diff options
| author |   djm <djm@openbsd.org> | 2010-02-02 22:49:34 +0000 |
|---|---|---|
| committer | djm <djm@openbsd.org> | 2010-02-02 22:49:34 +0000 |
| commit | 28c8c2370a01096e967117282fc27aba00cadfc2 (patch) | |
| tree | b3de4b8bd68005f70f0138b24aa067380fd70b53 | |
| parent | Add missing 'in' in sample rdr-to rule. Noted by Steve Williams. (diff) | |
| download | wireguard-openbsd-28c8c2370a01096e967117282fc27aba00cadfc2.tar.xz wireguard-openbsd-28c8c2370a01096e967117282fc27aba00cadfc2.zip | |
make buffer_get_string_ret() really non-fatal in all cases (it was
using buffer_get_int(), which could fatal() on buffer empty);
ok markus dtucker
| -rw-r--r-- | usr.bin/ssh/bufaux.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/usr.bin/ssh/bufaux.c b/usr.bin/ssh/bufaux.c index 2fd5654a254..936e793103c 100644 --- a/usr.bin/ssh/bufaux.c +++ b/usr.bin/ssh/bufaux.c @@ -1,4 +1,4 @@ -/* $OpenBSD: bufaux.c,v 1.47 2010/01/12 01:36:08 djm Exp $ */ +/* $OpenBSD: bufaux.c,v 1.48 2010/02/02 22:49:34 djm Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -164,7 +164,10 @@ buffer_get_string_ret(Buffer *buffer, u_int *length_ptr) u_int len; /* Get the length. */ - len = buffer_get_int(buffer); + if (buffer_get_int_ret(&len, buffer) != 0) { + error("buffer_get_string_ret: cannot extract length"); + return (NULL); + } if (len > 256 * 1024) { error("buffer_get_string_ret: bad string length %u", len); return (NULL); |