- markus@cvs.openbsd.org 2005/03/14 11:46:56

     [buffer.c buffer.h channels.c]
     limit input buffer size for channels; bugzilla #896; with and ok dtucker@

diff --git a/ChangeLog b/ChangeLog
index c2a91886c4838ee70cf1d47f23ffb06671733998..87e6bc4f6b9725685ce36e7a1a8cde3891eb4cdf 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -25,6 +25,9 @@
      [auth.c]
      Populate host for log message for logins denied by AllowUsers and
      DenyUsers (bz #999); ok markus@
+   - markus@cvs.openbsd.org 2005/03/14 11:46:56
+     [buffer.c buffer.h channels.c]
+     limit input buffer size for channels; bugzilla #896; with and ok dtucker@
 
 20050313
  - (dtucker) [contrib/cygwin/ssh-host-config] Makes the query for the

diff --git a/buffer.c b/buffer.c
index 1a25004ba2b278a0be3c0d8f588a4bac5808879f..487e0810598a29a3211a647b561b46acc5009841 100644 (file)
--- a/buffer.c
+++ b/buffer.c
@@ -12,7 +12,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: buffer.c,v 1.22 2004/10/29 23:56:17 djm Exp $");
+RCSID("$OpenBSD: buffer.c,v 1.23 2005/03/14 11:46:56 markus Exp $");
 
 #include "xmalloc.h"
 #include "buffer.h"
@@ -78,7 +78,7 @@ buffer_append_space(Buffer *buffer, u_int len)
        u_int newlen;
        void *p;
 
-       if (len > 0x100000)
+       if (len > BUFFER_MAX_CHUNK)
                fatal("buffer_append_space: len %u not supported", len);
 
        /* If the buffer is empty, start using it from the beginning. */
@@ -97,7 +97,7 @@ restart:
         * If the buffer is quite empty, but all data is at the end, move the
         * data to the beginning and retry.
         */
-       if (buffer->offset > buffer->alloc / 2) {
+       if (buffer->offset > MIN(buffer->alloc, BUFFER_MAX_CHUNK)) {
                memmove(buffer->buf, buffer->buf + buffer->offset,
                        buffer->end - buffer->offset);
                buffer->end -= buffer->offset;
@@ -107,7 +107,7 @@ restart:
        /* Increase the size of the buffer and retry. */
 
        newlen = buffer->alloc + len + 32768;
-       if (newlen > 0xa00000)
+       if (newlen > BUFFER_MAX_LEN)
                fatal("buffer_append_space: alloc %u not supported",
                    newlen);
        buffer->buf = xrealloc(buffer->buf, newlen);

diff --git a/buffer.h b/buffer.h
index 9c09d4f43f759936133986194d27da8fb0127beb..2b20eed52acf29e6c68c1d47fbd6e17384f058bd 100644 (file)
--- a/buffer.h
+++ b/buffer.h
@@ -1,4 +1,4 @@
-/*     $OpenBSD: buffer.h,v 1.12 2004/10/29 23:56:17 djm Exp $ */
+/*     $OpenBSD: buffer.h,v 1.13 2005/03/14 11:46:56 markus Exp $      */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -23,6 +23,9 @@ typedef struct {
        u_int    end;           /* Offset of last byte containing data. */
 }       Buffer;
 
+#define        BUFFER_MAX_CHUNK        0x100000
+#define        BUFFER_MAX_LEN          0xa00000
+
 void    buffer_init(Buffer *);
 void    buffer_clear(Buffer *);
 void    buffer_free(Buffer *);

diff --git a/channels.c b/channels.c
index 4bd9af8e67e9f1c7467bb7559964d1258e036c1d..3f6db60c6fc6408cf5033078ccec37f68d86cf27 100644 (file)
--- a/channels.c
+++ b/channels.c
@@ -39,7 +39,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: channels.c,v 1.213 2005/03/10 22:01:05 deraadt Exp $");
+RCSID("$OpenBSD: channels.c,v 1.214 2005/03/14 11:46:56 markus Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -58,6 +58,8 @@ RCSID("$OpenBSD: channels.c,v 1.213 2005/03/10 22:01:05 deraadt Exp $");
 
 /* -- channel core */
 
+#define CHAN_RBUF      16*1024
+
 /*
  * Pointer to an array containing all allocated channels.  The array is
  * dynamically extended as needed.
@@ -712,6 +714,9 @@ channel_pre_open(Channel *c, fd_set * readset, fd_set * writeset)
 {
        u_int limit = compat20 ? c->remote_window : packet_get_maxsize();
 
+       /* check buffer limits */
+       limit = MIN(limit, (BUFFER_MAX_LEN - BUFFER_MAX_CHUNK - CHAN_RBUF));
+
        if (c->istate == CHAN_INPUT_OPEN &&
            limit > 0 &&
            buffer_len(&c->input) < limit)
@@ -1360,7 +1365,7 @@ channel_post_connecting(Channel *c, fd_set * readset, fd_set * writeset)
 static int
 channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
 {
-       char buf[16*1024];
+       char buf[CHAN_RBUF];
        int len;
 
        if (c->rfd != -1 &&
@@ -1454,7 +1459,7 @@ channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
 static int
 channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset)
 {
-       char buf[16*1024];
+       char buf[CHAN_RBUF];
        int len;
 
 /** XXX handle drain efd, too */