MFC buffer.c 1.1.1.7: Do not record expanded size before attempting to

reallocate associated memory.

4 files changed, 13 insertions, 4 deletions

diff --git a/UPDATING b/UPDATING
index d0c06b46bfa4..64a5dbf3c4f6 100644
--- a/UPDATING
+++ b/UPDATING
@@ -17,6 +17,9 @@ minimal number of processes, if possible, for that patch.  For those
 updates that don't have an advisory, or to be safe, you can do a full
 build and install as described in the COMMON ITEMS section.
 
+20030916:	p40	FreeBSD-SA-03:12.openssh
+	OpenSSH oversized packet buffer handling corrected.
+
 20030810:	p39	FreeBSD-SA-03:10.iBCS2
 	iBCS2 system call translator for statfs leaked information.
 
diff --git a/crypto/openssh/buffer.c b/crypto/openssh/buffer.c
index d993c8bcdef8..f7dc45eb9ef0 100644
--- a/crypto/openssh/buffer.c
+++ b/crypto/openssh/buffer.c
@@ -69,6 +69,8 @@ buffer_append(Buffer *buffer, const char *data, unsigned int len)
 void
 buffer_append_space(Buffer *buffer, char **datap, unsigned int len)
 {
+	u_int	newlen;
+
 	/* If the buffer is empty, start using it from the beginning. */
 	if (buffer->offset == buffer->end) {
 		buffer->offset = 0;
@@ -93,8 +95,12 @@ restart:
 		goto restart;
 	}
 	/* Increase the size of the buffer and retry. */
-	buffer->alloc += len + 32768;
-	buffer->buf = xrealloc(buffer->buf, buffer->alloc);
+	newlen = buffer->alloc + len + 32768;
+	if (newlen > 0xa00000)
+		fatal("buffer_append_space: alloc %u not supported",
+		    newlen);
+	buffer->buf = xrealloc(buffer->buf, newlen);
+	buffer->alloc = newlen;
 	goto restart;
 }
 
diff --git a/crypto/openssh/version.h b/crypto/openssh/version.h
index ac6fade2655b..72d95abc25c5 100644
--- a/crypto/openssh/version.h
+++ b/crypto/openssh/version.h
@@ -1,4 +1,4 @@
 /* $FreeBSD$ */
 /* $OpenBSD: version.h,v 1.13 2000/10/16 09:38:45 djm Exp $ */
 
-#define SSH_VERSION	"OpenSSH_2.3.0 FreeBSD localisations 20020307"
+#define SSH_VERSION	"OpenSSH_2.3.0 FreeBSD localisations 20030916"
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index ca15e7ce1c46..289751f7883b 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -36,7 +36,7 @@
 
 TYPE="FreeBSD"
 REVISION="4.4"
-BRANCH="RELEASE-p39"
+BRANCH="RELEASE-p40"
 RELEASE="${REVISION}-${BRANCH}"
 VERSION="${TYPE} ${RELEASE}"