src/radius/radius.c

898 		struct radius_attr_vendor *vhdr;
917 		while (left >= sizeof(*vhdr)) {
918 			vhdr = (struct radius_attr_vendor *) pos;
919 			if (vhdr->vendor_length > left ||
920 			    vhdr->vendor_length < sizeof(*vhdr)) {
924 			if (vhdr->vendor_type != subtype) {
925 				pos += vhdr->vendor_length;
926 				left -= vhdr->vendor_length;
930 			len = vhdr->vendor_length - sizeof(*vhdr);
934 			os_memcpy(data, pos + sizeof(*vhdr), len);
1145 	struct radius_attr_vendor *vhdr;
1151 	hlen = sizeof(vendor_id) + sizeof(*vhdr) + 2;
1161 	vhdr = (struct radius_attr_vendor *) pos;
1162 	vhdr->vendor_type = RADIUS_VENDOR_ATTR_MS_MPPE_SEND_KEY;
1163 	pos = (u8 *) (vhdr + 1);
1169 	vhdr->vendor_length = hlen + elen - sizeof(vendor_id);
1186 	vhdr = (struct radius_attr_vendor *) pos;
1187 	vhdr->vendor_type = RADIUS_VENDOR_ATTR_MS_MPPE_RECV_KEY;
1188 	pos = (u8 *) (vhdr + 1);
1194 	vhdr->vendor_length = hlen + elen - sizeof(vendor_id);