free(newpayload);
sfree(newpayload);
static int ssh2_rdpkt(unsigned char **data, int *datalen){    struct rdpkt2_state_tag *st = &rdpkt2_state;    crBegin;next_packet:    pktin.type = 0;    pktin.length = 0;    if (sccipher)        st->cipherblk = sccipher->blksize;    else        st->cipherblk = 8;    if (st->cipherblk < 8)        st->cipherblk = 8;    if (pktin.maxlen < st->cipherblk) {	pktin.maxlen = st->cipherblk;	pktin.data = (pktin.data == NULL ? malloc(st->cipherblk+APIEXTRA) :	              realloc(pktin.data, st->cipherblk+APIEXTRA));	if (!pktin.data)	    fatalbox("Out of memory");    }    /*     * Acquire and decrypt the first block of the packet. This will     * contain the length and padding details.     */     for (st->i = st->len = 0; st->i < st->cipherblk; st->i++) {	while ((*datalen) == 0)	    crReturn(st->cipherblk-st->i);	pktin.data[st->i] = *(*data)++;        (*datalen)--;    }#ifdef FWHACK    if (!memcmp(pktin.data, "Remo", 4)) {/* "Remo"te server has closed ... */        /* FIXME */    }#endif    if (sccipher)        sccipher->decrypt(pktin.data, st->cipherblk);    /*     * Now get the length and padding figures.     */    st->len = GET_32BIT(pktin.data);    st->pad = pktin.data[4];    /*     * This enables us to deduce the payload length.     */    st->payload = st->len - st->pad - 1;    pktin.length = st->payload + 5;    /*     * So now we can work out the total packet length.     */    st->packetlen = st->len + 4;    st->maclen = scmac ? scmac->len : 0;    /*     * Adjust memory allocation if packet is too big.     */    if (pktin.maxlen < st->packetlen+st->maclen) {	pktin.maxlen = st->packetlen+st->maclen;	pktin.data = (pktin.data == NULL ? malloc(pktin.maxlen+APIEXTRA) :	              realloc(pktin.data, pktin.maxlen+APIEXTRA));	if (!pktin.data)	    fatalbox("Out of memory");    }    /*     * Read and decrypt the remainder of the packet.     */    for (st->i = st->cipherblk; st->i < st->packetlen + st->maclen; st->i++) {	while ((*datalen) == 0)	    crReturn(st->packetlen + st->maclen - st->i);	pktin.data[st->i] = *(*data)++;        (*datalen)--;    }    /* Decrypt everything _except_ the MAC. */    if (sccipher)        sccipher->decrypt(pktin.data + st->cipherblk,                          st->packetlen - st->cipherblk);#if 0    debug(("Got packet len=%d pad=%d\r\n", st->len, st->pad));    for (st->i = 0; st->i < st->packetlen; st->i++)        debug(("  %02x", (unsigned char)pktin.data[st->i]));    debug(("\r\n"));#endif    /*     * Check the MAC.     */    if (scmac && !scmac->verify(pktin.data, st->len+4, st->incoming_sequence)) {	bombout(("Incorrect MAC received on packet"));        crReturn(0);    }    st->incoming_sequence++;               /* whether or not we MACed */    /*     * Decompress packet payload.     */    {	unsigned char *newpayload;	int newlen;	if (sccomp && sccomp->decompress(pktin.data+5, pktin.length-5,					 &newpayload, &newlen)) {	    if (pktin.maxlen < newlen+5) {		pktin.maxlen = newlen+5;		pktin.data = (pktin.data == NULL ? malloc(pktin.maxlen+APIEXTRA) :			      realloc(pktin.data, pktin.maxlen+APIEXTRA));		if (!pktin.data)		    fatalbox("Out of memory");	    }	    pktin.length = 5 + newlen;	    memcpy(pktin.data+5, newpayload, newlen);#if 0	    debug(("Post-decompression payload:\r\n"));	    for (st->i = 0; st->i < newlen; st->i++)		debug(("  %02x", (unsigned char)pktin.data[5+st->i]));	    debug(("\r\n"));#endif	    free(newpayload);	}    }    pktin.savedpos = 6;    pktin.type = pktin.data[5];    if (pktin.type == SSH2_MSG_IGNORE || pktin.type == SSH2_MSG_DEBUG)        goto next_packet;              /* FIXME: print DEBUG message */    crFinish(0);}