Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
View | Details | Raw Unified | Return to bug 87145
Collapse All | Expand All

(-)krb5-1.3.6-orig/src/appl/telnet/telnet/telnet.c (-9 / +15 lines)
Lines 1475-1480 Link Here
1475
	unsigned char flags;
1475
	unsigned char flags;
1476
	cc_t value;
1476
	cc_t value;
1477
{
1477
{
1478
	if ((slc_replyp - slc_reply) + 6 > sizeof(slc_reply))
1479
               return;
1478
	if ((*slc_replyp++ = func) == IAC)
1480
	if ((*slc_replyp++ = func) == IAC)
1479
		*slc_replyp++ = IAC;
1481
		*slc_replyp++ = IAC;
1480
	if ((*slc_replyp++ = flags) == IAC)
1482
	if ((*slc_replyp++ = flags) == IAC)
Lines 1488-1498 Link Here
1488
{
1490
{
1489
    register int len;
1491
    register int len;
1490
1492
1491
    *slc_replyp++ = IAC;
1492
    *slc_replyp++ = SE;
1493
    len = slc_replyp - slc_reply;
1493
    len = slc_replyp - slc_reply;
1494
    if (len <= 6)
1494
    if (len <= 4 || (len + 2 > sizeof(slc_reply)))
1495
	return;
1495
	return;
1496
1497
    *slc_replyp++ = IAC;
1498
    *slc_replyp++ = SE;
1499
    len += 2;
1500
1496
    if (NETROOM() > len) {
1501
    if (NETROOM() > len) {
1497
	ring_supply_data(&netoring, slc_reply, slc_replyp - slc_reply);
1502
	ring_supply_data(&netoring, slc_reply, slc_replyp - slc_reply);
1498
	printsub('>', &slc_reply[2], slc_replyp - slc_reply - 2);
1503
	printsub('>', &slc_reply[2], slc_replyp - slc_reply - 2);
Lines 1645-1650 Link Here
1645
	register unsigned char *ep;
1650
	register unsigned char *ep;
1646
{
1651
{
1647
	register unsigned char *vp, c;
1652
	register unsigned char *vp, c;
1653
	unsigned int len, olen, elen;
1648
1654
1649
	if (opt_reply == NULL)		/*XXX*/
1655
	if (opt_reply == NULL)		/*XXX*/
1650
		return;			/*XXX*/
1656
		return;			/*XXX*/
Lines 1662-1680 Link Here
1662
		return;
1668
		return;
1663
	}
1669
	}
1664
	vp = env_getvalue(ep);
1670
	vp = env_getvalue(ep);
1665
	if (opt_replyp + (vp ? strlen((char *)vp) : 0) +
1671
	elen = 2 * (vp ? strlen((char *)vp) : 0) +
1666
				strlen((char *)ep) + 6 > opt_replyend)
1672
		      2 * strlen((char *)ep) + 6;
1673
	if ((opt_replyend - opt_replyp) < elen)
1667
	{
1674
	{
1668
		register unsigned int len;
1675
		len = opt_replyend - opt_reply + elen;
1669
		opt_replyend += OPT_REPLY_SIZE;
1676
		olen = opt_replyp - opt_reply;
1670
		len = opt_replyend - opt_reply;
1671
		opt_reply = (unsigned char *)realloc(opt_reply, len);
1677
		opt_reply = (unsigned char *)realloc(opt_reply, len);
1672
		if (opt_reply == NULL) {
1678
		if (opt_reply == NULL) {
1673
/*@*/			printf("env_opt_add: realloc() failed!!!\n");
1679
/*@*/			printf("env_opt_add: realloc() failed!!!\n");
1674
			opt_reply = opt_replyp = opt_replyend = NULL;
1680
			opt_reply = opt_replyp = opt_replyend = NULL;
1675
			return;
1681
			return;
1676
		}
1682
		}
1677
		opt_replyp = opt_reply + len - (opt_replyend - opt_replyp);
1683
		opt_replyp = opt_reply + olen;
1678
		opt_replyend = opt_reply + len;
1684
		opt_replyend = opt_reply + len;
1679
	}
1685
	}
1680
	if (opt_welldefined((char *) ep))
1686
	if (opt_welldefined((char *) ep))

Return to bug 87145