1093 		struct radius_attr_vendor *vhdr;  in radius_msg_get_vendor_attr()  local
1112 		while (left >= sizeof(*vhdr)) {  in radius_msg_get_vendor_attr()
1113 			vhdr = (struct radius_attr_vendor *) pos;  in radius_msg_get_vendor_attr()
1114 			if (vhdr->vendor_length > left ||  in radius_msg_get_vendor_attr()
1115 			    vhdr->vendor_length < sizeof(*vhdr)) {  in radius_msg_get_vendor_attr()
1118 			if (vhdr->vendor_type != subtype) {  in radius_msg_get_vendor_attr()
1119 				pos += vhdr->vendor_length;  in radius_msg_get_vendor_attr()
1120 				left -= vhdr->vendor_length;  in radius_msg_get_vendor_attr()
1124 			len = vhdr->vendor_length - sizeof(*vhdr);  in radius_msg_get_vendor_attr()
1125 			data = os_memdup(pos + sizeof(*vhdr), len);  in radius_msg_get_vendor_attr()
1352 	struct radius_attr_vendor *vhdr;  in radius_msg_add_mppe_keys()  local
1358 	hlen = sizeof(vendor_id) + sizeof(*vhdr) + 2;  in radius_msg_add_mppe_keys()
1368 	vhdr = (struct radius_attr_vendor *) pos;  in radius_msg_add_mppe_keys()
1369 	vhdr->vendor_type = RADIUS_VENDOR_ATTR_MS_MPPE_SEND_KEY;  in radius_msg_add_mppe_keys()
1370 	pos = (u8 *) (vhdr + 1);  in radius_msg_add_mppe_keys()
1380 	vhdr->vendor_length = hlen + elen - sizeof(vendor_id);  in radius_msg_add_mppe_keys()
1397 	vhdr = (struct radius_attr_vendor *) pos;  in radius_msg_add_mppe_keys()
1398 	vhdr->vendor_type = RADIUS_VENDOR_ATTR_MS_MPPE_RECV_KEY;  in radius_msg_add_mppe_keys()
1399 	pos = (u8 *) (vhdr + 1);  in radius_msg_add_mppe_keys()
1405 	vhdr->vendor_length = hlen + elen - sizeof(vendor_id);  in radius_msg_add_mppe_keys()