vmps request: long attribute VQP-Ethernet-Frame

[Hermann Lauer]

Alan DeKok  wrote:
> > 0x0c05 is VQP-Ethernet-Frame, which can of course be longer than 253 bytes,
> > so there is a design issue here. One idea would be to cut the attribute to
> > 253 bytes in vqp_recv(). Could this be done there without memory issues ?
> 
>   Yes, if you're not interested in the rest of the data.

appended is a patch which implemeted the cutting. Seems to work.
Please tell me if anybody sees any pitfall in it.

Otherwise it should be cleaned up, which I probably will do in a week or so.
Thanks,
  Hermann

-- 
Netzwerkadministration/Zentrale Dienste, Interdiziplinaeres 
Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg
IWR; INF 368; 69120 Heidelberg; Tel: (06221)54-8236 Fax: -5224
Email: Hermann.Lauer at iwr.uni-heidelberg.de
-------------- next part --------------
--- freeradius-server-2.1.3/src/lib/vqp.c.cut253	Thu Jan 29 13:53:44 2009
+++ freeradius-server-2.1.3/src/lib/vqp.c	Thu Jan 29 16:11:13 2009
@@ -363,12 +363,12 @@
 			 *	for bigger lengths to exist... admins
 			 *	won't be typing in a 32K vlan name.
 			 */
-			if ((ptr[4] != 0) || (ptr[5] > 253)) {
+/*			if ((ptr[4] != 0) || (ptr[5] > 253)) {
 				fr_strerror_printf("Packet contains attribute 0x0c%02x with invalid length %02x %02x", ptr[3], ptr[4], ptr[5]);
 				rad_free(&packet);
 				return NULL;
-			}
-			attrlen = ptr[5];
+			}*/
+			attrlen = ptr[4]*256 + ptr[5];
 			ptr += 6 + attrlen;
 			length -= (6 + attrlen);
 		}
@@ -472,7 +472,7 @@
 	 */
 	while (ptr < end) {
 		attribute = (ptr[2] << 8) | ptr[3];
-		length = ptr[5];
+		length = ptr[5] + 256*ptr[4];
 		ptr += 6;
 
 		/*
@@ -500,8 +500,8 @@
 		default:
 		case PW_TYPE_STRING:
 		case PW_TYPE_OCTETS:
-			memcpy(vp->vp_octets, ptr, length);
-			vp->length = length;
+			vp->length = length > 253 ? 253 : length;
+			memcpy(vp->vp_octets, ptr, vp->length);
 			break;
 		}
 		ptr += length;