4 files changed, 21 insertions, 11 deletions

diff --git a/ChangeLog b/ChangeLog
index 71e501d00..440e56a17 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,9 @@
 20030917
  - (djm) Sync with V_3_7 branch
+ - (djm) OpenBSD Sync
+   - markus@cvs.openbsd.org 2003/09/16 21:02:40
+     [buffer.c channels.c version.h]
+     more malloc/fatal fixes; ok millert/deraadt; ghudson at MIT.EDU
 
 20030916
  - (dtucker) [acconfig.h configure.ac defines.h session.c] Bug #252: Retrieve
@@ -1108,4 +1112,4 @@
  - Fix sshd BindAddress and -b options for systems using fake-getaddrinfo.
    Report from murple@murple.net, diagnosis from dtucker@zip.com.au
 
-$Id: ChangeLog,v 1.2997 2003/09/16 21:24:25 djm Exp $
+$Id: ChangeLog,v 1.2998 2003/09/16 21:31:14 djm Exp $
diff --git a/buffer.c b/buffer.c
index 8ff8c2f48..aee293f8b 100644
--- a/buffer.c
+++ b/buffer.c
@@ -12,7 +12,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: buffer.c,v 1.17 2003/09/16 03:03:47 deraadt Exp $");
+RCSID("$OpenBSD: buffer.c,v 1.18 2003/09/16 21:02:39 markus Exp $");
 
 #include "xmalloc.h"
 #include "buffer.h"
@@ -23,8 +23,11 @@ RCSID("$OpenBSD: buffer.c,v 1.17 2003/09/16 03:03:47 deraadt Exp $");
 void
 buffer_init(Buffer *buffer)
 {
-        buffer->alloc = 4096;
-        buffer->buf = xmalloc(buffer->alloc);
+        const u_int len = 4096;
+
+        buffer->alloc = 0;
+        buffer->buf = xmalloc(len);
+        buffer->alloc = len;
         buffer->offset = 0;
         buffer->end = 0;
 }
@@ -34,8 +37,10 @@ buffer_init(Buffer *buffer)
 void
 buffer_free(Buffer *buffer)
 {
-        memset(buffer->buf, 0, buffer->alloc);
-        xfree(buffer->buf);
+        if (buffer->alloc > 0) {
+                memset(buffer->buf, 0, buffer->alloc);
+                xfree(buffer->buf);
+        }
 }
 
 /*
diff --git a/channels.c b/channels.c
index 65a6a7f00..3d75c8f2b 100644
--- a/channels.c
+++ b/channels.c
@@ -39,7 +39,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: channels.c,v 1.194 2003/08/29 10:04:36 markus Exp $");
+RCSID("$OpenBSD: channels.c,v 1.195 2003/09/16 21:02:40 markus Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -229,12 +229,13 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd,
         if (found == -1) {
                 /* There are no free slots.  Take last+1 slot and expand the array.  */
                 found = channels_alloc;
-                channels_alloc += 10;
                 if (channels_alloc > 10000)
                         fatal("channel_new: internal error: channels_alloc %d "
                             "too big.", channels_alloc);
+                channels = xrealloc(channels,
+                    (channels_alloc + 10) * sizeof(Channel *));
+                channels_alloc += 10;
                 debug2("channel: expanding %d", channels_alloc);
-                channels = xrealloc(channels, channels_alloc * sizeof(Channel *));
                 for (i = found; i < channels_alloc; i++)
                         channels[i] = NULL;
         }
diff --git a/version.h b/version.h
index 37e0c22ab..20daac42a 100644
--- a/version.h
+++ b/version.h
@@ -1,3 +1,3 @@
-/* $OpenBSD: version.h,v 1.37 2003/04/01 10:56:46 markus Exp $ */
+/* $OpenBSD: version.h,v 1.39 2003/09/16 21:02:40 markus Exp $ */
 
-#define SSH_VERSION    "OpenSSH_3.7p1"
+#define SSH_VERSION     "OpenSSH_3.7.1p1"