Additional corrections to OpenSSH buffer handling.

Obtained from:  openssh.org
Originally committed to head by: nectar

1 files changed, 3 insertions, 2 deletions

diff --git a/crypto/openssh/channels.c b/crypto/openssh/channels.c
index 1937b02..218744d 100644
--- a/crypto/openssh/channels.c
+++ b/crypto/openssh/channels.c
@@ -229,12 +229,13 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd,
 	if (found == -1) {
 		/* There are no free slots.  Take last+1 slot and expand the array.  */
 		found = channels_alloc;
-		channels_alloc += 10;
 		if (channels_alloc > 10000)
 			fatal("channel_new: internal error: channels_alloc %d "
 			    "too big.", channels_alloc);
+		channels = xrealloc(channels,
+		    (channels_alloc + 10) * sizeof(Channel *));
+		channels_alloc += 10;
 		debug2("channel: expanding %d", channels_alloc);
-		channels = xrealloc(channels, channels_alloc * sizeof(Channel *));
 		for (i = found; i < channels_alloc; i++)
 			channels[i] = NULL;
 	}