Commit 662fc625 authored by Marc Hoersken's avatar Marc Hoersken
Browse files

telnet.c: check sscanf results before passing them to snprintf

parent f9ffbfce

lib/telnet.c

+8 −7
Original line number Diff line number Diff line
@@ -932,8 +932,8 @@ static void suboption(struct connectdata *conn) 
  size_t len;

  size_t tmplen;

  int err;

  char varname[128];

  char varval[128];

  char varname[128] = "";

  char varval[128] = "";

  struct SessionHandle *data = conn->data;

  struct TELNET *tn = (struct TELNET *)data->req.protop;
@@ -973,13 +973,14 @@ static void suboption(struct connectdata *conn) 
        tmplen = (strlen(v->data) + 1);

        /* Add the variable only if it fits */

        if(len + tmplen < (int)sizeof(temp)-6) {

          sscanf(v->data, "%127[^,],%127s", varname, varval);

          if(sscanf(v->data, "%127[^,],%127s", varname, varval)) {

            snprintf((char *)&temp[len], sizeof(temp) - len,

                     "%c%s%c%s", CURL_NEW_ENV_VAR, varname,

                     CURL_NEW_ENV_VALUE, varval);

            len += tmplen;

          }

        }

      }

      snprintf((char *)&temp[len], sizeof(temp) - len,

               "%c%c", CURL_IAC, CURL_SE);

      len += 2;