Dynamically allocate fd_set; deraadt@ OK

2 files changed, 35 insertions, 21 deletions

diff --git a/usr.bin/ssh/packet.c b/usr.bin/ssh/packet.c
index b43dfaa38ee..362ee50ad66 100644
--- a/usr.bin/ssh/packet.c
+++ b/usr.bin/ssh/packet.c
@@ -37,7 +37,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: packet.c,v 1.55 2001/03/01 02:45:10 deraadt Exp $");
+RCSID("$OpenBSD: packet.c,v 1.56 2001/03/03 21:41:07 millert Exp $");
 
 #include "xmalloc.h"
 #include "buffer.h"
@@ -660,10 +660,13 @@ int
 packet_read(int *payload_len_ptr)
 {
 	int type, len;
-	fd_set set;
+	fd_set *setp;
 	char buf[8192];
 	DBG(debug("packet_read()"));
 
+	setp = (fd_set *)xmalloc(howmany(connection_in+1, NFDBITS) *
+	    sizeof(fd_mask));
+
 	/* Since we are blocking, ensure that all written packets have been sent. */
 	packet_write_wait();
 
@@ -678,17 +681,20 @@ packet_read(int *payload_len_ptr)
 		    || type == SSH_CMSG_EXIT_CONFIRMATION))
 			packet_integrity_check(*payload_len_ptr, 0, type);
 		/* If we got a packet, return it. */
-		if (type != SSH_MSG_NONE)
+		if (type != SSH_MSG_NONE) {
+			xfree(setp);
 			return type;
+		}
 		/*
 		 * Otherwise, wait for some data to arrive, add it to the
 		 * buffer, and try again.
 		 */
-		FD_ZERO(&set);
-		FD_SET(connection_in, &set);
+		memset(setp, 0, howmany(connection_in + 1, NFDBITS) *
+		    sizeof(fd_mask));
+		FD_SET(connection_in, setp);
 
 		/* Wait for some data to arrive. */
-		while (select(connection_in + 1, &set, NULL, NULL, NULL) == -1 &&
+		while (select(connection_in + 1, setp, NULL, NULL, NULL) == -1 &&
 		    (errno == EAGAIN || errno == EINTR))
 			;
 
@@ -1194,17 +1200,21 @@ packet_write_poll()
 void
 packet_write_wait()
 {
+	fd_set *setp;
+
+	setp = (fd_set *)xmalloc(howmany(connection_out + 1, NFDBITS) *
+	    sizeof(fd_mask));
 	packet_write_poll();
 	while (packet_have_data_to_write()) {
-		fd_set set;
-
-		FD_ZERO(&set);
-		FD_SET(connection_out, &set);
-		while (select(connection_out + 1, NULL, &set, NULL, NULL) == -1 &&
+		memset(setp, 0, howmany(connection_out + 1, NFDBITS) *
+		    sizeof(fd_mask));
+		FD_SET(connection_out, setp);
+		while (select(connection_out + 1, NULL, setp, NULL, NULL) == -1 &&
 		    (errno == EAGAIN || errno == EINTR))
 			;
 		packet_write_poll();
 	}
+	xfree(setp);
 }
 
 /* Returns true if there is buffered data to write to the connection. */
diff --git a/usr.bin/ssh/sftp-server.c b/usr.bin/ssh/sftp-server.c
index fa4eedc806a..e71bca13651 100644
--- a/usr.bin/ssh/sftp-server.c
+++ b/usr.bin/ssh/sftp-server.c
@@ -22,7 +22,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include "includes.h"
-RCSID("$OpenBSD: sftp-server.c,v 1.20 2001/02/21 09:12:56 deraadt Exp $");
+RCSID("$OpenBSD: sftp-server.c,v 1.21 2001/03/03 21:40:30 millert Exp $");
 
 #include "buffer.h"
 #include "bufaux.h"
@@ -920,9 +920,9 @@ process(void)
 int
 main(int ac, char **av)
 {
-	fd_set rset, wset;
+	fd_set *rset, *wset;
 	int in, out, max;
-	ssize_t len, olen;
+	ssize_t len, olen, set_size;
 
 	handle_init();
 
@@ -942,23 +942,27 @@ main(int ac, char **av)
 	buffer_init(&iqueue);
 	buffer_init(&oqueue);
 
+	set_size = howmany(max + 1, NFDBITS) * sizeof(fd_mask);
+	rset = (fd_set *)xmalloc(set_size);
+	wset = (fd_set *)xmalloc(set_size);
+
 	for (;;) {
-		FD_ZERO(&rset);
-		FD_ZERO(&wset);
+		memset(rset, 0, set_size);
+		memset(wset, 0, set_size);
 
-		FD_SET(in, &rset);
+		FD_SET(in, rset);
 		olen = buffer_len(&oqueue);
 		if (olen > 0)
-			FD_SET(out, &wset);
+			FD_SET(out, wset);
 
-		if (select(max+1, &rset, &wset, NULL, NULL) < 0) {
+		if (select(max+1, rset, wset, NULL, NULL) < 0) {
 			if (errno == EINTR)
 				continue;
 			exit(2);
 		}
 
 		/* copy stdin to iqueue */
-		if (FD_ISSET(in, &rset)) {
+		if (FD_ISSET(in, rset)) {
 			char buf[4*4096];
 			len = read(in, buf, sizeof buf);
 			if (len == 0) {
@@ -972,7 +976,7 @@ main(int ac, char **av)
 			}
 		}
 		/* send oqueue to stdout */
-		if (FD_ISSET(out, &wset)) {
+		if (FD_ISSET(out, wset)) {
 			len = write(out, buffer_ptr(&oqueue), olen);
 			if (len < 0) {
 				error("write error");