From: Alan T. DeKok <aland@freeradius.org>
Date: Thu, 16 Jul 2026 23:35:27 +0000 (-0400)
Subject: initialize length and use correct checks
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fcf6883b949daa82834d5763393420c8d3cdd960;p=thirdparty%2Ffreeradius-server.git

initialize length and use correct checks
---

diff --git a/src/protocols/radius/list.c b/src/protocols/radius/list.c
index 93ee42b289a..35e0ce249a7 100644
--- a/src/protocols/radius/list.c
+++ b/src/protocols/radius/list.c
@@ -706,11 +706,15 @@ int fr_packet_list_recv(fr_packet_list_t *pl, fd_set *set, TALLOC_CTX *ctx, fr_p
 			int rcode;
 			ps = &pl->sockets[start];
 
+			ps->used = 0;
 			rcode = fr_tcp_read_packet(ps->socket.fd, ps->buffer, ps->bufsize,
 						   &ps->used, max_attributes, require_message_authenticator);
 			if (rcode <= 0) return rcode;
 
-			fr_assert(ps->used >= RADIUS_HEADER_LENGTH);
+			if (ps->used < RADIUS_HEADER_LENGTH) {
+				fr_strerror_printf("TCP packet too short: %zu", ps->used);
+				return -1;
+			}
 
 			packet = fr_packet_alloc(ctx, false);
 			if (!packet) return -1;