mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2025-04-12 16:20:35 +08:00
Code Issues Packages Projects Releases Wiki Activity

telnet: fix option parser to not send uninitialized contents

Browse Source 
CVS-2021-22925

Reported-by: Red Hat Product Security
Bug: https://curl.se/docs/CVE-2021-22925.html
This commit is contained in:
Daniel Stenberg 2021-06-12 18:25:15 +02:00
parent 12284e008b
commit 894f6ec730
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 11 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
lib/telnet.c
View File

@ -920,12 +920,17 @@ static void suboption(struct Curl_easy *data)
size_t tmplen = (strlen(v->data) + 1);
/* Add the variable only if it fits */
if(len + tmplen < (int)sizeof(temp)-6) {
if(sscanf(v->data, "%127[^,],%127s", varname, varval) == 2) {
msnprintf((char *)&temp[len], sizeof(temp) - len,
"%c%s%c%s", CURL_NEW_ENV_VAR, varname,
CURL_NEW_ENV_VALUE, varval);
len += tmplen;
}
int rv;
char sep[2] = "";
varval[0] = 0;
rv = sscanf(v->data, "%127[^,]%1[,]%127s", varname, sep, varval);
if(rv == 1)
len += msnprintf((char *)&temp[len], sizeof(temp) - len,
"%c%s", CURL_NEW_ENV_VAR, varname);
else if(rv >= 2)
len += msnprintf((char *)&temp[len], sizeof(temp) - len,
"%c%s%c%s", CURL_NEW_ENV_VAR, varname,
CURL_NEW_ENV_VALUE, varval);
}
}
msnprintf((char *)&temp[len], sizeof(temp) - len,