- djm@cvs.openbsd.org 2004/06/18 11:11:54

     [channels.c clientloop.c]
     Don't explode in clientloop when we receive a bogus channel id, but
     also don't generate them to begin with; ok markus@

3 files changed, 12 insertions, 7 deletions

diff --git a/ChangeLog b/ChangeLog
index adbb925ec..57dc1693a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -32,6 +32,10 @@
      [ssh.1 ssh.c]
      trim synopsis for -S, allow -S and -oControlMaster, -MM means 'ask';
      ok djm
+   - djm@cvs.openbsd.org 2004/06/18 11:11:54
+     [channels.c clientloop.c]
+     Don't explode in clientloop when we receive a bogus channel id, but
+     also don't generate them to begin with; ok markus@
 
 20040617
  - (dtucker) [regress/scp.sh] diff -N is not portable (but needed for some
@@ -1305,4 +1309,4 @@
    - (djm) Trim deprecated options from INSTALL. Mention UsePAM
    - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu
 
-$Id: ChangeLog,v 1.3413 2004/06/18 12:21:55 djm Exp $
+$Id: ChangeLog,v 1.3414 2004/06/18 12:23:22 djm Exp $
diff --git a/channels.c b/channels.c
index 97c1fd31b..68d854388 100644
--- a/channels.c
+++ b/channels.c
@@ -39,7 +39,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: channels.c,v 1.205 2004/06/14 01:44:38 djm Exp $");
+RCSID("$OpenBSD: channels.c,v 1.206 2004/06/18 11:11:54 djm Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -487,7 +487,7 @@ channel_find_open(void)
 
         for (i = 0; i < channels_alloc; i++) {
                 c = channels[i];
-                if (c == NULL)
+                if (c == NULL || c->remote_id < 0)
                         continue;
                 switch (c->type) {
                 case SSH_CHANNEL_CLOSED:
diff --git a/clientloop.c b/clientloop.c
index 8f2f270d7..79aabbe06 100644
--- a/clientloop.c
+++ b/clientloop.c
@@ -59,7 +59,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: clientloop.c,v 1.127 2004/06/17 15:10:13 djm Exp $");
+RCSID("$OpenBSD: clientloop.c,v 1.128 2004/06/18 11:11:54 djm Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -1626,8 +1626,9 @@ client_input_channel_req(int type, u_int32_t seq, void *ctxt)
         debug("client_input_channel_req: channel %d rtype %s reply %d",
             id, rtype, reply);
 
-        c = channel_lookup(id);
-        if (c == NULL) {
+        if (id == -1) {
+                error("client_input_channel_req: request for channel -1");
+        } else if ((c = channel_lookup(id)) == NULL) {
                 error("client_input_channel_req: channel %d: unknown channel", id);
         } else if (strcmp(rtype, "exit-status") == 0) {
                 exitval = packet_get_int();
@@ -1646,7 +1647,7 @@ client_input_channel_req(int type, u_int32_t seq, void *ctxt)
         if (reply) {
                 packet_start(success ?
                     SSH2_MSG_CHANNEL_SUCCESS : SSH2_MSG_CHANNEL_FAILURE);
-                packet_put_int(c->remote_id);
+                packet_put_int(id);
                 packet_send();
         }
         xfree(rtype);