Merge pull request #366 from pali/rtnetlink-register

[ppp.git] / pppd / plugins / radius / avpair.c

diff --git a/pppd/plugins/radius/avpair.c b/pppd/plugins/radius/avpair.c
index b97a7cf3632fbf4dcdccf51e724abe68c59ac897..0dc9a85d13a6be0b4e8e939961e754e5a7ce2b00 100644 (file)
--- a/pppd/plugins/radius/avpair.c
+++ b/pppd/plugins/radius/avpair.c
@@ -76,7 +76,7 @@ int rc_avpair_assign (VALUE_PAIR *vp, void *pval, int len)
                                vp->strvalue[len] = '\0';
                                vp->lvalue = len;
                        } else {
-                       strncpy (vp->strvalue, (char *) pval, AUTH_STRING_LEN);
+                       strncpy ((char*) vp->strvalue, (char *) pval, AUTH_STRING_LEN);
                        vp->lvalue = strlen((char *) pval);
                        }
 
@@ -161,7 +161,7 @@ VALUE_PAIR *rc_avpair_gen (AUTH_HDR *auth)
        DICT_ATTR      *attr;
        VALUE_PAIR     *vp;
        VALUE_PAIR     *pair;
-       unsigned char   hex[3];         /* For hex string conversion. */
+       char            hex[3];         /* For hex string conversion. */
        char            buffer[512];
 
        /*
@@ -175,12 +175,12 @@ VALUE_PAIR *rc_avpair_gen (AUTH_HDR *auth)
        {
                attribute = *ptr++;
                attrlen = *ptr++;
-               attrlen -= 2;
-               if (attrlen < 0)
+               if (attrlen < 2 || attrlen > length)
                {
                        error("rc_avpair_gen: received attribute with invalid length");
                        break;
                }
+               attrlen -= 2;
 
                /* Handle vendor-specific specially */
                if (attribute == PW_VENDOR_SPECIFIC) {
@@ -600,7 +600,7 @@ int rc_avpair_parse (char *buffer, VALUE_PAIR **first_pair)
                        {
 
                            case PW_TYPE_STRING:
-                               strcpy (pair->strvalue, valstr);
+                               strcpy ((char*) pair->strvalue, valstr);
                                pair->lvalue = strlen(valstr);
                                break;
 
@@ -725,7 +725,7 @@ int rc_avpair_tostr (VALUE_PAIR *pair, char *name, int ln, char *value, int lv)
                        }
                        else
                        {
-                               strncat(value, ptr, 1);
+                               strncat(value, (char*) ptr, 1);
                                lv--;
                                if (lv < 0) break;
                        }