cli_clear_line: limit buffer usage to stay within the known size

1 files changed, 17 insertions, 15 deletions

diff --git a/libcli.c b/libcli.c
index 3e33bd2..cdf895c 100644
--- a/libcli.c
+++ b/libcli.c
@@ -802,23 +802,25 @@ out:
     return k;
 }
 
-static void cli_clear_line(struct cli_def *cli, struct cli_loop_ctx *ctx, char *cmd, int l, int cursor)
+static void cli_clear_line(struct cli_def *cli, struct cli_loop_ctx *ctx)
 {
     int i;
-    if (cursor < l)
+    if (ctx->cursor < ctx->l)
     {
-        for (i = 0; i < (l - cursor); i++)
+        for (i = 0; i < (ctx->l - ctx->cursor); i++)
 	  _write(cli, ctx, " ", 1);
     }
-    for (i = 0; i < l; i++)
-        cmd[i] = '\b';
-    for (; i < l * 2; i++)
-        cmd[i] = ' ';
-    for (; i < l * 3; i++)
-        cmd[i] = '\b';
-    _write(cli, ctx, cmd, i);
-    memset((char *)cmd, 0, i);
-    l = cursor = 0;
+    for (i = 0; i < ctx->l; i++)
+        ctx->cmd[i] = '\b';
+    _write(cli, ctx, ctx->cmd, i);
+    for (i = 0; i < ctx->l; i++)
+        ctx->cmd[i] = ' ';
+    _write(cli, ctx, ctx->cmd, i);
+    for (i = 0; i < ctx->l; i++)
+        ctx->cmd[i] = '\b';
+    _write(cli, ctx, ctx->cmd, i);
+    memset(ctx->cmd, 0, i);
+    ctx->l = ctx->cursor = 0;
 }
 
 void cli_reprompt(struct cli_def *cli)
@@ -1270,7 +1272,7 @@ int cli_loop_process_char(struct cli_def *cli, struct cli_loop_ctx *ctx, unsigne
 	if (cli->state == CLI_STATE_PASSWORD || cli->state == CLI_STATE_ENABLE_PASSWORD)
 	    memset(ctx->cmd, 0, ctx->l);
 	else
-	    cli_clear_line(cli, ctx, ctx->cmd, ctx->l, ctx->cursor);
+	    cli_clear_line(cli, ctx);
 
 	ctx->l = ctx->cursor = 0;
 	return CLI_LOOP_CTRL_CONTINUE;
@@ -1315,7 +1317,7 @@ int cli_loop_process_char(struct cli_def *cli, struct cli_loop_ctx *ctx, unsigne
     {
 	if (cli->mode != MODE_EXEC)
 	{
-	    cli_clear_line(cli, ctx, ctx->cmd, ctx->l, ctx->cursor);
+	    cli_clear_line(cli, ctx);
 	    cli_set_configmode(cli, MODE_EXEC, NULL);
 	    cli->showprompt = 1;
 	}
@@ -1431,7 +1433,7 @@ int cli_loop_process_char(struct cli_def *cli, struct cli_loop_ctx *ctx, unsigne
 	if (history_found && cli->history[ctx->in_history])
 	{
 	    // Show history item
-	    cli_clear_line(cli, ctx, ctx->cmd, ctx->l, ctx->cursor);
+	    cli_clear_line(cli, ctx);
 	    memset(ctx->cmd, 0, CLI_MAX_LINE_LENGTH);
 	    strncpy(ctx->cmd, cli->history[ctx->in_history], CLI_MAX_LINE_LENGTH - 1);
 	    /* cryptech: not sure if needed, but ensure we don't disclose memory after buf */