From: Daniel Stenberg <daniel@haxx.se>
Date: Thu, 24 Jun 2004 12:07:36 +0000 (+0000)
Subject: length limit the sscanf() parsing to prevent buffer overflow
X-Git-Tag: curl-7_12_1~204
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=62f04579610e3d34955331ed8f3b16bfdaa2fae1;p=thirdparty%2Fcurl.git

length limit the sscanf() parsing to prevent buffer overflow
---

diff --git a/lib/telnet.c b/lib/telnet.c
index 6915e601d6..aea4fdd823 100644
--- a/lib/telnet.c
+++ b/lib/telnet.c
@@ -878,7 +878,7 @@ static void suboption(struct connectdata *conn)
         tmplen = (strlen(v->data) + 1);
         /* Add the variable only if it fits */
         if(len + tmplen < (int)sizeof(temp)-6) {
-          sscanf(v->data, "%127[^,],%s", varname, varval);
+          sscanf(v->data, "%127[^,],%127s", varname, varval);
           snprintf((char *)&temp[len], sizeof(temp) - len,
                    "%c%s%c%s", CURL_NEW_ENV_VAR, varname,
                    CURL_NEW_ENV_VALUE, varval);