Attachment #1380 for bug #1390




		goto parse_int;

	case oRekeyLimit:
		intptr = &options->rekey_limit;
		arg = strdelim(&s);
		if (!arg || *arg == '\0')
			fatal("%.200s line %d: Missing argument.", filename, linenum);

		}
		val64 *= scale;
		/* detect integer wrap and too-large limits */
		if ((val64 / scale) != orig || val64 > UINT_MAX)
			fatal("%.200s line %d: RekeyLimit too large",
			    filename, linenum);
		if (val64 < 16)
			fatal("%.200s line %d: RekeyLimit too small",
			    filename, linenum);
		if (*activep && options->rekey_limit == -1)
			options->rekey_limit = (u_int32_t)val64;
		break;

	case oIdentityFile:

Lines 100-106 Link Here

(-)openssh-4.7p1/readconf.h (-1 / +1 lines)
100	int clear_forwardings;	100	int clear_forwardings;
101		101
102	int enable_ssh_keysign;	102	int enable_ssh_keysign;
103	int rekey_limit;	103	u_int32_t rekey_limit;
104	int no_host_authentication_for_localhost;	104	int no_host_authentication_for_localhost;
105	int identities_only;	105	int identities_only;
106	int server_alive_interval;	106	int server_alive_interval;

Return to bug 1390

Lines 498-504 Link Here

(-)openssh-4.7p1/readconf.c (-4 / +3 lines)
498	goto parse_int;	498	goto parse_int;
499		499
500	case oRekeyLimit:	500	case oRekeyLimit:
501	intptr = &options->rekey_limit;
502	arg = strdelim(&s);	501	arg = strdelim(&s);
503	if (!arg \|\| *arg == '\0')	502	if (!arg \|\| *arg == '\0')
504	fatal("%.200s line %d: Missing argument.", filename, linenum);	503	fatal("%.200s line %d: Missing argument.", filename, linenum);
Lines 526-539 Link Here
526	}	525	}
527	val64 *= scale;	526	val64 *= scale;
528	/* detect integer wrap and too-large limits */	527	/* detect integer wrap and too-large limits */
529	if ((val64 / scale) != orig \|\| val64 > INT_MAX)	528	if ((val64 / scale) != orig \|\| val64 > UINT_MAX)
530	fatal("%.200s line %d: RekeyLimit too large",	529	fatal("%.200s line %d: RekeyLimit too large",
531	filename, linenum);	530	filename, linenum);
532	if (val64 < 16)	531	if (val64 < 16)
533	fatal("%.200s line %d: RekeyLimit too small",	532	fatal("%.200s line %d: RekeyLimit too small",
534	filename, linenum);	533	filename, linenum);
535	if (activep && intptr == -1)	534	if (*activep && options->rekey_limit == -1)
536	*intptr = (int)val64;	535	options->rekey_limit = (u_int32_t)val64;
537	break;	536	break;
538		537
539	case oIdentityFile:	538	case oIdentityFile: