import openssh-5.1p1-gsskex-cjwatson-20080722.patch

1 files changed, 30 insertions, 11 deletions

diff --git a/monitor_wrap.c b/monitor_wrap.c
index eff912562..b559c77bf 100644
--- a/monitor_wrap.c
+++ b/monitor_wrap.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor_wrap.c,v 1.57 2007/06/07 19:37:34 pvalchev Exp $ */
+/* $OpenBSD: monitor_wrap.c,v 1.63 2008/07/10 18:08:11 markus Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -41,6 +41,7 @@
 #include <openssl/bn.h>
 #include <openssl/dh.h>
 
+#include "openbsd-compat/sys-queue.h"
 #include "xmalloc.h"
 #include "ssh.h"
 #include "dh.h"
@@ -222,8 +223,8 @@ mm_getpwnamallow(const char *username)
         mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PWNAM, &m);
 
         if (buffer_get_char(&m) == 0) {
-                buffer_free(&m);
-                return (NULL);
+                pw = NULL;
+                goto out;
         }
         pw = buffer_get_string(&m, &len);
         if (len != sizeof(struct passwd))
@@ -237,6 +238,7 @@ mm_getpwnamallow(const char *username)
         pw->pw_dir = buffer_get_string(&m, NULL);
         pw->pw_shell = buffer_get_string(&m, NULL);
 
+out:
         /* copy options block as a Match directive may have changed some */
         newopts = buffer_get_string(&m, &len);
         if (len != sizeof(*newopts))
@@ -571,7 +573,7 @@ mm_send_keystate(struct monitor *monitor)
         u_char *blob, *p;
         u_int bloblen, plen;
         u_int32_t seqnr, packets;
-        u_int64_t blocks;
+        u_int64_t blocks, bytes;
 
         buffer_init(&m);
 
@@ -620,14 +622,16 @@ mm_send_keystate(struct monitor *monitor)
         buffer_put_string(&m, blob, bloblen);
         xfree(blob);
 
-        packet_get_state(MODE_OUT, &seqnr, &blocks, &packets);
+        packet_get_state(MODE_OUT, &seqnr, &blocks, &packets, &bytes);
         buffer_put_int(&m, seqnr);
         buffer_put_int64(&m, blocks);
         buffer_put_int(&m, packets);
-        packet_get_state(MODE_IN, &seqnr, &blocks, &packets);
+        buffer_put_int64(&m, bytes);
+        packet_get_state(MODE_IN, &seqnr, &blocks, &packets, &bytes);
         buffer_put_int(&m, seqnr);
         buffer_put_int64(&m, blocks);
         buffer_put_int(&m, packets);
+        buffer_put_int64(&m, bytes);
 
         debug3("%s: New keys have been sent", __func__);
  skip:
@@ -664,7 +668,20 @@ mm_pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, size_t namebuflen)
 {
         Buffer m;
         char *p, *msg;
-        int success = 0;
+        int success = 0, tmp1 = -1, tmp2 = -1;
+
+        /* Kludge: ensure there are fds free to receive the pty/tty */
+        if ((tmp1 = dup(pmonitor->m_recvfd)) == -1 ||
+            (tmp2 = dup(pmonitor->m_recvfd)) == -1) {
+                error("%s: cannot allocate fds for pty", __func__);
+                if (tmp1 > 0)
+                        close(tmp1);
+                if (tmp2 > 0)
+                        close(tmp2);
+                return 0;
+        }
+        close(tmp1);
+        close(tmp2);
 
         buffer_init(&m);
         mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PTY, &m);
@@ -688,8 +705,9 @@ mm_pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, size_t namebuflen)
         buffer_append(&loginmsg, msg, strlen(msg));
         xfree(msg);
 
-        *ptyfd = mm_receive_fd(pmonitor->m_recvfd);
-        *ttyfd = mm_receive_fd(pmonitor->m_recvfd);
+        if ((*ptyfd = mm_receive_fd(pmonitor->m_recvfd)) == -1 ||
+            (*ttyfd = mm_receive_fd(pmonitor->m_recvfd)) == -1)
+                fatal("%s: receive fds failed", __func__);
 
         /* Success */
         return (1);
@@ -708,8 +726,9 @@ mm_session_pty_cleanup2(Session *s)
         buffer_free(&m);
 
         /* closed dup'ed master */
-        if (close(s->ptymaster) < 0)
-                error("close(s->ptymaster): %s", strerror(errno));
+        if (s->ptymaster != -1 && close(s->ptymaster) < 0)
+                error("close(s->ptymaster/%d): %s",
+                    s->ptymaster, strerror(errno));
 
         /* unlink pty from session */
         s->ttyfd = -1;