Add check to VERIFY_VP to check that the string buffer is still \0 terminated, and that the length of the of the buffer matches the length of the VALUE_PAIR.
Formatting
Valgrind complains about sscanf in rlm_eap_mschapv2.c reading past the end of response->vp_strvalue. Use VERIFY_VP to check that this can't be happening.
Reorder operations in mschap_add_reply to try and unconfuse valgrind
Don't leak memory when pairmake is called with a regular expression comparison
Another regex memory leak...