From c5a9be5adadebac299df5b60ec6d2cfbb234d4e1 Mon Sep 17 00:00:00 2001
From: Fabian Mauchle <fabian.mauchle@switch.ch>
Date: Tue, 27 Oct 2026 16:51:50 +0100
Subject: [PATCH] fix missing length check in vendor rewrite
 (GHSA-mf4w-p52g-j253)

---
 rewrite.c | 1 +
 1 file changed, 1 insertion(+)

--- a/rewrite.c
+++ b/rewrite.c
@@ -550,6 +550,7 @@ int dorewritesupattr(struct radmsg *msg,
             exist = 1;
             break;
         } else if (supattr->t == RAD_Attr_Vendor_Specific && attr->t == RAD_Attr_Vendor_Specific &&
+                   attr->l > 4 &&
                    memcmp(supattr->v, attr->v, 4) == 0) {
             if (!attrvalidate(attr->v + 4, attr->l - 4)) {
                 debug(DBG_INFO, "dorewritesup: vendor attribute validation failed, no rewrite");
