From: Alan T. DeKok <aland@freeradius.org>
Date: Thu, 11 Oct 2018 17:22:20 +0000 (-0400)
Subject: structs which are variable length have "flags.length == 0"
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e72a895f9b7e131fbe54e8428aee7efe45e8302b;p=thirdparty%2Ffreeradius-server.git

structs which are variable length have "flags.length == 0"
---

diff --git a/src/lib/util/dict.c b/src/lib/util/dict.c
index cb8fa737fba..4faa2b743e5 100644
--- a/src/lib/util/dict.c
+++ b/src/lib/util/dict.c
@@ -1107,16 +1107,27 @@ static bool dict_attr_fields_valid(fr_dict_t *dict, fr_dict_attr_t const *parent
 		 *	Sneak in the length of the children.
 		 */
 		memcpy(&mutable, &parent, sizeof(mutable));
-		mutable->flags.length += flags->length;
 
 		/*
 		 *	The struct has a maximum size.  Complain if we exceed it.
 		 */
-		if (mutable->flags.type_size && (mutable->flags.length > mutable->flags.type_size)) {
-			fr_strerror_printf("Child attribute causes struct to overflow maximum size of %d octets",
-					   mutable->flags.type_size);
-			goto error;
+		if (flags->length) {
+			if (mutable->flags.type_size && ((mutable->flags.length + flags->length) > mutable->flags.type_size)) {
+				fr_strerror_printf("Child attribute causes struct to overflow maximum size of %d octets",
+						   mutable->flags.type_size);
+				goto error;
+			}
+			mutable->flags.length += flags->length;
+
+		} else {
+			/*
+			 *	This is a bad hack... set the struct
+			 *	size to it's maximum value, which
+			 *	indicates that it has variable length.
+			 */
+			mutable->flags.length = 0;
 		}
+
 	}
 
 	return true;