Don't have a 2-byte over-run read

diff --git a/src/lib/radius.c b/src/lib/radius.c
index e0a36b9..bccfc0e 100644 (file)
--- a/src/lib/radius.c
+++ b/src/lib/radius.c
@@ -1643,7 +1643,7 @@ int rad_decode(RADIUS_PACKET *packet, RADIUS_PACKET *original,
                                subptr = ptr + 4;
                                sublen = attrlen - 4;
                                
-                               while (sublen > 0) {
+                               while (sublen >= 2) {
                                        if (subptr[1] < 2) { /* too short */
                                                break;
                                        }