936 		struct radius_attr_vendor *vhdr;  in radius_msg_get_vendor_attr()  local
955 		while (left >= sizeof(*vhdr)) {  in radius_msg_get_vendor_attr()
956 			vhdr = (struct radius_attr_vendor *) pos;  in radius_msg_get_vendor_attr()
957 			if (vhdr->vendor_length > left ||  in radius_msg_get_vendor_attr()
958 			    vhdr->vendor_length < sizeof(*vhdr)) {  in radius_msg_get_vendor_attr()
961 			if (vhdr->vendor_type != subtype) {  in radius_msg_get_vendor_attr()
962 				pos += vhdr->vendor_length;  in radius_msg_get_vendor_attr()
963 				left -= vhdr->vendor_length;  in radius_msg_get_vendor_attr()
967 			len = vhdr->vendor_length - sizeof(*vhdr);  in radius_msg_get_vendor_attr()
968 			data = os_memdup(pos + sizeof(*vhdr), len);  in radius_msg_get_vendor_attr()
1195 	struct radius_attr_vendor *vhdr;  in radius_msg_add_mppe_keys()  local
1201 	hlen = sizeof(vendor_id) + sizeof(*vhdr) + 2;  in radius_msg_add_mppe_keys()
1211 	vhdr = (struct radius_attr_vendor *) pos;  in radius_msg_add_mppe_keys()
1212 	vhdr->vendor_type = RADIUS_VENDOR_ATTR_MS_MPPE_SEND_KEY;  in radius_msg_add_mppe_keys()
1213 	pos = (u8 *) (vhdr + 1);  in radius_msg_add_mppe_keys()
1223 	vhdr->vendor_length = hlen + elen - sizeof(vendor_id);  in radius_msg_add_mppe_keys()
1240 	vhdr = (struct radius_attr_vendor *) pos;  in radius_msg_add_mppe_keys()
1241 	vhdr->vendor_type = RADIUS_VENDOR_ATTR_MS_MPPE_RECV_KEY;  in radius_msg_add_mppe_keys()
1242 	pos = (u8 *) (vhdr + 1);  in radius_msg_add_mppe_keys()
1248 	vhdr->vendor_length = hlen + elen - sizeof(vendor_id);  in radius_msg_add_mppe_keys()