From: Alan T. DeKok <aland@freeradius.org>
Date: Thu, 6 Jan 2022 00:07:39 +0000 (-0500)
Subject: pass the correct 'end' pointer
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cd7f7955791803b511062583cd1ff7631a5763bd;p=thirdparty%2Ffreeradius-server.git

pass the correct 'end' pointer
---

diff --git a/src/protocols/radius/decode.c b/src/protocols/radius/decode.c
index fe5592e85b..83a3f1727b 100644
--- a/src/protocols/radius/decode.c
+++ b/src/protocols/radius/decode.c
@@ -790,8 +790,20 @@ static ssize_t decode_extended(TALLOC_CTX *ctx, fr_pair_list_t *out,
 
 	FR_PROTO_HEX_DUMP(head, fraglen, "long-extended fragments");
 
-	ret = fr_radius_decode_pair_value(ctx, out,
-					  parent, head, fraglen, packet_ctx);
+	/*
+	 *	Reset the "end" pointer, because we're not passing in
+	 *	the real data.
+	 */
+	{
+		end = packet_ctx->end;
+		packet_ctx->end = head + fraglen;
+
+		ret = fr_radius_decode_pair_value(ctx, out,
+						  parent, head, fraglen, packet_ctx);
+
+		packet_ctx->end = end;
+	}
+
 	talloc_free(head);
 	if (ret < 0) return ret;
 
@@ -960,8 +972,20 @@ static ssize_t decode_wimax(TALLOC_CTX *ctx, fr_pair_list_t *out,
 
 	FR_PROTO_HEX_DUMP(head, wimax_len, "Wimax fragments");
 
-	ret = fr_radius_decode_pair_value(ctx, out,
-					  da, head, wimax_len, packet_ctx);
+	/*
+	 *	Reset the "end" pointer, because we're not passing in
+	 *	the real data.
+	 */
+	{
+		end = packet_ctx->end;
+		packet_ctx->end = head + wimax_len;
+
+		ret = fr_radius_decode_pair_value(ctx, out,
+						  parent, head, wimax_len, packet_ctx);
+
+		packet_ctx->end = end;
+	}
+
 	talloc_free(head);
 	if (ret < 0) return ret;