1 files changed, 16 insertions, 11 deletions

diff --git a/channels.c b/channels.c
index 2dea5dfd0..b8507ca13 100644
--- a/channels.c
+++ b/channels.c
@@ -39,7 +39,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: channels.c,v 1.212 2005/03/01 10:09:52 djm Exp $");
+RCSID("$OpenBSD: channels.c,v 1.214 2005/03/14 11:46:56 markus Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -58,6 +58,8 @@ RCSID("$OpenBSD: channels.c,v 1.212 2005/03/01 10:09:52 djm Exp $");
 
 /* -- channel core */
 
+#define CHAN_RBUF       16*1024
+
 /*
  * Pointer to an array containing all allocated channels.  The array is
  * dynamically extended as needed.
@@ -712,6 +714,9 @@ channel_pre_open(Channel *c, fd_set * readset, fd_set * writeset)
 {
         u_int limit = compat20 ? c->remote_window : packet_get_maxsize();
 
+        /* check buffer limits */
+        limit = MIN(limit, (BUFFER_MAX_LEN - BUFFER_MAX_CHUNK - CHAN_RBUF));
+
         if (c->istate == CHAN_INPUT_OPEN &&
             limit > 0 &&
             buffer_len(&c->input) < limit)
@@ -1018,7 +1023,7 @@ channel_decode_socks5(Channel *c, fd_set * readset, fd_set * writeset)
                 debug2("channel %d: only socks5 connect supported", c->self);
                 return -1;
         }
-        switch(s5_req.atyp){
+        switch (s5_req.atyp){
         case SSH_SOCKS5_IPV4:
                 addrlen = 4;
                 af = AF_INET;
@@ -1360,7 +1365,7 @@ channel_post_connecting(Channel *c, fd_set * readset, fd_set * writeset)
 static int
 channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
 {
-        char buf[16*1024];
+        char buf[CHAN_RBUF];
         int len;
 
         if (c->rfd != -1 &&
@@ -1454,7 +1459,7 @@ channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
 static int
 channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset)
 {
-        char buf[16*1024];
+        char buf[CHAN_RBUF];
         int len;
 
 /** XXX handle drain efd, too */
@@ -2199,11 +2204,11 @@ channel_setup_fwd_listener(int type, const char *listen_addr, u_short listen_por
 
         /*
          * Determine whether or not a port forward listens to loopback,
-         * specified address or wildcard. On the client, a specified bind 
-         * address will always override gateway_ports. On the server, a 
-         * gateway_ports of 1 (``yes'') will override the client's 
-         * specification and force a wildcard bind, whereas a value of 2 
-         * (``clientspecified'') will bind to whatever address the client 
+         * specified address or wildcard. On the client, a specified bind
+         * address will always override gateway_ports. On the server, a
+         * gateway_ports of 1 (``yes'') will override the client's
+         * specification and force a wildcard bind, whereas a value of 2
+         * (``clientspecified'') will bind to whatever address the client
          * asked for.
          *
          * Special-case listen_addrs are:
@@ -2317,7 +2322,7 @@ channel_cancel_rport_listener(const char *host, u_short port)
         u_int i;
         int found = 0;
 
-        for(i = 0; i < channels_alloc; i++) {
+        for (i = 0; i < channels_alloc; i++) {
                 Channel *c = channels[i];
 
                 if (c != NULL && c->type == SSH_CHANNEL_RPORT_LISTENER &&
@@ -2629,7 +2634,7 @@ channel_send_window_changes(void)
         struct winsize ws;
 
         for (i = 0; i < channels_alloc; i++) {
-                if (channels[i] == NULL || !channels[i]->client_tty || 
+                if (channels[i] == NULL || !channels[i]->client_tty ||
                     channels[i]->type != SSH_CHANNEL_OPEN)
                         continue;
                 if (ioctl(channels[i]->rfd, TIOCGWINSZ, &ws) < 0)