Issue 2379 – Failure when canceling reconnection on authentication banner, when the connection was already closed by the server

https://winscp.net/tracker/2379

Source commit: 6797a6eb7c41fff0ae0fe6b2ae8d7be0a1db52c6

source/Putty.cbproj

@@ -66,7 +66,7 @@
         <OutputExt>lib</OutputExt>
         <ProjectType>CppStaticLibrary</ProjectType>
         <SanitizedProjectName>Putty</SanitizedProjectName>
-        <TLIB_PageSize>256</TLIB_PageSize>
+        <TLIB_PageSize>512</TLIB_PageSize>
         <VerInfo_Keys>CompanyName=;FileDescription=;FileVersion=1.0.0.0;InternalName=;LegalCopyright=;LegalTrademarks=;OriginalFilename=;ProductName=;ProductVersion=1.0.0.0;Comments=</VerInfo_Keys>
         <VerInfo_Locale>1033</VerInfo_Locale>
     </PropertyGroup>

source/core/Terminal.cpp

@@ -409,7 +409,8 @@ bool __fastcall TCallbackGuard::Verify(Exception * E)
     (dynamic_cast<ECallbackGuardAbort *>(E) != NULL);
   if (Result)
   {
-    DebugAssert(FGuarding && (FFatalError != NULL));
+    DebugAssert(FGuarding);
+    DebugAssert(FFatalError != NULL);
     Verify();
   }
   return Result;

source/putty/ssh/userauth2-client.c

@@ -2169,11 +2169,18 @@ static void ssh2_userauth_print_banner(struct ssh2_userauth_state *s)
         { // WINSCP
         bool mid_line = false;
         while (bufchain_size(&s->banner) > 0) {
+            // WINSCP: consume banner buffer before calling seat_banner_pl.
+            // As we might get disconnected, while the banner is displaying,
+            // and ssh_remote_error calls here via ssh2_userauth_final_output,
+            // so we might get into loop
             ptrlen data = bufchain_prefix(&s->banner);
-            seat_banner_pl(ppl_get_iseat(&s->ppl), data);
+            char * buf = smalloc(data.len);
+            bufchain_fetch(&s->banner, buf, data.len);
             mid_line =
                 (((const char *)data.ptr)[data.len-1] != '\n');
             bufchain_consume(&s->banner, data.len);
+            seat_banner_pl(ppl_get_iseat(&s->ppl), make_ptrlen(buf, data.len));
+            sfree(buf);
         }
         bufchain_clear(&s->banner);