radius_xlat chops embedded NULs in cisco-av-pair

Kiril kyrmail at gmail.com
Mon Mar 31 15:35:49 CEST 2014

> No, it doesn't.
> If you look at the calls to fr_print_string, you'd see quote < 0
> is only passed in two places, valuepair.c:85 and valuepair.c:114,
> both in the radius_compare_vps function, where the output is
> passed to the regular expression comparison functions.
> Arguably if were doing comparisons on the raw attribute it should
> be a memcpy, especially as regcomp appears to take the length
> of the input string so it can probably deal with embedded NULLs
> But, this isn't related to your issue, if you read the concat
> code in 3.x.x xlat.c:1911 it's calling vp_aprint, which at
> the moment just does a talloc_strdup, which is as bad as
> strlcpy.
> After i've fixed that, and written a regression test for 3.x.x I will
> take a look at 2.x.x.


More information about the Freeradius-Users mailing list