diff options
| author | Nick Sayer <nsayer@FreeBSD.org> | 2001-05-16 18:27:09 +0000 |
|---|---|---|
| committer | Nick Sayer <nsayer@FreeBSD.org> | 2001-05-16 18:27:09 +0000 |
| commit | 60f581768d71a5fb42a4cd423e6541a7911b4c4c (patch) | |
| tree | 2e4f740a8459dbd1ecca0f0f3310af134a4a8598 /crypto | |
| parent | e7157113a9085da87ed83fd5f675100cecd57e51 (diff) | |
Notes
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/telnet/libtelnet/sra.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/crypto/telnet/libtelnet/sra.c b/crypto/telnet/libtelnet/sra.c index 0d494531e01f..a77b2f2495f5 100644 --- a/crypto/telnet/libtelnet/sra.c +++ b/crypto/telnet/libtelnet/sra.c @@ -90,9 +90,9 @@ int server; str_data[3] = TELQUAL_IS; user = (char *)malloc(256); - xuser = (char *)malloc(512); + xuser = (char *)malloc(513); pass = (char *)malloc(256); - xpass = (char *)malloc(512); + xpass = (char *)malloc(513); if (user == NULL || xuser == NULL || pass == NULL || xpass == NULL) @@ -158,6 +158,8 @@ int cnt; case SRA_USER: /* decode KAB(u) */ + if (cnt > 512) /* Attempted buffer overflow */ + break; memcpy(xuser,data,cnt); xuser[cnt] = '\0'; pk_decode(xuser,user,&ck); @@ -167,6 +169,8 @@ int cnt; break; case SRA_PASS: + if (cnt > 512) /* Attempted buffer overflow */ + break; /* decode KAB(P) */ memcpy(xpass,data,cnt); xpass[cnt] = '\0'; |