don't allow zero-length buffers

FreeRADIUS · May 30, 2017 · dd515a4 · dd515a4
1 parent 8631363
commit dd515a4
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/src/modules/rlm_eap/types/rlm_eap_pwd/rlm_eap_pwd.c b/src/modules/rlm_eap/types/rlm_eap_pwd/rlm_eap_pwd.c
@@ -184,6 +184,8 @@ static rlm_rcode_t mod_process(void *instance, eap_session_t *eap_session)
 		}
 
 		session->in_len = ntohs(in[0] * 256 | in[1]);
+		if (!session->in_len) return RLM_MODULE_FAIL;
+
 		MEM(session->in = talloc_zero_array(session, uint8_t, session->in_len));
 
 		memset(session->in, 0, session->in_len);