telnetd: Validate key length prior to copying into a fixed buffer.

[dragonfly.git] / lib / libtelnet / encrypt.c

diff --git a/lib/libtelnet/encrypt.c b/lib/libtelnet/encrypt.c
index 8b5666d..49f513b 100644 (file)
--- a/lib/libtelnet/encrypt.c
+++ b/lib/libtelnet/encrypt.c
@@ -714,6 +714,9 @@ encrypt_keyid(struct key_info *kp, unsigned char *keyid, int len)
        int dir = kp->dir;
        int ret = 0;
 
+       if (len > MAXKEYLEN)
+               len = MAXKEYLEN;
+
        if (!(ep = (*kp->getcrypt)(*kp->modep))) {
                if (len == 0)
                        return;