Reason:

src/lib/radius.c

static VALUE_PAIR *rad_vp2tlv(VALUE_PAIR *vps)

{

……

                               end = vp2data(NULL, NULL, NULL, vp, ptr + 2,

                           tlv->vp_tlv + tlv->length - ptr);

……

}

static uint8_t *vp2data(const RADIUS_PACKET *packet,

                                              const RADIUS_PACKET *original,

                                              const char *secret, const VALUE_PAIR *vp, uint8_t *ptr,

                                              size_t room)

{

……

if (packet) switch (vp->flags.encrypt) {   // packet is NULL, data isn't copyed.

                     case FLAG_ENCRYPT_USER_PASSWORD:

……

                      default:

                               /*

                               *            Just copy the data over

                               */

                               memcpy(ptr, data, len);

                               break;

               } /* switch over encryption flags */

               return ptr + len;

}

patched:

diff old/src/lib/radius.c new/src/lib/radius.c

799a800,801

>       else

>               memcpy(ptr, data, len);