- djm@cvs.openbsd.org 2011/12/07 05:44:38

     [auth2.c dh.c packet.c roaming.h roaming_client.c roaming_common.c]
     fix some harmless and/or unreachable int overflows;
     reported Xi Wang, ok markus@

1 files changed, 3 insertions, 1 deletions

diff --git a/roaming_common.c b/roaming_common.c
index 9adbe56fc..8d0b6054a 100644
--- a/roaming_common.c
+++ b/roaming_common.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: roaming_common.c,v 1.8 2010/01/12 00:59:29 djm Exp $ */
+/* $OpenBSD: roaming_common.c,v 1.9 2011/12/07 05:44:38 djm Exp $ */
 /*
  * Copyright (c) 2004-2009 AppGate Network Security AB
  *
@@ -75,6 +75,8 @@ get_recv_buf_size()
 void
 set_out_buffer_size(size_t size)
 {
+        if (size == 0 || size > MAX_ROAMBUF)
+                fatal("%s: bad buffer size %lu", __func__, (u_long)size);
         /*
          * The buffer size can only be set once and the buffer will live
          * as long as the session lives.