From: Alan T. DeKok <aland@freeradius.org>
Date: Fri, 30 Jun 2017 11:41:12 +0000 (-0400)
Subject: update comments and sanity checks
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bc0ffa8956f1889ec03977b94602fce8d7850bd1;p=thirdparty%2Ffreeradius-server.git

update comments and sanity checks
---

diff --git a/src/protocols/radius/decode.c b/src/protocols/radius/decode.c
index 7ece8294698..72b4c3d7b3b 100644
--- a/src/protocols/radius/decode.c
+++ b/src/protocols/radius/decode.c
@@ -322,10 +322,12 @@ static ssize_t decode_concat(TALLOC_CTX *ctx, vp_cursor_t *cursor,
 	attr = ptr[0];
 
 	/*
-	 *	The packet has already been sanity checked, so we
-	 *	don't care about walking off of the end of it.
+	 *	See how many consecutive attributes there are.
 	 */
 	while (ptr < end) {
+		if (ptr[1] <= 2) return -1;
+		if ((ptr + ptr[1]) > end) return -1;
+
 		total += ptr[1] - 2;
 
 		ptr += ptr[1];