From 90d5350ea0e26f38fb2cf86ec09609d7baf4d48a Mon Sep 17 00:00:00 2001
From: djm <djm>
Date: Mon, 3 Nov 2008 08:22:09 +0000
Subject: [PATCH] aadt@cvs.openbsd.org 2008/10/03 23:56:28      [sshconnect2.c]
      Repair strnvis() buffersize of 4*n+1, with termination gauranteed by the
      function.      spotted by des@freebsd, who commited an incorrect fix to
 the freebsd tree      and (as is fairly typical) did not report the problem
 to us.  But this fix      is correct.      ok djm

---
 ChangeLog     | 8 ++++++++
 sshconnect2.c | 6 +++---
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 580d72d9..2f47df33 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -39,6 +39,14 @@
      do not give an example of how to chmod files: we can presume the user
      knows that. removes an ambiguity in the permission of authorized_keys;
      ok deraadt
+   - deraadt@cvs.openbsd.org 2008/10/03 23:56:28
+     [sshconnect2.c]
+     Repair strnvis() buffersize of 4*n+1, with termination gauranteed by the
+     function.
+     spotted by des@freebsd, who commited an incorrect fix to the freebsd tree
+     and (as is fairly typical) did not report the problem to us.  But this fix
+     is correct.
+     ok djm
 
 20080906
  - (dtucker) [config.guess config.sub] Update to latest versions from
diff --git a/sshconnect2.c b/sshconnect2.c
index 1a8f3907..fe9285f1 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect2.c,v 1.167 2008/07/31 14:48:28 markus Exp $ */
+/* $OpenBSD: sshconnect2.c,v 1.168 2008/10/03 23:56:28 deraadt Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -386,8 +386,8 @@ input_userauth_banner(int type, u_int32_t seq, void *ctxt)
 	if (len > 0 && options.log_level >= SYSLOG_LEVEL_INFO) {
 		if (len > 65536)
 			len = 65536;
-		msg = xmalloc(len * 4); /* max expansion from strnvis() */
-		strnvis(msg, raw, len * 4, VIS_SAFE|VIS_OCTAL);
+		msg = xmalloc(len * 4 + 1); /* max expansion from strnvis() */
+		strnvis(msg, raw, len * 4 + 1, VIS_SAFE|VIS_OCTAL);
 		fprintf(stderr, "%s", msg);
 		xfree(msg);
 	}
-- 
2.45.1