bug-inetutils
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH] telnet: Fix silent truncation (off-by-one check)


From: Mats Erik Andersson
Subject: Re: [PATCH] telnet: Fix silent truncation (off-by-one check)
Date: Fri, 21 Feb 2020 14:38:11 +0100
User-agent: Mutt/1.5.23 (2014-03-12)

Well done,

but DP must also be cast using `(char *)'. Otherwise compilation
grinds to a halt on `-Werror'. Please add this once your copyright
assignment goes through.

Regards,
  M E Andersson

Söndag den 16:e february 2020, klockan 19:26, skrev Tim Rühsen detta:
> If the DISPLAY variable had exactly 44 bytes, the SE
> byte (end sub negotiation) was silently truncated.
> ---
>  telnet/telnet.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/telnet/telnet.c b/telnet/telnet.c
> index 297ae0e4..9f8c871f 100644
> --- a/telnet/telnet.c
> +++ b/telnet/telnet.c
> @@ -1010,7 +1010,7 @@ suboption (void)
>          * protocol must remain unsevered.  Check that DP fits in
>          * full within TEMP.  Otherwise report buffer error.
>          */
> -       if (strlen (dp) > sizeof (temp) - 4 - 2)
> +       if (strlen (dp) >= sizeof (temp) - 4 - 2)
>           {
>             printf ("lm_will: not enough room in buffer\n");
>             break;



reply via email to

[Prev in Thread] Current Thread [Next in Thread]