- markus@cvs.openbsd.org 2003/09/18 08:49:45

     [deattack.c misc.c session.c ssh-agent.c]
     more buffer allocation fixes; from Solar Designer; CAN-2003-0682;
     ok millert@

1 files changed, 9 insertions, 8 deletions

diff --git a/ssh-agent.c b/ssh-agent.c
index c05c61468..e1e6cae9b 100644
--- a/ssh-agent.c
+++ b/ssh-agent.c
@@ -35,7 +35,7 @@
 
 #include "includes.h"
 #include "openbsd-compat/sys-queue.h"
-RCSID("$OpenBSD: ssh-agent.c,v 1.111 2003/06/12 19:12:03 markus Exp $");
+RCSID("$OpenBSD: ssh-agent.c,v 1.112 2003/09/18 08:49:45 markus Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/md5.h>
@@ -784,7 +784,7 @@ process_message(SocketEntry *e)
 static void
 new_socket(sock_type type, int fd)
 {
-        u_int i, old_alloc;
+        u_int i, old_alloc, new_alloc;
 
         if (fcntl(fd, F_SETFL, O_NONBLOCK) < 0)
                 error("fcntl O_NONBLOCK: %s", strerror(errno));
@@ -795,25 +795,26 @@ new_socket(sock_type type, int fd)
         for (i = 0; i < sockets_alloc; i++)
                 if (sockets[i].type == AUTH_UNUSED) {
                         sockets[i].fd = fd;
-                        sockets[i].type = type;
                         buffer_init(&sockets[i].input);
                         buffer_init(&sockets[i].output);
                         buffer_init(&sockets[i].request);
+                        sockets[i].type = type;
                         return;
                 }
         old_alloc = sockets_alloc;
-        sockets_alloc += 10;
+        new_alloc = sockets_alloc + 10;
         if (sockets)
-                sockets = xrealloc(sockets, sockets_alloc * sizeof(sockets[0]));
+                sockets = xrealloc(sockets, new_alloc * sizeof(sockets[0]));
         else
-                sockets = xmalloc(sockets_alloc * sizeof(sockets[0]));
-        for (i = old_alloc; i < sockets_alloc; i++)
+                sockets = xmalloc(new_alloc * sizeof(sockets[0]));
+        for (i = old_alloc; i < new_alloc; i++)
                 sockets[i].type = AUTH_UNUSED;
-        sockets[old_alloc].type = type;
+        sockets_alloc = new_alloc;
         sockets[old_alloc].fd = fd;
         buffer_init(&sockets[old_alloc].input);
         buffer_init(&sockets[old_alloc].output);
         buffer_init(&sockets[old_alloc].request);
+        sockets[old_alloc].type = type;
 }
 
 static int