From 096475b356245eab486ef8e79a0e85a4764d2147 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Aug 2011 16:37:29 +0200 Subject: channels: Fix incorrect return values in ssh_channel_write(). (cherry picked from commit 13227714f25b57b95594f33d395bc3cea0b7fe8e) --- src/channels.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/src/channels.c b/src/channels.c index 89acaa8e..ca730868 100644 --- a/src/channels.c +++ b/src/channels.c @@ -22,6 +22,7 @@ * MA 02111-1307, USA. */ +#include #include #include #include @@ -1129,7 +1130,7 @@ error: int channel_write_common(ssh_channel channel, const void *data, uint32_t len, int is_stderr) { ssh_session session; - int origlen = len; + uint32_t origlen = len; size_t effectivelen; size_t maxpacketlen; @@ -1142,6 +1143,12 @@ int channel_write_common(ssh_channel channel, const void *data, return -1; } + if (len > INT_MAX) { + ssh_log(session, SSH_LOG_PROTOCOL, + "Length (%u) is bigger than INT_MAX", len); + return SSH_ERROR; + } + enter_function(); /* @@ -1184,7 +1191,7 @@ int channel_write_common(ssh_channel channel, const void *data, /* nothing can be written */ ssh_log(session, SSH_LOG_PROTOCOL, "Wait for a growing window message..."); - return 0; + goto out; } effectivelen = len > channel->remote_window ? channel->remote_window : len; } else { @@ -1224,8 +1231,10 @@ int channel_write_common(ssh_channel channel, const void *data, data = ((uint8_t*)data + effectivelen); } +out: leave_function(); - return origlen; + return (int)(origlen - len); + error: buffer_reinit(session->out_buffer); -- cgit