fix len skipping

diff --git a/src/lib/vqp.c b/src/lib/vqp.c
--- a/src/lib/vqp.c
+++ b/src/lib/vqp.c
@@ -374,7 +374,7 @@
 				rad_free(&packet);
 				return NULL;
 			}
-			attrlen = ptr[5];
+			attrlen = (ptr[4] << 8) | ptr[5];
 			ptr += 6 + attrlen;
 			length -= (6 + attrlen);
 		}