mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Fable 5.1
c3e841003c
Tasks 3.3 and 4.1. - vfc curl and openssl-cve-2021-3449 excerpts re-harvested through the shared library: whole functions with upstream_start headers, the vendored key redacted code-safely, no truncated bodies. - vfc/recipes.toml carries mode, fix_path and function anchors; training/manifest.jsonl regenerated. - Juliet CWE-121 strcpy pair gets its buffer declarations back so the vulnerable side is a real overflow again. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
88 lines
3.0 KiB
C
88 lines
3.0 KiB
C
/* Provenance: curl/curl suboption (fixed).
|
|
* repo: curl/curl
|
|
* commit: 894f6ec730597eb243618d33cc84d71add8d6a8a
|
|
* parent: 12284e008bad5156b67d0ac253331a96d77201d1
|
|
* commit_url: https://github.com/curl/curl/commit/894f6ec730597eb243618d33cc84d71add8d6a8a
|
|
* cve: CVE-2021-22925
|
|
* license: curl
|
|
* function: suboption
|
|
* relpath: lib/telnet.c
|
|
* provenance: human
|
|
* mechanism: other
|
|
*/
|
|
|
|
static void suboption(struct Curl_easy *data)
|
|
{
|
|
struct curl_slist *v;
|
|
unsigned char temp[2048];
|
|
ssize_t bytes_written;
|
|
size_t len;
|
|
int err;
|
|
char varname[128] = "";
|
|
char varval[128] = "";
|
|
struct TELNET *tn = data->req.p.telnet;
|
|
struct connectdata *conn = data->conn;
|
|
|
|
printsub(data, '<', (unsigned char *)tn->subbuffer, CURL_SB_LEN(tn) + 2);
|
|
switch(CURL_SB_GET(tn)) {
|
|
case CURL_TELOPT_TTYPE:
|
|
len = strlen(tn->subopt_ttype) + 4 + 2;
|
|
msnprintf((char *)temp, sizeof(temp),
|
|
"%c%c%c%c%s%c%c", CURL_IAC, CURL_SB, CURL_TELOPT_TTYPE,
|
|
CURL_TELQUAL_IS, tn->subopt_ttype, CURL_IAC, CURL_SE);
|
|
bytes_written = swrite(conn->sock[FIRSTSOCKET], temp, len);
|
|
if(bytes_written < 0) {
|
|
err = SOCKERRNO;
|
|
failf(data,"Sending data failed (%d)",err);
|
|
}
|
|
printsub(data, '>', &temp[2], len-2);
|
|
break;
|
|
case CURL_TELOPT_XDISPLOC:
|
|
len = strlen(tn->subopt_xdisploc) + 4 + 2;
|
|
msnprintf((char *)temp, sizeof(temp),
|
|
"%c%c%c%c%s%c%c", CURL_IAC, CURL_SB, CURL_TELOPT_XDISPLOC,
|
|
CURL_TELQUAL_IS, tn->subopt_xdisploc, CURL_IAC, CURL_SE);
|
|
bytes_written = swrite(conn->sock[FIRSTSOCKET], temp, len);
|
|
if(bytes_written < 0) {
|
|
err = SOCKERRNO;
|
|
failf(data,"Sending data failed (%d)",err);
|
|
}
|
|
printsub(data, '>', &temp[2], len-2);
|
|
break;
|
|
case CURL_TELOPT_NEW_ENVIRON:
|
|
msnprintf((char *)temp, sizeof(temp),
|
|
"%c%c%c%c", CURL_IAC, CURL_SB, CURL_TELOPT_NEW_ENVIRON,
|
|
CURL_TELQUAL_IS);
|
|
len = 4;
|
|
|
|
for(v = tn->telnet_vars; v; v = v->next) {
|
|
size_t tmplen = (strlen(v->data) + 1);
|
|
/* Add the variable only if it fits */
|
|
if(len + tmplen < (int)sizeof(temp)-6) {
|
|
int rv;
|
|
char sep[2] = "";
|
|
varval[0] = 0;
|
|
rv = sscanf(v->data, "%127[^,]%1[,]%127s", varname, sep, varval);
|
|
if(rv == 1)
|
|
len += msnprintf((char *)&temp[len], sizeof(temp) - len,
|
|
"%c%s", CURL_NEW_ENV_VAR, varname);
|
|
else if(rv >= 2)
|
|
len += msnprintf((char *)&temp[len], sizeof(temp) - len,
|
|
"%c%s%c%s", CURL_NEW_ENV_VAR, varname,
|
|
CURL_NEW_ENV_VALUE, varval);
|
|
}
|
|
}
|
|
msnprintf((char *)&temp[len], sizeof(temp) - len,
|
|
"%c%c", CURL_IAC, CURL_SE);
|
|
len += 2;
|
|
bytes_written = swrite(conn->sock[FIRSTSOCKET], temp, len);
|
|
if(bytes_written < 0) {
|
|
err = SOCKERRNO;
|
|
failf(data,"Sending data failed (%d)",err);
|
|
}
|
|
printsub(data, '>', &temp[2], len-2);
|
|
break;
|
|
}
|
|
return;
|
|
}
|