6 files changed, 35 insertions, 21 deletions

diff --git a/buffer.c b/buffer.c
index 3099234bd..1627b1343 100644
--- a/buffer.c
+++ b/buffer.c
@@ -39,6 +39,7 @@ buffer_free(Buffer *buffer)
 {
         if (buffer->alloc > 0) {
                 memset(buffer->buf, 0, buffer->alloc);
+                buffer->alloc = 0;
                 xfree(buffer->buf);
         }
 }
diff --git a/deattack.c b/deattack.c
index 0442501e7..8b55d6686 100644
--- a/deattack.c
+++ b/deattack.c
@@ -18,7 +18,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: deattack.c,v 1.18 2002/03/04 17:27:39 stevesk Exp $");
+RCSID("$OpenBSD: deattack.c,v 1.19 2003/09/18 08:49:45 markus Exp $");
 
 #include "deattack.h"
 #include "log.h"
@@ -100,12 +100,12 @@ detect_attack(u_char *buf, u_int32_t len, u_char *IV)
 
         if (h == NULL) {
                 debug("Installing crc compensation attack detector.");
+                h = (u_int16_t *) xmalloc(l * HASH_ENTRYSIZE);
                 n = l;
-                h = (u_int16_t *) xmalloc(n * HASH_ENTRYSIZE);
         } else {
                 if (l > n) {
+                        h = (u_int16_t *) xrealloc(h, l * HASH_ENTRYSIZE);
                         n = l;
-                        h = (u_int16_t *) xrealloc(h, n * HASH_ENTRYSIZE);
                 }
         }
 
diff --git a/debian/changelog b/debian/changelog
index 9a61869a6..60844b097 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+openssh (1:3.6.1p2-9) unstable; urgency=high
+
+  * Merge even more buffer allocation fixes from upstream (CAN-2003-0682;
+    closes: #211434).
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 19 Sep 2003 10:25:25 +0100
+
 openssh (1:3.6.1p2-8) unstable; urgency=high
 
   * Merge more buffer allocation fixes from new upstream version 3.7.1p1
diff --git a/misc.c b/misc.c
index 512fb22fb..84c94f9b6 100644
--- a/misc.c
+++ b/misc.c
@@ -308,18 +308,21 @@ addargs(arglist *args, char *fmt, ...)
 {
         va_list ap;
         char buf[1024];
+        int nalloc;
 
         va_start(ap, fmt);
         vsnprintf(buf, sizeof(buf), fmt, ap);
         va_end(ap);
 
+        nalloc = args->nalloc;
         if (args->list == NULL) {
-                args->nalloc = 32;
+                nalloc = 32;
                 args->num = 0;
-        } else if (args->num+2 >= args->nalloc)
-                args->nalloc *= 2;
+        } else if (args->num+2 >= nalloc)
+                nalloc *= 2;
 
-        args->list = xrealloc(args->list, args->nalloc * sizeof(char *));
+        args->list = xrealloc(args->list, nalloc * sizeof(char *));
+        args->nalloc = nalloc;
         args->list[args->num++] = xstrdup(buf);
         args->list[args->num] = NULL;
 }
diff --git a/session.c b/session.c
index c75fea966..ec4a23ac5 100644
--- a/session.c
+++ b/session.c
@@ -844,8 +844,9 @@ static void
 child_set_env(char ***envp, u_int *envsizep, const char *name,
         const char *value)
 {
-        u_int i, namelen;
         char **env;
+        u_int envsize;
+        u_int i, namelen;
 
         /*
          * Find the slot where the value should be stored.  If the variable
@@ -862,12 +863,13 @@ child_set_env(char ***envp, u_int *envsizep, const char *name,
                 xfree(env[i]);
         } else {
                 /* New variable.  Expand if necessary. */
-                if (i >= (*envsizep) - 1) {
-                        if (*envsizep >= 1000)
-                                fatal("child_set_env: too many env vars,"
-                                    " skipping: %.100s", name);
-                        (*envsizep) += 50;
-                        env = (*envp) = xrealloc(env, (*envsizep) * sizeof(char *));
+                envsize = *envsizep;
+                if (i >= envsize - 1) {
+                        if (envsize >= 1000)
+                                fatal("child_set_env: too many env vars");
+                        envsize += 50;
+                        env = (*envp) = xrealloc(env, envsize * sizeof(char *));
+                        *envsizep = envsize;
                 }
                 /* Need to set the NULL pointer at end of array beyond the new slot. */
                 env[i + 1] = NULL;
diff --git a/ssh-agent.c b/ssh-agent.c
index eb593de73..a936134fe 100644
--- a/ssh-agent.c
+++ b/ssh-agent.c
@@ -767,7 +767,7 @@ process_message(SocketEntry *e)
 static void
 new_socket(sock_type type, int fd)
 {
-        u_int i, old_alloc;
+        u_int i, old_alloc, new_alloc;
 
         if (fcntl(fd, F_SETFL, O_NONBLOCK) < 0)
                 error("fcntl O_NONBLOCK: %s", strerror(errno));
@@ -778,25 +778,26 @@ new_socket(sock_type type, int fd)
         for (i = 0; i < sockets_alloc; i++)
                 if (sockets[i].type == AUTH_UNUSED) {
                         sockets[i].fd = fd;
-                        sockets[i].type = type;
                         buffer_init(&sockets[i].input);
                         buffer_init(&sockets[i].output);
                         buffer_init(&sockets[i].request);
+                        sockets[i].type = type;
                         return;
                 }
         old_alloc = sockets_alloc;
-        sockets_alloc += 10;
+        new_alloc = sockets_alloc + 10;
         if (sockets)
-                sockets = xrealloc(sockets, sockets_alloc * sizeof(sockets[0]));
+                sockets = xrealloc(sockets, new_alloc * sizeof(sockets[0]));
         else
-                sockets = xmalloc(sockets_alloc * sizeof(sockets[0]));
-        for (i = old_alloc; i < sockets_alloc; i++)
+                sockets = xmalloc(new_alloc * sizeof(sockets[0]));
+        for (i = old_alloc; i < new_alloc; i++)
                 sockets[i].type = AUTH_UNUSED;
-        sockets[old_alloc].type = type;
+        sockets_alloc = new_alloc;
         sockets[old_alloc].fd = fd;
         buffer_init(&sockets[old_alloc].input);
         buffer_init(&sockets[old_alloc].output);
         buffer_init(&sockets[old_alloc].request);
+        sockets[old_alloc].type = type;
 }
 
 static int