Code: rad_get_vendor_attr(u_int32_t *vendor, const void **data, size_t *len)
 {
 	struct vendor_attribute *attr;
 
	attr = (struct vendor_attribute *)*data;
 	*vendor = ntohl(attr->vendor_value);
 	*data = attr->attrib_data;
 	*len = attr->attrib_len - 2;
 
 	return (attr->attrib_type);
 }

Commit Message: Fix a security issue in radius_get_vendor_attr().

The underlying rad_get_vendor_attr() function assumed that it would always be
given valid VSA data. Indeed, the buffer length wasn't even passed in; the
assumption was that the length field within the VSA structure would be valid.

This could result in denial of service by providing a length that would be
beyond the memory limit, or potential arbitrary memory access by providing a
length greater than the actual data given.

rad_get_vendor_attr() has been changed to require the raw data length be
provided, and this is then used to check that the VSA is valid.

Conflicts:
	radlib_vs.h
CWE ID: CWE-119
rad_get_vendor_attr(u_int32_t *vendor, const void **data, size_t *len)
rad_get_vendor_attr(u_int32_t *vendor, unsigned char *type, const void **data, size_t *len, const void *raw, size_t raw_len)
 {
 	struct vendor_attribute *attr;
 
	if (raw_len < sizeof(struct vendor_attribute)) {
		return -1;
	}

	attr = (struct vendor_attribute *) raw;
 	*vendor = ntohl(attr->vendor_value);
	*type = attr->attrib_type;
 	*data = attr->attrib_data;
 	*len = attr->attrib_len - 2;
 
	if ((attr->attrib_len + 4) > raw_len) {
		return -1;
	}

 	return (attr->attrib_type);
 }
