telnet: Prevent buffer overflow in the user prompt for SRA

[jhb]

Summary

The Secure RPC authenticator for telnet prompts the local user for the
username to use for authentication. Previously it was using sprintf()
into a buffer of 256 bytes, but the username received over the wire
can be up to 255 bytes long which would overflow the prompt buffer.
Fix this in two ways: First, use snprintf() and check for overflow.
If the prompt buffer overflows, fail authentication without prompting
the user. Second, add 10 bytes to the buffer size to account for the
overhead of the prompt so that a maximally sized username fits.

While here, replace a bare 255 in the subsequent telnet_gets call with
an expression using sizeof() the relevant buffer.

PR: 270263
Reported by: Robert Morris <[e-mail]>
Tested on: CHERI

[jlduran]

If the prompt buffer overflows, fail authentication without prompting the user.

$ USER=$(printf "%266s" | tr " " a) telnet localhost
Trying ::1...
Connected to localhost.
Escape character is '^]'.
Trying SRA secure login:

contrib/telnet/libtelnet/sra.c

244–245

Shouldn't it be + 9 here?

$ USER=$(printf "%256s" | tr " " a) telnet localhost
Trying ::1...
Connected to localhost.
Escape character is '^]'.
Trying SRA secure login:
User (aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa):

[jlduran]

In D49832#1136272, @jlduran wrote:

If the prompt buffer overflows, fail authentication without prompting the user.

$ USER=$(printf "%266s" | tr " " a) telnet localhost
Trying ::1...
Connected to localhost.
Escape character is '^]'.
Trying SRA secure login:

Sorry, this general comment should have been erased, it is another (different issue):

$ USER=$(printf "%266s" | tr " " a) telnet
telnet> toggle authdebug
auth debugging enabled
telnet> open localhost
Trying ::1...
Connected to localhost.
Escape character is '^]'.
>>>TELNET: I support auth type 2 2
>>>TELNET: I support auth type 2 0
>>>TELNET: I support auth type 6 0
>>>TELNET: auth_send got: 06 00
>>>TELNET: He supports 6
>>>TELNET: Trying 6 0
Sent PKA to server.
Trying SRA secure login:
>>>IS:0: [0] (48) 63 32 30 30 63 65 32 61 34 36 32 34 65 30 36 32
>>>TELNET: Using type 6
SRA user name too long

[jhb]

contrib/telnet/libtelnet/sra.c

244–245

Yes, I rounded up to + 10.