From 96329fc2905244d8fdfaa008b35a94209f44523c Mon Sep 17 00:00:00 2001
From: Frank Rolsted Jensen <frj@thrane.eu>
Date: Thu, 6 Sep 2018 09:06:02 +0200
Subject: [PATCH] fix wrong decoding of the IAC escape char

---
 telnet.h       |  1 +
 telnet_basic.c | 15 ++++++++++++---
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/telnet.h b/telnet.h
index aa0aacc..4d49fab 100644
--- a/telnet.h
+++ b/telnet.h
@@ -20,6 +20,7 @@ typedef struct {
     srv_ms_f       *srv_ms;     /* Modem status from server */
 
     unsigned int    bytes_rx;   /* Rx byte count */
+    unsigned int    off_rx;     /* Rx buffer offset */
     unsigned char   mode_telnet;        /* Telnet mode */
     unsigned char   mode_rfc2217;       /* RFC-2217 mode */
     unsigned char   telnet_ack[256];    /* telnet option ack counter */
diff --git a/telnet_basic.c b/telnet_basic.c
index f798a3c..7c6aea4 100644
--- a/telnet_basic.c
+++ b/telnet_basic.c
@@ -132,7 +132,10 @@ int telnet_rx(tn_ctx_t * tcc, char *buf, size_t * plen)
     len = *plen;
     tcc->bytes_rx += len;
 
-    for (s = buf, rem = len; rem > 0; s = p)
+    if (len < (size_t)tcc->off_rx)
+        tcc->off_rx = 0;
+
+    for (s = buf + tcc->off_rx, rem = len - tcc->off_rx; rem > 0; s = p)
     {
         p = memchr(s, TNC_FF_IAC, rem);
         if (!p)
@@ -166,7 +169,7 @@ int telnet_rx(tn_ctx_t * tcc, char *buf, size_t * plen)
         case TNC_FD_DO:
         case TNC_FE_DONT:
             if (np < 3)
-                return 1;       /* Need more */
+                goto tn_more;           /* Need more */
             tcc->mode_telnet = 1;       /* Any such sequence activates TN */
             b2 = pu[2];
             if (b1 == TNC_FB_WILL)
@@ -192,7 +195,7 @@ int telnet_rx(tn_ctx_t * tcc, char *buf, size_t * plen)
                 }
             }
             if (np < 16)
-                return 1;       /* Not done */
+                goto tn_more; /* Not done */
             /* This does not look right */
             rem = 0;            /* Quit loop */
             break;
@@ -213,9 +216,15 @@ int telnet_rx(tn_ctx_t * tcc, char *buf, size_t * plen)
           tn_break:
             rem = 0;            /* Quit loop */
             break;
+
+          tn_more:             /* Request more data */
+            tcc->off_rx = len - np;
+            *plen = len;
+            return 1;
         }
     }
 
+    tcc->off_rx = 0;
     *plen = len;
 
     return 0;