diff -up netkit-telnet-0.17/telnetd/utility.c.orig netkit-telnet-0.17/telnetd/utility.c

--- netkit-telnet-0.17/telnetd/utility.c.orig	2020-03-25 11:53:56.772624325 +0100

+++ netkit-telnet-0.17/telnetd/utility.c	2020-03-25 11:54:01.966601415 +0100

@@ -221,31 +221,38 @@ void 	ptyflush(void)

  */

 static

 char *

-nextitem(char *current)

+nextitem(char *current, const char *endp)

 {

+    if (current >= endp) {

+        return NULL;

+    }

     if ((*current&0xff) != IAC) {

 	return current+1;

     }

+    if (current+1 >= endp) {

+        return NULL;

+    }

     switch (*(current+1)&0xff) {

     case DO:

     case DONT:

     case WILL:

     case WONT:

-	return current+3;

+	return current+3 <= endp ? current+3 : NULL;

     case SB:		/* loop forever looking for the SE */

 	{

 	    register char *look = current+2;

-	    for (;;) {

+	    while (look < endp) {

 		if ((*look++&0xff) == IAC) {

-		    if ((*look++&0xff) == SE) {

+		    if (look < endp && (*look++&0xff) == SE) {

 			return look;

 		    }

 		}

 	    }

+	    return NULL;

 	}

     default:

-	return current+2;

+	return current+2 <= endp ? current+2 : NULL;

     }

 }  /* end of nextitem */

@@ -271,7 +278,7 @@ void netclear(void)

     register char *thisitem, *next;

     char *good;

 #define	wewant(p)	((nfrontp > p) && ((*p&0xff) == IAC) && \

-				((*(p+1)&0xff) != EC) && ((*(p+1)&0xff) != EL))

+				(nfrontp > p+1 && (((*(p+1)&0xff) != EC) && ((*(p+1)&0xff) != EL))))

 #if	defined(ENCRYPT)

     thisitem = nclearto > netobuf ? nclearto : netobuf;

@@ -279,7 +286,7 @@ void netclear(void)

     thisitem = netobuf;

 #endif

-    while ((next = nextitem(thisitem)) <= nbackp) {

+    while ((next = nextitem(thisitem, nbackp)) != NULL && next <= nbackp) {

 	thisitem = next;

     }

@@ -291,20 +298,23 @@ void netclear(void)

     good = netobuf;	/* where the good bytes go */

 #endif

-    while (nfrontp > thisitem) {

+    while (thisitem != NULL && nfrontp > thisitem) {

 	if (wewant(thisitem)) {

 	    int length;

 	    next = thisitem;

 	    do {

-		next = nextitem(next);

-	    } while (wewant(next) && (nfrontp > next));

+		next = nextitem(next, nfrontp);

+	    } while (next != NULL && wewant(next) && (nfrontp > next));

+	    if (next == NULL) {

+		next = nfrontp;

+	    }

 	    length = next-thisitem;

 	    bcopy(thisitem, good, length);

 	    good += length;

 	    thisitem = next;

 	} else {

-	    thisitem = nextitem(thisitem);

+	    thisitem = nextitem(thisitem, nfrontp);

 	}

     }