- deraadt@cvs.openbsd.org 2002/06/27 09:08:00

     [monitor.c]
     improve mm_zalloc check; markus ok

2 files changed, 6 insertions, 3 deletions

diff --git a/ChangeLog b/ChangeLog
index a258cc897..5b2d8477d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -6,6 +6,9 @@
    - markus@cvs.openbsd.org 2002/06/27 08:49:44
      [dh.c ssh-keyscan.c sshconnect.c]
      more checks for NULL pointers; from grendel@zeitbombe.org; ok deraadt@
+   - deraadt@cvs.openbsd.org 2002/06/27 09:08:00
+     [monitor.c]
+     improve mm_zalloc check; markus ok
 
 20020702
  - (djm) Use PAM_MSG_MEMBER for PAM_TEXT_INFO messages, use xmalloc & 
@@ -1214,4 +1217,4 @@
  - (stevesk) entropy.c: typo in debug message
  - (djm) ssh-keygen -i needs seeded RNG; report from markus@
 
-$Id: ChangeLog,v 1.2316 2002/07/04 00:03:56 mouring Exp $
+$Id: ChangeLog,v 1.2317 2002/07/04 00:05:06 mouring Exp $
diff --git a/monitor.c b/monitor.c
index 86562243d..1ac22782b 100644
--- a/monitor.c
+++ b/monitor.c
@@ -25,7 +25,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: monitor.c,v 1.19 2002/06/26 14:49:36 deraadt Exp $");
+RCSID("$OpenBSD: monitor.c,v 1.20 2002/06/27 09:08:00 deraadt Exp $");
 
 #include <openssl/dh.h>
 
@@ -1456,7 +1456,7 @@ mm_zalloc(struct mm_master *mm, u_int ncount, u_int size)
         int len = size * ncount;
         void *address;
 
-        if (len <= 0)
+        if (len <= 0 || size > 65535 || ncount > 65535)
                 fatal("%s: mm_zalloc(%u, %u)", __func__, ncount, size);
 
         address = mm_malloc(mm, len);