diff options
| author |   markus <markus@openbsd.org> | 2005-03-14 11:46:56 +0000 |
|---|---|---|
| committer | markus <markus@openbsd.org> | 2005-03-14 11:46:56 +0000 |
| commit | a1d3689b8a6afe6d0225980eb0f4811c23b275dd (patch) | |
| tree | edc2a78d3c89e003c5b5df6cf443a6aa54729474 /usr.bin/ssh/channels.c | |
| parent | Populate host for log message for logins denied by AllowUsers and DenyUsers. (diff) | |
| download | wireguard-openbsd-a1d3689b8a6afe6d0225980eb0f4811c23b275dd.tar.xz wireguard-openbsd-a1d3689b8a6afe6d0225980eb0f4811c23b275dd.zip | |
limit input buffer size for channels; bugzilla #896; with and ok dtucker@
Diffstat (limited to 'usr.bin/ssh/channels.c')
| -rw-r--r-- | usr.bin/ssh/channels.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/usr.bin/ssh/channels.c b/usr.bin/ssh/channels.c index 54b951e0d9d..b387cddc731 100644 --- a/usr.bin/ssh/channels.c +++ b/usr.bin/ssh/channels.c @@ -39,7 +39,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: channels.c,v 1.213 2005/03/10 22:01:05 deraadt Exp $"); +RCSID("$OpenBSD: channels.c,v 1.214 2005/03/14 11:46:56 markus Exp $"); #include "ssh.h" #include "ssh1.h" @@ -58,6 +58,8 @@ RCSID("$OpenBSD: channels.c,v 1.213 2005/03/10 22:01:05 deraadt Exp $"); /* -- channel core */ +#define CHAN_RBUF 16*1024 + /* * Pointer to an array containing all allocated channels. The array is * dynamically extended as needed. @@ -711,6 +713,9 @@ channel_pre_open(Channel *c, fd_set * readset, fd_set * writeset) { u_int limit = compat20 ? c->remote_window : packet_get_maxsize(); + /* check buffer limits */ + limit = MIN(limit, (BUFFER_MAX_LEN - BUFFER_MAX_CHUNK - CHAN_RBUF)); + if (c->istate == CHAN_INPUT_OPEN && limit > 0 && buffer_len(&c->input) < limit) @@ -1359,7 +1364,7 @@ channel_post_connecting(Channel *c, fd_set * readset, fd_set * writeset) static int channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset) { - char buf[16*1024]; + char buf[CHAN_RBUF]; int len; if (c->rfd != -1 && @@ -1448,7 +1453,7 @@ channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset) static int channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset) { - char buf[16*1024]; + char buf[CHAN_RBUF]; int len; /** XXX handle drain efd, too */ |