summaryrefslogtreecommitdiff
path: root/usr.bin
diff options
context:
space:
mode:
authorMarkus Friedl <markus@cvs.openbsd.org>2005-03-14 11:46:57 +0000
committerMarkus Friedl <markus@cvs.openbsd.org>2005-03-14 11:46:57 +0000
commitcfd931622f0e30d11d731bf621aef06c3cc42dca (patch)
treefc340cb642670505958faa3f76d3378d7077a93b /usr.bin
parent3d2a2ca4ee3d89509cc28b5b6bfc1cfcd1004bb5 (diff)
limit input buffer size for channels; bugzilla #896; with and ok dtucker@
Diffstat (limited to 'usr.bin')
-rw-r--r--usr.bin/ssh/buffer.c8
-rw-r--r--usr.bin/ssh/buffer.h5
-rw-r--r--usr.bin/ssh/channels.c11
3 files changed, 16 insertions, 8 deletions
diff --git a/usr.bin/ssh/buffer.c b/usr.bin/ssh/buffer.c
index 1a25004ba2b..487e0810598 100644
--- a/usr.bin/ssh/buffer.c
+++ b/usr.bin/ssh/buffer.c
@@ -12,7 +12,7 @@
*/
#include "includes.h"
-RCSID("$OpenBSD: buffer.c,v 1.22 2004/10/29 23:56:17 djm Exp $");
+RCSID("$OpenBSD: buffer.c,v 1.23 2005/03/14 11:46:56 markus Exp $");
#include "xmalloc.h"
#include "buffer.h"
@@ -78,7 +78,7 @@ buffer_append_space(Buffer *buffer, u_int len)
u_int newlen;
void *p;
- if (len > 0x100000)
+ if (len > BUFFER_MAX_CHUNK)
fatal("buffer_append_space: len %u not supported", len);
/* If the buffer is empty, start using it from the beginning. */
@@ -97,7 +97,7 @@ restart:
* If the buffer is quite empty, but all data is at the end, move the
* data to the beginning and retry.
*/
- if (buffer->offset > buffer->alloc / 2) {
+ if (buffer->offset > MIN(buffer->alloc, BUFFER_MAX_CHUNK)) {
memmove(buffer->buf, buffer->buf + buffer->offset,
buffer->end - buffer->offset);
buffer->end -= buffer->offset;
@@ -107,7 +107,7 @@ restart:
/* Increase the size of the buffer and retry. */
newlen = buffer->alloc + len + 32768;
- if (newlen > 0xa00000)
+ if (newlen > BUFFER_MAX_LEN)
fatal("buffer_append_space: alloc %u not supported",
newlen);
buffer->buf = xrealloc(buffer->buf, newlen);
diff --git a/usr.bin/ssh/buffer.h b/usr.bin/ssh/buffer.h
index 9c09d4f43f7..2b20eed52ac 100644
--- a/usr.bin/ssh/buffer.h
+++ b/usr.bin/ssh/buffer.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: buffer.h,v 1.12 2004/10/29 23:56:17 djm Exp $ */
+/* $OpenBSD: buffer.h,v 1.13 2005/03/14 11:46:56 markus Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -23,6 +23,9 @@ typedef struct {
u_int end; /* Offset of last byte containing data. */
} Buffer;
+#define BUFFER_MAX_CHUNK 0x100000
+#define BUFFER_MAX_LEN 0xa00000
+
void buffer_init(Buffer *);
void buffer_clear(Buffer *);
void buffer_free(Buffer *);
diff --git a/usr.bin/ssh/channels.c b/usr.bin/ssh/channels.c
index 54b951e0d9d..b387cddc731 100644
--- a/usr.bin/ssh/channels.c
+++ b/usr.bin/ssh/channels.c
@@ -39,7 +39,7 @@
*/
#include "includes.h"
-RCSID("$OpenBSD: channels.c,v 1.213 2005/03/10 22:01:05 deraadt Exp $");
+RCSID("$OpenBSD: channels.c,v 1.214 2005/03/14 11:46:56 markus Exp $");
#include "ssh.h"
#include "ssh1.h"
@@ -58,6 +58,8 @@ RCSID("$OpenBSD: channels.c,v 1.213 2005/03/10 22:01:05 deraadt Exp $");
/* -- channel core */
+#define CHAN_RBUF 16*1024
+
/*
* Pointer to an array containing all allocated channels. The array is
* dynamically extended as needed.
@@ -711,6 +713,9 @@ channel_pre_open(Channel *c, fd_set * readset, fd_set * writeset)
{
u_int limit = compat20 ? c->remote_window : packet_get_maxsize();
+ /* check buffer limits */
+ limit = MIN(limit, (BUFFER_MAX_LEN - BUFFER_MAX_CHUNK - CHAN_RBUF));
+
if (c->istate == CHAN_INPUT_OPEN &&
limit > 0 &&
buffer_len(&c->input) < limit)
@@ -1359,7 +1364,7 @@ channel_post_connecting(Channel *c, fd_set * readset, fd_set * writeset)
static int
channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
{
- char buf[16*1024];
+ char buf[CHAN_RBUF];
int len;
if (c->rfd != -1 &&
@@ -1448,7 +1453,7 @@ channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
static int
channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset)
{
- char buf[16*1024];
+ char buf[CHAN_RBUF];
int len;
/** XXX handle drain efd, too */