Attachment 28756 Details for Bug 66128

[patch] SLC+ENV overflow fix

telnet-bsd-1.0-temp-increase+slc-env-overflow.diff (text/plain), 1.74 KB, created by Sebastian Krahmer on 2005-02-23 14:31:37 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Sebastian Krahmer

Created: 2005-02-23 14:31:37 UTC

Size: 1.74 KB

patch

obsolete

>diff -ruN telnet-bsd-1.0/telnet/telnet.c telnet-bsd-1.0.fixed/telnet/telnet.c
>--- telnet-bsd-1.0/telnet/telnet.c	2001-03-12 05:04:50.000000000 -0800
>+++ telnet-bsd-1.0.fixed/telnet/telnet.c	2005-02-23 07:21:57.440184560 -0800
>@@ -653,7 +653,7 @@
>       return;
>     } else {
>       char *name;
>-      unsigned char temp[50];
>+      unsigned char temp[300];
>       int len;
> 
> #if	defined(TN3270)
>@@ -682,7 +682,7 @@
>       return;
>     if (SB_GET() == TELQUAL_SEND) {
>       long ospeed, ispeed;
>-      unsigned char temp[50];
>+      unsigned char temp[300];
>       int len;
> 
>       TerminalSpeeds(&ispeed, &ospeed);
>@@ -779,7 +779,7 @@
>     if (SB_EOF())
>       return;
>     if (SB_GET() == TELQUAL_SEND) {
>-      unsigned char temp[50], *dp;
>+      unsigned char temp[300], *dp;
>       int len;
> 
>       if ((dp = env_getvalue((unsigned char *)"DISPLAY")) == NULL) {
>@@ -1146,6 +1146,11 @@
> 	void
> slc_add_reply(unsigned char func, unsigned char flags, cc_t value)
> {
>+	if (slc_replyp + 6 >= slc_reply + sizeof(slc_reply)) {
>+		printf("slc_add_reply: not enough room\n");
>+		return;
>+	}
>+ 
> 	if ((*slc_replyp++ = func) == IAC)
> 		*slc_replyp++ = IAC;
> 	if ((*slc_replyp++ = flags) == IAC)
>@@ -1159,6 +1164,11 @@
> {
>     int len;
> 
>+    if (slc_replyp + 2 >= slc_reply + sizeof(slc_reply)) {
>+        printf("slc_end_reply: not enough room\n");
>+        return;
>+    }
>+ 
>     *slc_replyp++ = IAC;
>     *slc_replyp++ = SE;
>     len = slc_replyp - slc_reply;
>@@ -1303,7 +1313,11 @@
> 	{
> 		int len;
> 		unsigned char *p;
>+		/* Pointer wrap should be no issue here */
> 		opt_replyend += OPT_REPLY_SIZE;
>+		opt_replyend += 2*strlen(ep);
>+		if (vp)
>+			opt_replyend += 2*strlen(vp);
> 		len = opt_replyend - opt_reply;
> 		p = (unsigned char *)realloc(opt_reply, len);
> 		if (p == NULL)

Actions: View | Diff

Attachments on bug 66128: 28649 | 28650 | 28708 | 28709 | 28710 | 28741 | 28742 | 28745 | 28746 | 28756 | 28757 | 32267 | 32268 | 39119