- deraadt@cvs.openbsd.org 2002/06/26 13:49:26

     [session.c]
     disclose less information from environment files; based on input
     from djm, and dschultz@uclink.Berkeley.EDU

1 files changed, 6 insertions, 2 deletions

diff --git a/session.c b/session.c
index 51c8a0ae4..747a00afa 100644
--- a/session.c
+++ b/session.c
@@ -33,7 +33,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: session.c,v 1.141 2002/06/26 08:58:26 markus Exp $");
+RCSID("$OpenBSD: session.c,v 1.142 2002/06/26 13:49:26 deraadt Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -877,12 +877,15 @@ read_environment_file(char ***env, u_int *envsize,
         FILE *f;
         char buf[4096];
         char *cp, *value;
+        u_int lineno = 0;
 
         f = fopen(filename, "r");
         if (!f)
                 return;
 
         while (fgets(buf, sizeof(buf), f)) {
+                if (++lineno > 1000)
+                        fatal("Too many lines in environment file %s", filename);
                 for (cp = buf; *cp == ' ' || *cp == '\t'; cp++)
                         ;
                 if (!*cp || *cp == '#' || *cp == '\n')
@@ -891,7 +894,8 @@ read_environment_file(char ***env, u_int *envsize,
                         *strchr(cp, '\n') = '\0';
                 value = strchr(cp, '=');
                 if (value == NULL) {
-                        fprintf(stderr, "Bad line in %.100s: %.200s\n", filename, buf);
+                        fprintf(stderr, "Bad line %u in %.100s\n", lineno,
+                            filename);
                         continue;
                 }
                 /*