3 files changed, 46 insertions, 11 deletions

diff --git a/buffer.c b/buffer.c
index ad04b267e..3099234bd 100644
--- a/buffer.c
+++ b/buffer.c
@@ -12,7 +12,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: buffer.c,v 1.16 2002/06/26 08:54:18 markus Exp $");
+RCSID("$OpenBSD: buffer.c,v 1.18 2003/09/16 21:02:39 markus Exp $");
 
 #include "xmalloc.h"
 #include "buffer.h"
@@ -23,8 +23,11 @@ RCSID("$OpenBSD: buffer.c,v 1.16 2002/06/26 08:54:18 markus Exp $");
 void
 buffer_init(Buffer *buffer)
 {
-        buffer->alloc = 4096;
-        buffer->buf = xmalloc(buffer->alloc);
+        const u_int len = 4096;
+
+        buffer->alloc = 0;
+        buffer->buf = xmalloc(len);
+        buffer->alloc = len;
         buffer->offset = 0;
         buffer->end = 0;
 }
@@ -34,8 +37,10 @@ buffer_init(Buffer *buffer)
 void
 buffer_free(Buffer *buffer)
 {
-        memset(buffer->buf, 0, buffer->alloc);
-        xfree(buffer->buf);
+        if (buffer->alloc > 0) {
+                memset(buffer->buf, 0, buffer->alloc);
+                xfree(buffer->buf);
+        }
 }
 
 /*
@@ -69,6 +74,7 @@ buffer_append(Buffer *buffer, const void *data, u_int len)
 void *
 buffer_append_space(Buffer *buffer, u_int len)
 {
+        u_int newlen;
         void *p;
 
         if (len > 0x100000)
@@ -98,11 +104,12 @@ restart:
                 goto restart;
         }
         /* Increase the size of the buffer and retry. */
-        buffer->alloc += len + 32768;
-        if (buffer->alloc > 0xa00000)
+        newlen = buffer->alloc + len + 32768;
+        if (newlen > 0xa00000)
                 fatal("buffer_append_space: alloc %u not supported",
-                    buffer->alloc);
-        buffer->buf = xrealloc(buffer->buf, buffer->alloc);
+                    newlen);
+        buffer->buf = xrealloc(buffer->buf, newlen);
+        buffer->alloc = newlen;
         goto restart;
         /* NOTREACHED */
 }
diff --git a/channels.c b/channels.c
index 1937b0244..218744d1a 100644
--- a/channels.c
+++ b/channels.c
@@ -229,12 +229,13 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd,
         if (found == -1) {
                 /* There are no free slots.  Take last+1 slot and expand the array.  */
                 found = channels_alloc;
-                channels_alloc += 10;
                 if (channels_alloc > 10000)
                         fatal("channel_new: internal error: channels_alloc %d "
                             "too big.", channels_alloc);
+                channels = xrealloc(channels,
+                    (channels_alloc + 10) * sizeof(Channel *));
+                channels_alloc += 10;
                 debug2("channel: expanding %d", channels_alloc);
-                channels = xrealloc(channels, channels_alloc * sizeof(Channel *));
                 for (i = found; i < channels_alloc; i++)
                         channels[i] = NULL;
         }
diff --git a/debian/changelog b/debian/changelog
index 2799cfdd9..9a61869a6 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,30 @@
+openssh (1:3.6.1p2-8) unstable; urgency=high
+
+  * Merge more buffer allocation fixes from new upstream version 3.7.1p1
+    (closes: #211324).
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 17 Sep 2003 03:07:19 +0100
+
+openssh (1:3.6.1p2-7) unstable; urgency=high
+
+  * Update debconf template translations:
+    - French (thanks, Christian Perrier; closes: #208801).
+    - Japanese (thanks, Kenshi Muto; closes: #210380).
+  * Some small improvements to the English templates courtesy of Christian
+    Perrier. I've manually unfuzzied a few translations where it was
+    obvious, on Christian's advice, but the others will have to be updated.
+  * Document how to generate an RSA1 host key (closes: #141703).
+  * Incorporate NMU fix for early buffer expansion vulnerability,
+    CAN-2003-0693 (closes: #211205). Thanks to Michael Stone.
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 16 Sep 2003 14:32:28 +0100
+
+openssh (1:3.6.1p2-6.0) unstable; urgency=high
+
+  * SECURITY: fix for CAN-2003-0693, buffer allocation error
+
+ -- Michael Stone <mstone@debian.org>  Tue, 16 Sep 2003 08:27:07 -0400
+
 openssh (1:3.6.1p2-6) unstable; urgency=medium
 
   * Use a more CVS-friendly means of setting SSH_VERSION.