From 629df770dbadc2accfbe1c81b3f31f876d0acd84 Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Tue, 30 Jun 2015 05:25:07 +0000 Subject: upstream commit fatal() when a remote window update causes the window value to overflow. Reported by Georg Wicherski, ok markus@ Upstream-ID: ead397a9aceb3bf74ebfa5fcaf259d72e569f351 --- channels.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'channels.c') diff --git a/channels.c b/channels.c index 8069cf1f..3fe836aa 100644 --- a/channels.c +++ b/channels.c @@ -1,4 +1,4 @@ -/* $OpenBSD: channels.c,v 1.345 2015/06/30 05:23:25 djm Exp $ */ +/* $OpenBSD: channels.c,v 1.346 2015/06/30 05:25:07 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -2641,7 +2641,7 @@ channel_input_window_adjust(int type, u_int32_t seq, void *ctxt) { Channel *c; int id; - u_int adjust; + u_int adjust, tmp; if (!compat20) return 0; @@ -2657,7 +2657,10 @@ channel_input_window_adjust(int type, u_int32_t seq, void *ctxt) adjust = packet_get_int(); packet_check_eom(); debug2("channel %d: rcvd adjust %u", id, adjust); - c->remote_window += adjust; + if ((tmp = c->remote_window + adjust) < c->remote_window) + fatal("channel %d: adjust %u overflows remote window %u", + id, adjust, c->remote_window); + c->remote_window = tmp; return 0; } -- cgit v1.2.3