Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bugzilla DB migration completed. Please report issues to Infra team via email via infra@gentoo.org or IRC
View | Details | Raw Unified | Return to bug 87019
Collapse All | Expand All

(-)telnet/telnet.c.orig (-5 / +25 lines)
Lines 1131-1136 Link Here
1131
1131
1132
1132
1133
unsigned char slc_reply[128];
1133
unsigned char slc_reply[128];
1134
unsigned char const * const slc_reply_eom = &slc_reply[sizeof(slc_reply)];
1134
unsigned char *slc_replyp;
1135
unsigned char *slc_replyp;
1135
1136
1136
	void
1137
	void
Lines 1146-1151 Link Here
1146
	void
1147
	void
1147
slc_add_reply(unsigned char func, unsigned char flags, cc_t value)
1148
slc_add_reply(unsigned char func, unsigned char flags, cc_t value)
1148
{
1149
{
1150
       /* A sequence of up to 6 bytes my be written for this member of the SLC
1151
        * suboption list by this function.  The end of negotiation command,
1152
        * which is written by slc_end_reply(), will require 2 additional
1153
        * bytes.  Do not proceed unless there is sufficient space for these
1154
        * items.
1155
        */
1156
	if (&slc_replyp[6+2] > slc_reply_eom)
1157
		return;
1149
	if ((*slc_replyp++ = func) == IAC)
1158
	if ((*slc_replyp++ = func) == IAC)
1150
		*slc_replyp++ = IAC;
1159
		*slc_replyp++ = IAC;
1151
	if ((*slc_replyp++ = flags) == IAC)
1160
	if ((*slc_replyp++ = flags) == IAC)
Lines 1159-1164 Link Here
1159
{
1168
{
1160
    int len;
1169
    int len;
1161
1170
1171
	/* The end of negotiation command requires 2 bytes. */
1172
	if (&slc_replyp[2] > slc_reply_eom)
1173
		return;
1174
1162
    *slc_replyp++ = IAC;
1175
    *slc_replyp++ = IAC;
1163
    *slc_replyp++ = SE;
1176
    *slc_replyp++ = SE;
1164
    len = slc_replyp - slc_reply;
1177
    len = slc_replyp - slc_reply;
Lines 1236-1243 Link Here
1236
	}
1249
	}
1237
}
1250
}
1238
1251
1239
#define	OPT_REPLY_SIZE	256
1252
#define	OPT_REPLY_SIZE	(2 * SUBBUFSIZE)
1240
unsigned char *opt_reply;
1253
unsigned char *opt_reply = NULL;
1241
unsigned char *opt_replyp;
1254
unsigned char *opt_replyp;
1242
unsigned char *opt_replyend;
1255
unsigned char *opt_replyend;
1243
1256
Lines 1298-1305 Link Here
1298
		return;
1311
		return;
1299
	}
1312
	}
1300
	vp = env_getvalue(ep);
1313
	vp = env_getvalue(ep);
1301
	if (opt_replyp + (vp ? strlen((char *)vp) : 0) +
1314
        if (opt_replyp + (vp ? 2 * strlen((char *)vp) : 0) +
1302
				strlen((char *)ep) + 6 > opt_replyend)
1315
                                2 * strlen((char *)ep) + 6 > opt_replyend)
1303
	{
1316
	{
1304
		int len;
1317
		int len;
1305
		unsigned char *p;
1318
		unsigned char *p;
Lines 1323-1328 Link Here
1323
		*opt_replyp++ = ENV_USERVAR;
1336
		*opt_replyp++ = ENV_USERVAR;
1324
	for (;;) {
1337
	for (;;) {
1325
		while ((c = *ep++)) {
1338
		while ((c = *ep++)) {
1339
			if (opt_replyp + (2 + 2) > opt_replyend)
1340
				return;
1326
			switch(c&0xff) {
1341
			switch(c&0xff) {
1327
			case IAC:
1342
			case IAC:
1328
				*opt_replyp++ = IAC;
1343
				*opt_replyp++ = IAC;
Lines 1337-1342 Link Here
1337
			*opt_replyp++ = c;
1352
			*opt_replyp++ = c;
1338
		}
1353
		}
1339
		if ((ep = vp)) {
1354
		if ((ep = vp)) {
1355
	                if (opt_replyp + (1 + 2 + 2) > opt_replyend)
1356
				return;
1340
		  *opt_replyp++ = ENV_VALUE;
1357
		  *opt_replyp++ = ENV_VALUE;
1341
		  vp = NULL;
1358
		  vp = NULL;
1342
		} else
1359
		} else
Lines 1361-1367 Link Here
1361
{
1378
{
1362
	int len;
1379
	int len;
1363
1380
1364
	len = opt_replyp - opt_reply + 2;
1381
	if (opt_replyp + 2 > opt_replyend)
1382
		return;
1383
	len = opt_replyp + 2 - opt_reply;
1384
1365
	if (emptyok || len > 6) {
1385
	if (emptyok || len > 6) {
1366
		*opt_replyp++ = IAC;
1386
		*opt_replyp++ = IAC;
1367
		*opt_replyp++ = SE;
1387
		*opt_replyp++ = SE;

Return to bug 87019