Commit 62f04579 authored by Daniel Stenberg's avatar Daniel Stenberg
Browse files

length limit the sscanf() parsing to prevent buffer overflow

parent 8879b57b

lib/telnet.c

+1 −1
Original line number Diff line number Diff line
@@ -878,7 +878,7 @@ static void suboption(struct connectdata *conn) 
        tmplen = (strlen(v->data) + 1);

        /* Add the variable only if it fits */

        if(len + tmplen < (int)sizeof(temp)-6) {

          sscanf(v->data, "%127[^,],%s", varname, varval);

          sscanf(v->data, "%127[^,],%127s", varname, varval);

          snprintf((char *)&temp[len], sizeof(temp) - len,

                   "%c%s%c%s", CURL_NEW_ENV_VAR, varname,

                   CURL_NEW_ENV_VALUE, varval);