Coverage Report

Created: 2025-07-01 07:00

/src/openssh/sshbuf-misc.c
Line
Count
Source (jump to first uncovered line)
1
/*  $OpenBSD: sshbuf-misc.c,v 1.20 2025/06/16 09:02:19 dtucker Exp $  */
2
/*
3
 * Copyright (c) 2011 Damien Miller
4
 *
5
 * Permission to use, copy, modify, and distribute this software for any
6
 * purpose with or without fee is hereby granted, provided that the above
7
 * copyright notice and this permission notice appear in all copies.
8
 *
9
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16
 */
17
18
#include "includes.h"
19
20
#include <sys/types.h>
21
#include <sys/socket.h>
22
#include <netinet/in.h>
23
#include <errno.h>
24
#include <stdlib.h>
25
#ifdef HAVE_STDINT_H
26
# include <stdint.h>
27
#endif
28
#include <stdio.h>
29
#include <limits.h>
30
#include <string.h>
31
#include <resolv.h>
32
#include <ctype.h>
33
#include <unistd.h>
34
35
#include "ssherr.h"
36
#define SSHBUF_INTERNAL
37
#include "sshbuf.h"
38
39
void
40
sshbuf_dump_data(const void *s, size_t len, FILE *f)
41
0
{
42
0
  size_t i, j;
43
0
  const u_char *p = (const u_char *)s;
44
45
0
  for (i = 0; i < len; i += 16) {
46
0
    fprintf(f, "%.4zu: ", i);
47
0
    for (j = i; j < i + 16; j++) {
48
0
      if (j < len)
49
0
        fprintf(f, "%02x ", p[j]);
50
0
      else
51
0
        fprintf(f, "   ");
52
0
    }
53
0
    fprintf(f, " ");
54
0
    for (j = i; j < i + 16; j++) {
55
0
      if (j < len) {
56
0
        if  (isascii(p[j]) && isprint(p[j]))
57
0
          fprintf(f, "%c", p[j]);
58
0
        else
59
0
          fprintf(f, ".");
60
0
      }
61
0
    }
62
0
    fprintf(f, "\n");
63
0
  }
64
0
}
65
66
void
67
sshbuf_dump(const struct sshbuf *buf, FILE *f)
68
0
{
69
0
  fprintf(f, "buffer len = %zu\n", sshbuf_len(buf));
70
0
  sshbuf_dump_data(sshbuf_ptr(buf), sshbuf_len(buf), f);
71
0
}
72
73
char *
74
sshbuf_dtob16(const struct sshbuf *buf)
75
0
{
76
0
  size_t i, j, len = sshbuf_len(buf);
77
0
  const u_char *p = sshbuf_ptr(buf);
78
0
  char *ret;
79
0
  const char hex[] = "0123456789abcdef";
80
81
0
  if (len == 0)
82
0
    return strdup("");
83
0
  if (SIZE_MAX / 2 <= len || (ret = malloc(len * 2 + 1)) == NULL)
84
0
    return NULL;
85
0
  for (i = j = 0; i < len; i++) {
86
0
    ret[j++] = hex[(p[i] >> 4) & 0xf];
87
0
    ret[j++] = hex[p[i] & 0xf];
88
0
  }
89
0
  ret[j] = '\0';
90
0
  return ret;
91
0
}
92
93
static int
94
b16tod(const char v)
95
0
{
96
0
  if (v >= '0' && v <= '9')
97
0
    return v - '0';
98
0
  if (v >= 'a' && v <= 'f')
99
0
    return 10 + v - 'a';
100
0
  if (v >= 'A' && v <= 'A')
101
0
    return 10 + v - 'A';
102
0
  return -1;
103
0
}
104
105
struct sshbuf *
106
sshbuf_b16tod(const char *b16)
107
0
{
108
0
  struct sshbuf *ret;
109
0
  size_t o;
110
0
  int r, v1, v2;
111
112
0
  if ((ret = sshbuf_new()) == NULL)
113
0
    return NULL;
114
0
  for (o = 0; b16[o] != '\0'; o += 2) {
115
0
    if ((v1 = b16tod(b16[o])) == -1 ||
116
0
        (v2 = b16tod(b16[o + 1])) == -1) {
117
0
      sshbuf_free(ret);
118
0
      return NULL;
119
0
    }
120
0
    if ((r = sshbuf_put_u8(ret, (u_char)((v1 << 4) | v2))) != 0) {
121
0
      sshbuf_free(ret);
122
0
      return NULL;
123
0
    }
124
0
  }
125
  /* success */
126
0
  return ret;
127
0
}
128
129
int
130
sshbuf_dtob64(const struct sshbuf *d, struct sshbuf *b64, int wrap)
131
0
{
132
0
  size_t i, slen = 0;
133
0
  char *s = NULL;
134
0
  int r;
135
136
0
  if (d == NULL || b64 == NULL || sshbuf_len(d) >= SIZE_MAX / 2)
137
0
    return SSH_ERR_INVALID_ARGUMENT;
138
0
  if (sshbuf_len(d) == 0)
139
0
    return 0;
140
0
  slen = ((sshbuf_len(d) + 2) / 3) * 4 + 1;
141
0
  if ((s = malloc(slen)) == NULL)
142
0
    return SSH_ERR_ALLOC_FAIL;
143
0
  if (b64_ntop(sshbuf_ptr(d), sshbuf_len(d), s, slen) == -1) {
144
0
    r = SSH_ERR_INTERNAL_ERROR;
145
0
    goto fail;
146
0
  }
147
0
  if (wrap) {
148
0
    for (i = 0; s[i] != '\0'; i++) {
149
0
      if ((r = sshbuf_put_u8(b64, s[i])) != 0)
150
0
        goto fail;
151
0
      if (i % 70 == 69 && (r = sshbuf_put_u8(b64, '\n')) != 0)
152
0
        goto fail;
153
0
    }
154
0
    if ((i - 1) % 70 != 69 && (r = sshbuf_put_u8(b64, '\n')) != 0)
155
0
      goto fail;
156
0
  } else {
157
0
    if ((r = sshbuf_put(b64, s, strlen(s))) != 0)
158
0
      goto fail;
159
0
  }
160
  /* Success */
161
0
  r = 0;
162
0
 fail:
163
0
  freezero(s, slen);
164
0
  return r;
165
0
}
166
167
char *
168
sshbuf_dtob64_string(const struct sshbuf *buf, int wrap)
169
0
{
170
0
  struct sshbuf *tmp;
171
0
  char *ret;
172
173
0
  if ((tmp = sshbuf_new()) == NULL)
174
0
    return NULL;
175
0
  if (sshbuf_dtob64(buf, tmp, wrap) != 0) {
176
0
    sshbuf_free(tmp);
177
0
    return NULL;
178
0
  }
179
0
  ret = sshbuf_dup_string(tmp);
180
0
  sshbuf_free(tmp);
181
0
  return ret;
182
0
}
183
184
int
185
sshbuf_b64tod(struct sshbuf *buf, const char *b64)
186
0
{
187
0
  size_t plen = strlen(b64);
188
0
  int nlen, r;
189
0
  u_char *p;
190
191
0
  if (plen == 0)
192
0
    return 0;
193
0
  if ((p = malloc(plen)) == NULL)
194
0
    return SSH_ERR_ALLOC_FAIL;
195
0
  if ((nlen = b64_pton(b64, p, plen)) < 0) {
196
0
    freezero(p, plen);
197
0
    return SSH_ERR_INVALID_FORMAT;
198
0
  }
199
0
  if ((r = sshbuf_put(buf, p, nlen)) < 0) {
200
0
    freezero(p, plen);
201
0
    return r;
202
0
  }
203
0
  freezero(p, plen);
204
0
  return 0;
205
0
}
206
207
int
208
sshbuf_dtourlb64(const struct sshbuf *d, struct sshbuf *b64, int wrap)
209
0
{
210
0
  int r = SSH_ERR_INTERNAL_ERROR;
211
0
  u_char *p;
212
0
  struct sshbuf *b = NULL;
213
0
  size_t i, l;
214
215
0
  if ((b = sshbuf_new()) == NULL)
216
0
    return SSH_ERR_ALLOC_FAIL;
217
  /* Encode using regular base64; we'll transform it once done */
218
0
  if ((r = sshbuf_dtob64(d, b, wrap)) != 0)
219
0
    goto out;
220
  /* remove padding from end of encoded string*/
221
0
  for (;;) {
222
0
    l = sshbuf_len(b);
223
0
    if (l <= 1 || sshbuf_ptr(b) == NULL) {
224
0
      r = SSH_ERR_INTERNAL_ERROR;
225
0
      goto out;
226
0
    }
227
0
    if (sshbuf_ptr(b)[l - 1] != '=')
228
0
      break;
229
0
    if ((r = sshbuf_consume_end(b, 1)) != 0)
230
0
      goto out;
231
0
  }
232
  /* Replace characters with rfc4648 equivalents */
233
0
  l = sshbuf_len(b);
234
0
  if ((p = sshbuf_mutable_ptr(b)) == NULL) {
235
0
    r = SSH_ERR_INTERNAL_ERROR;
236
0
    goto out;
237
0
  }
238
0
  for (i = 0; i < l; i++) {
239
0
    if (p[i] == '+')
240
0
      p[i] = '-';
241
0
    else if (p[i] == '/')
242
0
      p[i] = '_';
243
0
  }
244
0
  r = sshbuf_putb(b64, b);
245
0
 out:
246
0
  sshbuf_free(b);
247
0
  return r;
248
0
}
249
250
char *
251
sshbuf_dup_string(struct sshbuf *buf)
252
0
{
253
0
  const u_char *p = NULL, *s = sshbuf_ptr(buf);
254
0
  size_t l = sshbuf_len(buf);
255
0
  char *r;
256
257
0
  if (s == NULL || l >= SIZE_MAX)
258
0
    return NULL;
259
  /* accept a nul only as the last character in the buffer */
260
0
  if (l > 0 && (p = memchr(s, '\0', l)) != NULL) {
261
0
    if (p != s + l - 1)
262
0
      return NULL;
263
0
    l--; /* the nul is put back below */
264
0
  }
265
0
  if ((r = malloc(l + 1)) == NULL)
266
0
    return NULL;
267
0
  if (l > 0)
268
0
    memcpy(r, s, l);
269
0
  r[l] = '\0';
270
0
  return r;
271
0
}
272
273
int
274
sshbuf_cmp(const struct sshbuf *b, size_t offset,
275
    const void *s, size_t len)
276
0
{
277
0
  if (sshbuf_ptr(b) == NULL)
278
0
    return SSH_ERR_INTERNAL_ERROR;
279
0
  if (offset > SSHBUF_SIZE_MAX || len > SSHBUF_SIZE_MAX || len == 0)
280
0
    return SSH_ERR_INVALID_ARGUMENT;
281
0
  if (offset + len > sshbuf_len(b))
282
0
    return SSH_ERR_MESSAGE_INCOMPLETE;
283
0
  if (timingsafe_bcmp(sshbuf_ptr(b) + offset, s, len) != 0)
284
0
    return SSH_ERR_INVALID_FORMAT;
285
0
  return 0;
286
0
}
287
288
int
289
sshbuf_find(const struct sshbuf *b, size_t start_offset,
290
    const void *s, size_t len, size_t *offsetp)
291
0
{
292
0
  void *p;
293
294
0
  if (offsetp != NULL)
295
0
    *offsetp = 0;
296
0
  if (sshbuf_ptr(b) == NULL)
297
0
    return SSH_ERR_INTERNAL_ERROR;
298
0
  if (start_offset > SSHBUF_SIZE_MAX || len > SSHBUF_SIZE_MAX || len == 0)
299
0
    return SSH_ERR_INVALID_ARGUMENT;
300
0
  if (start_offset > sshbuf_len(b) || start_offset + len > sshbuf_len(b))
301
0
    return SSH_ERR_MESSAGE_INCOMPLETE;
302
0
  if ((p = memmem(sshbuf_ptr(b) + start_offset,
303
0
      sshbuf_len(b) - start_offset, s, len)) == NULL)
304
0
    return SSH_ERR_INVALID_FORMAT;
305
0
  if (offsetp != NULL)
306
0
    *offsetp = (const u_char *)p - sshbuf_ptr(b);
307
0
  return 0;
308
0
}
309
310
int
311
sshbuf_read(int fd, struct sshbuf *buf, size_t maxlen, size_t *rlen)
312
0
{
313
0
  int r, oerrno;
314
0
  size_t adjust;
315
0
  ssize_t rr;
316
0
  u_char *d;
317
318
0
  if (rlen != NULL)
319
0
    *rlen = 0;
320
0
  if ((r = sshbuf_reserve(buf, maxlen, &d)) != 0)
321
0
    return r;
322
0
  rr = read(fd, d, maxlen);
323
0
  oerrno = errno;
324
325
  /* Adjust the buffer to include only what was actually read */
326
0
  if ((adjust = maxlen - (rr > 0 ? rr : 0)) != 0) {
327
0
    if ((r = sshbuf_consume_end(buf, adjust)) != 0) {
328
      /* avoid returning uninitialised data to caller */
329
0
      memset(d + rr, '\0', adjust);
330
0
      return SSH_ERR_INTERNAL_ERROR; /* shouldn't happen */
331
0
    }
332
0
  }
333
0
  if (rr < 0) {
334
0
    errno = oerrno;
335
0
    return SSH_ERR_SYSTEM_ERROR;
336
0
  } else if (rr == 0) {
337
0
    errno = EPIPE;
338
0
    return SSH_ERR_SYSTEM_ERROR;
339
0
  }
340
  /* success */
341
0
  if (rlen != NULL)
342
0
    *rlen = (size_t)rr;
343
0
  return 0;
344
0
}