search for: incoming_stream

Howdy, I've found two bugs in the OpenSSH 2.9p2 source code. I had a look into the latest source-tree available at openssh.com, and they seem still there: -- 'incoming_stream' is used in place of 'outgoing_stream', file compress.c, line 36: void buffer_compress_init_send(int level) { if (compress_init_send_called == 1) deflateEnd(&incoming_stream); ****** should be &outgoing_stream compress_init_send_called = 1; debug("Enabling compression...

...s with "fatal: buffer_append_space: alloc 10506240 not supported" anytime privsep is on and compression is on. After some digging, we were able to trace the problem to "buffer_uncompress" in compress.c - it seems that in some circumstances the inflate call returns Z_OK and incoming_stream.avail_out == 0, thus the program alloc's another sizeof(buf)-0 = 4096 bytes for the output_buffer, then repeats the call to inflate, which again returns status==0 and avail_out==0, thus entering an infinite loop. This is what happens under strace: =====[cut here]===== [pid 8379] old_mmap...

...ODE_IN, p); - buffer_put_string(&m, p, plen); + buffer_put_binary(&m, p, plen); xfree(p); /* Compression state */ debug3("%s: Sending compression state", __func__); - buffer_put_string(&m, &outgoing_stream, sizeof(outgoing_stream)); - buffer_put_string(&m, &incoming_stream, sizeof(incoming_stream)); + buffer_put_binary(&m, &outgoing_stream, sizeof(outgoing_stream)); + buffer_put_binary(&m, &incoming_stream, sizeof(incoming_stream)); /* Network I/O buffers */ - buffer_put_string(&m, buffer_ptr(&input), buffer_len(&input)); - buffer_put_...