From 662fc625177208896ce707c5e39ea58d9936cb84 Mon Sep 17 00:00:00 2001 From: Marc Hoersken Date: Sat, 19 Apr 2014 15:23:04 +0200 Subject: [PATCH] telnet.c: check sscanf results before passing them to snprintf --- lib/telnet.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/lib/telnet.c b/lib/telnet.c index f8946f494..1f03a00fc 100644 --- a/lib/telnet.c +++ b/lib/telnet.c @@ -932,8 +932,8 @@ static void suboption(struct connectdata *conn) size_t len; size_t tmplen; int err; - char varname[128]; - char varval[128]; + char varname[128] = ""; + char varval[128] = ""; struct SessionHandle *data = conn->data; struct TELNET *tn = (struct TELNET *)data->req.protop; @@ -973,11 +973,12 @@ static void suboption(struct connectdata *conn) tmplen = (strlen(v->data) + 1); /* Add the variable only if it fits */ if(len + tmplen < (int)sizeof(temp)-6) { - sscanf(v->data, "%127[^,],%127s", varname, varval); - snprintf((char *)&temp[len], sizeof(temp) - len, - "%c%s%c%s", CURL_NEW_ENV_VAR, varname, - CURL_NEW_ENV_VALUE, varval); - len += tmplen; + if(sscanf(v->data, "%127[^,],%127s", varname, varval)) { + snprintf((char *)&temp[len], sizeof(temp) - len, + "%c%s%c%s", CURL_NEW_ENV_VAR, varname, + CURL_NEW_ENV_VALUE, varval); + len += tmplen; + } } } snprintf((char *)&temp[len], sizeof(temp) - len,