--- freeradius-server-2.1.3/src/lib/vqp.c.cut253	Thu Jan 29 13:53:44 2009
+++ freeradius-server-2.1.3/src/lib/vqp.c	Thu Jan 29 16:11:13 2009
@@ -363,12 +363,12 @@
 			 *	for bigger lengths to exist... admins
 			 *	won't be typing in a 32K vlan name.
 			 */
-			if ((ptr[4] != 0) || (ptr[5] > 253)) {
+/*			if ((ptr[4] != 0) || (ptr[5] > 253)) {
 				fr_strerror_printf("Packet contains attribute 0x0c%02x with invalid length %02x %02x", ptr[3], ptr[4], ptr[5]);
 				rad_free(&packet);
 				return NULL;
-			}
-			attrlen = ptr[5];
+			}*/
+			attrlen = ptr[4]*256 + ptr[5];
 			ptr += 6 + attrlen;
 			length -= (6 + attrlen);
 		}
@@ -472,7 +472,7 @@
 	 */
 	while (ptr < end) {
 		attribute = (ptr[2] << 8) | ptr[3];
-		length = ptr[5];
+		length = ptr[5] + 256*ptr[4];
 		ptr += 6;
 
 		/*
@@ -500,8 +500,8 @@
 		default:
 		case PW_TYPE_STRING:
 		case PW_TYPE_OCTETS:
-			memcpy(vp->vp_octets, ptr, length);
-			vp->length = length;
+			vp->length = length > 253 ? 253 : length;
+			memcpy(vp->vp_octets, ptr, vp->length);
 			break;
 		}
 		ptr += length;