From f6c2f5469fe4f2f48e748f4de413f9a7cbfc130d Mon Sep 17 00:00:00 2001
From: Fabian Mauchle <fabian.mauchle@switch.ch>
Date: Mon, 24 Aug 2026 08:28:56 +0200
Subject: [PATCH] fix vendor rewrite attribute too short

---
 rewrite.c         |  2 ++
 tests/t_rewrite.c | 25 +++++++++++++++++++++++++
 2 files changed, 27 insertions(+)

--- a/rewrite.c
+++ b/rewrite.c
@@ -504,6 +504,8 @@ int dorewritemod(struct radmsg *msg, str
     for (n = list_first(msg->attrs); n; n = list_next(n)) {
         struct tlv *attr = (struct tlv *)n->data;
         if (attr->t == RAD_Attr_Vendor_Specific) {
+            if (attr->l < 4)
+                continue;
             memcpy(&vendor, attr->v, 4);
             vendor = ntohl(vendor);
             for (m = list_first(modvattrs); m; m = list_next(m)) {
--- a/tests/t_rewrite.c
+++ b/tests/t_rewrite.c
@@ -84,7 +84,7 @@ void _reset_rewrite(struct rewrite *rewr
 }
 
 int main(int argc, char *argv[]) {
-    int testcount = 26;
+    int testcount = 27;
     struct list *origattrs, *expectedattrs;
     struct rewrite rewrite;
     char *username = "user@realm";
@@ -560,6 +560,31 @@ int main(int argc, char *argv[]) {
 
         regfree(&regex);
         _tlv_list_clear(origattrs);
+        _tlv_list_clear(expectedattrs);
+        _reset_rewrite(&rewrite);
+    }
+
+    /* test modify vendor too short*/
+    {
+        struct modattr *mod = malloc(sizeof(struct modattr));
+        regex_t regex;
+        uint8_t vendorattrin[] = {0, 0, 0, 42};
+
+        mod->t = 1;
+        mod->vendor = 42;
+        mod->regex = &regex;
+        mod->replacement = "bb";
+        regcomp(mod->regex, "a", REG_ICASE | REG_EXTENDED);
+
+        list_push(rewrite.modvattrs, mod);
+        list_push(origattrs, maketlv(RAD_Attr_Vendor_Specific, sizeof(vendorattrin) - 1, vendorattrin));
+
+        if (_check_rewrite(origattrs, &rewrite, origattrs, 0))
+            printf("not ");
+        printf("ok %d - modify vendor too short\n", testcount++);
+
+        regfree(&regex);
+        _tlv_list_clear(origattrs);
         _tlv_list_clear(expectedattrs);
         _reset_rewrite(&rewrite);
     }
