Import openssh_7.6p1.orig.tar.gz

1 files changed, 10 insertions, 7 deletions

diff --git a/sshbuf.c b/sshbuf.c
index cbf7ed4a4..de783a363 100644
--- a/sshbuf.c
+++ b/sshbuf.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: sshbuf.c,v 1.8 2016/11/25 23:22:04 djm Exp $  */
+/*      $OpenBSD: sshbuf.c,v 1.11 2017/06/01 06:58:25 djm Exp $ */
 /*
  * Copyright (c) 2011 Damien Miller
  *
@@ -193,15 +193,16 @@ sshbuf_reset(struct sshbuf *buf)
                 buf->off = buf->size;
                 return;
         }
-        if (sshbuf_check_sanity(buf) == 0)
-                explicit_bzero(buf->d, buf->alloc);
+        (void) sshbuf_check_sanity(buf);
         buf->off = buf->size = 0;
         if (buf->alloc != SSHBUF_SIZE_INIT) {
-                if ((d = realloc(buf->d, SSHBUF_SIZE_INIT)) != NULL) {
+                if ((d = recallocarray(buf->d, buf->alloc, SSHBUF_SIZE_INIT,
+                    1)) != NULL) {
                         buf->cd = buf->d = d;
                         buf->alloc = SSHBUF_SIZE_INIT;
                 }
         }
+        explicit_bzero(buf->d, SSHBUF_SIZE_INIT);
 }
 
 size_t
@@ -253,9 +254,8 @@ sshbuf_set_max_size(struct sshbuf *buf, size_t max_size)
                         rlen = ROUNDUP(buf->size, SSHBUF_SIZE_INC);
                 if (rlen > max_size)
                         rlen = max_size;
-                explicit_bzero(buf->d + buf->size, buf->alloc - buf->size);
                 SSHBUF_DBG(("new alloc = %zu", rlen));
-                if ((dp = realloc(buf->d, rlen)) == NULL)
+                if ((dp = recallocarray(buf->d, buf->alloc, rlen, 1)) == NULL)
                         return SSH_ERR_ALLOC_FAIL;
                 buf->cd = buf->d = dp;
                 buf->alloc = rlen;
@@ -344,7 +344,7 @@ sshbuf_allocate(struct sshbuf *buf, size_t len)
         if (rlen > buf->max_size)
                 rlen = buf->alloc + need;
         SSHBUF_DBG(("adjusted rlen %zu", rlen));
-        if ((dp = realloc(buf->d, rlen)) == NULL) {
+        if ((dp = recallocarray(buf->d, buf->alloc, rlen, 1)) == NULL) {
                 SSHBUF_DBG(("realloc fail"));
                 return SSH_ERR_ALLOC_FAIL;
         }
@@ -391,6 +391,9 @@ sshbuf_consume(struct sshbuf *buf, size_t len)
         if (len > sshbuf_len(buf))
                 return SSH_ERR_MESSAGE_INCOMPLETE;
         buf->off += len;
+        /* deal with empty buffer */
+        if (buf->off == buf->size)
+                buf->off = buf->size = 0;
         SSHBUF_TELL("done");
         return 0;
 }