From b50f474940c999c825c02675506ef7f64c3364aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
Date: Sun, 16 Feb 2020 19:15:45 +0100
Subject: [PATCH 33/60] telnet: Fix silent truncation (off-by-one check)

If the DISPLAY variable had exactly 44 bytes, the SE
byte (end sub negotiation) was silently truncated.
---
 telnet/telnet.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/telnet/telnet.c b/telnet/telnet.c
index 574bef83..e35b04f2 100644
--- a/telnet/telnet.c
+++ b/telnet/telnet.c
@@ -1010,7 +1010,7 @@ suboption (void)
 	   * protocol must remain unsevered.  Check that DP fits in
 	   * full within TEMP.  Otherwise report buffer error.
 	   */
-	  if (strlen (dp) > sizeof (temp) - 4 - 2)
+	  if (strlen ((char *) dp) >= sizeof (temp) - 4 - 2)
 	    {
 	      printf ("lm_will: not enough room in buffer\n");
 	      break;
-- 
2.26.0.292.g33ef6b2f38

