Fix heap overflow in raddtlsget(), radtcpget() and radtlsget().

Patch by Stephen Röttger.

1 files changed, 4 insertions, 0 deletions

diff --git a/dtls.c b/dtls.c
index 2586b8f..8f8c90a 100644
--- a/dtls.c
+++ b/dtls.c
@@ -235,6 +235,10 @@ unsigned char *raddtlsget(SSL *ssl, struct gqueue *rbios, int timeout) {
         }
 
 	len = RADLEN(buf);
+	if (len < 4) {
+	    debug(DBG_ERR, "raddtlsget: length too small");
+	    continue;
+	}
 	rad = malloc(len);
 	if (!rad) {
 	    debug(DBG_ERR, "raddtlsget: malloc failed");