diff -ru openssh-3.6.1p1/buffer.c openssh-3.6.1p1-patched/buffer.c
--- openssh-3.6.1p1/buffer.c	2002-06-26 11:14:27.000000000 +0200
+++ openssh-3.6.1p1-patched/buffer.c	2003-09-16 17:52:06.000000000 +0200
@@ -69,6 +69,7 @@
 void *
 buffer_append_space(Buffer *buffer, u_int len)
 {
+	u_int newlen;
 	void *p;
 
 	if (len > 0x100000)
@@ -98,11 +99,13 @@
 		goto restart;
 	}
 	/* Increase the size of the buffer and retry. */
-	buffer->alloc += len + 32768;
-	if (buffer->alloc > 0xa00000)
+	
+	newlen = buffer->alloc + len + 32768;
+	if (newlen > 0xa00000)
 		fatal("buffer_append_space: alloc %u not supported",
-		    buffer->alloc);
-	buffer->buf = xrealloc(buffer->buf, buffer->alloc);
+		    newlen);
+	buffer->buf = xrealloc(buffer->buf, newlen);
+	buffer->alloc = newlen;
 	goto restart;
 	/* NOTREACHED */
 }
diff -ru openssh-3.6.1p1/configure openssh-3.6.1p1-patched/configure
--- openssh-3.6.1p1/configure	2003-04-01 13:57:28.000000000 +0200
+++ openssh-3.6.1p1-patched/configure	2003-09-16 17:50:05.000000000 +0200
@@ -16090,7 +16090,7 @@
 
 # Looking for programs, paths and files
 
-PRIVSEP_PATH=/var/empty
+PRIVSEP_PATH='${prefix}/var/empty'
 
 # Check whether --with-privsep-path or --without-privsep-path was given.
 if test "${with_privsep_path+set}" = set; then
Only in openssh-3.6.1p1-patched: configure.rej