- newest buffer overflow fix

Changed files:
    openssh-buffer_c_overflow.patch -> 1.1

diff --git a/openssh-buffer_c_overflow.patch b/openssh-buffer_c_overflow.patch
new file mode 100644 (file)
index 0000000..46213d9
--- /dev/null
+++ b/openssh-buffer_c_overflow.patch
@@ -0,0 +1,24 @@
+--- buffer.c~  Tue Sep 16 16:18:17 2003
++++ buffer.c   Tue Sep 16 16:26:59 2003
+@@ -69,6 +69,7 @@
+ void *
+ buffer_append_space(Buffer *buffer, u_int len)
+ {
++      u_int newlen;
+       void *p;
+ 
+       /* If the buffer is empty, start using it from the beginning. */
+@@ -95,8 +96,11 @@
+               goto restart;
+       }
+       /* Increase the size of the buffer and retry. */
+-      buffer->alloc += len + 32768;
+-      buffer->buf = xrealloc(buffer->buf, buffer->alloc);
++      newlen = buffer->alloc + len + 32768;
++      if (newlen > 0xa00000)
++              fatal("buffer_append_space: alloc %u not supported", newlen);
++      buffer->buf = xrealloc(buffer->buf, newlen);
++      buffer->alloc = newlen;
+       goto restart;
+       /* NOTREACHED */
+ }