Coverage Report

Created: 2025-06-22 06:47

/src/hpn-ssh/sshbuf-misc.c
Line
Count
Source (jump to first uncovered line)
1
/*  $OpenBSD: sshbuf-misc.c,v 1.18 2022/01/22 00:43:43 djm Exp $  */
2
/*
3
 * Copyright (c) 2011 Damien Miller
4
 *
5
 * Permission to use, copy, modify, and distribute this software for any
6
 * purpose with or without fee is hereby granted, provided that the above
7
 * copyright notice and this permission notice appear in all copies.
8
 *
9
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16
 */
17
18
#include "includes.h"
19
20
#include <sys/types.h>
21
#include <sys/socket.h>
22
#include <netinet/in.h>
23
#include <errno.h>
24
#include <stdlib.h>
25
#ifdef HAVE_STDINT_H
26
# include <stdint.h>
27
#endif
28
#include <stdio.h>
29
#include <limits.h>
30
#include <string.h>
31
#include <resolv.h>
32
#include <ctype.h>
33
#include <unistd.h>
34
35
#include "ssherr.h"
36
#define SSHBUF_INTERNAL
37
#include "sshbuf.h"
38
39
void
40
sshbuf_dump_data(const void *s, size_t len, FILE *f)
41
0
{
42
0
  size_t i, j;
43
0
  const u_char *p = (const u_char *)s;
44
45
0
  for (i = 0; i < len; i += 16) {
46
0
    fprintf(f, "%.4zu: ", i);
47
0
    for (j = i; j < i + 16; j++) {
48
0
      if (j < len)
49
0
        fprintf(f, "%02x ", p[j]);
50
0
      else
51
0
        fprintf(f, "   ");
52
0
    }
53
0
    fprintf(f, " ");
54
0
    for (j = i; j < i + 16; j++) {
55
0
      if (j < len) {
56
0
        if  (isascii(p[j]) && isprint(p[j]))
57
0
          fprintf(f, "%c", p[j]);
58
0
        else
59
0
          fprintf(f, ".");
60
0
      }
61
0
    }
62
0
    fprintf(f, "\n");
63
0
  }
64
0
}
65
66
void
67
sshbuf_dump(const struct sshbuf *buf, FILE *f)
68
0
{
69
0
  fprintf(f, "buffer len = %zu\n", sshbuf_len(buf));
70
0
  sshbuf_dump_data(sshbuf_ptr(buf), sshbuf_len(buf), f);
71
0
}
72
73
char *
74
sshbuf_dtob16(struct sshbuf *buf)
75
0
{
76
0
  size_t i, j, len = sshbuf_len(buf);
77
0
  const u_char *p = sshbuf_ptr(buf);
78
0
  char *ret;
79
0
  const char hex[] = "0123456789abcdef";
80
81
0
  if (len == 0)
82
0
    return strdup("");
83
0
  if (SIZE_MAX / 2 <= len || (ret = malloc(len * 2 + 1)) == NULL)
84
0
    return NULL;
85
0
  for (i = j = 0; i < len; i++) {
86
0
    ret[j++] = hex[(p[i] >> 4) & 0xf];
87
0
    ret[j++] = hex[p[i] & 0xf];
88
0
  }
89
0
  ret[j] = '\0';
90
0
  return ret;
91
0
}
92
93
int
94
sshbuf_dtob64(const struct sshbuf *d, struct sshbuf *b64, int wrap)
95
55
{
96
55
  size_t i, slen = 0;
97
55
  char *s = NULL;
98
55
  int r;
99
100
55
  if (d == NULL || b64 == NULL || sshbuf_len(d) >= SIZE_MAX / 2)
101
0
    return SSH_ERR_INVALID_ARGUMENT;
102
55
  if (sshbuf_len(d) == 0)
103
0
    return 0;
104
55
  slen = ((sshbuf_len(d) + 2) / 3) * 4 + 1;
105
55
  if ((s = malloc(slen)) == NULL)
106
0
    return SSH_ERR_ALLOC_FAIL;
107
55
  if (b64_ntop(sshbuf_ptr(d), sshbuf_len(d), s, slen) == -1) {
108
0
    r = SSH_ERR_INTERNAL_ERROR;
109
0
    goto fail;
110
0
  }
111
55
  if (wrap) {
112
0
    for (i = 0; s[i] != '\0'; i++) {
113
0
      if ((r = sshbuf_put_u8(b64, s[i])) != 0)
114
0
        goto fail;
115
0
      if (i % 70 == 69 && (r = sshbuf_put_u8(b64, '\n')) != 0)
116
0
        goto fail;
117
0
    }
118
0
    if ((i - 1) % 70 != 69 && (r = sshbuf_put_u8(b64, '\n')) != 0)
119
0
      goto fail;
120
55
  } else {
121
55
    if ((r = sshbuf_put(b64, s, strlen(s))) != 0)
122
0
      goto fail;
123
55
  }
124
  /* Success */
125
55
  r = 0;
126
55
 fail:
127
55
  freezero(s, slen);
128
55
  return r;
129
55
}
130
131
char *
132
sshbuf_dtob64_string(const struct sshbuf *buf, int wrap)
133
0
{
134
0
  struct sshbuf *tmp;
135
0
  char *ret;
136
137
0
  if ((tmp = sshbuf_new()) == NULL)
138
0
    return NULL;
139
0
  if (sshbuf_dtob64(buf, tmp, wrap) != 0) {
140
0
    sshbuf_free(tmp);
141
0
    return NULL;
142
0
  }
143
0
  ret = sshbuf_dup_string(tmp);
144
0
  sshbuf_free(tmp);
145
0
  return ret;
146
0
}
147
148
int
149
sshbuf_b64tod(struct sshbuf *buf, const char *b64)
150
18.0k
{
151
18.0k
  size_t plen = strlen(b64);
152
18.0k
  int nlen, r;
153
18.0k
  u_char *p;
154
155
18.0k
  if (plen == 0)
156
0
    return 0;
157
18.0k
  if ((p = malloc(plen)) == NULL)
158
0
    return SSH_ERR_ALLOC_FAIL;
159
18.0k
  if ((nlen = b64_pton(b64, p, plen)) < 0) {
160
0
    freezero(p, plen);
161
0
    return SSH_ERR_INVALID_FORMAT;
162
0
  }
163
18.0k
  if ((r = sshbuf_put(buf, p, nlen)) < 0) {
164
0
    freezero(p, plen);
165
0
    return r;
166
0
  }
167
18.0k
  freezero(p, plen);
168
18.0k
  return 0;
169
18.0k
}
170
171
int
172
sshbuf_dtourlb64(const struct sshbuf *d, struct sshbuf *b64, int wrap)
173
55
{
174
55
  int r = SSH_ERR_INTERNAL_ERROR;
175
55
  u_char *p;
176
55
  struct sshbuf *b = NULL;
177
55
  size_t i, l;
178
179
55
  if ((b = sshbuf_new()) == NULL)
180
0
    return SSH_ERR_ALLOC_FAIL;
181
  /* Encode using regular base64; we'll transform it once done */
182
55
  if ((r = sshbuf_dtob64(d, b, wrap)) != 0)
183
0
    goto out;
184
  /* remove padding from end of encoded string*/
185
120
  for (;;) {
186
120
    l = sshbuf_len(b);
187
120
    if (l <= 1 || sshbuf_ptr(b) == NULL) {
188
0
      r = SSH_ERR_INTERNAL_ERROR;
189
0
      goto out;
190
0
    }
191
120
    if (sshbuf_ptr(b)[l - 1] != '=')
192
55
      break;
193
65
    if ((r = sshbuf_consume_end(b, 1)) != 0)
194
0
      goto out;
195
65
  }
196
  /* Replace characters with rfc4648 equivalents */
197
55
  l = sshbuf_len(b);
198
55
  if ((p = sshbuf_mutable_ptr(b)) == NULL) {
199
0
    r = SSH_ERR_INTERNAL_ERROR;
200
0
    goto out;
201
0
  }
202
59.3k
  for (i = 0; i < l; i++) {
203
59.2k
    if (p[i] == '+')
204
554
      p[i] = '-';
205
58.7k
    else if (p[i] == '/')
206
3.42k
      p[i] = '_';
207
59.2k
  }
208
55
  r = sshbuf_putb(b64, b);
209
55
 out:
210
55
  sshbuf_free(b);
211
55
  return r;
212
55
}
213
214
char *
215
sshbuf_dup_string(struct sshbuf *buf)
216
60.0k
{
217
60.0k
  const u_char *p = NULL, *s = sshbuf_ptr(buf);
218
60.0k
  size_t l = sshbuf_len(buf);
219
60.0k
  char *r;
220
221
60.0k
  if (s == NULL || l > SIZE_MAX)
222
0
    return NULL;
223
  /* accept a nul only as the last character in the buffer */
224
60.0k
  if (l > 0 && (p = memchr(s, '\0', l)) != NULL) {
225
360
    if (p != s + l - 1)
226
270
      return NULL;
227
90
    l--; /* the nul is put back below */
228
90
  }
229
59.8k
  if ((r = malloc(l + 1)) == NULL)
230
0
    return NULL;
231
59.8k
  if (l > 0)
232
59.8k
    memcpy(r, s, l);
233
59.8k
  r[l] = '\0';
234
59.8k
  return r;
235
59.8k
}
236
237
int
238
sshbuf_cmp(const struct sshbuf *b, size_t offset,
239
    const void *s, size_t len)
240
4.50k
{
241
4.50k
  if (sshbuf_ptr(b) == NULL)
242
0
    return SSH_ERR_INTERNAL_ERROR;
243
4.50k
  if (offset > SSHBUF_SIZE_MAX || len > SSHBUF_SIZE_MAX || len == 0)
244
0
    return SSH_ERR_INVALID_ARGUMENT;
245
4.50k
  if (offset + len > sshbuf_len(b))
246
59
    return SSH_ERR_MESSAGE_INCOMPLETE;
247
4.45k
  if (timingsafe_bcmp(sshbuf_ptr(b) + offset, s, len) != 0)
248
11
    return SSH_ERR_INVALID_FORMAT;
249
4.43k
  return 0;
250
4.45k
}
251
252
int
253
sshbuf_find(const struct sshbuf *b, size_t start_offset,
254
    const void *s, size_t len, size_t *offsetp)
255
0
{
256
0
  void *p;
257
258
0
  if (offsetp != NULL)
259
0
    *offsetp = 0;
260
0
  if (sshbuf_ptr(b) == NULL)
261
0
    return SSH_ERR_INTERNAL_ERROR;
262
0
  if (start_offset > SSHBUF_SIZE_MAX || len > SSHBUF_SIZE_MAX || len == 0)
263
0
    return SSH_ERR_INVALID_ARGUMENT;
264
0
  if (start_offset > sshbuf_len(b) || start_offset + len > sshbuf_len(b))
265
0
    return SSH_ERR_MESSAGE_INCOMPLETE;
266
0
  if ((p = memmem(sshbuf_ptr(b) + start_offset,
267
0
      sshbuf_len(b) - start_offset, s, len)) == NULL)
268
0
    return SSH_ERR_INVALID_FORMAT;
269
0
  if (offsetp != NULL)
270
0
    *offsetp = (const u_char *)p - sshbuf_ptr(b);
271
0
  return 0;
272
0
}
273
274
int
275
sshbuf_read(int fd, struct sshbuf *buf, size_t maxlen, size_t *rlen)
276
0
{
277
0
  int r, oerrno;
278
0
  size_t adjust;
279
0
  ssize_t rr;
280
0
  u_char *d;
281
282
0
  if (rlen != NULL)
283
0
    *rlen = 0;
284
0
  if ((r = sshbuf_reserve(buf, maxlen, &d)) != 0)
285
0
    return r;
286
0
  rr = read(fd, d, maxlen);
287
0
  oerrno = errno;
288
289
  /* Adjust the buffer to include only what was actually read */
290
0
  if ((adjust = maxlen - (rr > 0 ? rr : 0)) != 0) {
291
0
    if ((r = sshbuf_consume_end(buf, adjust)) != 0) {
292
      /* avoid returning uninitialised data to caller */
293
0
      memset(d + rr, '\0', adjust);
294
0
      return SSH_ERR_INTERNAL_ERROR; /* shouldn't happen */
295
0
    }
296
0
  }
297
0
  if (rr < 0) {
298
0
    errno = oerrno;
299
0
    return SSH_ERR_SYSTEM_ERROR;
300
0
  } else if (rr == 0) {
301
0
    errno = EPIPE;
302
0
    return SSH_ERR_SYSTEM_ERROR;
303
0
  }
304
  /* success */
305
0
  if (rlen != NULL) {
306
0
    *rlen = (size_t)rr;
307
0
  }
308
0
  return 0;
309
0
}