search for: sshbuf_set_max_size

...->alloc != SSHBUF_SIZE_INIT, which can put buf in an inconsistent state if buf->max_size < SSHBUF_SIZE_INIT, because it will make buf->alloc > buf->max_size true, which will trigger an error with a next call to sshbuf_check_sanity(). For example, struct sshbuf *buf = sshbuf_new(); sshbuf_set_max_size(buf, 100); sshbuf_reset(buf); will lead to SSH_ERR_INTERNAL_ERROR. This code is of course just for demonstration, but the thing is that an sshbuf object can be put into invalid state through its public API. Or it is just assumed that no one will ever set ->max_size to a value less than SSHBUF_SI...