2 files changed, 11 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 8fa522ffb..af372d8f2 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -39,6 +39,9 @@
    - markus@cvs.openbsd.org 2002/06/26 08:53:12
      [bufaux.c]
      limit size of BNs to 8KB; ok provos/deraadt
+   - markus@cvs.openbsd.org 2002/06/26 08:54:18
+     [buffer.c]
+     limit append to 1MB and buffers to 10MB
 
 20020625
  - (stevesk) [INSTALL acconfig.h configure.ac defines.h] remove --with-rsh
@@ -1138,4 +1141,4 @@
  - (stevesk) entropy.c: typo in debug message
  - (djm) ssh-keygen -i needs seeded RNG; report from markus@
 
-$Id: ChangeLog,v 1.2290 2002/06/26 09:14:08 djm Exp $
+$Id: ChangeLog,v 1.2291 2002/06/26 09:14:25 djm Exp $
diff --git a/buffer.c b/buffer.c
index 40572e5ac..ad04b267e 100644
--- a/buffer.c
+++ b/buffer.c
@@ -12,7 +12,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: buffer.c,v 1.15 2002/01/18 18:14:17 stevesk Exp $");
+RCSID("$OpenBSD: buffer.c,v 1.16 2002/06/26 08:54:18 markus Exp $");
 
 #include "xmalloc.h"
 #include "buffer.h"
@@ -71,6 +71,9 @@ buffer_append_space(Buffer *buffer, u_int len)
 {
         void *p;
 
+        if (len > 0x100000)
+                fatal("buffer_append_space: len %u not supported", len);
+
         /* If the buffer is empty, start using it from the beginning. */
         if (buffer->offset == buffer->end) {
                 buffer->offset = 0;
@@ -96,6 +99,9 @@ restart:
         }
         /* Increase the size of the buffer and retry. */
         buffer->alloc += len + 32768;
+        if (buffer->alloc > 0xa00000)
+                fatal("buffer_append_space: alloc %u not supported",
+                    buffer->alloc);
         buffer->buf = xrealloc(buffer->buf, buffer->alloc);
         goto restart;
         /* NOTREACHED */