X-Git-Url: https://git.distorted.org.uk/~mdw/sgt/putty/blobdiff_plain/d9add7bc6646db3641d4e2b189be62ac8f63185e..6ca3d5c624967e03f407f4ebf59c7a762cec71a5:/ssh.c

diff --git a/ssh.c b/ssh.c
index 808327d0..eed4e643 100644
--- a/ssh.c
+++ b/ssh.c
@@ -1052,7 +1052,7 @@ static void c_write_stderr(int trusted, const char *buf, int len)
 {
     int i;
     for (i = 0; i < len; i++)
-	if (buf[i] != '\r' && (trusted || buf[i] & 0x60))
+	if (buf[i] != '\r' && (trusted || buf[i] == '\n' || (buf[i] & 0x60)))
 	    fputc(buf[i], stderr);
 }
 
@@ -1489,6 +1489,7 @@ static struct Packet *construct_packet(Ssh ssh, int pkttype, va_list ap)
 
     while ((argtype = va_arg(ap, int)) != PKT_END) {
 	unsigned char *argp, argchar;
+	char *sargp;
 	unsigned long argint;
 	int arglen;
 	switch (argtype) {
@@ -1507,8 +1508,8 @@ static struct Packet *construct_packet(Ssh ssh, int pkttype, va_list ap)
 	    ssh_pkt_adddata(pkt, argp, arglen);
 	    break;
 	  case PKT_STR:
-	    argp = va_arg(ap, unsigned char *);
-	    ssh_pkt_addstring(pkt, argp);
+	    sargp = va_arg(ap, char *);
+	    ssh_pkt_addstring(pkt, sargp);
 	    break;
 	  case PKT_BIGNUM:
 	    bn = va_arg(ap, Bignum);
@@ -1654,7 +1655,7 @@ static void ssh_pkt_addstring(struct Packet *pkt, char *data)
 static void ssh1_pkt_addmp(struct Packet *pkt, Bignum b)
 {
     int len = ssh1_bignum_length(b);
-    unsigned char *data = snewn(len, char);
+    unsigned char *data = snewn(len, unsigned char);
     (void) ssh1_write_bignum(data, b);
     ssh_pkt_adddata(pkt, data, len);
     sfree(data);
@@ -2166,6 +2167,13 @@ static void ssh_detect_bugs(Ssh ssh, char *vstring)
 
     ssh->remote_bugs = 0;
 
+    /*
+     * General notes on server version strings:
+     *  - Not all servers reporting "Cisco-1.25" have all the bugs listed
+     *    here -- in particular, we've heard of one that's perfectly happy
+     *    with SSH1_MSG_IGNOREs -- but this string never seems to change,
+     *    so we can't distinguish them.
+     */
     if (ssh->cfg.sshbug_ignore1 == FORCE_ON ||
 	(ssh->cfg.sshbug_ignore1 == AUTO &&
 	 (!strcmp(imp, "1.2.18") || !strcmp(imp, "1.2.19") ||
@@ -3703,19 +3711,19 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
 	     *    magnitude of the password length, but it will
 	     *    introduce a bit of extra uncertainty.
 	     * 
-	     * A few servers (the old 1.2.18 through 1.2.22)
-	     * can't deal with SSH1_MSG_IGNORE. For these
-	     * servers, we need an alternative defence. We make
-	     * use of the fact that the password is interpreted
-	     * as a C string: so we can append a NUL, then some
-	     * random data.
+	     * A few servers can't deal with SSH1_MSG_IGNORE, at
+	     * least in this context. For these servers, we need
+	     * an alternative defence. We make use of the fact
+	     * that the password is interpreted as a C string:
+	     * so we can append a NUL, then some random data.
 	     * 
-	     * One server (a Cisco one) can deal with neither
-	     * SSH1_MSG_IGNORE _nor_ a padded password string.
-	     * For this server we are left with no defences
+	     * A few servers can deal with neither SSH1_MSG_IGNORE
+	     * here _nor_ a padded password string.
+	     * For these servers we are left with no defences
 	     * against password length sniffing.
 	     */
-	    if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE)) {
+	    if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE) &&
+	        !(ssh->remote_bugs & BUG_NEEDS_SSH1_PLAIN_PASSWORD)) {
 		/*
 		 * The server can deal with SSH1_MSG_IGNORE, so
 		 * we can use the primary defence.
@@ -3784,10 +3792,8 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
 			    PKTT_OTHER, PKT_END);
 	    } else {
 		/*
-		 * The server has _both_
-		 * BUG_CHOKES_ON_SSH1_IGNORE and
-		 * BUG_NEEDS_SSH1_PLAIN_PASSWORD. There is
-		 * therefore nothing we can do.
+		 * The server is believed unable to cope with
+		 * any of our password camouflage methods.
 		 */
 		int len;
 		len = strlen(s->cur_prompt->prompts[0]->result);