More versions of WeOnlyDo have the rekey bug (but they've fixed it now).

[u/mdw/putty] / ssh.c

diff --git a/ssh.c b/ssh.c
index 2b2b1dc..ee9345e 100644 (file)
--- a/ssh.c
+++ b/ssh.c
@@ -2249,7 +2249,9 @@ static void ssh_detect_bugs(Ssh ssh, char *vstring)
          wc_match("OpenSSH_2.[0-4]*", imp) ||
          wc_match("OpenSSH_2.5.[0-3]*", imp) ||
          wc_match("Sun_SSH_1.0", imp) ||
-         wc_match("Sun_SSH_1.0.1", imp)))) {
+         wc_match("Sun_SSH_1.0.1", imp) ||
+         /* All versions <= 1.2.6 (they changed their format in 1.2.7) */
+         wc_match("WeOnlyDo-*", imp)))) {
        /*
         * These versions have the SSH-2 rekey bug.
         */
@@ -2495,24 +2497,29 @@ static void ssh_gotdata(Ssh ssh, unsigned char *data, int datalen)
      * everything to s_rdpkt, and then pass the resulting packets
      * to the proper protocol handler.
      */
-    if (datalen == 0)
-       crReturnV;
-
-    /*
-     * Process queued data if there is any.
-     */
-    ssh_process_queued_incoming_data(ssh);
 
     while (1) {
-       while (datalen > 0) {
-           if (ssh->frozen)
+       while (bufchain_size(&ssh->queued_incoming_data) > 0 || datalen > 0) {
+           if (ssh->frozen) {
                ssh_queue_incoming_data(ssh, &data, &datalen);
-
-           ssh_process_incoming_data(ssh, &data, &datalen);
-
+               /* This uses up all data and cannot cause anything interesting
+                * to happen; indeed, for anything to happen at all, we must
+                * return, so break out. */
+               break;
+           } else if (bufchain_size(&ssh->queued_incoming_data) > 0) {
+               /* This uses up some or all data, and may freeze the
+                * session. */
+               ssh_process_queued_incoming_data(ssh);
+           } else {
+               /* This uses up some or all data, and may freeze the
+                * session. */
+               ssh_process_incoming_data(ssh, &data, &datalen);
+           }
+           /* FIXME this is probably EBW. */
            if (ssh->state == SSH_STATE_CLOSED)
                return;
        }
+       /* We're out of data. Go and get some more. */
        crReturnV;
     }
     crFinishV;