The cmd byte prepended to outv can itself be IAC (0xFF), which
insert_IAC_escape_char doubles. Worst case is 2 (escaped cmd) +
2048 (escaped 1024 data bytes) + 2 (IAC+IAC_EOR trailer) = 2052. The old
size of 2051 could cause a 1-byte buffer overflow.
Fixes: 2dc95b4cac5e ("s390x/3270: 3270 data stream handling")
Reported-by: Pavee Hui <[email protected]>
Signed-off-by: Marc-André Lureau <[email protected]>
---
hw/char/terminal3270.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/hw/char/terminal3270.c b/hw/char/terminal3270.c
index 989b6f6ee1e0..8247a07a54e6 100644
--- a/hw/char/terminal3270.c
+++ b/hw/char/terminal3270.c
@@ -23,10 +23,10 @@
/* Enough spaces for different window sizes. */
#define INPUT_BUFFER_SIZE 1000
/*
- * 1 for header, 1024*2 for datastream, 2 for tail
+ * 1*2 for header, 1024*2 for datastream, 2 for tail
* Reserve enough spaces for telnet IAC escape.
*/
-#define OUTPUT_BUFFER_SIZE 2051
+#define OUTPUT_BUFFER_SIZE 2052
struct Terminal3270 {
EmulatedCcw3270Device cdev;
--
2.56.0.rc0.29.g47ce80527c56
