diff options
| -rw-r--r-- | src/channels.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/src/channels.c b/src/channels.c index 89acaa8e..ca730868 100644 --- a/src/channels.c +++ b/src/channels.c @@ -22,6 +22,7 @@ * MA 02111-1307, USA. */ +#include <limits.h> #include <string.h> #include <stdlib.h> #include <stdio.h> @@ -1129,7 +1130,7 @@ error: int channel_write_common(ssh_channel channel, const void *data, uint32_t len, int is_stderr) { ssh_session session; - int origlen = len; + uint32_t origlen = len; size_t effectivelen; size_t maxpacketlen; @@ -1142,6 +1143,12 @@ int channel_write_common(ssh_channel channel, const void *data, return -1; } + if (len > INT_MAX) { + ssh_log(session, SSH_LOG_PROTOCOL, + "Length (%u) is bigger than INT_MAX", len); + return SSH_ERROR; + } + enter_function(); /* @@ -1184,7 +1191,7 @@ int channel_write_common(ssh_channel channel, const void *data, /* nothing can be written */ ssh_log(session, SSH_LOG_PROTOCOL, "Wait for a growing window message..."); - return 0; + goto out; } effectivelen = len > channel->remote_window ? channel->remote_window : len; } else { @@ -1224,8 +1231,10 @@ int channel_write_common(ssh_channel channel, const void *data, data = ((uint8_t*)data + effectivelen); } +out: leave_function(); - return origlen; + return (int)(origlen - len); + error: buffer_reinit(session->out_buffer); |