| From d52349fa1b6baac77ffa2c74769636aa2ece2ec5 Mon Sep 17 00:00:00 2001 |
| From: Erik Auerswald <auerswal@unix-ag.uni-kl.de> |
| Date: Sat, 3 Sep 2022 16:58:16 +0200 |
| Subject: [PATCH] telnetd: Handle early IAC EC or IAC EL receipt |
| |
| Fix telnetd crash if the first two bytes of a new connection |
| are 0xff 0xf7 (IAC EC) or 0xff 0xf8 (IAC EL). |
| |
| The problem was reported in: |
| <https://pierrekim.github.io/blog/2022-08-24-2-byte-dos-freebsd-netbsd-telnetd-netkit-telnetd-inetutils-telnetd-kerberos-telnetd.html>. |
| |
| * NEWS: Mention fix. |
| * telnetd/state.c (telrcv): Handle zero slctab[SLC_EC].sptr and |
| zero slctab[SLC_EL].sptr. |
| |
| CVE: CVE-2022-39028 |
| Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=fae8263e467380483c28513c0e5fac143e46f94f] |
| Signed-off-by: Khem Raj <raj.khem@gmail.com> |
| --- |
| telnetd/state.c | 12 +++++++++--- |
| 1 file changed, 9 insertions(+), 3 deletions(-) |
| |
| diff --git a/telnetd/state.c b/telnetd/state.c |
| index ffc6cba..c2d760f 100644 |
| --- a/telnetd/state.c |
| +++ b/telnetd/state.c |
| @@ -312,15 +312,21 @@ telrcv (void) |
| case EC: |
| case EL: |
| { |
| - cc_t ch; |
| + cc_t ch = (cc_t) (_POSIX_VDISABLE); |
| |
| DEBUG (debug_options, 1, printoption ("td: recv IAC", c)); |
| ptyflush (); /* half-hearted */ |
| init_termbuf (); |
| if (c == EC) |
| - ch = *slctab[SLC_EC].sptr; |
| + { |
| + if (slctab[SLC_EC].sptr) |
| + ch = *slctab[SLC_EC].sptr; |
| + } |
| else |
| - ch = *slctab[SLC_EL].sptr; |
| + { |
| + if (slctab[SLC_EL].sptr) |
| + ch = *slctab[SLC_EL].sptr; |
| + } |
| if (ch != (cc_t) (_POSIX_VDISABLE)) |
| pty_output_byte ((unsigned char) ch); |
| break; |
| -- |
| 2.37.3 |
| |