if (ssh->v1_compressing) {
unsigned char *decompblk;
int decomplen;
- zlib_decompress_block(ssh->sc_comp_ctx,
- ssh->pktin.body - 1, ssh->pktin.length + 1,
- &decompblk, &decomplen);
+ if (!zlib_decompress_block(ssh->sc_comp_ctx,
+ ssh->pktin.body - 1, ssh->pktin.length + 1,
+ &decompblk, &decomplen)) {
+ bombout(("Zlib decompression encountered invalid data"));
+ crStop(0);
+ }
if (ssh->pktin.maxlen < st->pad + decomplen) {
ssh->pktin.maxlen = st->pad + decomplen;
(ssh->cfg.sshbug_ignore1 == AUTO &&
(!strcmp(imp, "1.2.18") || !strcmp(imp, "1.2.19") ||
!strcmp(imp, "1.2.20") || !strcmp(imp, "1.2.21") ||
- !strcmp(imp, "1.2.22") || !strcmp(imp, "Cisco-1.25")))) {
+ !strcmp(imp, "1.2.22") || !strcmp(imp, "Cisco-1.25") ||
+ !strcmp(imp, "OSU_1.4alpha3")))) {
/*
* These versions don't support SSH1_MSG_IGNORE, so we have
* to use a different defence against password length
if (ssh->cfg.sshbug_plainpw1 == FORCE_ON ||
(ssh->cfg.sshbug_plainpw1 == AUTO &&
- (!strcmp(imp, "Cisco-1.25")))) {
+ (!strcmp(imp, "Cisco-1.25") || !strcmp(imp, "OSU_1.4alpha3")))) {
/*
* These versions need a plain password sent; they can't
* handle having a null and a random length of data after
ssh->fn = &fn_table;
ssh->s = new_connection(addr, *realhost, port,
0, 1, nodelay, (Plug) ssh, &ssh->cfg);
- sk_addr_free(addr);
if ((err = sk_socket_error(ssh->s)) != NULL) {
ssh->s = NULL;
return err;