/src/openssh/sshbuf-getput-basic.c

Source (jump to first uncovered line)
/*  $OpenBSD: sshbuf-getput-basic.c,v 1.13 2022/05/25 06:03:44 djm Exp $  */
/*
 * Copyright (c) 2011 Damien Miller
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

#define SSHBUF_INTERNAL
#include "includes.h"

#include <sys/types.h>

#include <stdarg.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#ifdef HAVE_STDINT_H
# include <stdint.h>
#endif

#include "ssherr.h"
#include "sshbuf.h"

int
sshbuf_get(struct sshbuf *buf, void *v, size_t len)
{
  const u_char *p = sshbuf_ptr(buf);
  int r;

  if ((r = sshbuf_consume(buf, len)) < 0)
    return r;
  if (v != NULL && len != 0)
    memcpy(v, p, len);
  return 0;
}

int
sshbuf_get_u64(struct sshbuf *buf, u_int64_t *valp)
{
  const u_char *p = sshbuf_ptr(buf);
  int r;

  if ((r = sshbuf_consume(buf, 8)) < 0)
    return r;
  if (valp != NULL)
    *valp = PEEK_U64(p);
  return 0;
}

int
sshbuf_get_u32(struct sshbuf *buf, u_int32_t *valp)
{
  const u_char *p = sshbuf_ptr(buf);
  int r;

  if ((r = sshbuf_consume(buf, 4)) < 0)
    return r;
  if (valp != NULL)
    *valp = PEEK_U32(p);
  return 0;
}

int
sshbuf_get_u16(struct sshbuf *buf, u_int16_t *valp)
{
  const u_char *p = sshbuf_ptr(buf);
  int r;

  if ((r = sshbuf_consume(buf, 2)) < 0)
    return r;
  if (valp != NULL)
    *valp = PEEK_U16(p);
  return 0;
}

int
sshbuf_get_u8(struct sshbuf *buf, u_char *valp)
{
  const u_char *p = sshbuf_ptr(buf);
  int r;

  if ((r = sshbuf_consume(buf, 1)) < 0)
    return r;
  if (valp != NULL)
    *valp = (u_int8_t)*p;
  return 0;
}

static int
check_offset(const struct sshbuf *buf, int wr, size_t offset, size_t len)
{
  if (sshbuf_ptr(buf) == NULL) /* calls sshbuf_check_sanity() */
    return SSH_ERR_INTERNAL_ERROR;
  if (offset >= SIZE_MAX - len)
    return SSH_ERR_INVALID_ARGUMENT;
  if (offset + len > sshbuf_len(buf)) {
    return wr ?
        SSH_ERR_NO_BUFFER_SPACE : SSH_ERR_MESSAGE_INCOMPLETE;
  }
  return 0;
}

static int
check_roffset(const struct sshbuf *buf, size_t offset, size_t len,
    const u_char **p)
{
  int r;

  *p = NULL;
  if ((r = check_offset(buf, 0, offset, len)) != 0)
    return r;
  *p = sshbuf_ptr(buf) + offset;
  return 0;
}

int
sshbuf_peek_u64(const struct sshbuf *buf, size_t offset, u_int64_t *valp)
{
  const u_char *p = NULL;
  int r;

  if (valp != NULL)
    *valp = 0;
  if ((r = check_roffset(buf, offset, 8, &p)) != 0)
    return r;
  if (valp != NULL)
    *valp = PEEK_U64(p);
  return 0;
}

int
sshbuf_peek_u32(const struct sshbuf *buf, size_t offset, u_int32_t *valp)
{
  const u_char *p = NULL;
  int r;

  if (valp != NULL)
    *valp = 0;
  if ((r = check_roffset(buf, offset, 4, &p)) != 0)
    return r;
  if (valp != NULL)
    *valp = PEEK_U32(p);
  return 0;
}

int
sshbuf_peek_u16(const struct sshbuf *buf, size_t offset, u_int16_t *valp)
{
  const u_char *p = NULL;
  int r;

  if (valp != NULL)
    *valp = 0;
  if ((r = check_roffset(buf, offset, 2, &p)) != 0)
    return r;
  if (valp != NULL)
    *valp = PEEK_U16(p);
  return 0;
}

int
sshbuf_peek_u8(const struct sshbuf *buf, size_t offset, u_char *valp)
{
  const u_char *p = NULL;
  int r;

  if (valp != NULL)
    *valp = 0;
  if ((r = check_roffset(buf, offset, 1, &p)) != 0)
    return r;
  if (valp != NULL)
    *valp = *p;
  return 0;
}

int
sshbuf_get_string(struct sshbuf *buf, u_char **valp, size_t *lenp)
{
  const u_char *val;
  size_t len;
  int r;

  if (valp != NULL)
    *valp = NULL;
  if (lenp != NULL)
    *lenp = 0;
  if ((r = sshbuf_get_string_direct(buf, &val, &len)) < 0)
    return r;
  if (valp != NULL) {
    if ((*valp = malloc(len + 1)) == NULL) {
      SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL"));
      return SSH_ERR_ALLOC_FAIL;
    }
    if (len != 0)
      memcpy(*valp, val, len);
    (*valp)[len] = '\0';
  }
  if (lenp != NULL)
    *lenp = len;
  return 0;
}

int
sshbuf_get_string_direct(struct sshbuf *buf, const u_char **valp, size_t *lenp)
{
  size_t len;
  const u_char *p;
  int r;

  if (valp != NULL)
    *valp = NULL;
  if (lenp != NULL)
    *lenp = 0;
  if ((r = sshbuf_peek_string_direct(buf, &p, &len)) < 0)
    return r;
  if (valp != NULL)
    *valp = p;
  if (lenp != NULL)
    *lenp = len;
  if (sshbuf_consume(buf, len + 4) != 0) {
    /* Shouldn't happen */
    SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
    SSHBUF_ABORT();
    return SSH_ERR_INTERNAL_ERROR;
  }
  return 0;
}

int
sshbuf_peek_string_direct(const struct sshbuf *buf, const u_char **valp,
    size_t *lenp)
{
  u_int32_t len;
  const u_char *p = sshbuf_ptr(buf);

  if (valp != NULL)
    *valp = NULL;
  if (lenp != NULL)
    *lenp = 0;
  if (sshbuf_len(buf) < 4) {
    SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE"));
    return SSH_ERR_MESSAGE_INCOMPLETE;
  }
  len = PEEK_U32(p);
  if (len > SSHBUF_SIZE_MAX - 4) {
    SSHBUF_DBG(("SSH_ERR_STRING_TOO_LARGE"));
    return SSH_ERR_STRING_TOO_LARGE;
  }
  if (sshbuf_len(buf) - 4 < len) {
    SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE"));
    return SSH_ERR_MESSAGE_INCOMPLETE;
  }
  if (valp != NULL)
    *valp = p + 4;
  if (lenp != NULL)
    *lenp = len;
  return 0;
}

int
sshbuf_get_cstring(struct sshbuf *buf, char **valp, size_t *lenp)
{
  size_t len;
  const u_char *p, *z;
  int r;

  if (valp != NULL)
    *valp = NULL;
  if (lenp != NULL)
    *lenp = 0;
  if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0)
    return r;
  /* Allow a \0 only at the end of the string */
  if (len > 0 &&
      (z = memchr(p , '\0', len)) != NULL && z < p + len - 1) {
    SSHBUF_DBG(("SSH_ERR_INVALID_FORMAT"));
    return SSH_ERR_INVALID_FORMAT;
  }
  if ((r = sshbuf_skip_string(buf)) != 0)
    return -1;
  if (valp != NULL) {
    if ((*valp = malloc(len + 1)) == NULL) {
      SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL"));
      return SSH_ERR_ALLOC_FAIL;
    }
    if (len != 0)
      memcpy(*valp, p, len);
    (*valp)[len] = '\0';
  }
  if (lenp != NULL)
    *lenp = (size_t)len;
  return 0;
}

int
sshbuf_get_stringb(struct sshbuf *buf, struct sshbuf *v)
{
  u_int32_t len;
  u_char *p;
  int r;

  /*
   * Use sshbuf_peek_string_direct() to figure out if there is
   * a complete string in 'buf' and copy the string directly
   * into 'v'.
   */
  if ((r = sshbuf_peek_string_direct(buf, NULL, NULL)) != 0 ||
      (r = sshbuf_get_u32(buf, &len)) != 0 ||
      (r = sshbuf_reserve(v, len, &p)) != 0 ||
      (r = sshbuf_get(buf, p, len)) != 0)
    return r;
  return 0;
}

int
sshbuf_put(struct sshbuf *buf, const void *v, size_t len)
{
  u_char *p;
  int r;

  if ((r = sshbuf_reserve(buf, len, &p)) < 0)
    return r;
  if (len != 0)
    memcpy(p, v, len);
  return 0;
}

int
sshbuf_putb(struct sshbuf *buf, const struct sshbuf *v)
{
  if (v == NULL)
    return 0;
  return sshbuf_put(buf, sshbuf_ptr(v), sshbuf_len(v));
}

int
sshbuf_putf(struct sshbuf *buf, const char *fmt, ...)
{
  va_list ap;
  int r;

  va_start(ap, fmt);
  r = sshbuf_putfv(buf, fmt, ap);
  va_end(ap);
  return r;
}

int
sshbuf_putfv(struct sshbuf *buf, const char *fmt, va_list ap)
{
  va_list ap2;
  int r, len;
  u_char *p;

  VA_COPY(ap2, ap);
  if ((len = vsnprintf(NULL, 0, fmt, ap2)) < 0) {
    r = SSH_ERR_INVALID_ARGUMENT;
    goto out;
  }
  if (len == 0) {
    r = 0;
    goto out; /* Nothing to do */
  }
  va_end(ap2);
  VA_COPY(ap2, ap);
  if ((r = sshbuf_reserve(buf, (size_t)len + 1, &p)) < 0)
    goto out;
  if ((r = vsnprintf((char *)p, len + 1, fmt, ap2)) != len) {
    r = SSH_ERR_INTERNAL_ERROR;
    goto out; /* Shouldn't happen */
  }
  /* Consume terminating \0 */
  if ((r = sshbuf_consume_end(buf, 1)) != 0)
    goto out;
  r = 0;
 out:
  va_end(ap2);
  return r;
}

int
sshbuf_put_u64(struct sshbuf *buf, u_int64_t val)
{
  u_char *p;
  int r;

  if ((r = sshbuf_reserve(buf, 8, &p)) < 0)
    return r;
  POKE_U64(p, val);
  return 0;
}

int
sshbuf_put_u32(struct sshbuf *buf, u_int32_t val)
{
  u_char *p;
  int r;

  if ((r = sshbuf_reserve(buf, 4, &p)) < 0)
    return r;
  POKE_U32(p, val);
  return 0;
}

int
sshbuf_put_u16(struct sshbuf *buf, u_int16_t val)
{
  u_char *p;
  int r;

  if ((r = sshbuf_reserve(buf, 2, &p)) < 0)
    return r;
  POKE_U16(p, val);
  return 0;
}

int
sshbuf_put_u8(struct sshbuf *buf, u_char val)
{
  u_char *p;
  int r;

  if ((r = sshbuf_reserve(buf, 1, &p)) < 0)
    return r;
  p[0] = val;
  return 0;
}

static int
check_woffset(struct sshbuf *buf, size_t offset, size_t len, u_char **p)
{
  int r;

  *p = NULL;
  if ((r = check_offset(buf, 1, offset, len)) != 0)
    return r;
  if (sshbuf_mutable_ptr(buf) == NULL)
    return SSH_ERR_BUFFER_READ_ONLY;
  *p = sshbuf_mutable_ptr(buf) + offset;
  return 0;
}

int
sshbuf_poke_u64(struct sshbuf *buf, size_t offset, u_int64_t val)
{
  u_char *p = NULL;
  int r;

  if ((r = check_woffset(buf, offset, 8, &p)) != 0)
    return r;
  POKE_U64(p, val);
  return 0;
}

int
sshbuf_poke_u32(struct sshbuf *buf, size_t offset, u_int32_t val)
{
  u_char *p = NULL;
  int r;

  if ((r = check_woffset(buf, offset, 4, &p)) != 0)
    return r;
  POKE_U32(p, val);
  return 0;
}

int
sshbuf_poke_u16(struct sshbuf *buf, size_t offset, u_int16_t val)
{
  u_char *p = NULL;
  int r;

  if ((r = check_woffset(buf, offset, 2, &p)) != 0)
    return r;
  POKE_U16(p, val);
  return 0;
}

int
sshbuf_poke_u8(struct sshbuf *buf, size_t offset, u_char val)
{
  u_char *p = NULL;
  int r;

  if ((r = check_woffset(buf, offset, 1, &p)) != 0)
    return r;
  *p = val;
  return 0;
}

int
sshbuf_poke(struct sshbuf *buf, size_t offset, void *v, size_t len)
{
  u_char *p = NULL;
  int r;

  if ((r = check_woffset(buf, offset, len, &p)) != 0)
    return r;
  memcpy(p, v, len);
  return 0;
}

int
sshbuf_put_string(struct sshbuf *buf, const void *v, size_t len)
{
  u_char *d;
  int r;

  if (len > SSHBUF_SIZE_MAX - 4) {
    SSHBUF_DBG(("SSH_ERR_NO_BUFFER_SPACE"));
    return SSH_ERR_NO_BUFFER_SPACE;
  }
  if ((r = sshbuf_reserve(buf, len + 4, &d)) < 0)
    return r;
  POKE_U32(d, len);
  if (len != 0)
    memcpy(d + 4, v, len);
  return 0;
}

int
sshbuf_put_cstring(struct sshbuf *buf, const char *v)
{
  return sshbuf_put_string(buf, v, v == NULL ? 0 : strlen(v));
}

int
sshbuf_put_stringb(struct sshbuf *buf, const struct sshbuf *v)
{
  if (v == NULL)
    return sshbuf_put_string(buf, NULL, 0);

  return sshbuf_put_string(buf, sshbuf_ptr(v), sshbuf_len(v));
}

int
sshbuf_froms(struct sshbuf *buf, struct sshbuf **bufp)
{
  const u_char *p;
  size_t len;
  struct sshbuf *ret;
  int r;

  if (buf == NULL || bufp == NULL)
    return SSH_ERR_INVALID_ARGUMENT;
  *bufp = NULL;
  if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0)
    return r;
  if ((ret = sshbuf_from(p, len)) == NULL)
    return SSH_ERR_ALLOC_FAIL;
  if ((r = sshbuf_consume(buf, len + 4)) != 0 ||  /* Shouldn't happen */
      (r = sshbuf_set_parent(ret, buf)) != 0) {
    sshbuf_free(ret);
    return r;
  }
  *bufp = ret;
  return 0;
}

int
sshbuf_put_bignum2_bytes(struct sshbuf *buf, const void *v, size_t len)
{
  u_char *d;
  const u_char *s = (const u_char *)v;
  int r, prepend;

  if (len > SSHBUF_SIZE_MAX - 5) {
    SSHBUF_DBG(("SSH_ERR_NO_BUFFER_SPACE"));
    return SSH_ERR_NO_BUFFER_SPACE;
  }
  /* Skip leading zero bytes */
  for (; len > 0 && *s == 0; len--, s++)
    ;
  /*
   * If most significant bit is set then prepend a zero byte to
   * avoid interpretation as a negative number.
   */
  prepend = len > 0 && (s[0] & 0x80) != 0;
  if ((r = sshbuf_reserve(buf, len + 4 + prepend, &d)) < 0)
    return r;
  POKE_U32(d, len + prepend);
  if (prepend)
    d[4] = 0;
  if (len != 0)
    memcpy(d + 4 + prepend, s, len);
  return 0;
}

int
sshbuf_get_bignum2_bytes_direct(struct sshbuf *buf,
    const u_char **valp, size_t *lenp)
{
  const u_char *d;
  size_t len, olen;
  int r;

  if ((r = sshbuf_peek_string_direct(buf, &d, &olen)) < 0)
    return r;
  len = olen;
  /* Refuse negative (MSB set) bignums */
  if ((len != 0 && (*d & 0x80) != 0))
    return SSH_ERR_BIGNUM_IS_NEGATIVE;
  /* Refuse overlong bignums, allow prepended \0 to avoid MSB set */
  if (len > SSHBUF_MAX_BIGNUM + 1 ||
      (len == SSHBUF_MAX_BIGNUM + 1 && *d != 0))
    return SSH_ERR_BIGNUM_TOO_LARGE;
  /* Trim leading zeros */
  while (len > 0 && *d == 0x00) {
    d++;
    len--;
  }
  if (valp != NULL)
    *valp = d;
  if (lenp != NULL)
    *lenp = len;
  if (sshbuf_consume(buf, olen + 4) != 0) {
    /* Shouldn't happen */
    SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
    SSHBUF_ABORT();
    return SSH_ERR_INTERNAL_ERROR;
  }
  return 0;
}

Coverage Report

Created: 2025-08-29 06:47

Line	Count	Source (jump to first uncovered line)
1		/* $OpenBSD: sshbuf-getput-basic.c,v 1.13 2022/05/25 06:03:44 djm Exp $ */
2		/*
3		* Copyright (c) 2011 Damien Miller
4		*
5		* Permission to use, copy, modify, and distribute this software for any
6		* purpose with or without fee is hereby granted, provided that the above
7		* copyright notice and this permission notice appear in all copies.
8		*
9		* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10		* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11		* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12		* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13		* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14		* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15		* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16		*/
17
18		#define SSHBUF_INTERNAL
19		#include "includes.h"
20
21		#include <sys/types.h>
22
23		#include <stdarg.h>
24		#include <stdlib.h>
25		#include <stdio.h>
26		#include <string.h>
27		#ifdef HAVE_STDINT_H
28		# include <stdint.h>
29		#endif
30
31		#include "ssherr.h"
32		#include "sshbuf.h"
33
34		int
35		sshbuf_get(struct sshbuf buf, void v, size_t len)
36	41.6k	{
37	41.6k	const u_char *p = sshbuf_ptr(buf);
38	41.6k	int r;
39
40	41.6k	if ((r = sshbuf_consume(buf, len)) < 0)
41	0	return r;
42	41.6k	if (v != NULL && len != 0)
43	21.6k	memcpy(v, p, len);
44	41.6k	return 0;
45	41.6k	}
46
47		int
48		sshbuf_get_u64(struct sshbuf buf, u_int64_t valp)
49	22.3k	{
50	22.3k	const u_char *p = sshbuf_ptr(buf);
51	22.3k	int r;
52
53	22.3k	if ((r = sshbuf_consume(buf, 8)) < 0)
54	80	return r;
55	22.2k	if (valp != NULL)
56	22.2k	*valp = PEEK_U64(p);
57	22.2k	return 0;
58	22.3k	}
59
60		int
61		sshbuf_get_u32(struct sshbuf buf, u_int32_t valp)
62	395k	{
63	395k	const u_char *p = sshbuf_ptr(buf);
64	395k	int r;
65
66	395k	if ((r = sshbuf_consume(buf, 4)) < 0)
67	126	return r;
68	395k	if (valp != NULL)
69	317k	*valp = PEEK_U32(p);
70	395k	return 0;
71	395k	}
72
73		int
74		sshbuf_get_u16(struct sshbuf buf, u_int16_t valp)
75	0	{
76	0	const u_char *p = sshbuf_ptr(buf);
77	0	int r;
78
79	0	if ((r = sshbuf_consume(buf, 2)) < 0)
80	0	return r;
81	0	if (valp != NULL)
82	0	*valp = PEEK_U16(p);
83	0	return 0;
84	0	}
85
86		int
87		sshbuf_get_u8(struct sshbuf buf, u_char valp)
88	3.43M	{
89	3.43M	const u_char *p = sshbuf_ptr(buf);
90	3.43M	int r;
91
92	3.43M	if ((r = sshbuf_consume(buf, 1)) < 0)
93	17.7k	return r;
94	3.42M	if (valp != NULL)
95	2.10M	valp = (u_int8_t)p;
96	3.42M	return 0;
97	3.43M	}
98
99		static int
100		check_offset(const struct sshbuf *buf, int wr, size_t offset, size_t len)
101	0	{
102	0	if (sshbuf_ptr(buf) == NULL) /* calls sshbuf_check_sanity() */
103	0	return SSH_ERR_INTERNAL_ERROR;
104	0	if (offset >= SIZE_MAX - len)
105	0	return SSH_ERR_INVALID_ARGUMENT;
106	0	if (offset + len > sshbuf_len(buf)) {
107	0	return wr ?
108	0	SSH_ERR_NO_BUFFER_SPACE : SSH_ERR_MESSAGE_INCOMPLETE;
109	0	}
110	0	return 0;
111	0	}
112
113		static int
114		check_roffset(const struct sshbuf *buf, size_t offset, size_t len,
115		const u_char **p)
116	0	{
117	0	int r;
118
119	0	*p = NULL;
120	0	if ((r = check_offset(buf, 0, offset, len)) != 0)
121	0	return r;
122	0	*p = sshbuf_ptr(buf) + offset;
123	0	return 0;
124	0	}
125
126		int
127		sshbuf_peek_u64(const struct sshbuf buf, size_t offset, u_int64_t valp)
128	0	{
129	0	const u_char *p = NULL;
130	0	int r;
131
132	0	if (valp != NULL)
133	0	*valp = 0;
134	0	if ((r = check_roffset(buf, offset, 8, &p)) != 0)
135	0	return r;
136	0	if (valp != NULL)
137	0	*valp = PEEK_U64(p);
138	0	return 0;
139	0	}
140
141		int
142		sshbuf_peek_u32(const struct sshbuf buf, size_t offset, u_int32_t valp)
143	0	{
144	0	const u_char *p = NULL;
145	0	int r;
146
147	0	if (valp != NULL)
148	0	*valp = 0;
149	0	if ((r = check_roffset(buf, offset, 4, &p)) != 0)
150	0	return r;
151	0	if (valp != NULL)
152	0	*valp = PEEK_U32(p);
153	0	return 0;
154	0	}
155
156		int
157		sshbuf_peek_u16(const struct sshbuf buf, size_t offset, u_int16_t valp)
158	0	{
159	0	const u_char *p = NULL;
160	0	int r;
161
162	0	if (valp != NULL)
163	0	*valp = 0;
164	0	if ((r = check_roffset(buf, offset, 2, &p)) != 0)
165	0	return r;
166	0	if (valp != NULL)
167	0	*valp = PEEK_U16(p);
168	0	return 0;
169	0	}
170
171		int
172		sshbuf_peek_u8(const struct sshbuf buf, size_t offset, u_char valp)
173	0	{
174	0	const u_char *p = NULL;
175	0	int r;
176
177	0	if (valp != NULL)
178	0	*valp = 0;
179	0	if ((r = check_roffset(buf, offset, 1, &p)) != 0)
180	0	return r;
181	0	if (valp != NULL)
182	0	valp = p;
183	0	return 0;
184	0	}
185
186		int
187		sshbuf_get_string(struct sshbuf buf, u_char valp, size_t lenp)
188	782k	{
189	782k	const u_char *val;
190	782k	size_t len;
191	782k	int r;
192
193	782k	if (valp != NULL)
194	25.8k	*valp = NULL;
195	782k	if (lenp != NULL)
196	25.8k	*lenp = 0;
197	782k	if ((r = sshbuf_get_string_direct(buf, &val, &len)) < 0)
198	2.63k	return r;
199	779k	if (valp != NULL) {
200	25.5k	if ((*valp = malloc(len + 1)) == NULL) {
201	0	SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL"));
202	0	return SSH_ERR_ALLOC_FAIL;
203	0	}
204	25.5k	if (len != 0)
205	24.7k	memcpy(*valp, val, len);
206	25.5k	(*valp)[len] = '\0';
207	25.5k	}
208	779k	if (lenp != NULL)
209	25.5k	*lenp = len;
210	779k	return 0;
211	779k	}
212
213		int
214		sshbuf_get_string_direct(struct sshbuf buf, const u_char valp, size_t lenp)
215	3.34M	{
216	3.34M	size_t len;
217	3.34M	const u_char *p;
218	3.34M	int r;
219
220	3.34M	if (valp != NULL)
221	788k	*valp = NULL;
222	3.34M	if (lenp != NULL)
223	788k	*lenp = 0;
224	3.34M	if ((r = sshbuf_peek_string_direct(buf, &p, &len)) < 0)
225	3.65k	return r;
226	3.34M	if (valp != NULL)
227	785k	*valp = p;
228	3.34M	if (lenp != NULL)
229	785k	*lenp = len;
230	3.34M	if (sshbuf_consume(buf, len + 4) != 0) {
231		/* Shouldn't happen */
232	0	SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
233	0	SSHBUF_ABORT();
234	0	return SSH_ERR_INTERNAL_ERROR;
235	0	}
236	3.34M	return 0;
237	3.34M	}
238
239		int
240		sshbuf_peek_string_direct(const struct sshbuf buf, const u_char *valp,
241		size_t *lenp)
242	5.95M	{
243	5.95M	u_int32_t len;
244	5.95M	const u_char *p = sshbuf_ptr(buf);
245
246	5.95M	if (valp != NULL)
247	5.90M	*valp = NULL;
248	5.95M	if (lenp != NULL)
249	5.90M	*lenp = 0;
250	5.95M	if (sshbuf_len(buf) < 4) {
251	2.17k	SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE"));
252	2.17k	return SSH_ERR_MESSAGE_INCOMPLETE;
253	2.17k	}
254	5.94M	len = PEEK_U32(p);
255	5.94M	if (len > SSHBUF_SIZE_MAX - 4) {
256	1.95k	SSHBUF_DBG(("SSH_ERR_STRING_TOO_LARGE"));
257	1.95k	return SSH_ERR_STRING_TOO_LARGE;
258	1.95k	}
259	5.94M	if (sshbuf_len(buf) - 4 < len) {
260	3.09k	SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE"));
261	3.09k	return SSH_ERR_MESSAGE_INCOMPLETE;
262	3.09k	}
263	5.94M	if (valp != NULL)
264	5.90M	*valp = p + 4;
265	5.94M	if (lenp != NULL)
266	5.90M	*lenp = len;
267	5.94M	return 0;
268	5.94M	}
269
270		int
271		sshbuf_get_cstring(struct sshbuf buf, char valp, size_t lenp)
272	2.47M	{
273	2.47M	size_t len;
274	2.47M	const u_char p, z;
275	2.47M	int r;
276
277	2.47M	if (valp != NULL)
278	2.47M	*valp = NULL;
279	2.47M	if (lenp != NULL)
280	13.8k	*lenp = 0;
281	2.47M	if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0)
282	1.15k	return r;
283		/* Allow a \0 only at the end of the string */
284	2.47M	if (len > 0 &&
285	2.47M	(z = memchr(p , '\0', len)) != NULL && z < p + len - 1) {
286	591	SSHBUF_DBG(("SSH_ERR_INVALID_FORMAT"));
287	591	return SSH_ERR_INVALID_FORMAT;
288	591	}
289	2.47M	if ((r = sshbuf_skip_string(buf)) != 0)
290	0	return -1;
291	2.47M	if (valp != NULL) {
292	2.47M	if ((*valp = malloc(len + 1)) == NULL) {
293	0	SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL"));
294	0	return SSH_ERR_ALLOC_FAIL;
295	0	}
296	2.47M	if (len != 0)
297	1.96M	memcpy(*valp, p, len);
298	2.47M	(*valp)[len] = '\0';
299	2.47M	}
300	2.47M	if (lenp != NULL)
301	13.8k	*lenp = (size_t)len;
302	2.47M	return 0;
303	2.47M	}
304
305		int
306		sshbuf_get_stringb(struct sshbuf buf, struct sshbuf v)
307	41.7k	{
308	41.7k	u_int32_t len;
309	41.7k	u_char *p;
310	41.7k	int r;
311
312		/*
313		* Use sshbuf_peek_string_direct() to figure out if there is
314		* a complete string in 'buf' and copy the string directly
315		* into 'v'.
316		*/
317	41.7k	if ((r = sshbuf_peek_string_direct(buf, NULL, NULL)) != 0 \|\|
318	41.7k	(r = sshbuf_get_u32(buf, &len)) != 0 \|\|
319	41.7k	(r = sshbuf_reserve(v, len, &p)) != 0 \|\|
320	41.7k	(r = sshbuf_get(buf, p, len)) != 0)
321	110	return r;
322	41.6k	return 0;
323	41.7k	}
324
325		int
326		sshbuf_put(struct sshbuf buf, const void v, size_t len)
327	3.20M	{
328	3.20M	u_char *p;
329	3.20M	int r;
330
331	3.20M	if ((r = sshbuf_reserve(buf, len, &p)) < 0)
332	0	return r;
333	3.20M	if (len != 0)
334	3.19M	memcpy(p, v, len);
335	3.20M	return 0;
336	3.20M	}
337
338		int
339		sshbuf_putb(struct sshbuf buf, const struct sshbuf v)
340	256k	{
341	256k	if (v == NULL)
342	6	return 0;
343	256k	return sshbuf_put(buf, sshbuf_ptr(v), sshbuf_len(v));
344	256k	}
345
346		int
347		sshbuf_putf(struct sshbuf buf, const char fmt, ...)
348	133k	{
349	133k	va_list ap;
350	133k	int r;
351
352	133k	va_start(ap, fmt);
353	133k	r = sshbuf_putfv(buf, fmt, ap);
354	133k	va_end(ap);
355	133k	return r;
356	133k	}
357
358		int
359		sshbuf_putfv(struct sshbuf buf, const char fmt, va_list ap)
360	133k	{
361	133k	va_list ap2;
362	133k	int r, len;
363	133k	u_char *p;
364
365	133k	VA_COPY(ap2, ap);
366	133k	if ((len = vsnprintf(NULL, 0, fmt, ap2)) < 0) {
367	0	r = SSH_ERR_INVALID_ARGUMENT;
368	0	goto out;
369	0	}
370	133k	if (len == 0) {
371	0	r = 0;
372	0	goto out; /* Nothing to do */
373	0	}
374	133k	va_end(ap2);
375	133k	VA_COPY(ap2, ap);
376	133k	if ((r = sshbuf_reserve(buf, (size_t)len + 1, &p)) < 0)
377	0	goto out;
378	133k	if ((r = vsnprintf((char *)p, len + 1, fmt, ap2)) != len) {
379	0	r = SSH_ERR_INTERNAL_ERROR;
380	0	goto out; /* Shouldn't happen */
381	0	}
382		/* Consume terminating \0 */
383	133k	if ((r = sshbuf_consume_end(buf, 1)) != 0)
384	0	goto out;
385	133k	r = 0;
386	133k	out:
387	133k	va_end(ap2);
388	133k	return r;
389	133k	}
390
391		int
392		sshbuf_put_u64(struct sshbuf *buf, u_int64_t val)
393	0	{
394	0	u_char *p;
395	0	int r;
396
397	0	if ((r = sshbuf_reserve(buf, 8, &p)) < 0)
398	0	return r;
399	0	POKE_U64(p, val);
400	0	return 0;
401	0	}
402
403		int
404		sshbuf_put_u32(struct sshbuf *buf, u_int32_t val)
405	2.02M	{
406	2.02M	u_char *p;
407	2.02M	int r;
408
409	2.02M	if ((r = sshbuf_reserve(buf, 4, &p)) < 0)
410	0	return r;
411	2.02M	POKE_U32(p, val);
412	2.02M	return 0;
413	2.02M	}
414
415		int
416		sshbuf_put_u16(struct sshbuf *buf, u_int16_t val)
417	0	{
418	0	u_char *p;
419	0	int r;
420
421	0	if ((r = sshbuf_reserve(buf, 2, &p)) < 0)
422	0	return r;
423	0	POKE_U16(p, val);
424	0	return 0;
425	0	}
426
427		int
428		sshbuf_put_u8(struct sshbuf *buf, u_char val)
429	18.3M	{
430	18.3M	u_char *p;
431	18.3M	int r;
432
433	18.3M	if ((r = sshbuf_reserve(buf, 1, &p)) < 0)
434	0	return r;
435	18.3M	p[0] = val;
436	18.3M	return 0;
437	18.3M	}
438
439		static int
440		check_woffset(struct sshbuf buf, size_t offset, size_t len, u_char *p)
441	0	{
442	0	int r;
443
444	0	*p = NULL;
445	0	if ((r = check_offset(buf, 1, offset, len)) != 0)
446	0	return r;
447	0	if (sshbuf_mutable_ptr(buf) == NULL)
448	0	return SSH_ERR_BUFFER_READ_ONLY;
449	0	*p = sshbuf_mutable_ptr(buf) + offset;
450	0	return 0;
451	0	}
452
453		int
454		sshbuf_poke_u64(struct sshbuf *buf, size_t offset, u_int64_t val)
455	0	{
456	0	u_char *p = NULL;
457	0	int r;
458
459	0	if ((r = check_woffset(buf, offset, 8, &p)) != 0)
460	0	return r;
461	0	POKE_U64(p, val);
462	0	return 0;
463	0	}
464
465		int
466		sshbuf_poke_u32(struct sshbuf *buf, size_t offset, u_int32_t val)
467	0	{
468	0	u_char *p = NULL;
469	0	int r;
470
471	0	if ((r = check_woffset(buf, offset, 4, &p)) != 0)
472	0	return r;
473	0	POKE_U32(p, val);
474	0	return 0;
475	0	}
476
477		int
478		sshbuf_poke_u16(struct sshbuf *buf, size_t offset, u_int16_t val)
479	0	{
480	0	u_char *p = NULL;
481	0	int r;
482
483	0	if ((r = check_woffset(buf, offset, 2, &p)) != 0)
484	0	return r;
485	0	POKE_U16(p, val);
486	0	return 0;
487	0	}
488
489		int
490		sshbuf_poke_u8(struct sshbuf *buf, size_t offset, u_char val)
491	0	{
492	0	u_char *p = NULL;
493	0	int r;
494
495	0	if ((r = check_woffset(buf, offset, 1, &p)) != 0)
496	0	return r;
497	0	*p = val;
498	0	return 0;
499	0	}
500
501		int
502		sshbuf_poke(struct sshbuf buf, size_t offset, void v, size_t len)
503	0	{
504	0	u_char *p = NULL;
505	0	int r;
506
507	0	if ((r = check_woffset(buf, offset, len, &p)) != 0)
508	0	return r;
509	0	memcpy(p, v, len);
510	0	return 0;
511	0	}
512
513		int
514		sshbuf_put_string(struct sshbuf buf, const void v, size_t len)
515	2.71M	{
516	2.71M	u_char *d;
517	2.71M	int r;
518
519	2.71M	if (len > SSHBUF_SIZE_MAX - 4) {
520	0	SSHBUF_DBG(("SSH_ERR_NO_BUFFER_SPACE"));
521	0	return SSH_ERR_NO_BUFFER_SPACE;
522	0	}
523	2.71M	if ((r = sshbuf_reserve(buf, len + 4, &d)) < 0)
524	0	return r;
525	2.71M	POKE_U32(d, len);
526	2.71M	if (len != 0)
527	2.17M	memcpy(d + 4, v, len);
528	2.71M	return 0;
529	2.71M	}
530
531		int
532		sshbuf_put_cstring(struct sshbuf buf, const char v)
533	2.68M	{
534	2.68M	return sshbuf_put_string(buf, v, v == NULL ? 0 : strlen(v));
535	2.68M	}
536
537		int
538		sshbuf_put_stringb(struct sshbuf buf, const struct sshbuf v)
539	22.2k	{
540	22.2k	if (v == NULL)
541	0	return sshbuf_put_string(buf, NULL, 0);
542
543	22.2k	return sshbuf_put_string(buf, sshbuf_ptr(v), sshbuf_len(v));
544	22.2k	}
545
546		int
547		sshbuf_froms(struct sshbuf buf, struct sshbuf *bufp)
548	53.5k	{
549	53.5k	const u_char *p;
550	53.5k	size_t len;
551	53.5k	struct sshbuf *ret;
552	53.5k	int r;
553
554	53.5k	if (buf == NULL \|\| bufp == NULL)
555	0	return SSH_ERR_INVALID_ARGUMENT;
556	53.5k	*bufp = NULL;
557	53.5k	if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0)
558	1.52k	return r;
559	52.0k	if ((ret = sshbuf_from(p, len)) == NULL)
560	0	return SSH_ERR_ALLOC_FAIL;
561	52.0k	if ((r = sshbuf_consume(buf, len + 4)) != 0 \|\| /* Shouldn't happen */
562	52.0k	(r = sshbuf_set_parent(ret, buf)) != 0) {
563	0	sshbuf_free(ret);
564	0	return r;
565	0	}
566	52.0k	*bufp = ret;
567	52.0k	return 0;
568	52.0k	}
569
570		int
571		sshbuf_put_bignum2_bytes(struct sshbuf buf, const void v, size_t len)
572	748	{
573	748	u_char *d;
574	748	const u_char s = (const u_char )v;
575	748	int r, prepend;
576
577	748	if (len > SSHBUF_SIZE_MAX - 5) {
578	0	SSHBUF_DBG(("SSH_ERR_NO_BUFFER_SPACE"));
579	0	return SSH_ERR_NO_BUFFER_SPACE;
580	0	}
581		/* Skip leading zero bytes */
582	751	for (; len > 0 && *s == 0; len--, s++)
583	3	;
584		/*
585		* If most significant bit is set then prepend a zero byte to
586		* avoid interpretation as a negative number.
587		*/
588	748	prepend = len > 0 && (s[0] & 0x80) != 0;
589	748	if ((r = sshbuf_reserve(buf, len + 4 + prepend, &d)) < 0)
590	0	return r;
591	748	POKE_U32(d, len + prepend);
592	748	if (prepend)
593	380	d[4] = 0;
594	748	if (len != 0)
595	748	memcpy(d + 4 + prepend, s, len);
596	748	return 0;
597	748	}
598
599		int
600		sshbuf_get_bignum2_bytes_direct(struct sshbuf *buf,
601		const u_char *valp, size_t lenp)
602	18.1k	{
603	18.1k	const u_char *d;
604	18.1k	size_t len, olen;
605	18.1k	int r;
606
607	18.1k	if ((r = sshbuf_peek_string_direct(buf, &d, &olen)) < 0)
608	566	return r;
609	17.5k	len = olen;
610		/* Refuse negative (MSB set) bignums */
611	17.5k	if ((len != 0 && (*d & 0x80) != 0))
612	67	return SSH_ERR_BIGNUM_IS_NEGATIVE;
613		/* Refuse overlong bignums, allow prepended \0 to avoid MSB set */
614	17.5k	if (len > SSHBUF_MAX_BIGNUM + 1 \|\|
615	17.5k	(len == SSHBUF_MAX_BIGNUM + 1 && *d != 0))
616	84	return SSH_ERR_BIGNUM_TOO_LARGE;
617		/* Trim leading zeros */
618	34.1k	while (len > 0 && *d == 0x00) {
619	16.7k	d++;
620	16.7k	len--;
621	16.7k	}
622	17.4k	if (valp != NULL)
623	17.4k	*valp = d;
624	17.4k	if (lenp != NULL)
625	17.4k	*lenp = len;
626	17.4k	if (sshbuf_consume(buf, olen + 4) != 0) {
627		/* Shouldn't happen */
628	0	SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
629	0	SSHBUF_ABORT();
630	0	return SSH_ERR_INTERNAL_ERROR;
631	0	}
632	17.4k	return 0;
633	17.4k	}