===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/clientloop.c,v
retrieving revision 1.275.2.2
retrieving revision 1.276
diff -u -r1.275.2.2 -r1.276
--- src/usr.bin/ssh/clientloop.c	2016/01/27 12:19:42	1.275.2.2
+++ src/usr.bin/ssh/clientloop.c	2015/10/20 03:36:35	1.276
@@ -1,4 +1,4 @@
-/* $OpenBSD: clientloop.c,v 1.275.2.2 2016/01/27 12:19:42 sthen Exp $ */
+/* $OpenBSD: clientloop.c,v 1.276 2015/10/20 03:36:35 mmcc Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -280,9 +280,6 @@
 {
 	size_t i, dlen;
 
-	if (display == NULL)
-		return 0;
-
 	dlen = strlen(display);
 	for (i = 0; i < dlen; i++) {
 		if (!isalnum((u_char)display[i]) &&
@@ -296,34 +293,34 @@
 
 #define SSH_X11_PROTO		"MIT-MAGIC-COOKIE-1"
 #define X11_TIMEOUT_SLACK	60
-int
+void
 client_x11_get_proto(const char *display, const char *xauth_path,
     u_int trusted, u_int timeout, char **_proto, char **_data)
 {
-	char cmd[1024], line[512], xdisplay[512];
+	char cmd[1024];
+	char line[512];
+	char xdisplay[512];
 	static char proto[512], data[512];
 	FILE *f;
-	int got_data = 0, generated = 0, do_unlink = 0, i, r;
-	char *xauthdir, *xauthfile;
+	int got_data = 0, generated = 0, do_unlink = 0, i;
+	char xauthdir[PATH_MAX] = "", xauthfile[PATH_MAX] = "";
 	struct stat st;
 	u_int now, x11_timeout_real;
 
-	xauthdir = xauthfile = NULL;
 	*_proto = proto;
 	*_data = data;
 	proto[0] = data[0] = '\0';
 
-	if (!client_x11_display_valid(display)) {
-		logit("DISPLAY \"%s\" invalid; disabling X11 forwarding",
-		    display);
-		return -1;
-	}
-	if (xauth_path != NULL && stat(xauth_path, &st) == -1) {
+	if (xauth_path == NULL ||(stat(xauth_path, &st) == -1)) {
 		debug("No xauth program.");
-		xauth_path = NULL;
-	}
-
-	if (xauth_path != NULL) {
+	} else if (!client_x11_display_valid(display)) {
+		logit("DISPLAY '%s' invalid, falling back to fake xauth data",
+		    display);
+	} else {
+		if (display == NULL) {
+			debug("x11_get_proto: DISPLAY not set");
+			return;
+		}
 		/*
 		 * Handle FamilyLocal case where $DISPLAY does
 		 * not match an authorization entry.  For this we
@@ -332,62 +329,43 @@
 		 *      is not perfect.
 		 */
 		if (strncmp(display, "localhost:", 10) == 0) {
-			if ((r = snprintf(xdisplay, sizeof(xdisplay), "unix:%s",
-			    display + 10)) < 0 ||
-			    (size_t)r >= sizeof(xdisplay)) {
-				error("%s: display name too long", __func__);
-				return -1;
-			}
+			snprintf(xdisplay, sizeof(xdisplay), "unix:%s",
+			    display + 10);
 			display = xdisplay;
 		}
 		if (trusted == 0) {
-			xauthdir = xmalloc(PATH_MAX);
-			xauthfile = xmalloc(PATH_MAX);
+			mktemp_proto(xauthdir, PATH_MAX);
 			/*
-			 * Generate an untrusted X11 auth cookie.
-			 *
 			 * The authentication cookie should briefly outlive
 			 * ssh's willingness to forward X11 connections to
 			 * avoid nasty fail-open behaviour in the X server.
 			 */
-			mktemp_proto(xauthdir, PATH_MAX);
-			if (mkdtemp(xauthdir) == NULL) {
-				error("%s: mkdtemp: %s",
-				    __func__, strerror(errno));
-				return -1;
-			}
-			do_unlink = 1;
-			if ((r = snprintf(xauthfile, PATH_MAX,
-			    "%s/xauthfile", xauthdir)) < 0 ||
-			    (size_t)r >= PATH_MAX) {
-				error("%s: xauthfile path too long", __func__);
-				unlink(xauthfile);
-				rmdir(xauthdir);
-				return -1;
-			}
-
 			if (timeout >= UINT_MAX - X11_TIMEOUT_SLACK)
 				x11_timeout_real = UINT_MAX;
 			else
 				x11_timeout_real = timeout + X11_TIMEOUT_SLACK;
-			if ((r = snprintf(cmd, sizeof(cmd),
-			    "%s -f %s generate %s " SSH_X11_PROTO
-			    " untrusted timeout %u 2>" _PATH_DEVNULL,
-			    xauth_path, xauthfile, display,
-			    x11_timeout_real)) < 0 ||
-			    (size_t)r >= sizeof(cmd))
-				fatal("%s: cmd too long", __func__);
-			debug2("%s: %s", __func__, cmd);
-			if (x11_refuse_time == 0) {
-				now = monotime() + 1;
-				if (UINT_MAX - timeout < now)
-					x11_refuse_time = UINT_MAX;
-				else
-					x11_refuse_time = now + timeout;
-				channel_set_x11_refuse_time(x11_refuse_time);
+			if (mkdtemp(xauthdir) != NULL) {
+				do_unlink = 1;
+				snprintf(xauthfile, PATH_MAX, "%s/xauthfile",
+				    xauthdir);
+				snprintf(cmd, sizeof(cmd),
+				    "%s -f %s generate %s " SSH_X11_PROTO
+				    " untrusted timeout %u 2>" _PATH_DEVNULL,
+				    xauth_path, xauthfile, display,
+				    x11_timeout_real);
+				debug2("x11_get_proto: %s", cmd);
+				if (x11_refuse_time == 0) {
+					now = monotime() + 1;
+					if (UINT_MAX - timeout < now)
+						x11_refuse_time = UINT_MAX;
+					else
+						x11_refuse_time = now + timeout;
+					channel_set_x11_refuse_time(
+					    x11_refuse_time);
+				}
+				if (system(cmd) == 0)
+					generated = 1;
 			}
-			if (system(cmd) == 0)
-				generated = 1;
 		}
 
 		/*
@@ -409,23 +387,16 @@
 				got_data = 1;
 			if (f)
 				pclose(f);
-		}
+		} else
+			error("Warning: untrusted X11 forwarding setup failed: "
+			    "xauth key data not generated");
 	}
 
 	if (do_unlink) {
 		unlink(xauthfile);
 		rmdir(xauthdir);
 	}
-	free(xauthdir);
-	free(xauthfile);
 
-	/* Don't fall back to fake X11 data for untrusted forwarding */
-	if (!trusted && !got_data) {
-		error("Warning: untrusted X11 forwarding setup failed: "
-		    "xauth key data not generated");
-		return -1;
-	}
-
 	/*
 	 * If we didn't get authentication data, just make up some
 	 * data.  The forwarding code will check the validity of the
@@ -448,8 +419,6 @@
 			rnd >>= 8;
 		}
 	}
-
-	return 0;
 }
 
 /*