From: Joshua Rogers <MegaManSec@users.noreply.github.com>
Date: Sun, 5 Oct 2025 02:57:29 +0000 (+0800)
Subject: telnet: use pointer[0] for "unknown" option instead of pointer[i]
X-Git-Tag: rc-8_17_0-1~136
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=eb8809270336225ef0266b01ca29191b88b1a3c7;p=thirdparty%2Fcurl.git

telnet: use pointer[0] for "unknown" option instead of pointer[i]

i is taken from pointer[length-2] (often the IAC byte) before we do
length -= 2, so using pointer[i] indexes an arbitrary/stale byte
unrelated to the option code. pointer[0] is the suboption’s option code
per the telnet SB format, so printing pointer[0] yields correct, stable
diagnostics.

Closes #18851
---

diff --git a/lib/telnet.c b/lib/telnet.c
index 66585d6f2a..ddc0b22cb6 100644
--- a/lib/telnet.c
+++ b/lib/telnet.c
@@ -732,7 +732,7 @@ static void printsub(struct Curl_easy *data,
       }
     }
     else
-      infof(data, "%d (unknown)", pointer[i]);
+      infof(data, "%d (unknown)", pointer[0]);
 
     switch(pointer[0]) {
     case CURL_TELOPT_NAWS: