934 		struct radius_attr_vendor *vhdr;  in radius_msg_get_vendor_attr()  local
953 		while (left >= sizeof(*vhdr)) {  in radius_msg_get_vendor_attr()
954 			vhdr = (struct radius_attr_vendor *) pos;  in radius_msg_get_vendor_attr()
955 			if (vhdr->vendor_length > left ||  in radius_msg_get_vendor_attr()
956 			    vhdr->vendor_length < sizeof(*vhdr)) {  in radius_msg_get_vendor_attr()
959 			if (vhdr->vendor_type != subtype) {  in radius_msg_get_vendor_attr()
960 				pos += vhdr->vendor_length;  in radius_msg_get_vendor_attr()
961 				left -= vhdr->vendor_length;  in radius_msg_get_vendor_attr()
965 			len = vhdr->vendor_length - sizeof(*vhdr);  in radius_msg_get_vendor_attr()
966 			data = os_memdup(pos + sizeof(*vhdr), len);  in radius_msg_get_vendor_attr()
1193 	struct radius_attr_vendor *vhdr;  in radius_msg_add_mppe_keys()  local
1199 	hlen = sizeof(vendor_id) + sizeof(*vhdr) + 2;  in radius_msg_add_mppe_keys()
1209 	vhdr = (struct radius_attr_vendor *) pos;  in radius_msg_add_mppe_keys()
1210 	vhdr->vendor_type = RADIUS_VENDOR_ATTR_MS_MPPE_SEND_KEY;  in radius_msg_add_mppe_keys()
1211 	pos = (u8 *) (vhdr + 1);  in radius_msg_add_mppe_keys()
1221 	vhdr->vendor_length = hlen + elen - sizeof(vendor_id);  in radius_msg_add_mppe_keys()
1238 	vhdr = (struct radius_attr_vendor *) pos;  in radius_msg_add_mppe_keys()
1239 	vhdr->vendor_type = RADIUS_VENDOR_ATTR_MS_MPPE_RECV_KEY;  in radius_msg_add_mppe_keys()
1240 	pos = (u8 *) (vhdr + 1);  in radius_msg_add_mppe_keys()
1246 	vhdr->vendor_length = hlen + elen - sizeof(vendor_id);  in radius_msg_add_mppe_keys()