277 	const struct radius_attr_type *attr;  in radius_msg_dump_attr()  local
282 	attr = radius_get_attr_type(hdr->type);  in radius_msg_dump_attr()
285 		   hdr->type, attr ? attr->name : "?Unknown?", hdr->length);  in radius_msg_dump_attr()
287 	if (attr == NULL || hdr->length < sizeof(struct radius_attr_hdr))  in radius_msg_dump_attr()
293 	switch (attr->data_type) {  in radius_msg_dump_attr()
356 		struct radius_attr_hdr *attr = radius_get_attr_hdr(msg, i);  in radius_msg_dump()  local
357 		radius_msg_dump_attr(attr);  in radius_msg_dump()
367 		struct radius_attr_hdr *attr;  in radius_msg_finish()  local
370 		attr = radius_msg_add_attr(msg,  in radius_msg_finish()
373 		if (attr == NULL) {  in radius_msg_finish()
380 			 wpabuf_len(msg->buf), (u8 *) (attr + 1));  in radius_msg_finish()
397 	struct radius_attr_hdr *attr;  in radius_msg_finish_srv()  local
402 	attr = radius_msg_add_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR,  in radius_msg_finish_srv()
404 	if (attr == NULL) {  in radius_msg_finish_srv()
412 		 wpabuf_len(msg->buf), (u8 *) (attr + 1));  in radius_msg_finish_srv()
441 	struct radius_attr_hdr *attr;  in radius_msg_finish_das_resp()  local
444 	attr = radius_msg_add_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR,  in radius_msg_finish_das_resp()
446 	if (attr == NULL) {  in radius_msg_finish_das_resp()
454 		 wpabuf_len(msg->buf), (u8 *) (attr + 1));  in radius_msg_finish_das_resp()
547 	struct radius_attr_hdr *attr = NULL, *tmp;  in radius_msg_verify_das_req()  local
566 			if (attr != NULL) {  in radius_msg_verify_das_req()
572 			attr = tmp;  in radius_msg_verify_das_req()
576 	if (attr == NULL) {  in radius_msg_verify_das_req()
581 	os_memcpy(orig, attr + 1, MD5_MAC_LEN);  in radius_msg_verify_das_req()
582 	os_memset(attr + 1, 0, MD5_MAC_LEN);  in radius_msg_verify_das_req()
589 	os_memcpy(attr + 1, orig, MD5_MAC_LEN);  in radius_msg_verify_das_req()
598 					struct radius_attr_hdr *attr)  in radius_msg_add_attr_to_array()  argument
614 		(unsigned char *) attr - wpabuf_head_u8(msg->buf);  in radius_msg_add_attr_to_array()
624 	struct radius_attr_hdr *attr;  in radius_msg_add_attr()  local
632 	buf_needed = sizeof(*attr) + data_len;  in radius_msg_add_attr()
641 	attr = wpabuf_put(msg->buf, sizeof(struct radius_attr_hdr));  in radius_msg_add_attr()
642 	attr->type = type;  in radius_msg_add_attr()
643 	attr->length = sizeof(*attr) + data_len;  in radius_msg_add_attr()
646 	if (radius_msg_add_attr_to_array(msg, attr))  in radius_msg_add_attr()
649 	return attr;  in radius_msg_add_attr()
666 	struct radius_attr_hdr *attr;  in radius_msg_parse()  local
701 		if ((size_t) (end - pos) < sizeof(*attr))  in radius_msg_parse()
704 		attr = (struct radius_attr_hdr *) pos;  in radius_msg_parse()
706 		if (pos + attr->length > end || attr->length < sizeof(*attr))  in radius_msg_parse()
711 		if (radius_msg_add_attr_to_array(msg, attr))  in radius_msg_parse()
714 		pos += attr->length;  in radius_msg_parse()
753 	struct radius_attr_hdr *attr;  in radius_msg_get_eap()  local
760 		attr = radius_get_attr_hdr(msg, i);  in radius_msg_get_eap()
761 		if (attr->type == RADIUS_ATTR_EAP_MESSAGE &&  in radius_msg_get_eap()
762 		    attr->length > sizeof(struct radius_attr_hdr))  in radius_msg_get_eap()
763 			len += attr->length - sizeof(struct radius_attr_hdr);  in radius_msg_get_eap()
774 		attr = radius_get_attr_hdr(msg, i);  in radius_msg_get_eap()
775 		if (attr->type == RADIUS_ATTR_EAP_MESSAGE &&  in radius_msg_get_eap()
776 		    attr->length > sizeof(struct radius_attr_hdr)) {  in radius_msg_get_eap()
777 			int flen = attr->length - sizeof(*attr);  in radius_msg_get_eap()
778 			wpabuf_put_data(eap, attr + 1, flen);  in radius_msg_get_eap()
791 	struct radius_attr_hdr *attr = NULL, *tmp;  in radius_msg_verify_msg_auth()  local
797 			if (attr != NULL) {  in radius_msg_verify_msg_auth()
801 			attr = tmp;  in radius_msg_verify_msg_auth()
805 	if (attr == NULL) {  in radius_msg_verify_msg_auth()
810 	os_memcpy(orig, attr + 1, MD5_MAC_LEN);  in radius_msg_verify_msg_auth()
811 	os_memset(attr + 1, 0, MD5_MAC_LEN);  in radius_msg_verify_msg_auth()
820 	os_memcpy(attr + 1, orig, MD5_MAC_LEN);  in radius_msg_verify_msg_auth()
875 	struct radius_attr_hdr *attr;  in radius_msg_copy_attr()  local
880 		attr = radius_get_attr_hdr(src, i);  in radius_msg_copy_attr()
881 		if (attr->type == type && attr->length >= sizeof(*attr)) {  in radius_msg_copy_attr()
882 			if (!radius_msg_add_attr(dst, type, (u8 *) (attr + 1),  in radius_msg_copy_attr()
883 						 attr->length - sizeof(*attr)))  in radius_msg_copy_attr()
933 		struct radius_attr_hdr *attr = radius_get_attr_hdr(msg, i);  in radius_msg_get_vendor_attr()  local
938 		if (attr->type != RADIUS_ATTR_VENDOR_SPECIFIC ||  in radius_msg_get_vendor_attr()
939 		    attr->length < sizeof(*attr))  in radius_msg_get_vendor_attr()
942 		left = attr->length - sizeof(*attr);  in radius_msg_get_vendor_attr()
946 		pos = (u8 *) (attr + 1);  in radius_msg_get_vendor_attr()
1191 	struct radius_attr_hdr *attr;  in radius_msg_add_mppe_keys()  local
1220 	attr = radius_msg_add_attr(msg, RADIUS_ATTR_VENDOR_SPECIFIC,  in radius_msg_add_mppe_keys()
1223 	if (attr == NULL) {  in radius_msg_add_mppe_keys()
1245 	attr = radius_msg_add_attr(msg, RADIUS_ATTR_VENDOR_SPECIFIC,  in radius_msg_add_mppe_keys()
1248 	if (attr == NULL) {  in radius_msg_add_mppe_keys()
1259 	struct radius_attr_hdr *attr;  in radius_msg_add_wfa()  local
1273 	attr = radius_msg_add_attr(msg, RADIUS_ATTR_VENDOR_SPECIFIC,  in radius_msg_add_wfa()
1276 	if (attr == NULL)  in radius_msg_add_wfa()
1356 	struct radius_attr_hdr *attr = NULL, *tmp;  in radius_msg_get_attr()  local
1362 			attr = tmp;  in radius_msg_get_attr()
1367 	if (!attr || attr->length < sizeof(*attr))  in radius_msg_get_attr()
1370 	dlen = attr->length - sizeof(*attr);  in radius_msg_get_attr()
1372 		os_memcpy(buf, (attr + 1), dlen > len ? len : dlen);  in radius_msg_get_attr()
1381 	struct radius_attr_hdr *attr = NULL, *tmp;  in radius_msg_get_attr_ptr()  local
1387 			attr = tmp;  in radius_msg_get_attr_ptr()
1392 	if (!attr || attr->length < sizeof(*attr))  in radius_msg_get_attr_ptr()
1395 	*buf = (u8 *) (attr + 1);  in radius_msg_get_attr_ptr()
1396 	*len = attr->length - sizeof(*attr);  in radius_msg_get_attr_ptr()
1407 		struct radius_attr_hdr *attr = radius_get_attr_hdr(msg, i);  in radius_msg_count_attr()  local
1408 		if (attr->type == type &&  in radius_msg_count_attr()
1409 		    attr->length >= sizeof(struct radius_attr_hdr) + min_len)  in radius_msg_count_attr()
1434 	struct radius_attr_hdr *attr = NULL;  in radius_msg_get_vlanid()  local
1442 		attr = radius_get_attr_hdr(msg, i);  in radius_msg_get_vlanid()
1443 		if (attr->length < sizeof(*attr))  in radius_msg_get_vlanid()
1445 		data = (const u8 *) (attr + 1);  in radius_msg_get_vlanid()
1446 		dlen = attr->length - sizeof(*attr);  in radius_msg_get_vlanid()
1447 		if (attr->length < 3)  in radius_msg_get_vlanid()
1454 		switch (attr->type) {  in radius_msg_get_vlanid()
1456 			if (attr->length != 6)  in radius_msg_get_vlanid()
1462 			if (attr->length != 6)  in radius_msg_get_vlanid()
1518 	struct radius_attr_hdr *attr;  in radius_msg_get_tunnel_password()  local
1527 		attr = radius_get_attr_hdr(msg, i);  in radius_msg_get_tunnel_password()
1528 		if (attr == NULL ||  in radius_msg_get_tunnel_password()
1529 		    attr->type != RADIUS_ATTR_TUNNEL_PASSWORD) {  in radius_msg_get_tunnel_password()
1532 		if (attr->length <= 5)  in radius_msg_get_tunnel_password()
1534 		data = (const u8 *) (attr + 1);  in radius_msg_get_tunnel_password()
1535 		dlen = attr->length - sizeof(*attr);  in radius_msg_get_tunnel_password()
1618 		os_free(c->attr[i].data);  in radius_free_class()
1619 	os_free(c->attr);  in radius_free_class()
1620 	c->attr = NULL;  in radius_free_class()
1630 	if (src->attr == NULL)  in radius_copy_class()
1633 	dst->attr = os_calloc(src->count, sizeof(struct radius_attr_data));  in radius_copy_class()
1634 	if (dst->attr == NULL)  in radius_copy_class()
1640 		dst->attr[i].data = os_malloc(src->attr[i].len);  in radius_copy_class()
1641 		if (dst->attr[i].data == NULL)  in radius_copy_class()
1644 		os_memcpy(dst->attr[i].data, src->attr[i].data,  in radius_copy_class()
1645 			  src->attr[i].len);  in radius_copy_class()
1646 		dst->attr[i].len = src->attr[i].len;  in radius_copy_class()
1656 	struct radius_attr_hdr *attr;  in radius_msg_find_unlisted_attr()  local
1659 		attr = radius_get_attr_hdr(msg, i);  in radius_msg_find_unlisted_attr()
1662 			if (attr->type == attrs[j])  in radius_msg_find_unlisted_attr()
1667 			return attr->type; /* unlisted attr */  in radius_msg_find_unlisted_attr()