fix len skipping

diff --git a/src/lib/vqp.c b/src/lib/vqp.c
--- a/src/lib/vqp.c
+++ b/src/lib/vqp.c
@@ -374,7 +374,7 @@
 				rad_free(&packet);
 				return NULL;
 			}
-			attrlen = ptr[5];
+			attrlen = (ptr[4] << 8) | ptr[5];
 			ptr += 6 + attrlen;
 			length -= (6 + attrlen);
 		}
@@ -507,8 +507,8 @@
 		case PW_TYPE_OCTETS:
 		case PW_TYPE_STRING:
 			vp->length = (length > MAX_VMPS_LEN) ? MAX_VMPS_LEN : length;
-			memcpy(vp->vp_octets, ptr, length);
-			vp->vp_octets[length] = '\0';
+			memcpy(vp->vp_octets, ptr, vp->length);
+			vp->vp_octets[vp->length] = '\0';
 			break;
 		}
 		ptr += length;