1 files changed, 7 insertions, 6 deletions

diff --git a/channels.c b/channels.c
index 8e66265a3..9efe89c9c 100644
--- a/channels.c
+++ b/channels.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: channels.c,v 1.328 2013/12/19 01:04:36 djm Exp $ */
+/* $OpenBSD: channels.c,v 1.331 2014/02/26 20:29:29 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -423,7 +423,7 @@ channel_free(Channel *c)
                 if (cc->abandon_cb != NULL)
                         cc->abandon_cb(c, cc->ctx);
                 TAILQ_REMOVE(&c->status_confirms, cc, entry);
-                bzero(cc, sizeof(*cc));
+                explicit_bzero(cc, sizeof(*cc));
                 free(cc);
         }
         if (c->filter_cleanup != NULL && c->filter_ctx != NULL)
@@ -1072,6 +1072,9 @@ channel_decode_socks4(Channel *c, fd_set *readset, fd_set *writeset)
         buffer_get(&c->input, (char *)&s4_req.dest_addr, 4);
         have = buffer_len(&c->input);
         p = buffer_ptr(&c->input);
+        if (memchr(p, '\0', have) == NULL)
+                fatal("channel %d: decode socks4: user not nul terminated",
+                    c->self);
         len = strlen(p);
         debug2("channel %d: decode socks4: user %s/%d", c->self, p, len);
         len++;                                  /* trailing '\0' */
@@ -2671,7 +2674,7 @@ channel_input_status_confirm(int type, u_int32_t seq, void *ctxt)
                 return;
         cc->cb(type, c, cc->ctx);
         TAILQ_REMOVE(&c->status_confirms, cc, entry);
-        bzero(cc, sizeof(*cc));
+        explicit_bzero(cc, sizeof(*cc));
         free(cc);
 }
 
@@ -3304,9 +3307,7 @@ channel_connect_ctx_free(struct channel_connect *cctx)
         free(cctx->host);
         if (cctx->aitop)
                 freeaddrinfo(cctx->aitop);
-        bzero(cctx, sizeof(*cctx));
-        cctx->host = NULL;
-        cctx->ai = cctx->aitop = NULL;
+        memset(cctx, 0, sizeof(*cctx));
 }
 
 /* Return CONNECTING channel to remote host, port */