From 64d4a2a19c6631ef93067900215993fda06d0ce7 Mon Sep 17 00:00:00 2001
From: Simon Josefsson <simon@josefsson.org>
Date: Wed, 1 Jan 2020 15:28:54 +0100
Subject: [PATCH 29/60] telnet: Validate supplied environment variables.
 CVE-2019-0053

telnet/telnet.c (suboption): Use snprintf instead of sprintf.
telnet/utilities.c (printsub): Likewise.
---
 ChangeLog          | 6 ++++++
 telnet/telnet.c    | 6 +++---
 telnet/utilities.c | 2 +-
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index b877de19..5defbf12 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2020-01-01  Simon Josefsson  <simon@josefsson.org>
+
+	telnet: Validate supplied environment variables. CVE-2019-0053
+	* telnet/telnet.c (suboption): Use snprintf instead of sprintf.
+	* telnet/utilities.c (printsub): Likewise.
+
 2020-01-01  Simon Josefsson  <simon@josefsson.org>
 
 	* telnet/telnet.c (telsnd): Telnet -E(no escape) is treating
diff --git a/telnet/telnet.c b/telnet/telnet.c
index 97be8add..6e00513a 100644
--- a/telnet/telnet.c
+++ b/telnet/telnet.c
@@ -861,7 +861,7 @@ suboption (void)
 	  len = strlen (name) + 4 + 2;
 	  if (len < NETROOM ())
 	    {
-	      sprintf ((char *) temp, "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
+	      snprintf ((char *) temp, sizeof (temp), "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
 		       TELQUAL_IS, name, IAC, SE);
 	      ring_supply_data (&netoring, temp, len);
 	      printsub ('>', &temp[2], len - 2);
@@ -885,7 +885,7 @@ suboption (void)
 
 	  TerminalSpeeds (&ispeed, &ospeed);
 
-	  sprintf ((char *) temp, "%c%c%c%c%d,%d%c%c", IAC, SB, TELOPT_TSPEED,
+	  snprintf ((char *) temp, sizeof (temp), "%c%c%c%c%d,%d%c%c", IAC, SB, TELOPT_TSPEED,
 		   TELQUAL_IS, (int) ospeed, (int) ispeed, IAC, SE);
 	  len = strlen ((char *) temp + 4) + 4;	/* temp[3] is 0 ... */
 
@@ -999,7 +999,7 @@ suboption (void)
 	      send_wont (TELOPT_XDISPLOC, 1);
 	      break;
 	    }
-	  sprintf ((char *) temp, "%c%c%c%c%s%c%c", IAC, SB, TELOPT_XDISPLOC,
+	  snprintf ((char *) temp, sizeof (temp), "%c%c%c%c%s%c%c", IAC, SB, TELOPT_XDISPLOC,
 		   TELQUAL_IS, dp, IAC, SE);
 	  len = strlen ((char *) temp + 4) + 4;	/* temp[3] is 0 ... */
 
diff --git a/telnet/utilities.c b/telnet/utilities.c
index 7bd53967..195e90c4 100644
--- a/telnet/utilities.c
+++ b/telnet/utilities.c
@@ -732,7 +732,7 @@ printsub (char direction, unsigned char *pointer, int length)
 	      {
 		char tbuf[64];
 
-		sprintf (tbuf, "%s%s%s%s%s",
+		snprintf (tbuf, sizeof (tbuf), "%s%s%s%s%s",
 			 pointer[2] & MODE_EDIT ? "|EDIT" : "",
 			 pointer[2] & MODE_TRAPSIG ? "|TRAPSIG" : "",
 			 pointer[2] & MODE_SOFT_TAB ? "|SOFT_TAB" : "",
-- 
2.26.0.292.g33ef6b2f38

