fix wrong decoding of the IAC escape char

telnet.h

@@ -20,6 +20,7 @@ typedef struct {
     srv_ms_f       *srv_ms;     /* Modem status from server */
 
     unsigned int    bytes_rx;   /* Rx byte count */
+    unsigned int    off_rx;     /* Rx buffer offset */
     unsigned char   mode_telnet;        /* Telnet mode */
     unsigned char   mode_rfc2217;       /* RFC-2217 mode */
     unsigned char   telnet_ack[256];    /* telnet option ack counter */

telnet_basic.c

@@ -132,7 +132,10 @@ int telnet_rx(tn_ctx_t * tcc, char *buf, size_t * plen)
     len = *plen;
     tcc->bytes_rx += len;
 
-    for (s = buf, rem = len; rem > 0; s = p)
+    if (len < (size_t)tcc->off_rx)
+        tcc->off_rx = 0;
+
+    for (s = buf + tcc->off_rx, rem = len - tcc->off_rx; rem > 0; s = p)
     {
         p = memchr(s, TNC_FF_IAC, rem);
         if (!p)
@@ -166,7 +169,7 @@ int telnet_rx(tn_ctx_t * tcc, char *buf, size_t * plen)
         case TNC_FD_DO:
         case TNC_FE_DONT:
             if (np < 3)
-                return 1;       /* Need more */
+                goto tn_more;           /* Need more */
             tcc->mode_telnet = 1;       /* Any such sequence activates TN */
             b2 = pu[2];
             if (b1 == TNC_FB_WILL)
@@ -192,7 +195,7 @@ int telnet_rx(tn_ctx_t * tcc, char *buf, size_t * plen)
                 }
             }
             if (np < 16)
-                return 1;       /* Not done */
+                goto tn_more; /* Not done */
             /* This does not look right */
             rem = 0;            /* Quit loop */
             break;
@@ -213,9 +216,15 @@ int telnet_rx(tn_ctx_t * tcc, char *buf, size_t * plen)
           tn_break:
             rem = 0;            /* Quit loop */
             break;
+
+          tn_more:             /* Request more data */
+            tcc->off_rx = len - np;
+            *plen = len;
+            return 1;
         }
     }
 
+    tcc->off_rx = 0;
     *plen = len;
 
     return 0;