1 files changed, 18 insertions, 5 deletions

diff --git a/bufaux.c b/bufaux.c
index cd9a35ded..e17f001e1 100644
--- a/bufaux.c
+++ b/bufaux.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: bufaux.c,v 1.46 2008/06/10 23:21:34 dtucker Exp $ */
+/* $OpenBSD: bufaux.c,v 1.47 2010/01/12 01:36:08 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -198,14 +198,17 @@ buffer_get_string(Buffer *buffer, u_int *length_ptr)
 }
 
 void *
-buffer_get_string_ptr(Buffer *buffer, u_int *length_ptr)
+buffer_get_string_ptr_ret(Buffer *buffer, u_int *length_ptr)
 {
         void *ptr;
         u_int len;
 
-        len = buffer_get_int(buffer);
-        if (len > 256 * 1024)
-                fatal("buffer_get_string_ptr: bad string length %u", len);
+        if (buffer_get_int_ret(&len, buffer) != 0)
+                return NULL;
+        if (len > 256 * 1024) {
+                error("buffer_get_string_ptr: bad string length %u", len);
+                return NULL;
+        }
         ptr = buffer_ptr(buffer);
         buffer_consume(buffer, len);
         if (length_ptr)
@@ -213,6 +216,16 @@ buffer_get_string_ptr(Buffer *buffer, u_int *length_ptr)
         return (ptr);
 }
 
+void *
+buffer_get_string_ptr(Buffer *buffer, u_int *length_ptr)
+{
+        void *ret;
+
+        if ((ret = buffer_get_string_ptr_ret(buffer, length_ptr)) == NULL)
+                fatal("buffer_get_string_ptr: buffer error");
+        return (ret);
+}
+
 /*
  * Stores and arbitrary binary string in the buffer.
  */