Fix condition where we could exit with a fatal error when an input

buffer became too large and the remote end had advertised a big window.
The problem was a mismatch in the backoff math between the channels code
and the buffer code, so make a buffer_check_alloc() function that the
channels code can use to propsectivly check whether an incremental
allocation will succeed.  bz #1131, debugged with the assistance of
cove AT wildpackets.com; ok dtucker@ deraadt@

1 files changed, 3 insertions, 4 deletions

diff --git a/usr.bin/ssh/buffer.h b/usr.bin/ssh/buffer.h
index abdaea3493d..43414ae99e5 100644
--- a/usr.bin/ssh/buffer.h
+++ b/usr.bin/ssh/buffer.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: buffer.h,v 1.14 2006/03/25 22:22:42 djm Exp $ */
+/* $OpenBSD: buffer.h,v 1.15 2006/04/16 00:48:52 djm Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -23,9 +23,6 @@ typedef struct {
 	u_int	 end;		/* Offset of last byte containing data. */
 }       Buffer;
 
-#define	BUFFER_MAX_CHUNK	0x100000
-#define	BUFFER_MAX_LEN		0xa00000
-
 void	 buffer_init(Buffer *);
 void	 buffer_clear(Buffer *);
 void	 buffer_free(Buffer *);
@@ -36,6 +33,8 @@ void	*buffer_ptr(Buffer *);
 void	 buffer_append(Buffer *, const void *, u_int);
 void	*buffer_append_space(Buffer *, u_int);
 
+int	 buffer_check_alloc(Buffer *, u_int);
+
 void	 buffer_get(Buffer *, void *, u_int);
 
 void	 buffer_consume(Buffer *, u_int);