d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix buffer overflow when DISPLAY is longer than 43 characters. This

Browse Source 
is not exploitable because telnet doesn't run with elevated privs.

Didn't fix all the other potential buffer overflows.  Would be a good
task for someone who has lots of time to carefully study each case
because cut and paste solutions are dangerous for this code base.

Added $FreeBSD$ in the same way that command.c did it.
This commit is contained in:
Warner Losh 2000-09-20 23:07:04 +00:00
parent 80d92dc27e
commit fbbed1ea76
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=66151
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
usr.bin/telnet/telnet.c
View File

@ -29,6 +29,8 @@
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* $FreeBSD$
*/
#ifndef lint
@ -946,16 +948,17 @@ suboption()
unsigned char temp[50], *dp;
int len;
if ((dp = env_getvalue((unsigned char *)"DISPLAY")) == NULL) {
if ((dp = env_getvalue((unsigned char *)"DISPLAY")) == NULL ||
strlen(dp) > sizeof(temp) - 7) {
/*
* Something happened, we no longer have a DISPLAY
* variable. So, turn off the option.
* variable. Or it is too long. So, turn off the option.
*/
send_wont(TELOPT_XDISPLOC, 1);
break;
}
sprintf((char *)temp, "%c%c%c%c%s%c%c", IAC, SB, TELOPT_XDISPLOC,
TELQUAL_IS, dp, IAC, SE);
snprintf((char *)temp, sizeof(temp), "%c%c%c%c%s%c%c", IAC, SB,
TELOPT_XDISPLOC, TELQUAL_IS, dp, IAC, SE);
len = strlen((char *)temp+4) + 4; /* temp[3] is 0 ... */
if (len < NETROOM()) {