1 files changed, 14 insertions, 10 deletions

diff --git a/packet.c b/packet.c
index 90db33bdd..029bb4c98 100644
--- a/packet.c
+++ b/packet.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.c,v 1.189 2013/11/08 00:39:15 djm Exp $ */
+/* $OpenBSD: packet.c,v 1.190 2013/11/21 00:45:44 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -713,7 +713,7 @@ packet_send1(void)
         buffer_append(&active_state->output, buf, 4);
         cp = buffer_append_space(&active_state->output,
             buffer_len(&active_state->outgoing_packet));
-        cipher_crypt(&active_state->send_context, cp,
+        cipher_crypt(&active_state->send_context, 0, cp,
             buffer_ptr(&active_state->outgoing_packet),
             buffer_len(&active_state->outgoing_packet), 0, 0);
 
@@ -946,8 +946,8 @@ packet_send2_wrapped(void)
         }
         /* encrypt packet and append to output buffer. */
         cp = buffer_append_space(&active_state->output, len + authlen);
-        cipher_crypt(&active_state->send_context, cp,
-            buffer_ptr(&active_state->outgoing_packet),
+        cipher_crypt(&active_state->send_context, active_state->p_send.seqnr,
+            cp, buffer_ptr(&active_state->outgoing_packet),
             len - aadlen, aadlen, authlen);
         /* append unencrypted MAC */
         if (mac && mac->enabled) {
@@ -1208,7 +1208,7 @@ packet_read_poll1(void)
         /* Decrypt data to incoming_packet. */
         buffer_clear(&active_state->incoming_packet);
         cp = buffer_append_space(&active_state->incoming_packet, padded_len);
-        cipher_crypt(&active_state->receive_context, cp,
+        cipher_crypt(&active_state->receive_context, 0, cp,
             buffer_ptr(&active_state->input), padded_len, 0, 0);
 
         buffer_consume(&active_state->input, padded_len);
@@ -1279,10 +1279,12 @@ packet_read_poll2(u_int32_t *seqnr_p)
         aadlen = (mac && mac->enabled && mac->etm) || authlen ? 4 : 0;
 
         if (aadlen && active_state->packlen == 0) {
-                if (buffer_len(&active_state->input) < 4)
+                if (cipher_get_length(&active_state->receive_context,
+                    &active_state->packlen,
+                    active_state->p_read.seqnr,
+                    buffer_ptr(&active_state->input),
+                    buffer_len(&active_state->input)) != 0)
                         return SSH_MSG_NONE;
-                cp = buffer_ptr(&active_state->input);
-                active_state->packlen = get_u32(cp);
                 if (active_state->packlen < 1 + 4 ||
                     active_state->packlen > PACKET_MAX_SIZE) {
 #ifdef PACKET_DEBUG
@@ -1302,7 +1304,8 @@ packet_read_poll2(u_int32_t *seqnr_p)
                 buffer_clear(&active_state->incoming_packet);
                 cp = buffer_append_space(&active_state->incoming_packet,
                     block_size);
-                cipher_crypt(&active_state->receive_context, cp,
+                cipher_crypt(&active_state->receive_context,
+                    active_state->p_read.seqnr, cp,
                     buffer_ptr(&active_state->input), block_size, 0, 0);
                 cp = buffer_ptr(&active_state->incoming_packet);
                 active_state->packlen = get_u32(cp);
@@ -1357,7 +1360,8 @@ packet_read_poll2(u_int32_t *seqnr_p)
                 macbuf = mac_compute(mac, active_state->p_read.seqnr,
                     buffer_ptr(&active_state->input), aadlen + need);
         cp = buffer_append_space(&active_state->incoming_packet, aadlen + need);
-        cipher_crypt(&active_state->receive_context, cp,
+        cipher_crypt(&active_state->receive_context,
+            active_state->p_read.seqnr, cp,
             buffer_ptr(&active_state->input), need, aadlen, authlen);
         buffer_consume(&active_state->input, aadlen + need + authlen);
         /*