Don't assume that hp->h_lenght == 4. Be conservative in its use.

Submitted by:	 J. Assange a long time ago.

1 files changed, 10 insertions, 7 deletions

diff --git a/usr.bin/telnet/commands.c b/usr.bin/telnet/commands.c
index 0d190cb..c3e1f87 100644
--- a/usr.bin/telnet/commands.c
+++ b/usr.bin/telnet/commands.c
@@ -2201,9 +2201,11 @@ tn(argc, argv)
 		sin.sin_family = host->h_addrtype;
 #if	defined(h_addr)		/* In 4.3, this is a #define */
 		memmove((caddr_t)&sin.sin_addr,
-				host->h_addr_list[0], host->h_length);
+				host->h_addr_list[0], 
+				MIN(host->h_length, sizeof(sin.sin_addr)));
 #else	/* defined(h_addr) */
-		memmove((caddr_t)&sin.sin_addr, host->h_addr, host->h_length);
+		memmove((caddr_t)&sin.sin_addr, host->h_addr, 
+				MIN(host->h_length, sizeof(sin.sin_addr)));
 #endif	/* defined(h_addr) */
 		strncpy(_hostname, host->h_name, sizeof(_hostname));
 		_hostname[sizeof(_hostname)-1] = '\0';
@@ -2294,8 +2296,8 @@ tn(argc, argv)
 		errno = oerrno;
 		perror((char *)0);
 		host->h_addr_list++;
-		memcpy((caddr_t)&sin.sin_addr,
-			host->h_addr_list[0], host->h_length);
+		memcpy((caddr_t)&sin.sin_addr, host->h_addr_list[0], 
+				MIN(host->h_length, sizeof(sin.sin_addr)));
 		(void) NetClose(net);
 		continue;
 	    }
@@ -2779,10 +2781,11 @@ sourceroute(arg, cpp, lenp)
 			sin_addr.s_addr = tmp;
 		} else if (host = gethostbyname(cp)) {
 #if	defined(h_addr)
-			memcpy((caddr_t)&sin_addr,
-				host->h_addr_list[0], host->h_length);
+			memcpy((caddr_t)&sin_addr, host->h_addr_list[0], 
+					MIN(host->h_length,sizeof(sin_addr)));
 #else
-			memcpy((caddr_t)&sin_addr, host->h_addr, host->h_length);
+			memcpy((caddr_t)&sin_addr, host->h_addr, 
+					MIN(host->h_length,sizeof(sin_addr)));
 #endif
 		} else {
 			*cpp = cp;