From d52349fa1b6baac77ffa2c74769636aa2ece2ec5 Mon Sep 17 00:00:00 2001
From: Erik Auerswald <auerswal@unix-ag.uni-kl.de>
Date: Sat, 3 Sep 2022 16:58:16 +0200
Subject: [PATCH] telnetd: Handle early IAC EC or IAC EL receipt

Fix telnetd crash if the first two bytes of a new connection
are 0xff 0xf7 (IAC EC) or 0xff 0xf8 (IAC EL).

The problem was reported in:
<https://pierrekim.github.io/blog/2022-08-24-2-byte-dos-freebsd-netbsd-telnetd-netkit-telnetd-inetutils-telnetd-kerberos-telnetd.html>.

* NEWS: Mention fix.
* telnetd/state.c (telrcv): Handle zero slctab[SLC_EC].sptr and
zero slctab[SLC_EL].sptr.

CVE: CVE-2022-39028
Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=fae8263e467380483c28513c0e5fac143e46f94f]
Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
 telnetd/state.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/telnetd/state.c b/telnetd/state.c
index ffc6cba..c2d760f 100644
--- a/telnetd/state.c
+++ b/telnetd/state.c
@@ -312,15 +312,21 @@ telrcv (void)
 	    case EC:
 	    case EL:
 	      {
-		cc_t ch;
+		cc_t ch = (cc_t) (_POSIX_VDISABLE);
 
 		DEBUG (debug_options, 1, printoption ("td: recv IAC", c));
 		ptyflush ();	/* half-hearted */
 		init_termbuf ();
 		if (c == EC)
-		  ch = *slctab[SLC_EC].sptr;
+		  {
+		    if (slctab[SLC_EC].sptr)
+		      ch = *slctab[SLC_EC].sptr;
+		  }
 		else
-		  ch = *slctab[SLC_EL].sptr;
+		  {
+		    if (slctab[SLC_EL].sptr)
+		      ch = *slctab[SLC_EL].sptr;
+		  }
 		if (ch != (cc_t) (_POSIX_VDISABLE))
 		  pty_output_byte ((unsigned char) ch);
 		break;
-- 
2.37.3