1 files changed, 27 insertions, 58 deletions

diff --git a/channels.c b/channels.c
index 65a6a7f00..e663c2159 100644
--- a/channels.c
+++ b/channels.c
@@ -39,7 +39,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: channels.c,v 1.194 2003/08/29 10:04:36 markus Exp $");
+RCSID("$OpenBSD: channels.c,v 1.200 2004/01/19 09:24:21 markus Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -217,7 +217,6 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd,
                 channels = xmalloc(channels_alloc * sizeof(Channel *));
                 for (i = 0; i < channels_alloc; i++)
                         channels[i] = NULL;
-                fatal_add_cleanup((void (*) (void *)) channel_free_all, NULL);
         }
         /* Try to find a free slot where to put the new channel. */
         for (found = -1, i = 0; i < channels_alloc; i++)
@@ -229,12 +228,13 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd,
         if (found == -1) {
                 /* There are no free slots.  Take last+1 slot and expand the array.  */
                 found = channels_alloc;
-                channels_alloc += 10;
                 if (channels_alloc > 10000)
                         fatal("channel_new: internal error: channels_alloc %d "
                             "too big.", channels_alloc);
+                channels = xrealloc(channels,
+                    (channels_alloc + 10) * sizeof(Channel *));
+                channels_alloc += 10;
                 debug2("channel: expanding %d", channels_alloc);
-                channels = xrealloc(channels, channels_alloc * sizeof(Channel *));
                 for (i = found; i < channels_alloc; i++)
                         channels[i] = NULL;
         }
@@ -970,7 +970,7 @@ channel_decode_socks5(Channel *c, fd_set * readset, fd_set * writeset)
         have = buffer_len(&c->input);
         if (!(c->flags & SSH_SOCKS5_AUTHDONE)) {
                 /* format: ver | nmethods | methods */
-                if (have < 2) 
+                if (have < 2)
                         return 0;
                 nmethods = p[1];
                 if (have < nmethods + 2)
@@ -1035,7 +1035,7 @@ channel_decode_socks5(Channel *c, fd_set * readset, fd_set * writeset)
         else if (inet_ntop(af, dest_addr, c->path, sizeof(c->path)) == NULL)
                 return -1;
         c->host_port = ntohs(dest_port);
-        
+
         debug2("channel %d: dynamic request: socks5 host %s port %u command %u",
             c->self, c->path, c->host_port, s5_req.command);
 
@@ -1397,9 +1397,9 @@ channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
                 data = buffer_ptr(&c->output);
                 dlen = buffer_len(&c->output);
 #ifdef _AIX
-                /* XXX: Later AIX versions can't push as much data to tty */ 
-                if (compat20 && c->wfd_isatty && dlen > 8*1024)
-                        dlen = 8*1024;
+                /* XXX: Later AIX versions can't push as much data to tty */
+                if (compat20 && c->wfd_isatty)
+                        dlen = MIN(dlen, 8*1024);
 #endif
                 len = write(c->wfd, data, dlen);
                 if (len < 0 && (errno == EINTR || errno == EAGAIN))
@@ -1817,13 +1817,25 @@ channel_input_data(int type, u_int32_t seq, void *ctxt)
             c->type != SSH_CHANNEL_X11_OPEN)
                 return;
 
-        /* same for protocol 1.5 if output end is no longer open */
-        if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN)
-                return;
-
         /* Get the data. */
         data = packet_get_string(&data_len);
 
+        /*
+         * Ignore data for protocol > 1.3 if output end is no longer open.
+         * For protocol 2 the sending side is reducing its window as it sends
+         * data, so we must 'fake' consumption of the data in order to ensure
+         * that window updates are sent back.  Otherwise the connection might
+         * deadlock.
+         */
+        if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN) {
+                if (compat20) {
+                        c->local_window -= data_len;
+                        c->local_consumed += data_len;
+                }
+                xfree(data);
+                return;
+        }
+
         if (compat20) {
                 if (data_len > c->local_maxpacket) {
                         logit("channel %d: rcvd big packet %d, maxpack %d",
@@ -2195,7 +2207,7 @@ channel_setup_fwd_listener(int type, const char *listen_addr, u_short listen_por
                         continue;
                 }
                 /* Start listening for connections on the socket. */
-                if (listen(sock, 5) < 0) {
+                if (listen(sock, SSH_LISTEN_BACKLOG) < 0) {
                         error("listen: %.100s", strerror(errno));
                         close(sock);
                         continue;
@@ -2550,7 +2562,7 @@ x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
         /* Start listening for connections on the socket. */
         for (n = 0; n < num_socks; n++) {
                 sock = socks[n];
-                if (listen(sock, 5) < 0) {
+                if (listen(sock, SSH_LISTEN_BACKLOG) < 0) {
                         error("listen: %.100s", strerror(errno));
                         close(sock);
                         return -1;
@@ -2838,46 +2850,3 @@ auth_request_forwarding(void)
         packet_send();
         packet_write_wait();
 }
-
-/* This is called to process an SSH_SMSG_AGENT_OPEN message. */
-
-void
-auth_input_open_request(int type, u_int32_t seq, void *ctxt)
-{
-        Channel *c = NULL;
-        int remote_id, sock;
-
-        /* Read the remote channel number from the message. */
-        remote_id = packet_get_int();
-        packet_check_eom();
-
-        /*
-         * Get a connection to the local authentication agent (this may again
-         * get forwarded).
-         */
-        sock = ssh_get_authentication_socket();
-
-        /*
-         * If we could not connect the agent, send an error message back to
-         * the server. This should never happen unless the agent dies,
-         * because authentication forwarding is only enabled if we have an
-         * agent.
-         */
-        if (sock >= 0) {
-                c = channel_new("", SSH_CHANNEL_OPEN, sock, sock,
-                    -1, 0, 0, 0, "authentication agent connection", 1);
-                c->remote_id = remote_id;
-                c->force_drain = 1;
-        }
-        if (c == NULL) {
-                packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
-                packet_put_int(remote_id);
-        } else {
-                /* Send a confirmation to the remote host. */
-                debug("Forwarding authentication connection.");
-                packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
-                packet_put_int(remote_id);
-                packet_put_int(c->self);
-        }
-        packet_send();
-}