 @@ -1,14 +1,14 @@
-/*	$NetBSD: telnet.c,v 1.36 2012/01/10 13:49:32 christos Exp $	*/
+/*	$NetBSD: telnet.c,v 1.36.20.1 2018/12/18 18:37:26 martin Exp $	*/
 /*
  * Copyright (c) 1988, 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
 @@ -24,27 +24,27 @@
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
 #ifndef lint
 #if 0
 static char sccsid[] = "@(#)telnet.c	8.4 (Berkeley) 5/30/95";
 #else
-__RCSID("$NetBSD: telnet.c,v 1.36 2012/01/10 13:49:32 christos Exp $");
+__RCSID("$NetBSD: telnet.c,v 1.36.20.1 2018/12/18 18:37:26 martin Exp $");
 #endif
 #endif /* not lint */
 #include <sys/param.h>
 #include <signal.h>
 #include <term.h>
 #include <unistd.h>
 /* By the way, we need to include curses.h before telnet.h since,
  * among other things, telnet.h #defines 'DO', which is a variable
  * declared in curses.h.
  */
 @@ -846,50 +846,50 @@ suboption(void)
 	} else {
 	    char *name;
 	    unsigned char temp[50];
 	    int len;
 #ifdef TN3270
 	    if (tn3270_ttype()) {
 		return;
+	    }
 #endif	/* defined(TN3270) */
 	    name = gettermname();
 	    len = strlen(name) + 4 + 2;
 	    if (len < NETROOM()) {
-		sprintf((char *)temp, "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
+		snprintf((char *)temp, sizeof(temp), "%c%c%c%c%s%c%c", IAC, SB,
-				TELQUAL_IS, name, IAC, SE);
+				TELOPT_TTYPE, TELQUAL_IS, name, IAC, SE);
 		ring_supply_data(&netoring, temp, len);
 		printsub('>', &temp[2], len-2);
 	    } else {
 		ExitString("No room in buffer for terminal type.\n", 1);
 		/*NOTREACHED*/
+	    }
+	}
 	break;
     case TELOPT_TSPEED:
 	if (my_want_state_is_wont(TELOPT_TSPEED))
 	    return;
 	if (SB_EOF())
 	    return;
 	if (SB_GET() == TELQUAL_SEND) {
 	    long osp, isp;
 	    unsigned char temp[50];
 	    int len;
 	    TerminalSpeeds(&isp, &osp);
-	    sprintf((char *)temp, "%c%c%c%c%ld,%ld%c%c", IAC, SB, TELOPT_TSPEED,
+	    snprintf((char *)temp, sizeof(temp), "%c%c%c%c%ld,%ld%c%c", IAC, SB,
-		    TELQUAL_IS, osp, isp, IAC, SE);
+		    TELOPT_TSPEED, TELQUAL_IS, osp, isp, IAC, SE);
 	    len = strlen((char *)temp+4) + 4;	/* temp[3] is 0 ... */
 	    if (len < NETROOM()) {
 		ring_supply_data(&netoring, temp, len);
 		printsub('>', temp+2, len - 2);
+	    }
 /*@*/	    else printf("lm_will: not enough room in buffer\n");
+	}
 	break;
     case TELOPT_LFLOW:
 	if (my_want_state_is_wont(TELOPT_LFLOW))
 	    return;
 	if (SB_EOF())
 @@ -973,28 +973,28 @@ suboption(void)
 	    return;
 	if (SB_GET() == TELQUAL_SEND) {
 	    unsigned char temp[50], *dp;
 	    int len;
 	    if ((dp = env_getvalue((const unsigned char *)"DISPLAY")) == NULL) {
 		/*
 		 * Something happened, we no longer have a DISPLAY
 		 * variable.  So, turn off the option.
 		 */
 		send_wont(TELOPT_XDISPLOC, 1);
 		break;
+	    }
-	    sprintf((char *)temp, "%c%c%c%c%s%c%c", IAC, SB, TELOPT_XDISPLOC,
+	    snprintf((char *)temp, sizeof(temp), "%c%c%c%c%s%c%c", IAC, SB,
-		    TELQUAL_IS, dp, IAC, SE);
+		    TELOPT_XDISPLOC, TELQUAL_IS, dp, IAC, SE);
 	    len = strlen((char *)temp+4) + 4;	/* temp[3] is 0 ... */
 	    if (len < NETROOM()) {
 		ring_supply_data(&netoring, temp, len);
 		printsub('>', temp+2, len - 2);
+	    }
 /*@*/	    else printf("lm_will: not enough room in buffer\n");
+	}
 	break;
 #ifdef AUTHENTICATION
 	case TELOPT_AUTHENTICATION: {
 		if (!autologin)

 @@ -1,14 +1,14 @@
-/*	$NetBSD: utilities.c,v 1.23 2012/01/09 16:08:55 christos Exp $	*/
+/*	$NetBSD: utilities.c,v 1.23.20.1 2018/12/18 18:37:26 martin Exp $	*/
 /*
  * Copyright (c) 1988, 1993
  *	The Regents of the University of California.  All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
 @@ -24,27 +24,27 @@
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
 #ifndef lint
 #if 0
 static char sccsid[] = "@(#)utilities.c	8.3 (Berkeley) 5/30/95";
 #else
-__RCSID("$NetBSD: utilities.c,v 1.23 2012/01/09 16:08:55 christos Exp $");
+__RCSID("$NetBSD: utilities.c,v 1.23.20.1 2018/12/18 18:37:26 martin Exp $");
 #endif
 #endif /* not lint */
 #define	TELOPTS
 #define	TELCMDS
 #define	SLC_NAMES
 #include <arpa/telnet.h>
 #include <sys/types.h>
 #include <sys/time.h>
 #include <sys/socket.h>
 #include <unistd.h>
 #include <poll.h>
 @@ -623,27 +623,27 @@ printsub(
+		}
 		for (; i < length; i++)
 		    fprintf(NetTrace, " ?%d?", pointer[i]);
 		break;
 	    case LM_MODE:
 		fprintf(NetTrace, "MODE ");
 		if (length < 3) {
 		    fprintf(NetTrace, "(no mode??\?)");
 		    break;
+		}
+		{
 		    char tbuf[64];
-		    sprintf(tbuf, "%s%s%s%s%s",
+		    snprintf(tbuf, sizeof(tbuf), "%s%s%s%s%s",
 			pointer[2]&MODE_EDIT ? "|EDIT" : "",
 			pointer[2]&MODE_TRAPSIG ? "|TRAPSIG" : "",
 			pointer[2]&MODE_SOFT_TAB ? "|SOFT_TAB" : "",
 			pointer[2]&MODE_LIT_ECHO ? "|LIT_ECHO" : "",
 			pointer[2]&MODE_ACK ? "|ACK" : "");
 		    fprintf(NetTrace, "%s", tbuf[1] ? &tbuf[1] : "0");
+		}
 		if (pointer[2]&~(MODE_MASK))
 		    fprintf(NetTrace, " (0x%x)", pointer[2]);
 		for (i = 3; i < length; i++)
 		    fprintf(NetTrace, " ?0x%x?", pointer[i]);
 		break;
 	    default: