summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--channels.c12
1 files changed, 9 insertions, 3 deletions
diff --git a/channels.c b/channels.c
index ae248414b..fecd4540e 100644
--- a/channels.c
+++ b/channels.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: channels.c,v 1.354 2016/09/30 09:19:13 markus Exp $ */ 1/* $OpenBSD: channels.c,v 1.355 2016/09/30 20:24:46 djm Exp $ */
2/* 2/*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -2472,7 +2472,8 @@ channel_proxy_downstream(Channel *downstream)
2472 char *ctype = NULL, *listen_host = NULL; 2472 char *ctype = NULL, *listen_host = NULL;
2473 u_char type; 2473 u_char type;
2474 size_t have; 2474 size_t have;
2475 int ret = -1, r, id, remote_id, listen_port, idx; 2475 int ret = -1, r, idx;
2476 u_int id, remote_id, listen_port;
2476 2477
2477 /* sshbuf_dump(&downstream->input, stderr); */ 2478 /* sshbuf_dump(&downstream->input, stderr); */
2478 if ((r = sshbuf_get_string_direct(&downstream->input, &cp, &have)) 2479 if ((r = sshbuf_get_string_direct(&downstream->input, &cp, &have))
@@ -2563,6 +2564,11 @@ channel_proxy_downstream(Channel *downstream)
2563 error("%s: parse error %s", __func__, ssh_err(r)); 2564 error("%s: parse error %s", __func__, ssh_err(r));
2564 goto out; 2565 goto out;
2565 } 2566 }
2567 if (listen_port > 65535) {
2568 error("%s: tcpip-forward for %s: bad port %u",
2569 __func__, listen_host, listen_port);
2570 goto out;
2571 }
2566 /* Record that connection to this host/port is permitted. */ 2572 /* Record that connection to this host/port is permitted. */
2567 permitted_opens = xreallocarray(permitted_opens, 2573 permitted_opens = xreallocarray(permitted_opens,
2568 num_permitted_opens + 1, sizeof(*permitted_opens)); 2574 num_permitted_opens + 1, sizeof(*permitted_opens));
@@ -2570,7 +2576,7 @@ channel_proxy_downstream(Channel *downstream)
2570 permitted_opens[idx].host_to_connect = xstrdup("<mux>"); 2576 permitted_opens[idx].host_to_connect = xstrdup("<mux>");
2571 permitted_opens[idx].port_to_connect = -1; 2577 permitted_opens[idx].port_to_connect = -1;
2572 permitted_opens[idx].listen_host = listen_host; 2578 permitted_opens[idx].listen_host = listen_host;
2573 permitted_opens[idx].listen_port = listen_port; 2579 permitted_opens[idx].listen_port = (int)listen_port;
2574 permitted_opens[idx].downstream = downstream; 2580 permitted_opens[idx].downstream = downstream;
2575 listen_host = NULL; 2581 listen_host = NULL;
2576 break; 2582 break;