1 files changed, 34 insertions, 13 deletions

diff --git a/src/appl/telnet/libtelnet/kerberos5.c b/src/appl/telnet/libtelnet/kerberos5.c
index 6a62f36..18356a5 100644
--- a/src/appl/telnet/libtelnet/kerberos5.c
+++ b/src/appl/telnet/libtelnet/kerberos5.c
@@ -95,7 +95,7 @@ void kerberos5_forward();
 
 #endif	/* FORWARD */
 
-static unsigned char str_data[2048] = { IAC, SB, TELOPT_AUTHENTICATION, 0,
+static unsigned char str_data[8192] = {IAC, SB, TELOPT_AUTHENTICATION, 0,
 			  		AUTHTYPE_KERBEROS_V5, };
 /*static unsigned char str_name[1024] = { IAC, SB, TELOPT_AUTHENTICATION,
 					TELQUAL_NAME, };*/
@@ -136,6 +136,7 @@ Data(ap, type, d, c)
 {
         unsigned char *p = str_data + 4;
 	unsigned char *cd = (unsigned char *)d;
+	size_t spaceleft = sizeof(str_data) - 4;
 
 	if (c == -1)
 		c = strlen((char *)cd);
@@ -151,9 +152,16 @@ Data(ap, type, d, c)
 	*p++ = ap->type;
 	*p++ = ap->way;
 	*p++ = type;
+	spaceleft -= 3;
         while (c-- > 0) {
-                if ((*p++ = *cd++) == IAC)
-                        *p++ = IAC;
+		if ((*p++ = *cd++) == IAC) {
+			*p++ = IAC;
+			spaceleft--;
+		}
+		if ((--spaceleft < 4) && c) {
+			errno = ENOMEM;
+			return -1;
+		}
         }
         *p++ = IAC;
         *p++ = SE;
@@ -423,7 +431,8 @@ kerberos5_is(ap, data, cnt)
 				    NULL, keytabid, NULL, &ticket);
 		if (r) {
 			(void) strcpy(errbuf, "krb5_rd_req failed: ");
-			(void) strcat(errbuf, error_message(r));
+			errbuf[sizeof(errbuf) - 1] = '\0';
+			(void) strncat(errbuf, error_message(r), sizeof(errbuf) - 1 - strlen(errbuf));
 			goto errout;
 		}
 
@@ -440,8 +449,12 @@ kerberos5_is(ap, data, cnt)
 		    princ[krb5_princ_component(telnet_context, 
 					       ticket->server,0)->length] = '\0';
 		    if (strcmp("host", princ)) {
-			(void) sprintf(errbuf, "incorrect service name: \"%s\" != \"%s\"",
-				       princ, "host");
+                        if(strlen(princ) < sizeof(errbuf) - 39) {
+                            (void) sprintf(errbuf, "incorrect service name: \"%s\" != \"host\"",
+                                           princ);
+                        } else {
+                            (void) sprintf(errbuf, "incorrect service name: principal != \"host\"");
+                        }
 			goto errout;
 		    }
 		} else {
@@ -455,7 +468,8 @@ kerberos5_is(ap, data, cnt)
 		if (r) {
 		    (void) strcpy(errbuf,
 				  "krb5_auth_con_getauthenticator failed: ");
-		    (void) strcat(errbuf, error_message(r));
+		    errbuf[sizeof(errbuf) - 1] = '\0';
+		    (void) strncat(errbuf, error_message(r), sizeof(errbuf) - 1 - strlen(errbuf));
 		    goto errout;
 		}
 		if ((ap->way & AUTH_ENCRYPT_MASK) == AUTH_ENCRYPT_ON &&
@@ -476,7 +490,8 @@ kerberos5_is(ap, data, cnt)
 					     &key);
 		    if (r) {
 			(void) strcpy(errbuf, "krb5_auth_con_getkey failed: ");
-			(void) strcat(errbuf, error_message(r));
+			errbuf[sizeof(errbuf) - 1] = '\0';
+			(void) strncat(errbuf, error_message(r), sizeof(errbuf) - 1 - strlen(errbuf));
 			goto errout;
 		    }
 		    r = krb5_verify_checksum(telnet_context,
@@ -495,7 +510,8 @@ kerberos5_is(ap, data, cnt)
 		    if (r) {
 			(void) strcpy(errbuf,
 				      "checksum verification failed: ");
-			(void) strcat(errbuf, error_message(r));
+		        errbuf[sizeof(errbuf) - 1] = '\0';
+			(void) strncat(errbuf, error_message(r), sizeof(errbuf) - 1 - strlen(errbuf));
 			goto errout;
 		    }
 		    krb5_free_keyblock(telnet_context, key);
@@ -506,7 +522,8 @@ kerberos5_is(ap, data, cnt)
 		    if ((r = krb5_mk_rep(telnet_context, auth_context,
 					 &outbuf))) {
 			(void) strcpy(errbuf, "Make reply failed: ");
-			(void) strcat(errbuf, error_message(r));
+		        errbuf[sizeof(errbuf) - 1] = '\0';
+			(void) strncat(errbuf, error_message(r), sizeof(errbuf) - 1 - strlen(errbuf));
 			goto errout;
 		    }
 
@@ -560,7 +577,8 @@ kerberos5_is(ap, data, cnt)
 		    char errbuf[128];
 		    
 		    (void) strcpy(errbuf, "Read forwarded creds failed: ");
-		    (void) strcat(errbuf, error_message(r));
+		    errbuf[sizeof(errbuf) - 1] = '\0';
+		    (void) strncat(errbuf, error_message(r), sizeof(errbuf) - 1 - strlen(errbuf));
 		    Data(ap, KRB_FORWARD_REJECT, errbuf, -1);
 		    if (auth_debug_mode)
 		      printf(
@@ -586,7 +604,8 @@ kerberos5_is(ap, data, cnt)
 	    char eerrbuf[329];
 
 	    strcpy(eerrbuf, "telnetd: ");
-	    strcat(eerrbuf, errbuf);
+	    eerrbuf[sizeof(eerrbuf) - 1] = '\0';
+	    strncat(eerrbuf, errbuf, sizeof(eerrbuf) - 1 - strlen(eerrbuf));
 	    Data(ap, KRB_REJECT, eerrbuf, -1);
 	}
 	if (auth_debug_mode)
@@ -706,7 +725,9 @@ kerberos5_status(ap, name, level)
 	    krb5_kuserok(telnet_context, ticket->enc_part2->client, 
 			 UserNameRequested))
 	{
-		strcpy(name, UserNameRequested);
+		/* the name buffer comes from telnetd/telnetd{-ktd}.c */
+		strncpy(name, UserNameRequested, 255);
+		name[255] = '\0';
 		return(AUTH_VALID);
 	} else
 		return(AUTH_USER);