diff options
| author | Tom Yu <tlyu@mit.edu> | 1997-04-10 04:06:02 +0000 |
|---|---|---|
| committer | Tom Yu <tlyu@mit.edu> | 1997-04-10 04:06:02 +0000 |
| commit | 06b82a7c7abc400d0c0c5366f7d20105a08dbc3f (patch) | |
| tree | 7c39af39679b2cc8a0c163c56a2625ed6c918f21 /src | |
| parent | ce1b214abb4b4bc51c7d2c25346bbe48c89cbf4b (diff) | |
| download | krb5-06b82a7c7abc400d0c0c5366f7d20105a08dbc3f.tar.gz krb5-06b82a7c7abc400d0c0c5366f7d20105a08dbc3f.tar.xz krb5-06b82a7c7abc400d0c0c5366f7d20105a08dbc3f.zip | |
* sys_term.c (start_login): Bounds check the constructed "speed"
passed in to login.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@10065 dc483132-0cff-0310-8789-dd5450dbe970
Diffstat (limited to 'src')
| -rw-r--r-- | src/appl/telnet/telnetd/ChangeLog | 5 | ||||
| -rw-r--r-- | src/appl/telnet/telnetd/sys_term.c | 10 |
2 files changed, 13 insertions, 2 deletions
diff --git a/src/appl/telnet/telnetd/ChangeLog b/src/appl/telnet/telnetd/ChangeLog index d64b94d87..b8fa48c52 100644 --- a/src/appl/telnet/telnetd/ChangeLog +++ b/src/appl/telnet/telnetd/ChangeLog @@ -1,3 +1,8 @@ +Wed Apr 9 23:46:40 1997 Tom Yu <tlyu@mit.edu> + + * sys_term.c (start_login): Bounds check the constructed "speed" + passed in to login. + Wed Feb 12 15:22:53 1997 Tom Yu <tlyu@voltage-multiplier.mit.edu> * configure.in: Fix DES425_DEPLIB diff --git a/src/appl/telnet/telnetd/sys_term.c b/src/appl/telnet/telnetd/sys_term.c index a7c7ee526..0e5def6b0 100644 --- a/src/appl/telnet/telnetd/sys_term.c +++ b/src/appl/telnet/telnetd/sys_term.c @@ -1289,7 +1289,7 @@ start_login(host, autologin, name) if (pty > 2) { register char *cp; - char speed[128]; + char speed[1024]; int isecho, israw, xpty, len; extern int def_rspeed; # ifndef LOGIN_HOST @@ -1326,7 +1326,13 @@ start_login(host, autologin, name) len = strlen(name)+1; write(xpty, name, len); write(xpty, name, len); - sprintf(speed, "%s/%d", (cp = getenv("TERM")) ? cp : "", + memset(speed, 0, sizeof(speed)); + strncpy(speed, + (cp = getenv("TERM")) ? cp : "", + sizeof(speed)-1-(10*sizeof(def_rspeed)/4)-1); + /* 1 for /, () for the number, 1 for trailing 0. */ + sprintf(speed + strlen(speed), + "/%d", (def_rspeed > 0) ? def_rspeed : 9600); len = strlen(speed)+1; write(xpty, speed, len); |