From 6864598a29b652a6b69a958f5cd1318aa2b258af Mon Sep 17 00:00:00 2001
From: Collin Funk <collin.funk1@gmail.com>
Date: Wed, 11 Mar 2026 23:06:46 -0700
Subject: [PATCH] telnetd: fix stack buffer overflow processing SLC suboption triplets

Previously a client could write past the end of an internal buffer using
an SLC suboption with many triplets using function octets greater than
18, possibly leading to remote code execution. Reported by Adiel Sol,
Arad Inbar, Erez Cohen, Nir Somech, Ben Grinberg, Daniel Lubel at DREAM
Security Research Team at:
<https://lists.gnu.org/r/bug-inetutils/2026-03/msg00031.html>.

* telnetd/slc.c (add_slc): Return early if writing the tuple would lead
us to writing past the end of the buffer.
* NEWS.md: Mention the fix.

Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/inetutils.git/commit/?id=6864598a29b652a6b69a958f5cd1318aa2b258af]
CVE: CVE-2026-32746
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
 telnetd/slc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/telnetd/slc.c b/telnetd/slc.c
index b3cc117..9d6bad1 100644
--- a/telnetd/slc.c
+++ b/telnetd/slc.c
@@ -162,6 +162,9 @@ get_slc_defaults (void)
 void
 add_slc (register char func, register char flag, register cc_t val)
 {
+  /* Do nothing if the entire triplet cannot fit in the buffer.  */
+  if (slcbuf + sizeof slcbuf - slcptr <= 6)
+    return;
 
   if ((*slcptr++ = (unsigned char) func) == 0xff)
     *slcptr++ = 0xff;
-- 
2.43.0

