summaryrefslogtreecommitdiff
path: root/tcp.c
diff options
context:
space:
mode:
authorLinus Nordberg <linus@nordu.net>2015-01-16 16:44:04 +0100
committerLinus Nordberg <linus@nordu.net>2015-01-16 16:51:14 +0100
commit5ca04071b14af6261c797551bcf26a3851ebbae8 (patch)
tree1eb8003b5aee3af2278ae505b78f5e213dda4839 /tcp.c
parent42eb3c67e5ee5e0a0e8b5175a001bc5822c3a919 (diff)
Fix heap overflow in raddtlsget(), radtcpget() and radtlsget().
Patch by Stephen Röttger.
Diffstat (limited to 'tcp.c')
-rw-r--r--tcp.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/tcp.c b/tcp.c
index 6de39fc..515acbf 100644
--- a/tcp.c
+++ b/tcp.c
@@ -173,6 +173,10 @@ unsigned char *radtcpget(int s, int timeout) {
}
len = RADLEN(buf);
+ if (len < 4) {
+ debug(DBG_ERR, "radtcpget: length too small");
+ continue;
+ }
rad = malloc(len);
if (!rad) {
debug(DBG_ERR, "radtcpget: malloc failed");