===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/authfile.c,v
retrieving revision 1.55
retrieving revision 1.56
diff -u -r1.55 -r1.56
--- src/usr.bin/ssh/authfile.c	2003/09/18 07:56:05	1.55
+++ src/usr.bin/ssh/authfile.c	2004/05/11 19:01:43	1.56
@@ -36,7 +36,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: authfile.c,v 1.55 2003/09/18 07:56:05 markus Exp $");
+RCSID("$OpenBSD: authfile.c,v 1.56 2004/05/11 19:01:43 deraadt Exp $");
 
 #include <openssl/err.h>
 #include <openssl/evp.h>
@@ -236,14 +236,16 @@
 	struct stat st;
 	char *cp;
 	int i;
-	off_t len;
+	size_t len;
 
 	if (fstat(fd, &st) < 0) {
 		error("fstat for key file %.200s failed: %.100s",
 		    filename, strerror(errno));
 		return NULL;
 	}
-	len = st.st_size;
+	if (st.st_size > 1*1024*1024)
+		close(fd);
+	len = (size_t)st.st_size;		/* truncated */
 
 	buffer_init(&buffer);
 	cp = buffer_append_space(&buffer, len);
@@ -318,7 +320,7 @@
     char **commentp)
 {
 	int i, check1, check2, cipher_type;
-	off_t len;
+	size_t len;
 	Buffer buffer, decrypted;
 	u_char *cp;
 	CipherContext ciphercontext;
@@ -332,7 +334,11 @@
 		close(fd);
 		return NULL;
 	}
-	len = st.st_size;
+	if (st.st_size > 1*1024*1024) {
+		close(fd);
+		return (NULL);
+	}
+	len = (size_t)st.st_size;		/* truncated */
 
 	buffer_init(&buffer);
 	cp = buffer_append_space(&buffer, len);