Merge 4.0p1 to the trunk.

1 files changed, 5 insertions, 1 deletions

diff --git a/packet.c b/packet.c
index b062c0436..e2607b20f 100644
--- a/packet.c
+++ b/packet.c
@@ -37,7 +37,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: packet.c,v 1.115 2004/06/21 17:36:31 avsm Exp $");
+RCSID("$OpenBSD: packet.c,v 1.116 2004/10/20 11:48:53 markus Exp $");
 
 #include "openbsd-compat/sys-queue.h"
 
@@ -995,6 +995,8 @@ packet_read_poll1(void)
                     buffer_len(&compression_buffer));
         }
         type = buffer_get_char(&incoming_packet);
+        if (type < SSH_MSG_MIN || type > SSH_MSG_MAX)
+                packet_disconnect("Invalid ssh1 packet type: %d", type);
         return type;
 }
 
@@ -1107,6 +1109,8 @@ packet_read_poll2(u_int32_t *seqnr_p)
          * return length of payload (without type field)
          */
         type = buffer_get_char(&incoming_packet);
+        if (type < SSH2_MSG_MIN || type >= SSH2_MSG_LOCAL_MIN)
+                packet_disconnect("Invalid ssh2 packet type: %d", type);
         if (type == SSH2_MSG_NEWKEYS)
                 set_newkeys(MODE_IN);
 #ifdef PACKET_DEBUG