diff options
Diffstat (limited to 'serverloop.c')
-rw-r--r-- | serverloop.c | 12 |
1 files changed, 5 insertions, 7 deletions
diff --git a/serverloop.c b/serverloop.c index ea468c954..16a4fd3e5 100644 --- a/serverloop.c +++ b/serverloop.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: serverloop.c,v 1.216 2019/06/28 13:35:04 deraadt Exp $ */ | 1 | /* $OpenBSD: serverloop.c,v 1.217 2019/11/27 03:34:04 dtucker Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -675,7 +675,7 @@ server_input_channel_open(int type, u_int32_t seq, struct ssh *ssh) | |||
675 | char *ctype = NULL; | 675 | char *ctype = NULL; |
676 | const char *errmsg = NULL; | 676 | const char *errmsg = NULL; |
677 | int r, reason = SSH2_OPEN_CONNECT_FAILED; | 677 | int r, reason = SSH2_OPEN_CONNECT_FAILED; |
678 | u_int rchan = 0, rmaxpack = 0, rwindow = 0; | 678 | u_int32_t rchan = 0, rmaxpack = 0, rwindow = 0; |
679 | 679 | ||
680 | if ((r = sshpkt_get_cstring(ssh, &ctype, NULL)) != 0 || | 680 | if ((r = sshpkt_get_cstring(ssh, &ctype, NULL)) != 0 || |
681 | (r = sshpkt_get_u32(ssh, &rchan)) != 0 || | 681 | (r = sshpkt_get_u32(ssh, &rchan)) != 0 || |
@@ -683,11 +683,9 @@ server_input_channel_open(int type, u_int32_t seq, struct ssh *ssh) | |||
683 | (r = sshpkt_get_u32(ssh, &rmaxpack)) != 0) | 683 | (r = sshpkt_get_u32(ssh, &rmaxpack)) != 0) |
684 | sshpkt_fatal(ssh, r, "%s: parse packet", __func__); | 684 | sshpkt_fatal(ssh, r, "%s: parse packet", __func__); |
685 | debug("%s: ctype %s rchan %u win %u max %u", __func__, | 685 | debug("%s: ctype %s rchan %u win %u max %u", __func__, |
686 | ctype, rchan, rwindow, rmaxpack); | 686 | ctype, (u_int)rchan, (u_int)rwindow, (u_int)rmaxpack); |
687 | 687 | ||
688 | if (rchan > INT_MAX) { | 688 | if (strcmp(ctype, "session") == 0) { |
689 | error("%s: invalid remote channel ID", __func__); | ||
690 | } else if (strcmp(ctype, "session") == 0) { | ||
691 | c = server_request_session(ssh); | 689 | c = server_request_session(ssh); |
692 | } else if (strcmp(ctype, "direct-tcpip") == 0) { | 690 | } else if (strcmp(ctype, "direct-tcpip") == 0) { |
693 | c = server_request_direct_tcpip(ssh, &reason, &errmsg); | 691 | c = server_request_direct_tcpip(ssh, &reason, &errmsg); |
@@ -698,7 +696,7 @@ server_input_channel_open(int type, u_int32_t seq, struct ssh *ssh) | |||
698 | } | 696 | } |
699 | if (c != NULL) { | 697 | if (c != NULL) { |
700 | debug("%s: confirm %s", __func__, ctype); | 698 | debug("%s: confirm %s", __func__, ctype); |
701 | c->remote_id = (int)rchan; | 699 | c->remote_id = rchan; |
702 | c->have_remote_id = 1; | 700 | c->have_remote_id = 1; |
703 | c->remote_window = rwindow; | 701 | c->remote_window = rwindow; |
704 | c->remote_maxpacket = rmaxpack; | 702 | c->remote_maxpacket = rmaxpack; |