- release 4

[packages/openssh.git] / openssh-buffer_c_overflow.patch

--- 1/buffer.c~	Tue Sep 16 16:18:17 2003
+++ 1/buffer.c	Tue Sep 16 16:26:59 2003
@@ -69,6 +69,7 @@
 void *
 buffer_append_space(Buffer *buffer, u_int len)
 {
+	u_int newlen;
 	void *p;
 
 	/* If the buffer is empty, start using it from the beginning. */
@@ -95,8 +96,11 @@
 		goto restart;
 	}
 	/* Increase the size of the buffer and retry. */
-	buffer->alloc += len + 32768;
-	buffer->buf = xrealloc(buffer->buf, buffer->alloc);
+	newlen = buffer->alloc + len + 32768;
+	if (newlen > 0xa00000)
+		fatal("buffer_append_space: alloc %u not supported", newlen);
+	buffer->buf = xrealloc(buffer->buf, newlen);
+	buffer->alloc = newlen;
 	goto restart;
 	/* NOTREACHED */
 }