The unified diff between revisions [fdd44441..] and [1d86a4f0..] is displayed below. It can also be downloaded as a raw diff.

This diff has been restricted to the following files: 'common-channel.c'

#
#
# patch "common-channel.c"
#  from [522b3539ac8ac8feb32efd8c3e7a0490e51b29c3]
#    to [42c4b46eac09d7abf45f066a008e5d2cafbb0127]
#
============================================================
--- common-channel.c	522b3539ac8ac8feb32efd8c3e7a0490e51b29c3
+++ common-channel.c	42c4b46eac09d7abf45f066a008e5d2cafbb0127
@@ -147,6 +147,7 @@ struct Channel* newchannel(unsigned int
 	newchan->outfd = FD_UNINIT;
 	newchan->errfd = FD_CLOSED; /* this isn't always set to start with */
 	newchan->initconn = 0;
+	newchan->await_open = 0;

 	newchan->writebuf = cbuf_new(RECV_MAXWINDOW);
 	newchan->extrabuf = NULL; /* The user code can set it up */
@@ -409,9 +410,9 @@ static void writechannel(struct Channel*
 		channel->recvdonelen = 0;
 	}

-	assert(channel->recvwindow <= RECV_MAXWINDOW);
-	assert(channel->recvwindow <= cbuf_getavail(channel->writebuf));
-	assert(channel->extrabuf == NULL ||
+	dropbear_assert(channel->recvwindow <= RECV_MAXWINDOW);
+	dropbear_assert(channel->recvwindow <= cbuf_getavail(channel->writebuf));
+	dropbear_assert(channel->extrabuf == NULL ||
 			channel->recvwindow <= cbuf_getavail(channel->extrabuf));


@@ -603,14 +604,14 @@ static void send_msg_channel_data(struct

 	CHECKCLEARTOWRITE();

-	assert(!channel->sentclosed);
+	dropbear_assert(!channel->sentclosed);

 	if (isextended) {
 		fd = channel->errfd;
 	} else {
 		fd = channel->outfd;
 	}
-	assert(fd >= 0);
+	dropbear_assert(fd >= 0);

 	maxlen = MIN(channel->transwindow, channel->transmaxpacket);
 	/* -(1+4+4) is SSH_MSG_CHANNEL_DATA, channel number, string length, and
@@ -718,9 +719,9 @@ void common_recv_msg_channel_data(struct
 		len -= buflen;
 	}

-	assert(channel->recvwindow >= datalen);
+	dropbear_assert(channel->recvwindow >= datalen);
 	channel->recvwindow -= datalen;
-	assert(channel->recvwindow <= RECV_MAXWINDOW);
+	dropbear_assert(channel->recvwindow <= RECV_MAXWINDOW);

 	TRACE(("leave recv_msg_channel_data"))
 }
@@ -933,6 +934,8 @@ int send_msg_channel_open_init(int fd, c
 	chan->infd = chan->outfd = fd;
 	ses.maxfd = MAX(ses.maxfd, fd);

+	chan->await_open = 1;
+
 	/* now open the channel connection */
 	CHECKCLEARTOWRITE();

@@ -960,6 +963,11 @@ void recv_msg_channel_open_confirmation(
 		dropbear_exit("Unknown channel");
 	}

+	if (!channel->await_open) {
+		dropbear_exit("unexpected channel reply");
+	}
+	channel->await_open = 0;
+
 	channel->remotechan =  buf_getint(ses.payload);
 	channel->transwindow = buf_getint(ses.payload);
 	channel->transmaxpacket = buf_getint(ses.payload);
@@ -990,6 +998,11 @@ void recv_msg_channel_open_failure() {
 		dropbear_exit("Unknown channel");
 	}

+	if (!channel->await_open) {
+		dropbear_exit("unexpected channel reply");
+	}
+	channel->await_open = 0;
+
 	removechannel(channel);
 }
 #endif /* USING_LISTENERS */