mirror of https://github.com/wolfSSL/wolfssh.git
4cb8d1ee99
The while loop condition only checked that the opcode byte was in bounds (idx < modesSz) but not the 4-byte argument read by ato32(). When modesSz had a remainder of 1 mod 5 and the trailing byte was a valid opcode (1-159) rather than TTY_OP_END, ato32() would read 4 bytes past the buffer. Change the loop guard to require a full TERMINAL_MODE_SZ bytes remaining before entering the loop body. |
||
|---|---|---|
| .. | ||
| agent.c | ||
| certman.c | ||
| include.am | ||
| internal.c | ||
| io.c | ||
| keygen.c | ||
| log.c | ||
| misc.c | ||
| port.c | ||
| ssh.c | ||
| wolfscp.c | ||
| wolfsftp.c | ||
| wolfterm.c | ||