jimzah/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2024-11-30 08:43:23 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Fix CVE-2020-10188

Browse Source 
Reviewed by:		emaste
Obtained from:		NetBSD 6cc1539c8028b
MFC after:		3 days
Differential Revision:	https://reviews.freebsd.org/D36732
This commit is contained in:
Cy Schubert 2022-09-21 14:38:08 -07:00
parent ed5183455e
commit 5760cb266e
1 changed files with 21 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
contrib/telnet/telnetd/utility.c
View File

@ -147,31 +147,38 @@ ptyflush(void)
* character.
*/
static char *
nextitem(char *current)
nextitem(char *current, const char *endp)
{
if (current >= endp) {
return NULL;
}
if ((*current&0xff) != IAC) {
return current+1;
}
if (current+1 >= endp) {
return NULL;
}
switch (*(current+1)&0xff) {
case DO:
case DONT:
case WILL:
case WONT:
return current+3;
return current+3 <= endp ? current+3 : NULL;
case SB: /* loop forever looking for the SE */
{
char *look = current+2;
for (;;) {
while (look < endp) {
if ((*look++&0xff) == IAC) {
if ((*look++&0xff) == SE) {
if (look < endp && (*look++&0xff) == SE) {
return look;
}
}
}
return NULL;
}
default:
return current+2;
return current+2 <= endp ? current+2 : NULL;
}
} /* end of nextitem */
@ -197,7 +204,7 @@ netclear(void)
char *thisitem, *next;
char *good;
#define wewant(p) ((nfrontp > p) && ((*p&0xff) == IAC) && \
((*(p+1)&0xff) != EC) && ((*(p+1)&0xff) != EL))
(nfrontp > p+1) && ((*(p+1)&0xff) != EC) && ((*(p+1)&0xff) != EL))
#ifdef ENCRYPTION
thisitem = nclearto > netobuf ? nclearto : netobuf;
@ -205,7 +212,7 @@ netclear(void)
thisitem = netobuf;
#endif /* ENCRYPTION */
while ((next = nextitem(thisitem)) <= nbackp) {
while ((next = nextitem(thisitem, nbackp)) != NULL && (next <= nbackp)) {
thisitem = next;
}
@ -217,20 +224,23 @@ netclear(void)
good = netobuf; /* where the good bytes go */
#endif /* ENCRYPTION */
while (nfrontp > thisitem) {
while ((thisitem != NULL) && (nfrontp > thisitem)) {
if (wewant(thisitem)) {
int length;
next = thisitem;
do {
next = nextitem(next);
} while (wewant(next) && (nfrontp > next));
next = nextitem(next, nfrontp);
} while ((next != NULL) && wewant(next) && (nfrontp > next));
if (next == NULL) {
next = nfrontp;
}
length = next-thisitem;
memmove(good, thisitem, length);
good += length;
thisitem = next;
} else {
thisitem = nextitem(thisitem);
thisitem = nextitem(thisitem, nfrontp);
}
}