[bug-inetutils] Broken handling of TIOCPKT in telnetd

[Anders Grafström]

Handling of the TIOCPKT byte seems broken in telnetd.
TIOCPKT_DATA and several control status flags are
not caught. They pass straight through and show up in
the log file when a telnet session is logged.

With bash you could try this and check the log:
telnet localhost 2>&1 | tee log.txt
(The NULL bytes are TIOCPKT_DATA)

Here's a patch.

Index: inetutils/telnetd/telnetd.c
===================================================================
RCS file: /sources/inetutils/inetutils/telnetd/telnetd.c,v
retrieving revision 1.38
diff -u -r1.38 telnetd.c
--- inetutils/telnetd/telnetd.c 29 Jun 2007 16:29:29 -0000      1.38
+++ inetutils/telnetd/telnetd.c 19 Nov 2007 19:51:21 -0000
@@ -603,12 +603,12 @@
              pty_get_char (0);
              copy_termbuf ();
              localstat ();
+             goto tiocpkt_handled;
            }
 #endif
          if (c & TIOCPKT_FLUSHWRITE)
            {
              static char flushdata[] = { IAC, DM };
-             pty_get_char (0);
              netclear ();      /* clear buffer back */
              net_output_datalen (flushdata, sizeof (flushdata));
              set_neturg ();
@@ -625,10 +625,11 @@
                                   IAC, SB, TELOPT_LFLOW,
                                   flowmode ? LFLOW_ON : LFLOW_OFF, IAC, SE);
                }
-             pty_get_char (0);
            }

+         pty_get_char (0);
        }
+       tiocpkt_handled:

       while (pty_input_level () > 0)
        {