From 38077f9b9d9e86f4a7d2317b3697ea4370889999 Mon Sep 17 00:00:00 2001 From: Dmitry Kozlov Date: Fri, 28 Jan 2011 22:29:40 +0300 Subject: cli: fixed buffer overflow in telnet part --- accel-pppd/cli/telnet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'accel-pppd/cli') diff --git a/accel-pppd/cli/telnet.c b/accel-pppd/cli/telnet.c index 7e48782d..82bcb0d4 100644 --- a/accel-pppd/cli/telnet.c +++ b/accel-pppd/cli/telnet.c @@ -297,7 +297,7 @@ static int telnet_input_char(struct telnet_client_t *cln, uint8_t c) return -1; } } else if (cln->cmdline_len) { - b = _malloc(sizeof(*b) + cln->cmdline_len); + b = _malloc(sizeof(*b) + cln->cmdline_len + 1); b->p_buf = NULL; memcpy(b->buf, cln->cmdline, cln->cmdline_len); b->size = cln->cmdline_len; @@ -708,7 +708,7 @@ static void load_history_file(void) return; while (fgets((char *)temp_buf, RECV_BUF_SIZE, f)) { - b = _malloc(sizeof(*b) + strlen((char *)temp_buf)); + b = _malloc(sizeof(*b) + strlen((char *)temp_buf) + 1); b->p_buf = NULL; b->size = strlen((char *)temp_buf) - 1; memcpy(b->buf, temp_buf, b->size); -- cgit v1.2.3