diff --git a/ssh-keyscan.c b/ssh-keyscan.c

index d29a03b4..d7283136 100644

--- a/ssh-keyscan.c

+++ b/ssh-keyscan.c

@@ -490,6 +490,15 @@ congreet(int s)

 		return;

 	}

+	/*

+	 * Read the server banner as per RFC4253 section 4.2.  The "SSH-"

+	 * protocol identification string may be preceeded by an arbitarily

+	 * large banner which we must read and ignore.  Loop while reading

+	 * newline-terminated lines until we have one starting with "SSH-".

+	 * The ID string cannot be longer than 255 characters although the

+	 * preceeding banner lines may (in which case they'll be discarded

+	 * in multiple iterations of the outer loop).

+	 */

 	for (;;) {

 		memset(buf, '\0', sizeof(buf));

 		bufsiz = sizeof(buf);

@@ -517,6 +526,11 @@ congreet(int s)

 		conrecycle(s);

 		return;

 	}

+	if (cp >= buf + sizeof(buf)) {

+		error("%s: greeting exceeds allowable length", c->c_name);

+		confree(s);

+		return;

+	}

 	if (*cp != '\n' && *cp != '\r') {

 		error("%s: bad greeting", c->c_name);

 		confree(s);