channels: Fix checking for fatal errors.

We need this that we don't end up in and infinite poll loop.

src/channels.c

@@ -1452,6 +1452,11 @@ static int channel_request(ssh_channel channel, const char *request,
   }
   while(channel->request_state == SSH_CHANNEL_REQ_STATE_PENDING){
     ssh_handle_packets(session,-1);
+    if(session->session_state == SSH_SESSION_STATE_ERROR) {
+	channel->request_state = SSH_CHANNEL_REQ_STATE_ERROR;
+	break;
+    }
+
   }
   /* we received something */
   switch (channel->request_state){

src/poll.c

@@ -612,11 +612,16 @@ int ssh_poll_ctx_dopoll(ssh_poll_ctx ctx, int timeout) {
     if (!ctx->pollfds[i].revents) {
       i++;
     } else {
+      int ret;
+
       p = ctx->pollptrs[i];
       fd = ctx->pollfds[i].fd;
       revents = ctx->pollfds[i].revents;
 
-      if (p->cb && p->cb(p, fd, revents, p->cb_data) < 0) {
+      if (p->cb && (ret = p->cb(p, fd, revents, p->cb_data)) < 0) {
+        if (ret == -2) {
+            return -1;
+        }
         /* the poll was removed, reload the used counter and start again */
         used = ctx->polls_used;
         i=0;

src/socket.c

@@ -256,6 +256,7 @@ int ssh_socket_pollcallback(struct ssh_poll_handle_struct *p, socket_t fd, int r
 				/* p may have been freed, so don't use it
 				* anymore in this function */
 				p = NULL;
+				return -2;
 			}
 		}
 		if(r==0){
@@ -272,6 +273,7 @@ int ssh_socket_pollcallback(struct ssh_poll_handle_struct *p, socket_t fd, int r
 				/* p may have been freed, so don't use it
 				* anymore in this function */
 				p = NULL;
+				return -2;
 			}
 		}
 		if(r>0){