Github user mike-jumper commented on a diff in the pull request:
https://github.com/apache/guacamole-server/pull/198#discussion_r232440908
--- Diff: src/protocols/ssh/argv.c ---
@@ -0,0 +1,128 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+#include "config.h"
+#include "argv.h"
+#include "ssh.h"
+#include "terminal/terminal.h"
+
+#include <guacamole/protocol.h>
+#include <guacamole/socket.h>
+#include <guacamole/user.h>
+
+#include <stdlib.h>
+#include <string.h>
+
+/**
+ * The value or current status of a connection parameter received over an
+ * "argv" stream.
+ */
+typedef struct guac_ssh_argv {
+
+ /**
+ * Buffer space for containing the received argument value.
+ */
+ char buffer[16384];
+
+ /**
+ * The number of bytes received so far.
+ */
+ int length;
+
+} guac_ssh_argv;
+
+/**
+ * Handler for "blob" instructions which appends the data from received
blobs
+ * to the end of the in-progress argument value buffer.
+ *
+ * @see guac_user_blob_handler
+ */
+static int guac_ssh_argv_blob_handler(guac_user* user,
+ guac_stream* stream, void* data, int length) {
+
+ guac_ssh_argv* argv = (guac_ssh_argv*) stream->data;
+
+ /* Calculate buffer size remaining, including space for null
terminator,
+ * adjusting received length accordingly */
+ int remaining = sizeof(argv->buffer) - argv->length - 1;
+ if (length > remaining)
+ length = remaining;
+
+ /* Append received data to end of buffer */
+ memcpy(argv->buffer + argv->length, data, length);
+ argv->length += length;
+
+ return 0;
+
+}
+
+/**
+ * Handler for "end" instructions which applies the changes specified by
the
+ * argument value buffer associated with the stream.
+ *
+ * @see guac_user_end_handler
+ */
+static int guac_ssh_argv_end_handler(guac_user* user,
+ guac_stream* stream) {
+
+ guac_client* client = user->client;
+ guac_ssh_client* telnet_client = (guac_ssh_client*) client->data;
+ guac_terminal* terminal = telnet_client->term;
+
+ /* Append null terminator to value */
+ guac_ssh_argv* argv = (guac_ssh_argv*) stream->data;
+ argv->buffer[argv->length] = '\0';
--- End diff --
Good question. It's effectively checked in the handling of each received
blob, where it's also critical that the buffer not be overrun. In this case,
`argv->length` is guaranteed to be no greater than `sizeof(argv->buffer) - 1`
thanks to:
https://github.com/apache/guacamole-server/blob/f293c5e9c076d583f2f513a7673928da4395814c/src/protocols/ssh/argv.c#L61-L69
---
