int msglen = GET_32BIT(pktin.body); int nowlen;
unsigned msglen = GET_32BIT(pktin.body); unsigned nowlen;
static int ssh1_rdpkt(unsigned char **data, int *datalen){    struct rdpkt1_state_tag *st = &rdpkt1_state;    crBegin;next_packet:    pktin.type = 0;    pktin.length = 0;    for (st->i = st->len = 0; st->i < 4; st->i++) {	while ((*datalen) == 0)	    crReturn(4-st->i);	st->len = (st->len << 8) + **data;	(*data)++, (*datalen)--;    }#ifdef FWHACK    if (st->len == 0x52656d6f) {        /* "Remo"te server has closed ... */        st->len = 0x300;                /* big enough to carry to end */    }#endif    st->pad = 8 - (st->len % 8);    st->biglen = st->len + st->pad;    pktin.length = st->len - 5;    if (pktin.maxlen < st->biglen) {	pktin.maxlen = st->biglen;	pktin.data = (pktin.data == NULL ? smalloc(st->biglen+APIEXTRA) :	              srealloc(pktin.data, st->biglen+APIEXTRA));	if (!pktin.data)	    fatalbox("Out of memory");    }    st->to_read = st->biglen;    st->p = pktin.data;    while (st->to_read > 0) {        st->chunk = st->to_read;	while ((*datalen) == 0)	    crReturn(st->to_read);	if (st->chunk > (*datalen))	    st->chunk = (*datalen);	memcpy(st->p, *data, st->chunk);	*data += st->chunk;	*datalen -= st->chunk;	st->p += st->chunk;	st->to_read -= st->chunk;    }    if (cipher)	cipher->decrypt(pktin.data, st->biglen);#if 0    debug(("Got packet len=%d pad=%d\r\n", st->len, st->pad));    for (st->i = 0; st->i < st->biglen; st->i++)        debug(("  %02x", (unsigned char)pktin.data[st->i]));    debug(("\r\n"));#endif    st->realcrc = crc32(pktin.data, st->biglen-4);    st->gotcrc = GET_32BIT(pktin.data+st->biglen-4);    if (st->gotcrc != st->realcrc) {	bombout(("Incorrect CRC received on packet"));        crReturn(0);    }    pktin.body = pktin.data + st->pad + 1;    if (ssh1_compressing) {	unsigned char *decompblk;	int decomplen;#if 0        {            int i;            debug(("Packet payload pre-decompression:\n"));            for (i = -1; i < pktin.length; i++)                debug(("  %02x", (unsigned char)pktin.body[i]));            debug(("\r\n"));        }#endif	zlib_decompress_block(pktin.body-1, pktin.length+1,			      &decompblk, &decomplen);	if (pktin.maxlen < st->pad + decomplen) {	    pktin.maxlen = st->pad + decomplen;	    pktin.data = srealloc(pktin.data, pktin.maxlen+APIEXTRA);            pktin.body = pktin.data + st->pad + 1;	    if (!pktin.data)		fatalbox("Out of memory");	}	memcpy(pktin.body-1, decompblk, decomplen);	sfree(decompblk);	pktin.length = decomplen-1;#if 0        {            int i;            debug(("Packet payload post-decompression:\n"));            for (i = -1; i < pktin.length; i++)                debug(("  %02x", (unsigned char)pktin.body[i]));            debug(("\r\n"));        }#endif    }    if (pktin.type == SSH1_SMSG_STDOUT_DATA ||        pktin.type == SSH1_SMSG_STDERR_DATA ||        pktin.type == SSH1_MSG_DEBUG ||        pktin.type == SSH1_SMSG_AUTH_TIS_CHALLENGE ||        pktin.type == SSH1_SMSG_AUTH_CCARD_CHALLENGE) {	long strlen = GET_32BIT(pktin.body);	if (strlen + 4 != pktin.length) {	    bombout(("Received data packet with bogus string length"));            crReturn(0);        }    }    pktin.type = pktin.body[-1];    if (pktin.type == SSH1_MSG_DEBUG) {	/* log debug message */	char buf[80];	int strlen = GET_32BIT(pktin.body);	strcpy(buf, "Remote: ");	if (strlen > 70) strlen = 70;	memcpy(buf+8, pktin.body+4, strlen);	buf[8+strlen] = '\0';	logevent(buf);	goto next_packet;    } else if (pktin.type == SSH1_MSG_IGNORE) {	/* do nothing */	goto next_packet;    }    if (pktin.type == SSH1_MSG_DISCONNECT) {	/* log reason code in disconnect message */	char buf[256];	int msglen = GET_32BIT(pktin.body);	int nowlen;	strcpy(buf, "Remote sent disconnect: ");	nowlen = strlen(buf);	if (msglen > sizeof(buf)-nowlen-1)	    msglen = sizeof(buf)-nowlen-1;	memcpy(buf+nowlen, pktin.body+4, msglen);	buf[nowlen+msglen] = '\0';	logevent(buf);    }    crFinish(0);}