From 13de3560de281b3c8b9c4ae7aac023d049b89644 Mon Sep 17 00:00:00 2001
From: djm <djm>
Date: Fri, 18 Jun 2004 12:23:22 +0000
Subject: [PATCH]    - djm@cvs.openbsd.org 2004/06/18 11:11:54      [channels.c
 clientloop.c]      Don't explode in clientloop when we receive a bogus
 channel id, but      also don't generate them to begin with; ok markus@

---
 ChangeLog    | 4 ++++
 channels.c   | 4 ++--
 clientloop.c | 9 +++++----
 3 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 4d43bfc2..cae53357 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -32,6 +32,10 @@
      [ssh.1 ssh.c]
      trim synopsis for -S, allow -S and -oControlMaster, -MM means 'ask';
      ok djm
+   - djm@cvs.openbsd.org 2004/06/18 11:11:54
+     [channels.c clientloop.c]
+     Don't explode in clientloop when we receive a bogus channel id, but
+     also don't generate them to begin with; ok markus@
 
 20040617
  - (dtucker) [regress/scp.sh] diff -N is not portable (but needed for some
diff --git a/channels.c b/channels.c
index 97c1fd31..68d85438 100644
--- a/channels.c
+++ b/channels.c
@@ -39,7 +39,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: channels.c,v 1.205 2004/06/14 01:44:38 djm Exp $");
+RCSID("$OpenBSD: channels.c,v 1.206 2004/06/18 11:11:54 djm Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -487,7 +487,7 @@ channel_find_open(void)
 
 	for (i = 0; i < channels_alloc; i++) {
 		c = channels[i];
-		if (c == NULL)
+		if (c == NULL || c->remote_id < 0)
 			continue;
 		switch (c->type) {
 		case SSH_CHANNEL_CLOSED:
diff --git a/clientloop.c b/clientloop.c
index 8f2f270d..79aabbe0 100644
--- a/clientloop.c
+++ b/clientloop.c
@@ -59,7 +59,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: clientloop.c,v 1.127 2004/06/17 15:10:13 djm Exp $");
+RCSID("$OpenBSD: clientloop.c,v 1.128 2004/06/18 11:11:54 djm Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -1626,8 +1626,9 @@ client_input_channel_req(int type, u_int32_t seq, void *ctxt)
 	debug("client_input_channel_req: channel %d rtype %s reply %d",
 	    id, rtype, reply);
 
-	c = channel_lookup(id);
-	if (c == NULL) {
+	if (id == -1) {
+		error("client_input_channel_req: request for channel -1");
+	} else if ((c = channel_lookup(id)) == NULL) {
 		error("client_input_channel_req: channel %d: unknown channel", id);
 	} else if (strcmp(rtype, "exit-status") == 0) {
 		exitval = packet_get_int();
@@ -1646,7 +1647,7 @@ client_input_channel_req(int type, u_int32_t seq, void *ctxt)
 	if (reply) {
 		packet_start(success ?
 		    SSH2_MSG_CHANNEL_SUCCESS : SSH2_MSG_CHANNEL_FAILURE);
-		packet_put_int(c->remote_id);
+		packet_put_int(id);
 		packet_send();
 	}
 	xfree(rtype);
-- 
2.45.2