From: Alan T. DeKok <aland@freeradius.org>
Date: Sat, 8 Sep 2018 13:43:58 +0000 (-0400)
Subject: don't do strlen() on secret
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b502595f1e355b1d7dff655ff4cd5b06c52f22a2;p=thirdparty%2Ffreeradius-server.git

don't do strlen() on secret
---

diff --git a/src/modules/rlm_radius/rlm_radius_udp.c b/src/modules/rlm_radius/rlm_radius_udp.c
index 2a52303b083..2b4733b3e88 100644
--- a/src/modules/rlm_radius/rlm_radius_udp.c
+++ b/src/modules/rlm_radius/rlm_radius_udp.c
@@ -843,7 +843,7 @@ check_active:
 	memcpy(original + 4, rr->vector, sizeof(rr->vector));
 
 	if (fr_radius_verify(c->buffer, original,
-			     (uint8_t const *) c->inst->secret, strlen(c->inst->secret)) < 0) {
+			     (uint8_t const *) c->inst->secret, talloc_array_length(c->inst->secret) - 1) < 0) {
 		RPWDEBUG("Ignoring response with invalid signature");
 		goto redo;
 	}