/src/hpn-ssh/sshbuf-getput-basic.c

Source (jump to first uncovered line)
/*  $OpenBSD: sshbuf-getput-basic.c,v 1.13 2022/05/25 06:03:44 djm Exp $  */
/*
 * Copyright (c) 2011 Damien Miller
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

#define SSHBUF_INTERNAL
#include "includes.h"

#include <sys/types.h>

#include <stdarg.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#ifdef HAVE_STDINT_H
# include <stdint.h>
#endif

#include "ssherr.h"
#include "sshbuf.h"

int
sshbuf_get(struct sshbuf *buf, void *v, size_t len)
{
  const u_char *p = sshbuf_ptr(buf);
  int r;

  if ((r = sshbuf_consume(buf, len)) < 0)
    return r;
  if (v != NULL && len != 0)
    memcpy(v, p, len);
  return 0;
}

int
sshbuf_get_u64(struct sshbuf *buf, u_int64_t *valp)
{
  const u_char *p = sshbuf_ptr(buf);
  int r;

  if ((r = sshbuf_consume(buf, 8)) < 0)
    return r;
  if (valp != NULL)
    *valp = PEEK_U64(p);
  return 0;
}

int
sshbuf_get_u32(struct sshbuf *buf, u_int32_t *valp)
{
  const u_char *p = sshbuf_ptr(buf);
  int r;

  if ((r = sshbuf_consume(buf, 4)) < 0)
    return r;
  if (valp != NULL)
    *valp = PEEK_U32(p);
  return 0;
}

int
sshbuf_get_u16(struct sshbuf *buf, u_int16_t *valp)
{
  const u_char *p = sshbuf_ptr(buf);
  int r;

  if ((r = sshbuf_consume(buf, 2)) < 0)
    return r;
  if (valp != NULL)
    *valp = PEEK_U16(p);
  return 0;
}

int
sshbuf_get_u8(struct sshbuf *buf, u_char *valp)
{
  const u_char *p = sshbuf_ptr(buf);
  int r;

  if ((r = sshbuf_consume(buf, 1)) < 0)
    return r;
  if (valp != NULL)
    *valp = (u_int8_t)*p;
  return 0;
}

static int
check_offset(const struct sshbuf *buf, int wr, size_t offset, size_t len)
{
  if (sshbuf_ptr(buf) == NULL) /* calls sshbuf_check_sanity() */
    return SSH_ERR_INTERNAL_ERROR;
  if (offset >= SIZE_MAX - len)
    return SSH_ERR_INVALID_ARGUMENT;
  if (offset + len > sshbuf_len(buf)) {
    return wr ?
        SSH_ERR_NO_BUFFER_SPACE : SSH_ERR_MESSAGE_INCOMPLETE;
  }
  return 0;
}

static int
check_roffset(const struct sshbuf *buf, size_t offset, size_t len,
    const u_char **p)
{
  int r;

  *p = NULL;
  if ((r = check_offset(buf, 0, offset, len)) != 0)
    return r;
  *p = sshbuf_ptr(buf) + offset;
  return 0;
}

int
sshbuf_peek_u64(const struct sshbuf *buf, size_t offset, u_int64_t *valp)
{
  const u_char *p = NULL;
  int r;

  if (valp != NULL)
    *valp = 0;
  if ((r = check_roffset(buf, offset, 8, &p)) != 0)
    return r;
  if (valp != NULL)
    *valp = PEEK_U64(p);
  return 0;
}

int
sshbuf_peek_u32(const struct sshbuf *buf, size_t offset, u_int32_t *valp)
{
  const u_char *p = NULL;
  int r;

  if (valp != NULL)
    *valp = 0;
  if ((r = check_roffset(buf, offset, 4, &p)) != 0)
    return r;
  if (valp != NULL)
    *valp = PEEK_U32(p);
  return 0;
}

int
sshbuf_peek_u16(const struct sshbuf *buf, size_t offset, u_int16_t *valp)
{
  const u_char *p = NULL;
  int r;

  if (valp != NULL)
    *valp = 0;
  if ((r = check_roffset(buf, offset, 2, &p)) != 0)
    return r;
  if (valp != NULL)
    *valp = PEEK_U16(p);
  return 0;
}

int
sshbuf_peek_u8(const struct sshbuf *buf, size_t offset, u_char *valp)
{
  const u_char *p = NULL;
  int r;

  if (valp != NULL)
    *valp = 0;
  if ((r = check_roffset(buf, offset, 1, &p)) != 0)
    return r;
  if (valp != NULL)
    *valp = *p;
  return 0;
}

int
sshbuf_get_string(struct sshbuf *buf, u_char **valp, size_t *lenp)
{
  const u_char *val;
  size_t len;
  int r;

  if (valp != NULL)
    *valp = NULL;
  if (lenp != NULL)
    *lenp = 0;
  if ((r = sshbuf_get_string_direct(buf, &val, &len)) < 0)
    return r;
  if (valp != NULL) {
    if ((*valp = malloc(len + 1)) == NULL) {
      SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL"));
      return SSH_ERR_ALLOC_FAIL;
    }
    if (len != 0)
      memcpy(*valp, val, len);
    (*valp)[len] = '\0';
  }
  if (lenp != NULL)
    *lenp = len;
  return 0;
}

int
sshbuf_get_string_direct(struct sshbuf *buf, const u_char **valp, size_t *lenp)
{
  size_t len;
  const u_char *p;
  int r;

  if (valp != NULL)
    *valp = NULL;
  if (lenp != NULL)
    *lenp = 0;
  if ((r = sshbuf_peek_string_direct(buf, &p, &len)) < 0)
    return r;
  if (valp != NULL)
    *valp = p;
  if (lenp != NULL)
    *lenp = len;
  if (sshbuf_consume(buf, len + 4) != 0) {
    /* Shouldn't happen */
    SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
    SSHBUF_ABORT();
    return SSH_ERR_INTERNAL_ERROR;
  }
  return 0;
}

int
sshbuf_peek_string_direct(const struct sshbuf *buf, const u_char **valp,
    size_t *lenp)
{
  u_int32_t len;
  const u_char *p = sshbuf_ptr(buf);

  if (valp != NULL)
    *valp = NULL;
  if (lenp != NULL)
    *lenp = 0;
  if (sshbuf_len(buf) < 4) {
    SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE"));
    return SSH_ERR_MESSAGE_INCOMPLETE;
  }
  len = PEEK_U32(p);
  if (len > SSHBUF_SIZE_MAX - 4) {
    SSHBUF_DBG(("SSH_ERR_STRING_TOO_LARGE"));
    return SSH_ERR_STRING_TOO_LARGE;
  }
  if (sshbuf_len(buf) - 4 < len) {
    SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE"));
    return SSH_ERR_MESSAGE_INCOMPLETE;
  }
  if (valp != NULL)
    *valp = p + 4;
  if (lenp != NULL)
    *lenp = len;
  return 0;
}

int
sshbuf_get_cstring(struct sshbuf *buf, char **valp, size_t *lenp)
{
  size_t len;
  const u_char *p, *z;
  int r;

  if (valp != NULL)
    *valp = NULL;
  if (lenp != NULL)
    *lenp = 0;
  if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0)
    return r;
  /* Allow a \0 only at the end of the string */
  if (len > 0 &&
      (z = memchr(p , '\0', len)) != NULL && z < p + len - 1) {
    SSHBUF_DBG(("SSH_ERR_INVALID_FORMAT"));
    return SSH_ERR_INVALID_FORMAT;
  }
  if ((r = sshbuf_skip_string(buf)) != 0)
    return -1;
  if (valp != NULL) {
    if ((*valp = malloc(len + 1)) == NULL) {
      SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL"));
      return SSH_ERR_ALLOC_FAIL;
    }
    if (len != 0)
      memcpy(*valp, p, len);
    (*valp)[len] = '\0';
  }
  if (lenp != NULL)
    *lenp = (size_t)len;
  return 0;
}

int
sshbuf_get_stringb(struct sshbuf *buf, struct sshbuf *v)
{
  u_int32_t len;
  u_char *p;
  int r;

  /*
   * Use sshbuf_peek_string_direct() to figure out if there is
   * a complete string in 'buf' and copy the string directly
   * into 'v'.
   */
  if ((r = sshbuf_peek_string_direct(buf, NULL, NULL)) != 0 ||
      (r = sshbuf_get_u32(buf, &len)) != 0 ||
      (r = sshbuf_reserve(v, len, &p)) != 0 ||
      (r = sshbuf_get(buf, p, len)) != 0)
    return r;
  return 0;
}

int
sshbuf_put(struct sshbuf *buf, const void *v, size_t len)
{
  u_char *p;
  int r;

  if ((r = sshbuf_reserve(buf, len, &p)) < 0)
    return r;
  if (len != 0)
    memcpy(p, v, len);
  return 0;
}

int
sshbuf_putb(struct sshbuf *buf, const struct sshbuf *v)
{
  if (v == NULL)
    return 0;
  return sshbuf_put(buf, sshbuf_ptr(v), sshbuf_len(v));
}

int
sshbuf_putf(struct sshbuf *buf, const char *fmt, ...)
{
  va_list ap;
  int r;

  va_start(ap, fmt);
  r = sshbuf_putfv(buf, fmt, ap);
  va_end(ap);
  return r;
}

int
sshbuf_putfv(struct sshbuf *buf, const char *fmt, va_list ap)
{
  va_list ap2;
  int r, len;
  u_char *p;

  VA_COPY(ap2, ap);
  if ((len = vsnprintf(NULL, 0, fmt, ap2)) < 0) {
    r = SSH_ERR_INVALID_ARGUMENT;
    goto out;
  }
  if (len == 0) {
    r = 0;
    goto out; /* Nothing to do */
  }
  va_end(ap2);
  VA_COPY(ap2, ap);
  if ((r = sshbuf_reserve(buf, (size_t)len + 1, &p)) < 0)
    goto out;
  if ((r = vsnprintf((char *)p, len + 1, fmt, ap2)) != len) {
    r = SSH_ERR_INTERNAL_ERROR;
    goto out; /* Shouldn't happen */
  }
  /* Consume terminating \0 */
  if ((r = sshbuf_consume_end(buf, 1)) != 0)
    goto out;
  r = 0;
 out:
  va_end(ap2);
  return r;
}

int
sshbuf_put_u64(struct sshbuf *buf, u_int64_t val)
{
  u_char *p;
  int r;

  if ((r = sshbuf_reserve(buf, 8, &p)) < 0)
    return r;
  POKE_U64(p, val);
  return 0;
}

int
sshbuf_put_u32(struct sshbuf *buf, u_int32_t val)
{
  u_char *p;
  int r;

  if ((r = sshbuf_reserve(buf, 4, &p)) < 0)
    return r;
  POKE_U32(p, val);
  return 0;
}

int
sshbuf_put_u16(struct sshbuf *buf, u_int16_t val)
{
  u_char *p;
  int r;

  if ((r = sshbuf_reserve(buf, 2, &p)) < 0)
    return r;
  POKE_U16(p, val);
  return 0;
}

int
sshbuf_put_u8(struct sshbuf *buf, u_char val)
{
  u_char *p;
  int r;

  if ((r = sshbuf_reserve(buf, 1, &p)) < 0)
    return r;
  p[0] = val;
  return 0;
}

static int
check_woffset(struct sshbuf *buf, size_t offset, size_t len, u_char **p)
{
  int r;

  *p = NULL;
  if ((r = check_offset(buf, 1, offset, len)) != 0)
    return r;
  if (sshbuf_mutable_ptr(buf) == NULL)
    return SSH_ERR_BUFFER_READ_ONLY;
  *p = sshbuf_mutable_ptr(buf) + offset;
  return 0;
}

int
sshbuf_poke_u64(struct sshbuf *buf, size_t offset, u_int64_t val)
{
  u_char *p = NULL;
  int r;

  if ((r = check_woffset(buf, offset, 8, &p)) != 0)
    return r;
  POKE_U64(p, val);
  return 0;
}

int
sshbuf_poke_u32(struct sshbuf *buf, size_t offset, u_int32_t val)
{
  u_char *p = NULL;
  int r;

  if ((r = check_woffset(buf, offset, 4, &p)) != 0)
    return r;
  POKE_U32(p, val);
  return 0;
}

int
sshbuf_poke_u16(struct sshbuf *buf, size_t offset, u_int16_t val)
{
  u_char *p = NULL;
  int r;

  if ((r = check_woffset(buf, offset, 2, &p)) != 0)
    return r;
  POKE_U16(p, val);
  return 0;
}

int
sshbuf_poke_u8(struct sshbuf *buf, size_t offset, u_char val)
{
  u_char *p = NULL;
  int r;

  if ((r = check_woffset(buf, offset, 1, &p)) != 0)
    return r;
  *p = val;
  return 0;
}

int
sshbuf_poke(struct sshbuf *buf, size_t offset, void *v, size_t len)
{
  u_char *p = NULL;
  int r;

  if ((r = check_woffset(buf, offset, len, &p)) != 0)
    return r;
  memcpy(p, v, len);
  return 0;
}

int
sshbuf_put_string(struct sshbuf *buf, const void *v, size_t len)
{
  u_char *d;
  int r;

  if (len > SSHBUF_SIZE_MAX - 4) {
    SSHBUF_DBG(("SSH_ERR_NO_BUFFER_SPACE"));
    return SSH_ERR_NO_BUFFER_SPACE;
  }
  if ((r = sshbuf_reserve(buf, len + 4, &d)) < 0)
    return r;
  POKE_U32(d, len);
  if (len != 0)
    memcpy(d + 4, v, len);
  return 0;
}

int
sshbuf_put_cstring(struct sshbuf *buf, const char *v)
{
  return sshbuf_put_string(buf, v, v == NULL ? 0 : strlen(v));
}

int
sshbuf_put_stringb(struct sshbuf *buf, const struct sshbuf *v)
{
  if (v == NULL)
    return sshbuf_put_string(buf, NULL, 0);

  return sshbuf_put_string(buf, sshbuf_ptr(v), sshbuf_len(v));
}

int
sshbuf_froms(struct sshbuf *buf, struct sshbuf **bufp)
{
  const u_char *p;
  size_t len;
  struct sshbuf *ret;
  int r;

  if (buf == NULL || bufp == NULL)
    return SSH_ERR_INVALID_ARGUMENT;
  *bufp = NULL;
  if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0)
    return r;
  if ((ret = sshbuf_from(p, len)) == NULL)
    return SSH_ERR_ALLOC_FAIL;
  if ((r = sshbuf_consume(buf, len + 4)) != 0 ||  /* Shouldn't happen */
      (r = sshbuf_set_parent(ret, buf)) != 0) {
    sshbuf_free(ret);
    return r;
  }
  *bufp = ret;
  return 0;
}

int
sshbuf_put_bignum2_bytes(struct sshbuf *buf, const void *v, size_t len)
{
  u_char *d;
  const u_char *s = (const u_char *)v;
  int r, prepend;

  if (len > SSHBUF_SIZE_MAX - 5) {
    SSHBUF_DBG(("SSH_ERR_NO_BUFFER_SPACE"));
    return SSH_ERR_NO_BUFFER_SPACE;
  }
  /* Skip leading zero bytes */
  for (; len > 0 && *s == 0; len--, s++)
    ;
  /*
   * If most significant bit is set then prepend a zero byte to
   * avoid interpretation as a negative number.
   */
  prepend = len > 0 && (s[0] & 0x80) != 0;
  if ((r = sshbuf_reserve(buf, len + 4 + prepend, &d)) < 0)
    return r;
  POKE_U32(d, len + prepend);
  if (prepend)
    d[4] = 0;
  if (len != 0)
    memcpy(d + 4 + prepend, s, len);
  return 0;
}

int
sshbuf_get_bignum2_bytes_direct(struct sshbuf *buf,
    const u_char **valp, size_t *lenp)
{
  const u_char *d;
  size_t len, olen;
  int r;

  if ((r = sshbuf_peek_string_direct(buf, &d, &olen)) < 0)
    return r;
  len = olen;
  /* Refuse negative (MSB set) bignums */
  if ((len != 0 && (*d & 0x80) != 0))
    return SSH_ERR_BIGNUM_IS_NEGATIVE;
  /* Refuse overlong bignums, allow prepended \0 to avoid MSB set */
  if (len > SSHBUF_MAX_BIGNUM + 1 ||
      (len == SSHBUF_MAX_BIGNUM + 1 && *d != 0))
    return SSH_ERR_BIGNUM_TOO_LARGE;
  /* Trim leading zeros */
  while (len > 0 && *d == 0x00) {
    d++;
    len--;
  }
  if (valp != NULL)
    *valp = d;
  if (lenp != NULL)
    *lenp = len;
  if (sshbuf_consume(buf, olen + 4) != 0) {
    /* Shouldn't happen */
    SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
    SSHBUF_ABORT();
    return SSH_ERR_INTERNAL_ERROR;
  }
  return 0;
}

Coverage Report

Created: 2025-06-22 06:47

Line	Count	Source (jump to first uncovered line)
1		/* $OpenBSD: sshbuf-getput-basic.c,v 1.13 2022/05/25 06:03:44 djm Exp $ */
2		/*
3		* Copyright (c) 2011 Damien Miller
4		*
5		* Permission to use, copy, modify, and distribute this software for any
6		* purpose with or without fee is hereby granted, provided that the above
7		* copyright notice and this permission notice appear in all copies.
8		*
9		* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10		* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11		* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12		* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13		* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14		* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15		* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16		*/
17
18		#define SSHBUF_INTERNAL
19		#include "includes.h"
20
21		#include <sys/types.h>
22
23		#include <stdarg.h>
24		#include <stdlib.h>
25		#include <stdio.h>
26		#include <string.h>
27		#ifdef HAVE_STDINT_H
28		# include <stdint.h>
29		#endif
30
31		#include "ssherr.h"
32		#include "sshbuf.h"
33
34		int
35		sshbuf_get(struct sshbuf buf, void v, size_t len)
36	68.4k	{
37	68.4k	const u_char *p = sshbuf_ptr(buf);
38	68.4k	int r;
39
40	68.4k	if ((r = sshbuf_consume(buf, len)) < 0)
41	0	return r;
42	68.4k	if (v != NULL && len != 0)
43	37.9k	memcpy(v, p, len);
44	68.4k	return 0;
45	68.4k	}
46
47		int
48		sshbuf_get_u64(struct sshbuf buf, u_int64_t valp)
49	28.3k	{
50	28.3k	const u_char *p = sshbuf_ptr(buf);
51	28.3k	int r;
52
53	28.3k	if ((r = sshbuf_consume(buf, 8)) < 0)
54	78	return r;
55	28.3k	if (valp != NULL)
56	28.3k	*valp = PEEK_U64(p);
57	28.3k	return 0;
58	28.3k	}
59
60		int
61		sshbuf_get_u32(struct sshbuf buf, u_int32_t valp)
62	158k	{
63	158k	const u_char *p = sshbuf_ptr(buf);
64	158k	int r;
65
66	158k	if ((r = sshbuf_consume(buf, 4)) < 0)
67	144	return r;
68	158k	if (valp != NULL)
69	155k	*valp = PEEK_U32(p);
70	158k	return 0;
71	158k	}
72
73		int
74		sshbuf_get_u16(struct sshbuf buf, u_int16_t valp)
75	0	{
76	0	const u_char *p = sshbuf_ptr(buf);
77	0	int r;
78
79	0	if ((r = sshbuf_consume(buf, 2)) < 0)
80	0	return r;
81	0	if (valp != NULL)
82	0	*valp = PEEK_U16(p);
83	0	return 0;
84	0	}
85
86		int
87		sshbuf_get_u8(struct sshbuf buf, u_char valp)
88	1.30M	{
89	1.30M	const u_char *p = sshbuf_ptr(buf);
90	1.30M	int r;
91
92	1.30M	if ((r = sshbuf_consume(buf, 1)) < 0)
93	26.1k	return r;
94	1.27M	if (valp != NULL)
95	1.15M	valp = (u_int8_t)p;
96	1.27M	return 0;
97	1.30M	}
98
99		static int
100		check_offset(const struct sshbuf *buf, int wr, size_t offset, size_t len)
101	0	{
102	0	if (sshbuf_ptr(buf) == NULL) /* calls sshbuf_check_sanity() */
103	0	return SSH_ERR_INTERNAL_ERROR;
104	0	if (offset >= SIZE_MAX - len)
105	0	return SSH_ERR_INVALID_ARGUMENT;
106	0	if (offset + len > sshbuf_len(buf)) {
107	0	return wr ?
108	0	SSH_ERR_NO_BUFFER_SPACE : SSH_ERR_MESSAGE_INCOMPLETE;
109	0	}
110	0	return 0;
111	0	}
112
113		static int
114		check_roffset(const struct sshbuf *buf, size_t offset, size_t len,
115		const u_char **p)
116	0	{
117	0	int r;
118
119	0	*p = NULL;
120	0	if ((r = check_offset(buf, 0, offset, len)) != 0)
121	0	return r;
122	0	*p = sshbuf_ptr(buf) + offset;
123	0	return 0;
124	0	}
125
126		int
127		sshbuf_peek_u64(const struct sshbuf buf, size_t offset, u_int64_t valp)
128	0	{
129	0	const u_char *p = NULL;
130	0	int r;
131
132	0	if (valp != NULL)
133	0	*valp = 0;
134	0	if ((r = check_roffset(buf, offset, 8, &p)) != 0)
135	0	return r;
136	0	if (valp != NULL)
137	0	*valp = PEEK_U64(p);
138	0	return 0;
139	0	}
140
141		int
142		sshbuf_peek_u32(const struct sshbuf buf, size_t offset, u_int32_t valp)
143	0	{
144	0	const u_char *p = NULL;
145	0	int r;
146
147	0	if (valp != NULL)
148	0	*valp = 0;
149	0	if ((r = check_roffset(buf, offset, 4, &p)) != 0)
150	0	return r;
151	0	if (valp != NULL)
152	0	*valp = PEEK_U32(p);
153	0	return 0;
154	0	}
155
156		int
157		sshbuf_peek_u16(const struct sshbuf buf, size_t offset, u_int16_t valp)
158	0	{
159	0	const u_char *p = NULL;
160	0	int r;
161
162	0	if (valp != NULL)
163	0	*valp = 0;
164	0	if ((r = check_roffset(buf, offset, 2, &p)) != 0)
165	0	return r;
166	0	if (valp != NULL)
167	0	*valp = PEEK_U16(p);
168	0	return 0;
169	0	}
170
171		int
172		sshbuf_peek_u8(const struct sshbuf buf, size_t offset, u_char valp)
173	0	{
174	0	const u_char *p = NULL;
175	0	int r;
176
177	0	if (valp != NULL)
178	0	*valp = 0;
179	0	if ((r = check_roffset(buf, offset, 1, &p)) != 0)
180	0	return r;
181	0	if (valp != NULL)
182	0	valp = p;
183	0	return 0;
184	0	}
185
186		int
187		sshbuf_get_string(struct sshbuf buf, u_char valp, size_t lenp)
188	83.3k	{
189	83.3k	const u_char *val;
190	83.3k	size_t len;
191	83.3k	int r;
192
193	83.3k	if (valp != NULL)
194	39.5k	*valp = NULL;
195	83.3k	if (lenp != NULL)
196	39.5k	*lenp = 0;
197	83.3k	if ((r = sshbuf_get_string_direct(buf, &val, &len)) < 0)
198	4.40k	return r;
199	78.9k	if (valp != NULL) {
200	39.2k	if ((*valp = malloc(len + 1)) == NULL) {
201	0	SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL"));
202	0	return SSH_ERR_ALLOC_FAIL;
203	0	}
204	39.2k	if (len != 0)
205	37.3k	memcpy(*valp, val, len);
206	39.2k	(*valp)[len] = '\0';
207	39.2k	}
208	78.9k	if (lenp != NULL)
209	39.2k	*lenp = len;
210	78.9k	return 0;
211	78.9k	}
212
213		int
214		sshbuf_get_string_direct(struct sshbuf buf, const u_char valp, size_t lenp)
215	613k	{
216	613k	size_t len;
217	613k	const u_char *p;
218	613k	int r;
219
220	613k	if (valp != NULL)
221	92.6k	*valp = NULL;
222	613k	if (lenp != NULL)
223	92.6k	*lenp = 0;
224	613k	if ((r = sshbuf_peek_string_direct(buf, &p, &len)) < 0)
225	5.41k	return r;
226	608k	if (valp != NULL)
227	87.8k	*valp = p;
228	608k	if (lenp != NULL)
229	87.8k	*lenp = len;
230	608k	if (sshbuf_consume(buf, len + 4) != 0) {
231		/* Shouldn't happen */
232	0	SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
233	0	SSHBUF_ABORT();
234	0	return SSH_ERR_INTERNAL_ERROR;
235	0	}
236	608k	return 0;
237	608k	}
238
239		int
240		sshbuf_peek_string_direct(const struct sshbuf buf, const u_char *valp,
241		size_t *lenp)
242	1.19M	{
243	1.19M	u_int32_t len;
244	1.19M	const u_char *p = sshbuf_ptr(buf);
245
246	1.19M	if (valp != NULL)
247	1.12M	*valp = NULL;
248	1.19M	if (lenp != NULL)
249	1.12M	*lenp = 0;
250	1.19M	if (sshbuf_len(buf) < 4) {
251	2.16k	SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE"));
252	2.16k	return SSH_ERR_MESSAGE_INCOMPLETE;
253	2.16k	}
254	1.19M	len = PEEK_U32(p);
255	1.19M	if (len > SSHBUF_SIZE_MAX - 4) {
256	3.44k	SSHBUF_DBG(("SSH_ERR_STRING_TOO_LARGE"));
257	3.44k	return SSH_ERR_STRING_TOO_LARGE;
258	3.44k	}
259	1.19M	if (sshbuf_len(buf) - 4 < len) {
260	3.50k	SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE"));
261	3.50k	return SSH_ERR_MESSAGE_INCOMPLETE;
262	3.50k	}
263	1.18M	if (valp != NULL)
264	1.11M	*valp = p + 4;
265	1.18M	if (lenp != NULL)
266	1.11M	*lenp = len;
267	1.18M	return 0;
268	1.19M	}
269
270		int
271		sshbuf_get_cstring(struct sshbuf buf, char valp, size_t lenp)
272	404k	{
273	404k	size_t len;
274	404k	const u_char p, z;
275	404k	int r;
276
277	404k	if (valp != NULL)
278	404k	*valp = NULL;
279	404k	if (lenp != NULL)
280	19.1k	*lenp = 0;
281	404k	if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0)
282	1.28k	return r;
283		/* Allow a \0 only at the end of the string */
284	402k	if (len > 0 &&
285	402k	(z = memchr(p , '\0', len)) != NULL && z < p + len - 1) {
286	300	SSHBUF_DBG(("SSH_ERR_INVALID_FORMAT"));
287	300	return SSH_ERR_INVALID_FORMAT;
288	300	}
289	402k	if ((r = sshbuf_skip_string(buf)) != 0)
290	0	return -1;
291	402k	if (valp != NULL) {
292	402k	if ((*valp = malloc(len + 1)) == NULL) {
293	0	SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL"));
294	0	return SSH_ERR_ALLOC_FAIL;
295	0	}
296	402k	if (len != 0)
297	334k	memcpy(*valp, p, len);
298	402k	(*valp)[len] = '\0';
299	402k	}
300	402k	if (lenp != NULL)
301	19.1k	*lenp = (size_t)len;
302	402k	return 0;
303	402k	}
304
305		int
306		sshbuf_get_stringb(struct sshbuf buf, struct sshbuf v)
307	68.5k	{
308	68.5k	u_int32_t len;
309	68.5k	u_char *p;
310	68.5k	int r;
311
312		/*
313		* Use sshbuf_peek_string_direct() to figure out if there is
314		* a complete string in 'buf' and copy the string directly
315		* into 'v'.
316		*/
317	68.5k	if ((r = sshbuf_peek_string_direct(buf, NULL, NULL)) != 0 \|\|
318	68.5k	(r = sshbuf_get_u32(buf, &len)) != 0 \|\|
319	68.5k	(r = sshbuf_reserve(v, len, &p)) != 0 \|\|
320	68.5k	(r = sshbuf_get(buf, p, len)) != 0)
321	118	return r;
322	68.4k	return 0;
323	68.5k	}
324
325		int
326		sshbuf_put(struct sshbuf buf, const void v, size_t len)
327	1.24M	{
328	1.24M	u_char *p;
329	1.24M	int r;
330
331	1.24M	if ((r = sshbuf_reserve(buf, len, &p)) < 0)
332	0	return r;
333	1.24M	if (len != 0)
334	1.22M	memcpy(p, v, len);
335	1.24M	return 0;
336	1.24M	}
337
338		int
339		sshbuf_putb(struct sshbuf buf, const struct sshbuf v)
340	100k	{
341	100k	if (v == NULL)
342	6	return 0;
343	100k	return sshbuf_put(buf, sshbuf_ptr(v), sshbuf_len(v));
344	100k	}
345
346		int
347		sshbuf_putf(struct sshbuf buf, const char fmt, ...)
348	38.1k	{
349	38.1k	va_list ap;
350	38.1k	int r;
351
352	38.1k	va_start(ap, fmt);
353	38.1k	r = sshbuf_putfv(buf, fmt, ap);
354	38.1k	va_end(ap);
355	38.1k	return r;
356	38.1k	}
357
358		int
359		sshbuf_putfv(struct sshbuf buf, const char fmt, va_list ap)
360	38.1k	{
361	38.1k	va_list ap2;
362	38.1k	int r, len;
363	38.1k	u_char *p;
364
365	38.1k	VA_COPY(ap2, ap);
366	38.1k	if ((len = vsnprintf(NULL, 0, fmt, ap2)) < 0) {
367	0	r = SSH_ERR_INVALID_ARGUMENT;
368	0	goto out;
369	0	}
370	38.1k	if (len == 0) {
371	0	r = 0;
372	0	goto out; /* Nothing to do */
373	0	}
374	38.1k	va_end(ap2);
375	38.1k	VA_COPY(ap2, ap);
376	38.1k	if ((r = sshbuf_reserve(buf, (size_t)len + 1, &p)) < 0)
377	0	goto out;
378	38.1k	if ((r = vsnprintf((char *)p, len + 1, fmt, ap2)) != len) {
379	0	r = SSH_ERR_INTERNAL_ERROR;
380	0	goto out; /* Shouldn't happen */
381	0	}
382		/* Consume terminating \0 */
383	38.1k	if ((r = sshbuf_consume_end(buf, 1)) != 0)
384	0	goto out;
385	38.1k	r = 0;
386	38.1k	out:
387	38.1k	va_end(ap2);
388	38.1k	return r;
389	38.1k	}
390
391		int
392		sshbuf_put_u64(struct sshbuf *buf, u_int64_t val)
393	0	{
394	0	u_char *p;
395	0	int r;
396
397	0	if ((r = sshbuf_reserve(buf, 8, &p)) < 0)
398	0	return r;
399	0	POKE_U64(p, val);
400	0	return 0;
401	0	}
402
403		int
404		sshbuf_put_u32(struct sshbuf *buf, u_int32_t val)
405	1.14M	{
406	1.14M	u_char *p;
407	1.14M	int r;
408
409	1.14M	if ((r = sshbuf_reserve(buf, 4, &p)) < 0)
410	0	return r;
411	1.14M	POKE_U32(p, val);
412	1.14M	return 0;
413	1.14M	}
414
415		int
416		sshbuf_put_u16(struct sshbuf *buf, u_int16_t val)
417	0	{
418	0	u_char *p;
419	0	int r;
420
421	0	if ((r = sshbuf_reserve(buf, 2, &p)) < 0)
422	0	return r;
423	0	POKE_U16(p, val);
424	0	return 0;
425	0	}
426
427		int
428		sshbuf_put_u8(struct sshbuf *buf, u_char val)
429	50.8M	{
430	50.8M	u_char *p;
431	50.8M	int r;
432
433	50.8M	if ((r = sshbuf_reserve(buf, 1, &p)) < 0)
434	0	return r;
435	50.8M	p[0] = val;
436	50.8M	return 0;
437	50.8M	}
438
439		static int
440		check_woffset(struct sshbuf buf, size_t offset, size_t len, u_char *p)
441	0	{
442	0	int r;
443
444	0	*p = NULL;
445	0	if ((r = check_offset(buf, 1, offset, len)) != 0)
446	0	return r;
447	0	if (sshbuf_mutable_ptr(buf) == NULL)
448	0	return SSH_ERR_BUFFER_READ_ONLY;
449	0	*p = sshbuf_mutable_ptr(buf) + offset;
450	0	return 0;
451	0	}
452
453		int
454		sshbuf_poke_u64(struct sshbuf *buf, size_t offset, u_int64_t val)
455	0	{
456	0	u_char *p = NULL;
457	0	int r;
458
459	0	if ((r = check_woffset(buf, offset, 8, &p)) != 0)
460	0	return r;
461	0	POKE_U64(p, val);
462	0	return 0;
463	0	}
464
465		int
466		sshbuf_poke_u32(struct sshbuf *buf, size_t offset, u_int32_t val)
467	0	{
468	0	u_char *p = NULL;
469	0	int r;
470
471	0	if ((r = check_woffset(buf, offset, 4, &p)) != 0)
472	0	return r;
473	0	POKE_U32(p, val);
474	0	return 0;
475	0	}
476
477		int
478		sshbuf_poke_u16(struct sshbuf *buf, size_t offset, u_int16_t val)
479	0	{
480	0	u_char *p = NULL;
481	0	int r;
482
483	0	if ((r = check_woffset(buf, offset, 2, &p)) != 0)
484	0	return r;
485	0	POKE_U16(p, val);
486	0	return 0;
487	0	}
488
489		int
490		sshbuf_poke_u8(struct sshbuf *buf, size_t offset, u_char val)
491	0	{
492	0	u_char *p = NULL;
493	0	int r;
494
495	0	if ((r = check_woffset(buf, offset, 1, &p)) != 0)
496	0	return r;
497	0	*p = val;
498	0	return 0;
499	0	}
500
501		int
502		sshbuf_poke(struct sshbuf buf, size_t offset, void v, size_t len)
503	0	{
504	0	u_char *p = NULL;
505	0	int r;
506
507	0	if ((r = check_woffset(buf, offset, len, &p)) != 0)
508	0	return r;
509	0	memcpy(p, v, len);
510	0	return 0;
511	0	}
512
513		int
514		sshbuf_put_string(struct sshbuf buf, const void v, size_t len)
515	779k	{
516	779k	u_char *d;
517	779k	int r;
518
519	779k	if (len > SSHBUF_SIZE_MAX - 4) {
520	0	SSHBUF_DBG(("SSH_ERR_NO_BUFFER_SPACE"));
521	0	return SSH_ERR_NO_BUFFER_SPACE;
522	0	}
523	779k	if ((r = sshbuf_reserve(buf, len + 4, &d)) < 0)
524	0	return r;
525	779k	POKE_U32(d, len);
526	779k	if (len != 0)
527	620k	memcpy(d + 4, v, len);
528	779k	return 0;
529	779k	}
530
531		int
532		sshbuf_put_cstring(struct sshbuf buf, const char v)
533	765k	{
534	765k	return sshbuf_put_string(buf, v, v == NULL ? 0 : strlen(v));
535	765k	}
536
537		int
538		sshbuf_put_stringb(struct sshbuf buf, const struct sshbuf v)
539	12.6k	{
540	12.6k	if (v == NULL)
541	0	return sshbuf_put_string(buf, NULL, 0);
542
543	12.6k	return sshbuf_put_string(buf, sshbuf_ptr(v), sshbuf_len(v));
544	12.6k	}
545
546		int
547		sshbuf_froms(struct sshbuf buf, struct sshbuf *bufp)
548	69.5k	{
549	69.5k	const u_char *p;
550	69.5k	size_t len;
551	69.5k	struct sshbuf *ret;
552	69.5k	int r;
553
554	69.5k	if (buf == NULL \|\| bufp == NULL)
555	0	return SSH_ERR_INVALID_ARGUMENT;
556	69.5k	*bufp = NULL;
557	69.5k	if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0)
558	1.54k	return r;
559	68.0k	if ((ret = sshbuf_from(p, len)) == NULL)
560	0	return SSH_ERR_ALLOC_FAIL;
561	68.0k	if ((r = sshbuf_consume(buf, len + 4)) != 0 \|\| /* Shouldn't happen */
562	68.0k	(r = sshbuf_set_parent(ret, buf)) != 0) {
563	0	sshbuf_free(ret);
564	0	return r;
565	0	}
566	68.0k	*bufp = ret;
567	68.0k	return 0;
568	68.0k	}
569
570		int
571		sshbuf_put_bignum2_bytes(struct sshbuf buf, const void v, size_t len)
572	0	{
573	0	u_char *d;
574	0	const u_char s = (const u_char )v;
575	0	int r, prepend;
576
577	0	if (len > SSHBUF_SIZE_MAX - 5) {
578	0	SSHBUF_DBG(("SSH_ERR_NO_BUFFER_SPACE"));
579	0	return SSH_ERR_NO_BUFFER_SPACE;
580	0	}
581		/* Skip leading zero bytes */
582	0	for (; len > 0 && *s == 0; len--, s++)
583	0	;
584		/*
585		* If most significant bit is set then prepend a zero byte to
586		* avoid interpretation as a negative number.
587		*/
588	0	prepend = len > 0 && (s[0] & 0x80) != 0;
589	0	if ((r = sshbuf_reserve(buf, len + 4 + prepend, &d)) < 0)
590	0	return r;
591	0	POKE_U32(d, len + prepend);
592	0	if (prepend)
593	0	d[4] = 0;
594	0	if (len != 0)
595	0	memcpy(d + 4 + prepend, s, len);
596	0	return 0;
597	0	}
598
599		int
600		sshbuf_get_bignum2_bytes_direct(struct sshbuf *buf,
601		const u_char *valp, size_t lenp)
602	27.3k	{
603	27.3k	const u_char *d;
604	27.3k	size_t len, olen;
605	27.3k	int r;
606
607	27.3k	if ((r = sshbuf_peek_string_direct(buf, &d, &olen)) < 0)
608	579	return r;
609	26.7k	len = olen;
610		/* Refuse negative (MSB set) bignums */
611	26.7k	if ((len != 0 && (*d & 0x80) != 0))
612	51	return SSH_ERR_BIGNUM_IS_NEGATIVE;
613		/* Refuse overlong bignums, allow prepended \0 to avoid MSB set */
614	26.7k	if (len > SSHBUF_MAX_BIGNUM + 1 \|\|
615	26.7k	(len == SSHBUF_MAX_BIGNUM + 1 && *d != 0))
616	92	return SSH_ERR_BIGNUM_TOO_LARGE;
617		/* Trim leading zeros */
618	48.8k	while (len > 0 && *d == 0x00) {
619	22.2k	d++;
620	22.2k	len--;
621	22.2k	}
622	26.6k	if (valp != NULL)
623	26.6k	*valp = d;
624	26.6k	if (lenp != NULL)
625	26.6k	*lenp = len;
626	26.6k	if (sshbuf_consume(buf, olen + 4) != 0) {
627		/* Shouldn't happen */
628	0	SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
629	0	SSHBUF_ABORT();
630	0	return SSH_ERR_INTERNAL_ERROR;
631	0	}
632	26.6k	return 0;
633	26.6k	}