Do not record expanded size before attempting to reallocate associated

memory.

Obtained from:	OpenBSD

2 files changed, 40 insertions, 0 deletions

diff --git a/security/openssh/Makefile b/security/openssh/Makefile
index 3775909d062f..594071e2d495 100644
--- a/security/openssh/Makefile
+++ b/security/openssh/Makefile
@@ -7,6 +7,7 @@
 
 PORTNAME=	openssh
 PORTVERSION=	3.6.1
+PORTREVISION=	1
 CATEGORIES=	security
 MASTER_SITES=	ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/ \
 		ftp://ftp.usa.openbsd.org/pub/OpenBSD/OpenSSH/ \
diff --git a/security/openssh/files/patch-buffer.c b/security/openssh/files/patch-buffer.c
new file mode 100644
index 000000000000..80fcad726108
--- /dev/null
+++ b/security/openssh/files/patch-buffer.c
@@ -0,0 +1,39 @@
+*** buffer.c.orig	Sat Jun 29 06:33:59 2002
+--- buffer.c	Tue Sep 16 00:33:54 2003
+***************
+*** 69,74 ****
+--- 69,75 ----
+  void *
+  buffer_append_space(Buffer *buffer, u_int len)
+  {
++ 	u_int newlen;
+  	void *p;
+  
+  	if (len > 0x100000)
+***************
+*** 98,108 ****
+  		goto restart;
+  	}
+  	/* Increase the size of the buffer and retry. */
+! 	buffer->alloc += len + 32768;
+! 	if (buffer->alloc > 0xa00000)
+  		fatal("buffer_append_space: alloc %u not supported",
+! 		    buffer->alloc);
+! 	buffer->buf = xrealloc(buffer->buf, buffer->alloc);
+  	goto restart;
+  	/* NOTREACHED */
+  }
+--- 99,111 ----
+  		goto restart;
+  	}
+  	/* Increase the size of the buffer and retry. */
+! 	
+! 	newlen = buffer->alloc + len + 32768;
+! 	if (newlen > 0xa00000)
+  		fatal("buffer_append_space: alloc %u not supported",
+! 		    newlen);
+! 	buffer->buf = xrealloc(buffer->buf, newlen);
+! 	buffer->alloc = newlen;
+  	goto restart;
+  	/* NOTREACHED */
+  }