Attachment #54257 for bug #83596




}


#define SLC_REPLY_SIZE 128
unsigned char *slc_reply;
unsigned char *slc_replyp;
unsigned char *slc_replyend;

	void
slc_start_reply(void)
{
        slc_reply = (unsigned char *)malloc(SLC_REPLY_SIZE);
        if (slc_reply == NULL) {
/*@*/           printf("slc_start_reply: malloc()/realloc() failed!!!\n");
                slc_reply = slc_replyp = slc_replyend = NULL;
                return;
	}

	slc_replyp = slc_reply;
	slc_replyend = slc_reply + SLC_REPLY_SIZE;
	*slc_replyp++ = IAC;
	*slc_replyp++ = SB;
	*slc_replyp++ = TELOPT_LINEMODE;
	*slc_replyp++ = LM_SLC;
}

static int
slc_assure_buffer(int want_len);

	static int
slc_assure_buffer(int want_len)
{
        if ((slc_replyp + want_len) >= slc_replyend) {
                int len;
		int old_len = slc_replyp - slc_reply;
		unsigned char *p;

                len = old_len
			+ (want_len / SLC_REPLY_SIZE + 1) * SLC_REPLY_SIZE;
                p = (unsigned char *)realloc(slc_reply, len);
                if (p == NULL)
                        free(slc_reply);
                slc_reply = p;
                if (slc_reply == NULL) {
/*@*/                   printf("slc_add_reply: realloc() failed!!!\n");
                        slc_reply = slc_replyp = slc_replyend = NULL;
                        return 1;
                }
                slc_replyp = slc_reply + old_len;
                slc_replyend = slc_reply + len;
        }
	return 0;
}

	void
slc_add_reply(unsigned char func, unsigned char flags, cc_t value)
{
	if (slc_assure_buffer(6))
		return;

	if (slc_replyp == NULL)
		return;

	if ((*slc_replyp++ = func) == IAC)
		*slc_replyp++ = IAC;
	if ((*slc_replyp++ = flags) == IAC)

{
    int len;

    if (slc_assure_buffer(2))
	return;

    if (slc_replyp == NULL)
	return;

    *slc_replyp++ = IAC;
    *slc_replyp++ = SE;
    len = slc_replyp - slc_reply;

	}
}

#define	OPT_REPLY_SIZE	1024
unsigned char *opt_reply;
unsigned char *opt_replyp;
unsigned char *opt_replyend;

env_opt_start_info(void)
{
	env_opt_start();
	if (opt_replyp && (opt_replyp > opt_reply))
	    opt_replyp[-1] = TELQUAL_INFO;
}

static int
env_opt_assure_buffer(int want_len);

	static int
env_opt_assure_buffer(int want_len)
{
        if ((opt_replyp + want_len) >= opt_replyend) {
		int len;
		unsigned char *p;
		int old_len = opt_replyp - opt_reply;

		len = old_len
			+ (want_len / OPT_REPLY_SIZE + 1) * OPT_REPLY_SIZE;
		p = (unsigned char *)realloc(opt_reply, len);
		if (p == NULL)
			free(opt_reply);
		opt_reply = p;
		if (opt_reply == NULL) {
/*@*/			printf("env_opt_add: realloc() failed!!!\n");
			opt_reply = opt_replyp = opt_replyend = NULL;
			return 1;
		}
		opt_replyp = opt_reply + old_len;
		opt_replyend = opt_reply + len;
	}
	return 0;
}

	void
env_opt_add(unsigned char *ep)
{

		return;
	}
	vp = env_getvalue(ep, 1);

	/* use the double length in case it gots escaped */
	if (env_opt_assure_buffer((vp ? strlen((char *)vp)*2 : 0) +
				strlen((char *)ep)*2 + 6))
		return;

		len = opt_replyend - opt_reply;
		p = (unsigned char *)realloc(opt_reply, len);
		if (p == NULL)
			free(opt_reply);
		opt_reply = p;
		if (opt_reply == NULL) {
/*@*/			printf("env_opt_add: realloc() failed!!!\n");
			opt_reply = opt_replyp = opt_replyend = NULL;
			return;
		}
		opt_replyp = opt_reply + len - (opt_replyend - opt_replyp);
		opt_replyend = opt_reply + len;
	}
	if (opt_welldefined((char *)ep))
#ifdef	OLD_ENVIRON
		if (telopt_environ == TELOPT_OLD_ENVIRON)

{
	int len;

        if (opt_reply == NULL)          /*XXX*/
                return;                 /*XXX*/


	len = opt_replyp - opt_reply + 2;
	if (emptyok || len > 6) {
		if (env_opt_assure_buffer(2))
			return;
		*opt_replyp++ = IAC;
		*opt_replyp++ = SE;
		if (NETROOM() > len) {

Return to bug 83596

Lines 1310-1331 Link Here

(-)netkit-telnet-0.17/telnet/telnet.c.CAN-2005-468_469 (-22 / +93 lines)
1310	}	1310	}
1311		1311
1312		1312
1313	unsigned char slc_reply[128];	1313	#define SLC_REPLY_SIZE 128
		1314	unsigned char *slc_reply;
1314	unsigned char *slc_replyp;	1315	unsigned char *slc_replyp;
		1316	unsigned char *slc_replyend;
1315		1317
1316	void	1318	void
1317	slc_start_reply(void)	1319	slc_start_reply(void)
1318	{	1320	{
		1321	slc_reply = (unsigned char *)malloc(SLC_REPLY_SIZE);
		1322	if (slc_reply == NULL) {
		1323	/@/ printf("slc_start_reply: malloc()/realloc() failed!!!\n");
		1324	slc_reply = slc_replyp = slc_replyend = NULL;
		1325	return;
		1326	}
		1327
1319	slc_replyp = slc_reply;	1328	slc_replyp = slc_reply;
		1329	slc_replyend = slc_reply + SLC_REPLY_SIZE;
1320	*slc_replyp++ = IAC;	1330	*slc_replyp++ = IAC;
1321	*slc_replyp++ = SB;	1331	*slc_replyp++ = SB;
1322	*slc_replyp++ = TELOPT_LINEMODE;	1332	*slc_replyp++ = TELOPT_LINEMODE;
1323	*slc_replyp++ = LM_SLC;	1333	*slc_replyp++ = LM_SLC;
1324	}	1334	}
1325		1335
		1336	static int
		1337	slc_assure_buffer(int want_len);
		1338
		1339	static int
		1340	slc_assure_buffer(int want_len)
		1341	{
		1342	if ((slc_replyp + want_len) >= slc_replyend) {
		1343	int len;
		1344	int old_len = slc_replyp - slc_reply;
		1345	unsigned char *p;
		1346
		1347	len = old_len
		1348	+ (want_len / SLC_REPLY_SIZE + 1) * SLC_REPLY_SIZE;
		1349	p = (unsigned char *)realloc(slc_reply, len);
		1350	if (p == NULL)
		1351	free(slc_reply);
		1352	slc_reply = p;
		1353	if (slc_reply == NULL) {
		1354	/@/ printf("slc_add_reply: realloc() failed!!!\n");
		1355	slc_reply = slc_replyp = slc_replyend = NULL;
		1356	return 1;
		1357	}
		1358	slc_replyp = slc_reply + old_len;
		1359	slc_replyend = slc_reply + len;
		1360	}
		1361	return 0;
		1362	}
		1363
1326	void	1364	void
1327	slc_add_reply(unsigned char func, unsigned char flags, cc_t value)	1365	slc_add_reply(unsigned char func, unsigned char flags, cc_t value)
1328	{	1366	{
		1367	if (slc_assure_buffer(6))
		1368	return;
		1369
		1370	if (slc_replyp == NULL)
		1371	return;
		1372
1329	if ((*slc_replyp++ = func) == IAC)	1373	if ((*slc_replyp++ = func) == IAC)
1330	*slc_replyp++ = IAC;	1374	*slc_replyp++ = IAC;
1331	if ((*slc_replyp++ = flags) == IAC)	1375	if ((*slc_replyp++ = flags) == IAC)
Lines 1339-1344 Link Here
1339	{	1383	{
1340	int len;	1384	int len;
1341		1385
		1386	if (slc_assure_buffer(2))
		1387	return;
		1388
		1389	if (slc_replyp == NULL)
		1390	return;
		1391
1342	*slc_replyp++ = IAC;	1392	*slc_replyp++ = IAC;
1343	*slc_replyp++ = SE;	1393	*slc_replyp++ = SE;
1344	len = slc_replyp - slc_reply;	1394	len = slc_replyp - slc_reply;
Lines 1456-1462 Link Here
1456	}	1506	}
1457	}	1507	}
1458		1508
1459	#define OPT_REPLY_SIZE 256	1509	#define OPT_REPLY_SIZE 1024
1460	unsigned char *opt_reply;	1510	unsigned char *opt_reply;
1461	unsigned char *opt_replyp;	1511	unsigned char *opt_replyp;
1462	unsigned char *opt_replyend;	1512	unsigned char *opt_replyend;
Lines 1490-1499 Link Here
1490	env_opt_start_info(void)	1540	env_opt_start_info(void)
1491	{	1541	{
1492	env_opt_start();	1542	env_opt_start();
1493	if (opt_replyp)	1543	if (opt_replyp && (opt_replyp > opt_reply))
1494	opt_replyp[-1] = TELQUAL_INFO;	1544	opt_replyp[-1] = TELQUAL_INFO;
1495	}	1545	}
1496		1546
		1547	static int
		1548	env_opt_assure_buffer(int want_len);
		1549
		1550	static int
		1551	env_opt_assure_buffer(int want_len)
		1552	{
		1553	if ((opt_replyp + want_len) >= opt_replyend) {
		1554	int len;
		1555	unsigned char *p;
		1556	int old_len = opt_replyp - opt_reply;
		1557
		1558	len = old_len
		1559	+ (want_len / OPT_REPLY_SIZE + 1) * OPT_REPLY_SIZE;
		1560	p = (unsigned char *)realloc(opt_reply, len);
		1561	if (p == NULL)
		1562	free(opt_reply);
		1563	opt_reply = p;
		1564	if (opt_reply == NULL) {
		1565	/@/ printf("env_opt_add: realloc() failed!!!\n");
		1566	opt_reply = opt_replyp = opt_replyend = NULL;
		1567	return 1;
		1568	}
		1569	opt_replyp = opt_reply + old_len;
		1570	opt_replyend = opt_reply + len;
		1571	}
		1572	return 0;
		1573	}
		1574
1497	void	1575	void
1498	env_opt_add(unsigned char *ep)	1576	env_opt_add(unsigned char *ep)
1499	{	1577	{
Lines 1515-1539 Link Here
1515	return;	1593	return;
1516	}	1594	}
1517	vp = env_getvalue(ep, 1);	1595	vp = env_getvalue(ep, 1);
1518	if (opt_replyp + (vp ? strlen((char *)vp) : 0) +	1596
1519	strlen((char *)ep) + 6 > opt_replyend)	1597	/* use the double length in case it gots escaped */
1520	{	1598	if (env_opt_assure_buffer((vp ? strlen((char )vp)2 : 0) +
1521	int len;	1599	strlen((char )ep)2 + 6))
1522	unsigned char *p;	1600	return;
1523	opt_replyend += OPT_REPLY_SIZE;	1601
1524	len = opt_replyend - opt_reply;
1525	p = (unsigned char *)realloc(opt_reply, len);
1526	if (p == NULL)
1527	free(opt_reply);
1528	opt_reply = p;
1529	if (opt_reply == NULL) {
1530	/@/ printf("env_opt_add: realloc() failed!!!\n");
1531	opt_reply = opt_replyp = opt_replyend = NULL;
1532	return;
1533	}
1534	opt_replyp = opt_reply + len - (opt_replyend - opt_replyp);
1535	opt_replyend = opt_reply + len;
1536	}
1537	if (opt_welldefined((char *)ep))	1602	if (opt_welldefined((char *)ep))
1538	#ifdef OLD_ENVIRON	1603	#ifdef OLD_ENVIRON
1539	if (telopt_environ == TELOPT_OLD_ENVIRON)	1604	if (telopt_environ == TELOPT_OLD_ENVIRON)
Lines 1588-1595 Link Here
1588	{	1653	{
1589	int len;	1654	int len;
1590		1655
		1656	if (opt_reply == NULL) /XXX/
		1657	return; /XXX/
		1658
		1659
1591	len = opt_replyp - opt_reply + 2;	1660	len = opt_replyp - opt_reply + 2;
1592	if (emptyok \|\| len > 6) {	1661	if (emptyok \|\| len > 6) {
		1662	if (env_opt_assure_buffer(2))
		1663	return;
1593	*opt_replyp++ = IAC;	1664	*opt_replyp++ = IAC;
1594	*opt_replyp++ = SE;	1665	*opt_replyp++ = SE;
1595	if (NETROOM() > len) {	1666	if (NETROOM() > len) {