proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-08-09 16:13:51 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

2003-10-15 Jay Fenlason <fenlason@redhat.com>

Browse Source 
* lib/vty.c: (vty_telnet_option) Remote DoS exists if a telnet
          end-sub-negotation is sent when no sub-negotation data has been
          sent. Return immediately if no sub-negotation is in progress.
          (vty_read) do not attempt to process options if no sub-negotation
          is in progress.
This commit is contained in:
paul 2003-10-15 23:08:55 +00:00
parent 79ad27982a
commit 5b8c1b0d6a
1 changed files with 12 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
lib/vty.c
View File

@ -1140,15 +1140,18 @@ vty_telnet_option (struct vty *vty, unsigned char *buf, int nbytes)
break; break;
case SE: case SE:
{ {
char *buffer = (char *)vty->sb_buffer->head->data; char *buffer;
int length = vty->sb_buffer->length; int length;
if (buffer == NULL)
return 0;
if (!vty->iac_sb_in_progress) if (!vty->iac_sb_in_progress)
return 0; return 0;
buffer = (char *)vty->sb_buffer->head->data;
length = vty->sb_buffer->length;
if (buffer == NULL)
return 0;
if (buffer[0] == '\0') if (buffer[0] == '\0')
{ {
vty->iac_sb_in_progress = 0; vty->iac_sb_in_progress = 0;
@ -1251,7 +1254,6 @@ static int
vty_read (struct thread *thread) vty_read (struct thread *thread)
{ {
int i; int i;
int ret;
int nbytes; int nbytes;
unsigned char buf[VTY_READ_BUFSIZ]; unsigned char buf[VTY_READ_BUFSIZ];
@ -1288,12 +1290,15 @@ vty_read (struct thread *thread)
if (vty->iac) if (vty->iac)
{ {
/* In case of telnet command */ /* In case of telnet command */
ret = vty_telnet_option (vty, buf + i, nbytes - i); int ret = 0;
if (vty->iac_sb_in_progress)
ret = vty_telnet_option (vty, buf + i, nbytes - i);
vty->iac = 0; vty->iac = 0;
i += ret; i += ret;
continue; continue;
} }
if (vty->status == VTY_MORE) if (vty->status == VTY_MORE)
{ {
switch (buf[i]) switch (buf[i])