From bb2848de5ae649e12e8205e99992ff81087d583e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 8 Oct 2012 19:52:20 +0200 Subject: channels: Check return values of buffer functions. Found by Coverity. --- src/channels.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/channels.c b/src/channels.c index 6a81e377..027fe356 100644 --- a/src/channels.c +++ b/src/channels.c @@ -654,6 +654,7 @@ SSH_PACKET_CALLBACK(channel_rcv_request) { ssh_string request_s; char *request; uint32_t status; + int rc; (void)user; (void)type; @@ -816,8 +817,14 @@ SSH_PACKET_CALLBACK(channel_rcv_request) { if(strcmp(request,"keepalive@openssh.com")==0){ SAFE_FREE(request); ssh_log(session, SSH_LOG_PROTOCOL,"Responding to Openssh's keepalive"); - buffer_add_u8(session->out_buffer, SSH2_MSG_CHANNEL_FAILURE); - buffer_add_u32(session->out_buffer, htonl(channel->remote_channel)); + rc = buffer_add_u8(session->out_buffer, SSH2_MSG_CHANNEL_FAILURE); + if (rc < 0) { + return SSH_PACKET_USED; + } + rc = buffer_add_u32(session->out_buffer, htonl(channel->remote_channel)); + if (rc < 0) { + return SSH_PACKET_USED; + } packet_send(session); leave_function(); return SSH_PACKET_USED; -- cgit v1.2.3