Merge even more buffer allocation fixes from upstream (CAN-2003-0682,

#211434).

1 files changed, 9 insertions, 7 deletions

diff --git a/session.c b/session.c
index c75fea966..ec4a23ac5 100644
--- a/session.c
+++ b/session.c
@@ -844,8 +844,9 @@ static void
 child_set_env(char ***envp, u_int *envsizep, const char *name,
         const char *value)
 {
-        u_int i, namelen;
         char **env;
+        u_int envsize;
+        u_int i, namelen;
 
         /*
          * Find the slot where the value should be stored.  If the variable
@@ -862,12 +863,13 @@ child_set_env(char ***envp, u_int *envsizep, const char *name,
                 xfree(env[i]);
         } else {
                 /* New variable.  Expand if necessary. */
-                if (i >= (*envsizep) - 1) {
-                        if (*envsizep >= 1000)
-                                fatal("child_set_env: too many env vars,"
-                                    " skipping: %.100s", name);
-                        (*envsizep) += 50;
-                        env = (*envp) = xrealloc(env, (*envsizep) * sizeof(char *));
+                envsize = *envsizep;
+                if (i >= envsize - 1) {
+                        if (envsize >= 1000)
+                                fatal("child_set_env: too many env vars");
+                        envsize += 50;
+                        env = (*envp) = xrealloc(env, envsize * sizeof(char *));
+                        *envsizep = envsize;
                 }
                 /* Need to set the NULL pointer at end of array beyond the new slot. */
                 env[i + 1] = NULL;