Merge branch 'master' into tlv

diff --combined util_radius.cpp
index 51958aa,90ce876..f730ddb
--- 1/util_radius.cpp
--- 2/util_radius.cpp
+++ b/util_radius.cpp
@@@ -446,25 -446,9 +446,25 @@@ gss_eap_radius_attr_provider::releaseAn
  bool
  gss_eap_radius_attr_provider::init(void)
  {
 +    struct rs_context *radContext;
 +
      gss_eap_attr_ctx::registerProvider(ATTR_TYPE_RADIUS,
                                         "urn:ietf:params:gss-eap:radius-avp",
                                         createAttrContext);
 +
 +#if 1
 +    /*
 +     * This hack is necessary in order to force the loading of the global
 +     * dictionary, otherwise accepting reauthentication tokens fails unless
 +     * the acceptor has already accepted a normal authentication token.
 +     */
 +    if (rs_context_create(&radContext, RS_DICT_FILE) != 0) {
 +        return false;
 +    }
 +
 +    rs_context_destroy(radContext);
 +#endif
 +
      return true;
  }
  
@@@ -495,8 -479,12 +495,12 @@@ gssEapRadiusAddAvp(OM_uint32 *minor
          VALUE_PAIR *vp;
          size_t n = remain;
  
-         if (n > MAX_STRING_LEN)
-             n = MAX_STRING_LEN;
+       /*
+          * There's an extra byte of padding; RADIUS AVPs can only
+          * be 253 octets.
+          */
+         if (n >= MAX_STRING_LEN)
+             n = MAX_STRING_LEN - 1;
  
          vp = paircreate(attrid, PW_TYPE_OCTETS);
          if (vp == NULL) {
@@@ -672,11 -660,10 +676,11 @@@ avpImport(VALUE_PAIR **pVp
      remain -= 4;
  
      da = dict_attrbyvalue(attrid);
 -    if (da == NULL)
 -        goto fail;
 -
 -    vp = pairalloc(da);
 +    if (da != NULL) {
 +        vp = pairalloc(da);
 +    } else {
 +        vp = paircreate(attrid, PW_TYPE_STRING);
 +    }
      if (vp == NULL) {
          throw new std::bad_alloc;
          goto fail;
@@@ -698,13 -685,8 +702,8 @@@
          remain -= 5;
          break;
      case PW_TYPE_STRING:
-         /* check enough room to NUL terminate */
-         if (p[0] == MAX_STRING_LEN)
-             goto fail;
-         else
-         /* fallthrough */
      default:
-         if (p[0] > MAX_STRING_LEN)
+         if (p[0] >= MAX_STRING_LEN)
              goto fail;
  
          vp->length = (uint32_t)p[0];
@@@ -725,9 -707,7 +724,9 @@@
      return true;
  
  fail:
 -    pairbasicfree(vp);
 +    if (vp != NULL)
 +        pairbasicfree(vp);
 +    *pVp = NULL;
      return false;
  }