From e4a5a7252c5dac4eb24027332d66ec363bd8ae8b Mon Sep 17 00:00:00 2001
From: Vladimir Dubrovin <3proxy@3proxy.ru>
Date: Tue, 28 Jul 2026 11:31:06 +0300
Subject: [PATCH] Fix: buffer overflow in radsend (log radius or combination of
 auth radius with fakeresolve must be enabled, RADIUS feature is experimental)

---
 src/authradius.c | 2 ++
 src/common.c     | 5 +++++
 2 files changed, 7 insertions(+)

diff --git a/src/authradius.c b/src/authradius.c
index 78033dc..592441e 100644
--- a/src/authradius.c
+++ b/src/authradius.c
@@ -391,6 +391,7 @@ int radsend(struct clientparam * param, int auth, int stop){
 	if(conf.stringtable){
 		*ptr++ = PW_NAS_IDENTIFIER;
 		len = strlen((char *)conf.stringtable[SERVICES+param->service]);
+		if(len > 253) len = 253;
 		*ptr++ = (2 + len);
 		memcpy(ptr, conf.stringtable[SERVICES+param->service], len);
 		ptr += len;
@@ -416,6 +417,7 @@ int radsend(struct clientparam * param, int auth, int stop){
 	if(param->hostname){
 		*ptr++ = PW_CALLED_STATION_ID;
 		len = strlen((char *)param->hostname);
+		if(len > 253) len = 253;
 		*ptr++ = (2 + len);
 		memcpy(ptr, param->hostname, len);
 		ptr += len;
diff --git a/src/common.c b/src/common.c
index 5bafffd..d3fc6a8 100644
--- a/src/common.c
+++ b/src/common.c
@@ -507,6 +507,11 @@ int parsehostname(char *hostname, struct clientparam *param, uint16_t port){
 		*SAPORT(&param->req) = htons(port);
 		return 0;
 	}
+	if(strlen(hostname + (se!=0)) > 253){
+		if(se) *se = ']';
+		if(sp) *sp = ':';
+		return 1;
+	}
 	if(hostname != (char *)param->hostname){
 		if(param->hostname) free(param->hostname);
 		param->hostname = (unsigned char *)strdup(hostname + (se!=0));