Code:  PHP_FUNCTION(radius_get_vendor_attr)
 {
	int res;
	const void *data;
 	int len;
 	u_int32_t vendor;
 
	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &data, &len) == FAILURE) {
 		return;
 	}
 
	res = rad_get_vendor_attr(&vendor, &data, (size_t *) &len);
	if (res == -1) {
 		RETURN_FALSE;
 	} else {
 
 		array_init(return_value);
		add_assoc_long(return_value, "attr", res);
 		add_assoc_long(return_value, "vendor", vendor);
		add_assoc_stringl(return_value, "data", (char *) data, len, 1);
 		return;
 	}
 }

Vulnerability Type: DoS Exec Code Overflow 
CWE ID: CWE-119
Summary: Buffer overflow in the radius_get_vendor_attr function in the Radius extension before 1.2.7 for PHP allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large Vendor Specific Attributes (VSA) length value.
Commit Message: Fix a security issue in radius_get_vendor_attr().

The underlying rad_get_vendor_attr() function assumed that it would always be
given valid VSA data. Indeed, the buffer length wasn't even passed in; the
assumption was that the length field within the VSA structure would be valid.

This could result in denial of service by providing a length that would be
beyond the memory limit, or potential arbitrary memory access by providing a
length greater than the actual data given.

rad_get_vendor_attr() has been changed to require the raw data length be
provided, and this is then used to check that the VSA is valid.

Conflicts:
	radlib_vs.h