280 	const struct radius_attr_type *attr;  in radius_msg_dump_attr()  local
285 	attr = radius_get_attr_type(hdr->type);  in radius_msg_dump_attr()
288 		   hdr->type, attr ? attr->name : "?Unknown?", hdr->length);  in radius_msg_dump_attr()
290 	if (attr == NULL || hdr->length < sizeof(struct radius_attr_hdr))  in radius_msg_dump_attr()
296 	switch (attr->data_type) {  in radius_msg_dump_attr()
359 		struct radius_attr_hdr *attr = radius_get_attr_hdr(msg, i);  in radius_msg_dump()  local
360 		radius_msg_dump_attr(attr);  in radius_msg_dump()
370 		struct radius_attr_hdr *attr;  in radius_msg_finish()  local
373 		attr = radius_msg_add_attr(msg,  in radius_msg_finish()
376 		if (attr == NULL) {  in radius_msg_finish()
383 			 wpabuf_len(msg->buf), (u8 *) (attr + 1));  in radius_msg_finish()
400 	struct radius_attr_hdr *attr;  in radius_msg_finish_srv()  local
405 	attr = radius_msg_add_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR,  in radius_msg_finish_srv()
407 	if (attr == NULL) {  in radius_msg_finish_srv()
415 		 wpabuf_len(msg->buf), (u8 *) (attr + 1));  in radius_msg_finish_srv()
444 	struct radius_attr_hdr *attr;  in radius_msg_finish_das_resp()  local
447 	attr = radius_msg_add_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR,  in radius_msg_finish_das_resp()
449 	if (attr == NULL) {  in radius_msg_finish_das_resp()
457 		 wpabuf_len(msg->buf), (u8 *) (attr + 1));  in radius_msg_finish_das_resp()
550 	struct radius_attr_hdr *attr = NULL, *tmp;  in radius_msg_verify_das_req()  local
569 			if (attr != NULL) {  in radius_msg_verify_das_req()
575 			attr = tmp;  in radius_msg_verify_das_req()
579 	if (attr == NULL) {  in radius_msg_verify_das_req()
584 	os_memcpy(orig, attr + 1, MD5_MAC_LEN);  in radius_msg_verify_das_req()
585 	os_memset(attr + 1, 0, MD5_MAC_LEN);  in radius_msg_verify_das_req()
592 	os_memcpy(attr + 1, orig, MD5_MAC_LEN);  in radius_msg_verify_das_req()
601 					struct radius_attr_hdr *attr)  in radius_msg_add_attr_to_array()  argument
617 		(unsigned char *) attr - wpabuf_head_u8(msg->buf);  in radius_msg_add_attr_to_array()
627 	struct radius_attr_hdr *attr;  in radius_msg_add_attr()  local
635 	buf_needed = sizeof(*attr) + data_len;  in radius_msg_add_attr()
644 	attr = wpabuf_put(msg->buf, sizeof(struct radius_attr_hdr));  in radius_msg_add_attr()
645 	attr->type = type;  in radius_msg_add_attr()
646 	attr->length = sizeof(*attr) + data_len;  in radius_msg_add_attr()
649 	if (radius_msg_add_attr_to_array(msg, attr))  in radius_msg_add_attr()
652 	return attr;  in radius_msg_add_attr()
669 	struct radius_attr_hdr *attr;  in radius_msg_parse()  local
704 		if ((size_t) (end - pos) < sizeof(*attr))  in radius_msg_parse()
707 		attr = (struct radius_attr_hdr *) pos;  in radius_msg_parse()
709 		if (attr->length > end - pos || attr->length < sizeof(*attr))  in radius_msg_parse()
714 		if (radius_msg_add_attr_to_array(msg, attr))  in radius_msg_parse()
717 		pos += attr->length;  in radius_msg_parse()
756 	struct radius_attr_hdr *attr;  in radius_msg_get_eap()  local
763 		attr = radius_get_attr_hdr(msg, i);  in radius_msg_get_eap()
764 		if (attr->type == RADIUS_ATTR_EAP_MESSAGE &&  in radius_msg_get_eap()
765 		    attr->length > sizeof(struct radius_attr_hdr))  in radius_msg_get_eap()
766 			len += attr->length - sizeof(struct radius_attr_hdr);  in radius_msg_get_eap()
777 		attr = radius_get_attr_hdr(msg, i);  in radius_msg_get_eap()
778 		if (attr->type == RADIUS_ATTR_EAP_MESSAGE &&  in radius_msg_get_eap()
779 		    attr->length > sizeof(struct radius_attr_hdr)) {  in radius_msg_get_eap()
780 			int flen = attr->length - sizeof(*attr);  in radius_msg_get_eap()
781 			wpabuf_put_data(eap, attr + 1, flen);  in radius_msg_get_eap()
794 	struct radius_attr_hdr *attr = NULL, *tmp;  in radius_msg_verify_msg_auth()  local
800 			if (attr != NULL) {  in radius_msg_verify_msg_auth()
804 			attr = tmp;  in radius_msg_verify_msg_auth()
808 	if (attr == NULL) {  in radius_msg_verify_msg_auth()
813 	os_memcpy(orig, attr + 1, MD5_MAC_LEN);  in radius_msg_verify_msg_auth()
814 	os_memset(attr + 1, 0, MD5_MAC_LEN);  in radius_msg_verify_msg_auth()
823 	os_memcpy(attr + 1, orig, MD5_MAC_LEN);  in radius_msg_verify_msg_auth()
878 	struct radius_attr_hdr *attr;  in radius_msg_copy_attr()  local
883 		attr = radius_get_attr_hdr(src, i);  in radius_msg_copy_attr()
884 		if (attr->type == type && attr->length >= sizeof(*attr)) {  in radius_msg_copy_attr()
885 			if (!radius_msg_add_attr(dst, type, (u8 *) (attr + 1),  in radius_msg_copy_attr()
886 						 attr->length - sizeof(*attr)))  in radius_msg_copy_attr()
922 		struct radius_attr_hdr *attr = radius_get_attr_hdr(msg, i);  in radius_msg_get_vendor_attr()  local
927 		if (attr->type != RADIUS_ATTR_VENDOR_SPECIFIC ||  in radius_msg_get_vendor_attr()
928 		    attr->length < sizeof(*attr))  in radius_msg_get_vendor_attr()
931 		left = attr->length - sizeof(*attr);  in radius_msg_get_vendor_attr()
935 		pos = (u8 *) (attr + 1);  in radius_msg_get_vendor_attr()
1180 	struct radius_attr_hdr *attr;  in radius_msg_add_mppe_keys()  local
1211 	attr = radius_msg_add_attr(msg, RADIUS_ATTR_VENDOR_SPECIFIC,  in radius_msg_add_mppe_keys()
1214 	if (attr == NULL) {  in radius_msg_add_mppe_keys()
1236 	attr = radius_msg_add_attr(msg, RADIUS_ATTR_VENDOR_SPECIFIC,  in radius_msg_add_mppe_keys()
1239 	if (attr == NULL) {  in radius_msg_add_mppe_keys()
1250 	struct radius_attr_hdr *attr;  in radius_msg_add_wfa()  local
1264 	attr = radius_msg_add_attr(msg, RADIUS_ATTR_VENDOR_SPECIFIC,  in radius_msg_add_wfa()
1267 	if (attr == NULL)  in radius_msg_add_wfa()
1347 	struct radius_attr_hdr *attr = NULL, *tmp;  in radius_msg_get_attr()  local
1353 			attr = tmp;  in radius_msg_get_attr()
1358 	if (!attr || attr->length < sizeof(*attr))  in radius_msg_get_attr()
1361 	dlen = attr->length - sizeof(*attr);  in radius_msg_get_attr()
1363 		os_memcpy(buf, (attr + 1), dlen > len ? len : dlen);  in radius_msg_get_attr()
1372 	struct radius_attr_hdr *attr = NULL, *tmp;  in radius_msg_get_attr_ptr()  local
1378 			attr = tmp;  in radius_msg_get_attr_ptr()
1383 	if (!attr || attr->length < sizeof(*attr))  in radius_msg_get_attr_ptr()
1386 	*buf = (u8 *) (attr + 1);  in radius_msg_get_attr_ptr()
1387 	*len = attr->length - sizeof(*attr);  in radius_msg_get_attr_ptr()
1398 		struct radius_attr_hdr *attr = radius_get_attr_hdr(msg, i);  in radius_msg_count_attr()  local
1399 		if (attr->type == type &&  in radius_msg_count_attr()
1400 		    attr->length >= sizeof(struct radius_attr_hdr) + min_len)  in radius_msg_count_attr()
1443 	struct radius_attr_hdr *attr = NULL;  in radius_msg_get_vlanid()  local
1455 		attr = radius_get_attr_hdr(msg, i);  in radius_msg_get_vlanid()
1456 		if (attr->length < sizeof(*attr))  in radius_msg_get_vlanid()
1458 		data = (const u8 *) (attr + 1);  in radius_msg_get_vlanid()
1459 		dlen = attr->length - sizeof(*attr);  in radius_msg_get_vlanid()
1460 		if (attr->length < 3)  in radius_msg_get_vlanid()
1467 		switch (attr->type) {  in radius_msg_get_vlanid()
1469 			if (attr->length != 6)  in radius_msg_get_vlanid()
1475 			if (attr->length != 6)  in radius_msg_get_vlanid()
1496 			if (attr->length != 6)  in radius_msg_get_vlanid()
1554 	struct radius_attr_hdr *attr;  in radius_msg_get_tunnel_password()  local
1563 		attr = radius_get_attr_hdr(msg, i);  in radius_msg_get_tunnel_password()
1564 		if (attr == NULL ||  in radius_msg_get_tunnel_password()
1565 		    attr->type != RADIUS_ATTR_TUNNEL_PASSWORD) {  in radius_msg_get_tunnel_password()
1568 		if (attr->length <= 5)  in radius_msg_get_tunnel_password()
1570 		data = (const u8 *) (attr + 1);  in radius_msg_get_tunnel_password()
1571 		dlen = attr->length - sizeof(*attr);  in radius_msg_get_tunnel_password()
1654 		os_free(c->attr[i].data);  in radius_free_class()
1655 	os_free(c->attr);  in radius_free_class()
1656 	c->attr = NULL;  in radius_free_class()
1666 	if (src->attr == NULL)  in radius_copy_class()
1669 	dst->attr = os_calloc(src->count, sizeof(struct radius_attr_data));  in radius_copy_class()
1670 	if (dst->attr == NULL)  in radius_copy_class()
1676 		dst->attr[i].data = os_malloc(src->attr[i].len);  in radius_copy_class()
1677 		if (dst->attr[i].data == NULL)  in radius_copy_class()
1680 		os_memcpy(dst->attr[i].data, src->attr[i].data,  in radius_copy_class()
1681 			  src->attr[i].len);  in radius_copy_class()
1682 		dst->attr[i].len = src->attr[i].len;  in radius_copy_class()
1692 	struct radius_attr_hdr *attr;  in radius_msg_find_unlisted_attr()  local
1695 		attr = radius_get_attr_hdr(msg, i);  in radius_msg_find_unlisted_attr()
1698 			if (attr->type == attrs[j])  in radius_msg_find_unlisted_attr()
1703 			return attr->type; /* unlisted attr */  in radius_msg_find_unlisted_attr()