diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2004-06-24 12:07:36 +0000 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2004-06-24 12:07:36 +0000 |
| commit | 62f04579610e3d34955331ed8f3b16bfdaa2fae1 (patch) | |
| tree | 760436a64ecef41532a29b1e7468f43aa1e5dcbe /lib/telnet.c | |
| parent | 8879b57b733c384944d5bb4308dc8710554ed1bf (diff) | |
length limit the sscanf() parsing to prevent buffer overflow
Diffstat (limited to 'lib/telnet.c')
| -rw-r--r-- | lib/telnet.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/telnet.c b/lib/telnet.c index 6915e601d..aea4fdd82 100644 --- a/lib/telnet.c +++ b/lib/telnet.c @@ -878,7 +878,7 @@ static void suboption(struct connectdata *conn) tmplen = (strlen(v->data) + 1); /* Add the variable only if it fits */ if(len + tmplen < (int)sizeof(temp)-6) { - sscanf(v->data, "%127[^,],%s", varname, varval); + sscanf(v->data, "%127[^,],%127s", varname, varval); snprintf((char *)&temp[len], sizeof(temp) - len, "%c%s%c%s", CURL_NEW_ENV_VAR, varname, CURL_NEW_ENV_VALUE, varval); |