git-market/curl-curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-04-11 12:01:42 +08:00
Code Issues Actions 14 Packages Projects Releases Wiki Activity

telnet: abort on bad suboption sequence

Browse Source 
Instead of trying to repair.

Reported-by: Huseyin Tintas

Closes #20108
This commit is contained in:
Daniel Stenberg 2025-12-29 10:11:20 +01:00
parent 7fc78c2c1c
commit bc9ab557df
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 5 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
lib/telnet.c
View File

@ -1124,7 +1124,6 @@ static CURLcode telrcv(struct Curl_easy *data,
break;
case CURL_TS_IAC:
process_iac:
DEBUGASSERT(startwrite < 0);
switch(c) {
case CURL_WILL:
@ -1197,24 +1196,12 @@ process_iac:
if(c != CURL_IAC) {
/*
* This is an error. We only expect to get "IAC IAC" or "IAC SE".
* Several things may have happened. An IAC was not doubled, the
* IAC SE was left off, or another option got inserted into the
* suboption are all possibilities. If we assume that the IAC was
* not doubled, and really the IAC SE was left off, we could get
* into an infinite loop here. So, instead, we terminate the
* suboption, and process the partial suboption if we can.
* Several things may have happened. An IAC was not doubled, the IAC
* SE was left off, or another option got inserted into the
* suboption are all possibilities.
*/
CURL_SB_ACCUM(tn, CURL_IAC);
CURL_SB_ACCUM(tn, c);
tn->subpointer -= 2;
CURL_SB_TERM(tn);
printoption(data, "In SUBOPTION processing, RCVD", CURL_IAC, c);
result = suboption(data, tn); /* handle sub-option */
if(result)
return result;
tn->telrcv_state = CURL_TS_IAC;
goto process_iac;
failf(data, "telnet: suboption error");
return CURLE_RECV_ERROR;
}
CURL_SB_ACCUM(tn, c);
tn->telrcv_state = CURL_TS_SB;