Fix handling of zero-length server banners (thanks, Tomas Mraz; closes:

#497026).

2 files changed, 5 insertions, 2 deletions

diff --git a/debian/changelog b/debian/changelog
index 925cb8a62..3702aaab2 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -5,6 +5,8 @@ openssh (1:5.1p1-3) UNRELEASED; urgency=low
   * Configure with --disable-strip; dh_strip will deal with stripping
     binaries and will honour DEB_BUILD_OPTIONS (thanks, Bernhard R. Link;
     closes: #498681).
+  * Fix handling of zero-length server banners (thanks, Tomas Mraz; closes:
+    #497026).
 
  -- Colin Watson <cjwatson@debian.org>  Mon, 25 Aug 2008 09:52:33 +0100
 
diff --git a/sshconnect2.c b/sshconnect2.c
index 18cbbd9f9..185e7b204 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -441,8 +441,9 @@ input_userauth_banner(int type, u_int32_t seq, void *ctxt)
         if (options.log_level >= SYSLOG_LEVEL_INFO) {
                 if (len > 65536)
                         len = 65536;
-                msg = xmalloc(len * 4); /* max expansion from strnvis() */
-                strnvis(msg, raw, len * 4, VIS_SAFE|VIS_OCTAL);
+                msg = xmalloc(len * 4 + 1); /* max expansion from strnvis() */
+                strnvis(msg, raw, len * 4 + 1, VIS_SAFE|VIS_OCTAL);
+                msg[len*4] = '\0';
                 fprintf(stderr, "%s", msg);
                 xfree(msg);
         }