From 9256b4a78ad6b14d97f80a0e749c66d97e46d5e1 Mon Sep 17 00:00:00 2001
From: Fabian Mauchle <fabian.mauchle@switch.ch>
Date: Tue, 28 Jul 2026 08:20:58 +0200
Subject: [PATCH] fix ms-mppe alignment check (GHSA-wj29-mxmc-q98c)

---
 radsecproxy.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

--- a/radsecproxy.c
+++ b/radsecproxy.c
@@ -815,7 +815,7 @@ int pwdrecrypt(uint8_t *pwd, uint8_t len
 }
 
 int msmpprecrypt(uint8_t *msmpp, uint8_t len, uint8_t *oldsecret, int oldsecret_len, uint8_t *newsecret, int newsecret_len, uint8_t *oldauth, uint8_t *newauth) {
-    if (len < 18)
+    if (len < 18 || (len - 2) % 16)
 	return 0;
     if (!msmppdecrypt(msmpp + 2, len - 2, oldsecret, oldsecret_len, oldauth, msmpp)) {
 	debug(DBG_WARN, "msmpprecrypt: failed to decrypt msppe key");
