319 	const struct radius_attr_type *attr;  in radius_msg_dump_attr()  local
339 		attr = radius_get_attr_type((ext->type << 8) | ext->ext_type);  in radius_msg_dump_attr()
342 			   attr ? attr->name : "?Unknown?", ext->length);  in radius_msg_dump_attr()
346 		attr = radius_get_attr_type(hdr->type);  in radius_msg_dump_attr()
348 			   hdr->type, attr ? attr->name : "?Unknown?",  in radius_msg_dump_attr()
354 	if (!attr)  in radius_msg_dump_attr()
357 	switch (attr->data_type) {  in radius_msg_dump_attr()
420 		struct radius_attr_hdr *attr = radius_get_attr_hdr(msg, i);  in radius_msg_dump()  local
421 		radius_msg_dump_attr(attr);  in radius_msg_dump()
429 	struct radius_attr_hdr *attr;  in radius_msg_add_msg_auth()  local
432 	attr = radius_msg_add_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR,  in radius_msg_add_msg_auth()
434 	if (!attr) {  in radius_msg_add_msg_auth()
440 	return (u8 *) (attr + 1);  in radius_msg_add_msg_auth()
633 	struct radius_attr_hdr *attr = NULL, *tmp;  in radius_msg_verify_das_req()  local
652 			if (attr != NULL) {  in radius_msg_verify_das_req()
658 			attr = tmp;  in radius_msg_verify_das_req()
662 	if (attr == NULL) {  in radius_msg_verify_das_req()
671 	os_memcpy(orig, attr + 1, MD5_MAC_LEN);  in radius_msg_verify_das_req()
672 	os_memset(attr + 1, 0, MD5_MAC_LEN);  in radius_msg_verify_das_req()
679 	os_memcpy(attr + 1, orig, MD5_MAC_LEN);  in radius_msg_verify_das_req()
688 					struct radius_attr_hdr *attr)  in radius_msg_add_attr_to_array()  argument
704 		(unsigned char *) attr - wpabuf_head_u8(msg->buf);  in radius_msg_add_attr_to_array()
714 	struct radius_attr_hdr *attr = NULL;  in radius_msg_add_attr()  local
750 		buf_needed = sizeof(*attr) + data_len;  in radius_msg_add_attr()
774 			if (!attr)  in radius_msg_add_attr()
775 				attr = (struct radius_attr_hdr *) ext;  in radius_msg_add_attr()
789 		attr = (struct radius_attr_hdr *) ext;  in radius_msg_add_attr()
794 		if (radius_msg_add_attr_to_array(msg, attr))  in radius_msg_add_attr()
797 		attr = wpabuf_put(msg->buf, sizeof(struct radius_attr_hdr));  in radius_msg_add_attr()
798 		attr->type = type;  in radius_msg_add_attr()
799 		attr->length = sizeof(*attr) + data_len;  in radius_msg_add_attr()
801 		if (radius_msg_add_attr_to_array(msg, attr))  in radius_msg_add_attr()
805 	return attr;  in radius_msg_add_attr()
822 	struct radius_attr_hdr *attr;  in radius_msg_parse()  local
857 		if ((size_t) (end - pos) < sizeof(*attr))  in radius_msg_parse()
860 		attr = (struct radius_attr_hdr *) pos;  in radius_msg_parse()
862 		if (attr->length > end - pos || attr->length < sizeof(*attr))  in radius_msg_parse()
867 		if (radius_msg_add_attr_to_array(msg, attr))  in radius_msg_parse()
870 		pos += attr->length;  in radius_msg_parse()
909 	struct radius_attr_hdr *attr;  in radius_msg_get_eap()  local
916 		attr = radius_get_attr_hdr(msg, i);  in radius_msg_get_eap()
917 		if (attr->type == RADIUS_ATTR_EAP_MESSAGE &&  in radius_msg_get_eap()
918 		    attr->length > sizeof(struct radius_attr_hdr))  in radius_msg_get_eap()
919 			len += attr->length - sizeof(struct radius_attr_hdr);  in radius_msg_get_eap()
930 		attr = radius_get_attr_hdr(msg, i);  in radius_msg_get_eap()
931 		if (attr->type == RADIUS_ATTR_EAP_MESSAGE &&  in radius_msg_get_eap()
932 		    attr->length > sizeof(struct radius_attr_hdr)) {  in radius_msg_get_eap()
933 			int flen = attr->length - sizeof(*attr);  in radius_msg_get_eap()
934 			wpabuf_put_data(eap, attr + 1, flen);  in radius_msg_get_eap()
947 	struct radius_attr_hdr *attr = NULL, *tmp;  in radius_msg_verify_msg_auth()  local
953 			if (attr != NULL) {  in radius_msg_verify_msg_auth()
957 			attr = tmp;  in radius_msg_verify_msg_auth()
961 	if (attr == NULL) {  in radius_msg_verify_msg_auth()
966 	os_memcpy(orig, attr + 1, MD5_MAC_LEN);  in radius_msg_verify_msg_auth()
967 	os_memset(attr + 1, 0, MD5_MAC_LEN);  in radius_msg_verify_msg_auth()
977 	os_memcpy(attr + 1, orig, MD5_MAC_LEN);  in radius_msg_verify_msg_auth()
1046 	struct radius_attr_hdr *attr;  in radius_msg_copy_attr()  local
1051 		attr = radius_get_attr_hdr(src, i);  in radius_msg_copy_attr()
1052 		if (attr->type == type && attr->length >= sizeof(*attr)) {  in radius_msg_copy_attr()
1053 			if (!radius_msg_add_attr(dst, type, (u8 *) (attr + 1),  in radius_msg_copy_attr()
1054 						 attr->length - sizeof(*attr)))  in radius_msg_copy_attr()
1090 		struct radius_attr_hdr *attr = radius_get_attr_hdr(msg, i);  in radius_msg_get_vendor_attr()  local
1095 		if (attr->type != RADIUS_ATTR_VENDOR_SPECIFIC ||  in radius_msg_get_vendor_attr()
1096 		    attr->length < sizeof(*attr))  in radius_msg_get_vendor_attr()
1099 		left = attr->length - sizeof(*attr);  in radius_msg_get_vendor_attr()
1103 		pos = (u8 *) (attr + 1);  in radius_msg_get_vendor_attr()
1349 	struct radius_attr_hdr *attr;  in radius_msg_add_mppe_keys()  local
1382 	attr = radius_msg_add_attr(msg, RADIUS_ATTR_VENDOR_SPECIFIC,  in radius_msg_add_mppe_keys()
1385 	if (attr == NULL) {  in radius_msg_add_mppe_keys()
1407 	attr = radius_msg_add_attr(msg, RADIUS_ATTR_VENDOR_SPECIFIC,  in radius_msg_add_mppe_keys()
1410 	if (attr == NULL) {  in radius_msg_add_mppe_keys()
1421 	struct radius_attr_hdr *attr;  in radius_msg_add_wfa()  local
1435 	attr = radius_msg_add_attr(msg, RADIUS_ATTR_VENDOR_SPECIFIC,  in radius_msg_add_wfa()
1438 	if (attr == NULL)  in radius_msg_add_wfa()
1448 	struct radius_attr_hdr *attr;  in radius_msg_add_ext_vs()  local
1461 	attr = radius_msg_add_attr(msg, type, buf, alen);  in radius_msg_add_ext_vs()
1463 	return attr != NULL;  in radius_msg_add_ext_vs()
1540 	struct radius_attr_hdr *attr = NULL, *tmp;  in radius_msg_get_attr()  local
1546 			attr = tmp;  in radius_msg_get_attr()
1551 	if (!attr || attr->length < sizeof(*attr))  in radius_msg_get_attr()
1554 	dlen = attr->length - sizeof(*attr);  in radius_msg_get_attr()
1556 		os_memcpy(buf, (attr + 1), dlen > len ? len : dlen);  in radius_msg_get_attr()
1565 	struct radius_attr_hdr *attr = NULL, *tmp;  in radius_msg_get_attr_ptr()  local
1571 			attr = tmp;  in radius_msg_get_attr_ptr()
1576 	if (!attr || attr->length < sizeof(*attr))  in radius_msg_get_attr_ptr()
1579 	*buf = (u8 *) (attr + 1);  in radius_msg_get_attr_ptr()
1580 	*len = attr->length - sizeof(*attr);  in radius_msg_get_attr_ptr()
1591 		struct radius_attr_hdr *attr = radius_get_attr_hdr(msg, i);  in radius_msg_count_attr()  local
1592 		if (attr->type == type &&  in radius_msg_count_attr()
1593 		    attr->length >= sizeof(struct radius_attr_hdr) + min_len)  in radius_msg_count_attr()
1636 	struct radius_attr_hdr *attr = NULL;  in radius_msg_get_vlanid()  local
1648 		attr = radius_get_attr_hdr(msg, i);  in radius_msg_get_vlanid()
1649 		if (attr->length < sizeof(*attr))  in radius_msg_get_vlanid()
1651 		data = (const u8 *) (attr + 1);  in radius_msg_get_vlanid()
1652 		dlen = attr->length - sizeof(*attr);  in radius_msg_get_vlanid()
1653 		if (attr->length < 3)  in radius_msg_get_vlanid()
1660 		switch (attr->type) {  in radius_msg_get_vlanid()
1662 			if (attr->length != 6)  in radius_msg_get_vlanid()
1668 			if (attr->length != 6)  in radius_msg_get_vlanid()
1689 			if (attr->length != 6)  in radius_msg_get_vlanid()
1747 	struct radius_attr_hdr *attr;  in radius_msg_get_tunnel_password()  local
1756 		attr = radius_get_attr_hdr(msg, i);  in radius_msg_get_tunnel_password()
1757 		if (attr == NULL ||  in radius_msg_get_tunnel_password()
1758 		    attr->type != RADIUS_ATTR_TUNNEL_PASSWORD) {  in radius_msg_get_tunnel_password()
1761 		if (attr->length <= 5)  in radius_msg_get_tunnel_password()
1763 		data = (const u8 *) (attr + 1);  in radius_msg_get_tunnel_password()
1764 		dlen = attr->length - sizeof(*attr);  in radius_msg_get_tunnel_password()
1846 		os_free(c->attr[i].data);  in radius_free_class()
1847 	os_free(c->attr);  in radius_free_class()
1848 	c->attr = NULL;  in radius_free_class()
1858 	if (src->attr == NULL)  in radius_copy_class()
1861 	dst->attr = os_calloc(src->count, sizeof(struct radius_attr_data));  in radius_copy_class()
1862 	if (dst->attr == NULL)  in radius_copy_class()
1868 		dst->attr[i].data = os_memdup(src->attr[i].data,  in radius_copy_class()
1869 					      src->attr[i].len);  in radius_copy_class()
1870 		if (dst->attr[i].data == NULL)  in radius_copy_class()
1873 		dst->attr[i].len = src->attr[i].len;  in radius_copy_class()
1883 	struct radius_attr_hdr *attr;  in radius_msg_find_unlisted_attr()  local
1886 		attr = radius_get_attr_hdr(msg, i);  in radius_msg_find_unlisted_attr()
1889 			if (attr->type == attrs[j])  in radius_msg_find_unlisted_attr()
1894 			return attr->type; /* unlisted attr */  in radius_msg_find_unlisted_attr()