Ticket #55493: telnet_telnet.c.patch

telnet/telnet.c

@@ -830 +830 @@
  *              Linemode
  */
 
+/* enough to hold a DISPLAY that could theoretically be up to PATH_MAX long */
+#define TEMPBUFSIZE 1024
+
 static void
 suboption (void)
 {
@@ -848 +851 @@
       else
         {
           char *name;
-          unsigned char temp[50];
+          unsigned char temp[TEMPBUFSIZE];
           int len;
 
 #if defined TN3270
@@ -859 +862 @@
 #endif /* defined(TN3270) */
           name = gettermname ();
           len = strlen (name) + 4 + 2;
-          if (len < NETROOM ())
+          if (len < NETROOM () && len < TEMPBUFSIZE-1)
             {
               sprintf ((char *) temp, "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
                        TELQUAL_IS, name, IAC, SE);
@@ -880 +883 @@
       if (SB_GET () == TELQUAL_SEND)
         {
           long ospeed, ispeed;
-          unsigned char temp[50];
+          unsigned char temp[TEMPBUFSIZE];
           int len;
 
           TerminalSpeeds (&ispeed, &ospeed);
@@ -987 +990 @@
         return;
       if (SB_GET () == TELQUAL_SEND)
         {
-          unsigned char temp[50], *dp;
+          unsigned char temp[TEMPBUFSIZE], *dp;
           int len;
 
-          if ((dp = env_getvalue ("DISPLAY")) == NULL)
+          if ((dp = env_getvalue ("DISPLAY")) == NULL || strlen(dp) >= TEMPBUFSIZE)
             {
               /*
                * Something happened, we no longer have a DISPLAY