d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

telnet: fix a couple of snprintf() buffer overflows

Browse Source 
Obtained from:	Juniper Networks
MFC after:	1 week
This commit is contained in:
Philip Paeps 2019-07-10 17:42:04 +00:00
parent e787ccc3f9
commit e68ce1cc10
3 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
contrib/telnet/telnet/commands.c
View File

@ -1655,10 +1655,11 @@ env_init(void)
char hbuf[256+1];
char *cp2 = strchr((char *)ep->value, ':');
gethostname(hbuf, 256);
hbuf[256] = '\0';
cp = (char *)malloc(strlen(hbuf) + strlen(cp2) + 1);
sprintf((char *)cp, "%s%s", hbuf, cp2);
gethostname(hbuf, sizeof(hbuf));
hbuf[sizeof(hbuf)-1] = '\0';
unsigned int buflen = strlen(hbuf) + strlen(cp2) + 1;
cp = (char *)malloc(sizeof(char)*buflen);
snprintf((char *)cp, buflen, "%s%s", hbuf, cp2);
free(ep->value);
ep->value = (unsigned char *)cp;
}

4
contrib/telnet/telnet/telnet.c
View File

@ -785,7 +785,7 @@ suboption(void)
name = gettermname();
len = strlen(name) + 4 + 2;
if (len < NETROOM()) {
sprintf(temp, "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
snprintf(temp, sizeof(temp), "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
TELQUAL_IS, name, IAC, SE);
ring_supply_data(&netoring, temp, len);
printsub('>', &temp[2], len-2);
@ -807,7 +807,7 @@ suboption(void)
TerminalSpeeds(&ispeed, &ospeed);
sprintf((char *)temp, "%c%c%c%c%ld,%ld%c%c", IAC, SB, TELOPT_TSPEED,
snprintf((char *)temp, sizeof(temp), "%c%c%c%c%ld,%ld%c%c", IAC, SB, TELOPT_TSPEED,
TELQUAL_IS, ospeed, ispeed, IAC, SE);
len = strlen((char *)temp+4) + 4; /* temp[3] is 0 ... */

2
contrib/telnet/telnet/utilities.c
View File

@ -629,7 +629,7 @@ printsub(char direction, unsigned char *pointer, int length)
}
{
char tbuf[64];
sprintf(tbuf, "%s%s%s%s%s",
snprintf(tbuf, sizeof(tbuf), "%s%s%s%s%s",
pointer[2]&MODE_EDIT ? "|EDIT" : "",
pointer[2]&MODE_TRAPSIG ? "|TRAPSIG" : "",
pointer[2]&MODE_SOFT_TAB ? "|SOFT_TAB" : "",