MFC buffer.c 1.1.1.7: Do not record expanded size before attempting to

reallocate associated memory.

3 files changed, 11 insertions, 5 deletions

diff --git a/UPDATING b/UPDATING
index 948a45942687..6ecee9dbc789 100644
--- a/UPDATING
+++ b/UPDATING
@@ -17,6 +17,9 @@ minimal number of processes, if possible, for that patch.  For those
 updates that don't have an advisory, or to be safe, you can do a full
 build and install as described in the COMMON ITEMS section.
 
+20030916:	p12	FreeBSD-SA-03:12.openssh
+	OpenSSH oversized packet buffer handling corrected.
+
 20030825:	p11	FreeBSD-SA-03:11.sendmail
 	Sendmail DNS map problem corrected.
 
diff --git a/crypto/openssh/buffer.c b/crypto/openssh/buffer.c
index ad04b267e0d8..9370998c97ce 100644
--- a/crypto/openssh/buffer.c
+++ b/crypto/openssh/buffer.c
@@ -69,6 +69,7 @@ buffer_append(Buffer *buffer, const void *data, u_int len)
 void *
 buffer_append_space(Buffer *buffer, u_int len)
 {
+	u_int newlen;
 	void *p;
 
 	if (len > 0x100000)
@@ -98,11 +99,13 @@ restart:
 		goto restart;
 	}
 	/* Increase the size of the buffer and retry. */
-	buffer->alloc += len + 32768;
-	if (buffer->alloc > 0xa00000)
+	
+	newlen = buffer->alloc + len + 32768;
+	if (newlen > 0xa00000)
 		fatal("buffer_append_space: alloc %u not supported",
-		    buffer->alloc);
-	buffer->buf = xrealloc(buffer->buf, buffer->alloc);
+		    newlen);
+	buffer->buf = xrealloc(buffer->buf, newlen);
+	buffer->alloc = newlen;
 	goto restart;
 	/* NOTREACHED */
 }
diff --git a/crypto/openssh/version.h b/crypto/openssh/version.h
index 2136a0021457..1eb8d33cc338 100644
--- a/crypto/openssh/version.h
+++ b/crypto/openssh/version.h
@@ -5,7 +5,7 @@
 
 #define SSH_VERSION             (ssh_version_get())
 #define SSH_VERSION_BASE        "OpenSSH_3.5p1"
-#define SSH_VERSION_ADDENDUM    "FreeBSD-20021029"
+#define SSH_VERSION_ADDENDUM    "FreeBSD-20030916"
 
 const char *ssh_version_get(void);
 void ssh_version_set_addendum(const char *add);