Index: channels.c
===================================================================
--- channels.c.orig
+++ channels.c
@@ -2625,6 +2625,9 @@ channel_setup_fwd_listener(int type, con
 	char ntop[NI_MAXHOST], strport[NI_MAXSERV];
 	in_port_t *lport_p;
 
+	if (num_adm_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
+		fatal("channel_setup_fwd_listener: too many forwards");
+
 	host = (type == SSH_CHANNEL_RPORT_LISTENER) ?
 	    listen_addr : host_to_connect;
 	is_client = (type == SSH_CHANNEL_PORT_LISTENER);