radius: Fix list traversal in rc_avpair_insert

In rc_avpair_insert, if the list element "p" is non-NULL but not
actually in the list "a", we can end up with this_node being NULL and
being dereferenced.

By changing the while test to this_node->next we avoid having
this_node being NULL; the loop will terminate when this_node == p or
this_node->next == NULL, which is what we want.

Signed-off-by: Paul Mackerras <paulus@ozlabs.org>

diff --git a/pppd/plugins/radius/avpair.c b/pppd/plugins/radius/avpair.c
index 9b5c39cd42687694e62ee927390462c32aff96f2..bbe141d2d80acdc439307430c8916371c3e0e362 100644 (file)
--- a/pppd/plugins/radius/avpair.c
+++ b/pppd/plugins/radius/avpair.c
@@ -426,7 +426,7 @@ void rc_avpair_insert (VALUE_PAIR **a, VALUE_PAIR *p, VALUE_PAIR *b)
        else /* look for the "p" entry in the "a" list (or run to end) */
        {
                this_node = *a;
-               while (this_node != (VALUE_PAIR *) NULL)
+               while (this_node->next != (VALUE_PAIR *) NULL)
                {
                        if (this_node == p)
                        {