diff options
author | ru <ru@FreeBSD.org> | 2001-07-20 12:02:30 +0000 |
---|---|---|
committer | ru <ru@FreeBSD.org> | 2001-07-20 12:02:30 +0000 |
commit | 4b023c5a9f160b15b1ae45ac500512e1209b8c02 (patch) | |
tree | 423ada7eed1633a885efca42128ef9d5203034c1 /crypto/telnet/libtelnet/auth.h | |
parent | 719efadfd6a1b229021ba4ba691e87765dea919b (diff) | |
download | FreeBSD-src-4b023c5a9f160b15b1ae45ac500512e1209b8c02.zip FreeBSD-src-4b023c5a9f160b15b1ae45ac500512e1209b8c02.tar.gz |
More potential buffer overflow fixes.
o Fixed `nfrontp' calculations in output_data(). If `remaining' is
initially zero, it was possible for `nfrontp' to be decremented.
Noticed by: dillon
o Replaced leaking writenet() with output_datalen():
: * writenet
: *
: * Just a handy little function to write a bit of raw data to the net.
: * It will force a transmit of the buffer if necessary
: *
: * arguments
: * ptr - A pointer to a character string to write
: * len - How many bytes to write
: */
: void
: writenet(ptr, len)
: register unsigned char *ptr;
: register int len;
: {
: /* flush buffer if no room for new data) */
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
: if ((&netobuf[BUFSIZ] - nfrontp) < len) {
: /* if this fails, don't worry, buffer is a little big */
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
: netflush();
: }
:
: memmove(nfrontp, ptr, len);
: nfrontp += len;
:
: } /* end of writenet */
What an irony! :-)
o Optimized output_datalen() a bit.
Diffstat (limited to 'crypto/telnet/libtelnet/auth.h')
0 files changed, 0 insertions, 0 deletions