From eb8809270336225ef0266b01ca29191b88b1a3c7 Mon Sep 17 00:00:00 2001 From: Joshua Rogers Date: Sun, 5 Oct 2025 10:57:29 +0800 Subject: [PATCH] telnet: use pointer[0] for "unknown" option instead of pointer[i] MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit i is taken from pointer[length-2] (often the IAC byte) before we do length -= 2, so using pointer[i] indexes an arbitrary/stale byte unrelated to the option code. pointer[0] is the suboption’s option code per the telnet SB format, so printing pointer[0] yields correct, stable diagnostics. Closes #18851 --- lib/telnet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/telnet.c b/lib/telnet.c index 66585d6f2a..ddc0b22cb6 100644 --- a/lib/telnet.c +++ b/lib/telnet.c @@ -732,7 +732,7 @@ static void printsub(struct Curl_easy *data, } } else - infof(data, "%d (unknown)", pointer[i]); + infof(data, "%d (unknown)", pointer[0]); switch(pointer[0]) { case CURL_TELOPT_NAWS: -- 2.47.3