if ((*t >= sizeof(fr_dict_attr_allowed_chars)) || !fr_dict_attr_allowed_chars[*t]) break;
 
 		/*
 		 *	Attribute:=value is NOT
@@ -2543,9 +2543,7 @@ FR_TOKEN fr_pair_raw_from_str(char const **ptr, VALUE_PAIR_RAW *raw)
 		 *	=
 		 *	value
 		 */
-		if ((*p == ':') && (!isdigit((int) p[1]))) {
-			break;
-		}
+		if ((*p == ':') && (!isdigit((int) p[1]))) break;
 
 		*(q++) = *(p++);
 	}