channels: Fix incorrect return values in ssh_channel_write().

(cherry picked from commit 13227714f25b57b95594f33d395bc3cea0b7fe8e)

1 files changed, 12 insertions, 3 deletions

diff --git a/src/channels.c b/src/channels.c
index 89acaa8e..ca730868 100644
--- a/src/channels.c
+++ b/src/channels.c
@@ -22,6 +22,7 @@
  * MA 02111-1307, USA.
  */
 
+#include <limits.h>
 #include <string.h>
 #include <stdlib.h>
 #include <stdio.h>
@@ -1129,7 +1130,7 @@ error:
 int channel_write_common(ssh_channel channel, const void *data,
     uint32_t len, int is_stderr) {
   ssh_session session;
-  int origlen = len;
+  uint32_t origlen = len;
   size_t effectivelen;
   size_t maxpacketlen;
 
@@ -1142,6 +1143,12 @@ int channel_write_common(ssh_channel channel, const void *data,
       return -1;
   }
 
+  if (len > INT_MAX) {
+      ssh_log(session, SSH_LOG_PROTOCOL,
+              "Length (%u) is bigger than INT_MAX", len);
+      return SSH_ERROR;
+  }
+
   enter_function();
 
   /*
@@ -1184,7 +1191,7 @@ int channel_write_common(ssh_channel channel, const void *data,
           /* nothing can be written */
           ssh_log(session, SSH_LOG_PROTOCOL,
                 "Wait for a growing window message...");
-          return 0;
+          goto out;
       }
       effectivelen = len > channel->remote_window ? channel->remote_window : len;
     } else {
@@ -1224,8 +1231,10 @@ int channel_write_common(ssh_channel channel, const void *data,
     data = ((uint8_t*)data + effectivelen);
   }
 
+out:
   leave_function();
-  return origlen;
+  return (int)(origlen - len);
+
 error:
   buffer_reinit(session->out_buffer);