One of the recent port forwarding crash reports contained details

which suggested bufchain_prefix() was finding an improperly
initialised bufchain structure. Looking at the code, this may indeed
have been able to happen, since the bufchain in a SOCKDATA_DORMANT
channel was not initialised until CHANNEL_OPEN_CONFIRMATION was
received. This seems utterly daft, so I now call bufchain_init()
when the channel structure is actually created. With any luck the
crash will mystically disappear now (I wasn't able to reproduce it
myself).

[originally from svn r1735]

ssh.c

@@ -5357,7 +5357,6 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 		c->type = CHAN_SOCKDATA;
 		c->v.v2.remwindow = ssh2_pkt_getuint32();
 		c->v.v2.remmaxpkt = ssh2_pkt_getuint32();
-		bufchain_init(&c->v.v2.outbuffer);
 		if (c->u.pfd.s)
 		    pfd_confirm(c->u.pfd.s);
 		if (c->closes) {
@@ -5759,6 +5758,7 @@ void *new_sock_channel(Socket s)
 	c->closes = 0;
 	c->type = CHAN_SOCKDATA_DORMANT;/* identify channel type */
 	c->u.pfd.s = s;
+	bufchain_init(&c->v.v2.outbuffer);
 	add234(ssh_channels, c);
     }
     return c;