Don't dereference NULL. Fixes #888

An attribute may have zero length, but is still (sort of)
well formed.

diff --git a/src/lib/radius.c b/src/lib/radius.c
index fca1bba..9666370 100644 (file)
--- a/src/lib/radius.c
+++ b/src/lib/radius.c
@@ -2933,7 +2933,7 @@ static ssize_t data2vp_tlvs(TALLOC_CTX *ctx,
                        pairfree(&head);
                        return -1;
                }
-               tail = &((*tail)->next);
+               if (*tail) tail = &((*tail)->next);
                data += data[1];
        }
 
@@ -3005,13 +3005,6 @@ static ssize_t data2vp_vsa(TALLOC_CTX *ctx, RADIUS_PACKET *packet,
                return -1;
        }
 
-#ifndef NDEBUG
-       if (attrlen <= (ssize_t) (dv->type + dv->length)) {
-               fr_strerror_printf("data2vp_vsa: Failure to call rad_tlv_ok");
-               return -1;
-       }
-#endif
-
        /*
         *      See if the VSA is known.
         */
@@ -3307,7 +3300,12 @@ create_attrs:
                        fr_strerror_printf("Internal sanity check %d", __LINE__);
                        return -1;
                }
-               tail = &((*tail)->next);
+
+               /*
+                *      Vendors can send zero-length VSAs.
+                */
+               if (*tail) tail = &((*tail)->next);
+
                data += vsa_len;
                attrlen -= vsa_len;
                packetlen -= vsa_len;

diff --git a/src/tests/unit/vendor.txt b/src/tests/unit/vendor.txt
index aa229d4..262e240 100644 (file)
--- a/src/tests/unit/vendor.txt
+++ b/src/tests/unit/vendor.txt
@@ -12,3 +12,9 @@ data USR-Event-Id = 1234
 
 decode 1a 15 00 00 4e 20 01 0f 6c 69 74 68 69 61 73 70 72 69 6e 67 73
 data Attr-26.20000.1 = 0x6c6974686961737072696e6773
+
+decode 1a 2e 00 00 00 2b 1c 02 01 06 00 00 00 00 3c 20 31 35 35 2e 34 2e 31 32 2e 31 30 30 20 30 30 3a 30 30 3a 30 30 3a 30 30 3a 30 30 3a 30 30
+data 3Com-User-Access-Level = 3Com-Visitor, 3Com-Ip-Host-Addr = '155.4.12.100 00:00:00:00:00:00'
+
+decode 1a 2c 00 00 00 2b 01 06 00 00 00 00 3c 20 31 35 35 2e 34 2e 31 32 2e 31 30 30 20 30 30 3a 30 30 3a 30 30 3a 30 30 3a 30 30 3a 30 30
+data 3Com-User-Access-Level = 3Com-Visitor, 3Com-Ip-Host-Addr = '155.4.12.100 00:00:00:00:00:00'