[src/trunk]: src/libexec/telnetd Fix CVE-2020-10188

[hgutch <hgutch%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/9b825f3c9497
branches:  trunk
changeset: 369646:9b825f3c9497
user:      hgutch <hgutch%NetBSD.org@localhost>
date:      Fri Aug 26 22:01:20 2022 +0000

description:
Fix CVE-2020-10188

diffstat:

 libexec/telnetd/utility.c |  38 ++++++++++++++++++++++++--------------
 1 files changed, 24 insertions(+), 14 deletions(-)

diffs (117 lines):

diff -r 2aa4a08bfd86 -r 9b825f3c9497 libexec/telnetd/utility.c
--- a/libexec/telnetd/utility.c Fri Aug 26 20:07:04 2022 +0000
+++ b/libexec/telnetd/utility.c Fri Aug 26 22:01:20 2022 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: utility.c,v 1.33 2019/02/04 04:36:41 mrg Exp $ */
+/*     $NetBSD: utility.c,v 1.34 2022/08/26 22:01:20 hgutch Exp $      */
 
 /*
  * Copyright (c) 1989, 1993
@@ -34,7 +34,7 @@
 #if 0
 static char sccsid[] = "@(#)utility.c  8.4 (Berkeley) 5/30/95";
 #else
-__RCSID("$NetBSD: utility.c,v 1.33 2019/02/04 04:36:41 mrg Exp $");
+__RCSID("$NetBSD: utility.c,v 1.34 2022/08/26 22:01:20 hgutch Exp $");
 #endif
 #endif /* not lint */
 
@@ -43,7 +43,7 @@
 #define PRINTOPTIONS
 #include "telnetd.h"
 
-char *nextitem(char *);
+char *nextitem(char *, const char *);
 void putstr(char *);
 
 extern int not42;
@@ -143,31 +143,38 @@
  * character.
  */
 char *
-nextitem(char *current)
+nextitem(char *current, const char *endp)
 {
+    if (current >= endp) {
+       return NULL;
+    }
     if ((*current&0xff) != IAC) {
        return current+1;
     }
+    if (current+1 >= endp) {
+       return NULL;
+    }
     switch (*(current+1)&0xff) {
     case DO:
     case DONT:
     case WILL:
     case WONT:
-       return current+3;
+       return current+3 <= endp ? current+3 : NULL;
     case SB:           /* loop forever looking for the SE */
        {
            char *look = current+2;
 
-           for (;;) {
+           while (look < endp) {
                if ((*look++&0xff) == IAC) {
-                   if ((*look++&0xff) == SE) {
+                   if (look < endp && (*look++&0xff) == SE) {
                        return look;
                    }
                }
            }
+           return NULL;
        }
     default:
-       return current+2;
+       return current+2 <= endp ? current+2 : NULL;
     }
 }  /* end of nextitem */
 
@@ -194,7 +201,7 @@
     char *thisitem, *next;
     char *good;
 #define        wewant(p)       ((nfrontp > p) && ((*p&0xff) == IAC) && \
-                               ((*(p+1)&0xff) != EC) && ((*(p+1)&0xff) != EL))
+                               (nfrontp > p+1) && ((*(p+1)&0xff) != EC) && ((*(p+1)&0xff) != EL))
 
 #ifdef ENCRYPTION
     thisitem = nclearto > netobuf ? nclearto : netobuf;
@@ -202,7 +209,7 @@
     thisitem = netobuf;
 #endif /* ENCRYPTION */
 
-    while ((next = nextitem(thisitem)) <= nbackp) {
+    while ((next = nextitem(thisitem, nbackp)) != NULL && (next <= nbackp)) {
        thisitem = next;
     }
 
@@ -214,20 +221,23 @@
     good = netobuf;    /* where the good bytes go */
 #endif /* ENCRYPTION */
 
-    while (nfrontp > thisitem) {
+    while ((thisitem != NULL) && (nfrontp > thisitem)) {
        if (wewant(thisitem)) {
            int length;
 
            next = thisitem;
            do {
-               next = nextitem(next);
-           } while (wewant(next) && (nfrontp > next));
+               next = nextitem(next, nfrontp);
+           } while ((next != NULL) && wewant(next) && (nfrontp > next));
+           if (next == NULL) {
+               next = nfrontp;
+           }
            length = next-thisitem;
            memmove(good, thisitem, length);
            good += length;
            thisitem = next;
        } else {
-           thisitem = nextitem(thisitem);
+           thisitem = nextitem(thisitem, nfrontp);
        }
     }