diff options
author | djm@openbsd.org <djm@openbsd.org> | 2015-06-30 05:25:07 +0000 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2015-06-30 16:12:20 +1000 |
commit | 629df770dbadc2accfbe1c81b3f31f876d0acd84 (patch) | |
tree | e56dd5ecd155755b92b4a45610057c1a9c6edd51 /channels.c | |
parent | f715afebe735d61df3fd30ad72d9ac1c8bd3b5f2 (diff) |
upstream commit
fatal() when a remote window update causes the window
value to overflow. Reported by Georg Wicherski, ok markus@
Upstream-ID: ead397a9aceb3bf74ebfa5fcaf259d72e569f351
Diffstat (limited to 'channels.c')
-rw-r--r-- | channels.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/channels.c b/channels.c index 8069cf1f9..3fe836aad 100644 --- a/channels.c +++ b/channels.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: channels.c,v 1.345 2015/06/30 05:23:25 djm Exp $ */ | 1 | /* $OpenBSD: channels.c,v 1.346 2015/06/30 05:25:07 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -2641,7 +2641,7 @@ channel_input_window_adjust(int type, u_int32_t seq, void *ctxt) | |||
2641 | { | 2641 | { |
2642 | Channel *c; | 2642 | Channel *c; |
2643 | int id; | 2643 | int id; |
2644 | u_int adjust; | 2644 | u_int adjust, tmp; |
2645 | 2645 | ||
2646 | if (!compat20) | 2646 | if (!compat20) |
2647 | return 0; | 2647 | return 0; |
@@ -2657,7 +2657,10 @@ channel_input_window_adjust(int type, u_int32_t seq, void *ctxt) | |||
2657 | adjust = packet_get_int(); | 2657 | adjust = packet_get_int(); |
2658 | packet_check_eom(); | 2658 | packet_check_eom(); |
2659 | debug2("channel %d: rcvd adjust %u", id, adjust); | 2659 | debug2("channel %d: rcvd adjust %u", id, adjust); |
2660 | c->remote_window += adjust; | 2660 | if ((tmp = c->remote_window + adjust) < c->remote_window) |
2661 | fatal("channel %d: adjust %u overflows remote window %u", | ||
2662 | id, adjust, c->remote_window); | ||
2663 | c->remote_window = tmp; | ||
2661 | return 0; | 2664 | return 0; |
2662 | } | 2665 | } |
2663 | 2666 | ||