CVE-2012-4562: Fix a possible infinite loop in buffer_reinit().

If needed is bigger than the highest power of two or a which fits in an
integer we will loop forever.

1 files changed, 9 insertions, 4 deletions

diff --git a/src/buffer.c b/src/buffer.c
index 3de4f3e3..ca120868 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -111,13 +111,18 @@ void ssh_buffer_free(struct ssh_buffer_struct *buffer) {
   SAFE_FREE(buffer);
 }
 
-static int realloc_buffer(struct ssh_buffer_struct *buffer, int needed) {
-  int smallest = 1;
-  char *new = NULL;
+static int realloc_buffer(struct ssh_buffer_struct *buffer, size_t needed) {
+  size_t smallest = 1;
+  char *new;
+
   buffer_verify(buffer);
+
   /* Find the smallest power of two which is greater or equal to needed */
   while(smallest <= needed) {
-    smallest <<= 1;
+      if (smallest == 0) {
+          return -1;
+      }
+      smallest <<= 1;
   }
   needed = smallest;
   new = realloc(buffer->data, needed);