fuzz_early_setup: 23| 2|void fuzz_early_setup(void) { 24| | /* Set stderr to point to normal stderr by default */ 25| 2| fuzz.fake_stderr = stderr; 26| 2|} fuzz_common_setup: 28| 1|void fuzz_common_setup(void) { 29| 1| disallow_core(); 30| 1| fuzz.fuzzing = 1; 31| 1| fuzz.wrapfds = 1; 32| 1| fuzz.do_jmp = 1; 33| 1| fuzz.input = m_malloc(sizeof(buffer)); 34| 1| _dropbear_log = fuzz_dropbear_log; 35| 1| crypto_init(); 36| 1| fuzz_seed("start", 5); 37| | /* let any messages get flushed */ 38| 1| setlinebuf(stdout); 39| |#if DEBUG_TRACE 40| | if (debug_trace) 41| | { 42| | fprintf(stderr, "Dropbear fuzzer: -v specified, not disabling stderr output\n"); 43| | } 44| | else 45| |#endif 46| 1| if (getenv("DROPBEAR_KEEP_STDERR")) { ------------------ | Branch (46:9): [True: 0, False: 1] ------------------ 47| 0| fprintf(stderr, "Dropbear fuzzer: DROPBEAR_KEEP_STDERR, not disabling stderr output\n"); 48| 0| } 49| 1| else 50| 1| { 51| 1| fprintf(stderr, "Dropbear fuzzer: Disabling stderr output\n"); 52| 1| fuzz.fake_stderr = fopen("/dev/null", "w"); 53| 1| assert(fuzz.fake_stderr); 54| 1| } 55| 1|} fuzz_set_input: 57| 2.38k|int fuzz_set_input(const uint8_t *Data, size_t Size) { 58| | 59| 2.38k| fuzz.input->data = (unsigned char*)Data; 60| 2.38k| fuzz.input->size = Size; 61| 2.38k| fuzz.input->len = Size; 62| 2.38k| fuzz.input->pos = 0; 63| | 64| 2.38k| memset(&ses, 0x0, sizeof(ses)); 65| 2.38k| memset(&svr_ses, 0x0, sizeof(svr_ses)); 66| 2.38k| memset(&cli_ses, 0x0, sizeof(cli_ses)); 67| 2.38k| wrapfd_setup(fuzz.input); 68| | // printhex("input", fuzz.input->data, fuzz.input->len); 69| | 70| 2.38k| fuzz_seed(fuzz.input->data, MIN(fuzz.input->len, 16)); 71| | 72| 2.38k| return DROPBEAR_SUCCESS; ------------------ | | 102| 2.38k|#define DROPBEAR_SUCCESS 0 ------------------ 73| 2.38k|} fuzz-common.c:fuzz_dropbear_log: 84| 3.10k|static void fuzz_dropbear_log(int UNUSED(priority), const char* UNUSED(format), va_list UNUSED(param)) { 85| | /* No print */ 86| 3.10k|} wrapfd_setup: 32| 2.38k|void wrapfd_setup(buffer *buf) { 33| 2.38k| TRACE(("wrapfd_setup")) 34| | 35| | // clean old ones 36| 2.38k| int i; 37| 2.38k| for (i = 0; i <= wrapfd_maxfd; i++) { ------------------ | Branch (37:14): [True: 0, False: 2.38k] ------------------ 38| 0| if (wrap_fds[i].mode != UNUSED) { ------------------ | Branch (38:7): [True: 0, False: 0] ------------------ 39| 0| wrapfd_remove(i); 40| 0| } 41| 0| } 42| 2.38k| wrapfd_maxfd = -1; 43| | 44| 2.38k| memset(rand_state, 0x0, sizeof(rand_state)); 45| 2.38k| wrapfd_setseed(50); 46| 2.38k| input_buf = buf; 47| 2.38k|} wrapfd_setseed: 49| 2.38k|void wrapfd_setseed(uint32_t seed) { 50| 2.38k| memcpy(rand_state, &seed, sizeof(seed)); 51| 2.38k| nrand48(rand_state); 52| 2.38k|} LLVMFuzzerTestOneInput: 10| 2.38k|int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { 11| 2.38k| static int once = 0; 12| 2.38k| if (!once) { ------------------ | Branch (12:6): [True: 1, False: 2.38k] ------------------ 13| 1| setup_fuzzer(); 14| 1| once = 1; 15| 1| } 16| | 17| 2.38k| if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) { ------------------ | | 103| 2.38k|#define DROPBEAR_FAILURE -1 ------------------ | Branch (17:6): [True: 0, False: 2.38k] ------------------ 18| 0| return 0; 19| 0| } 20| | 21| 2.38k| m_malloc_set_epoch(1); 22| | 23| 2.38k| if (setjmp(fuzz.jmp) == 0) { ------------------ | Branch (23:6): [True: 2.38k, False: 0] ------------------ 24| 2.38k| buffer *line = buf_getstringbuf(fuzz.input); 25| 2.38k| buffer *keyblob = buf_getstringbuf(fuzz.input); 26| | 27| 2.38k| unsigned int algolen; 28| 2.38k| char* algoname = buf_getstring(keyblob, &algolen); 29| | 30| 2.38k| if (signature_type_from_name(algoname, algolen) == DROPBEAR_SIGNATURE_NONE) { ------------------ | Branch (30:7): [True: 207, False: 2.17k] ------------------ 31| 207| dropbear_exit("fuzzer imagined a bogus algorithm"); 32| 207| } 33| | 34| 2.17k| int ret = fuzz_checkpubkey_line(line, 5, "/home/me/authorized_keys", 35| 2.17k| algoname, algolen, 36| 2.17k| keyblob->data, keyblob->len); 37| | 38| 2.17k| if (ret == DROPBEAR_SUCCESS) { ------------------ | | 102| 2.17k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (38:7): [True: 157, False: 2.02k] ------------------ 39| | /* fuzz_checkpubkey_line() should have cleaned up for failure */ 40| 157| svr_pubkey_options_cleanup(); 41| 157| } 42| | 43| 2.17k| buf_free(line); 44| 2.17k| buf_free(keyblob); 45| 2.17k| m_free(algoname); ------------------ | | 24| 2.17k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded - Ignored] | | ------------------ ------------------ 46| 2.17k| m_malloc_free_epoch(1, 0); 47| 2.17k| } else { 48| 0| m_malloc_free_epoch(1, 1); 49| 0| TRACE(("dropbear_exit longjmped")) 50| | /* dropbear_exit jumped here */ 51| 0| } 52| | 53| 2.17k| return 0; 54| 2.38k|} fuzzer-pubkey.c:setup_fuzzer: 6| 1|static void setup_fuzzer(void) { 7| 1| fuzz_common_setup(); 8| 1|} sha256_init: 205| 2.38k|{ 206| 2.38k| LTC_ARGCHK(md != NULL); ------------------ | | 32| 2.38k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 2.38k] | | | Branch (32:87): [Folded - Ignored] | | ------------------ ------------------ 207| | 208| 2.38k| md->sha256.curlen = 0; 209| 2.38k| md->sha256.length = 0; 210| 2.38k| md->sha256.state[0] = 0x6A09E667UL; 211| 2.38k| md->sha256.state[1] = 0xBB67AE85UL; 212| 2.38k| md->sha256.state[2] = 0x3C6EF372UL; 213| 2.38k| md->sha256.state[3] = 0xA54FF53AUL; 214| 2.38k| md->sha256.state[4] = 0x510E527FUL; 215| 2.38k| md->sha256.state[5] = 0x9B05688CUL; 216| 2.38k| md->sha256.state[6] = 0x1F83D9ABUL; 217| 2.38k| md->sha256.state[7] = 0x5BE0CD19UL; 218| 2.38k| return CRYPT_OK; 219| 2.38k|} sha256_done: 237| 2.38k|{ 238| 2.38k| int i; 239| | 240| 2.38k| LTC_ARGCHK(md != NULL); ------------------ | | 32| 2.38k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 2.38k] | | | Branch (32:87): [Folded - Ignored] | | ------------------ ------------------ 241| 2.38k| LTC_ARGCHK(out != NULL); ------------------ | | 32| 2.38k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 2.38k] | | | Branch (32:87): [Folded - Ignored] | | ------------------ ------------------ 242| | 243| 2.38k| if (md->sha256.curlen >= sizeof(md->sha256.buf)) { ------------------ | Branch (243:9): [True: 0, False: 2.38k] ------------------ 244| 0| return CRYPT_INVALID_ARG; 245| 0| } 246| | 247| | 248| | /* increase the length of the message */ 249| 2.38k| md->sha256.length += md->sha256.curlen * 8; 250| | 251| | /* append the '1' bit */ 252| 2.38k| md->sha256.buf[md->sha256.curlen++] = (unsigned char)0x80; 253| | 254| | /* if the length is currently above 56 bytes we append zeros 255| | * then compress. Then we can fall back to padding zeros and length 256| | * encoding like normal. 257| | */ 258| 2.38k| if (md->sha256.curlen > 56) { ------------------ | Branch (258:9): [True: 0, False: 2.38k] ------------------ 259| 0| while (md->sha256.curlen < 64) { ------------------ | Branch (259:16): [True: 0, False: 0] ------------------ 260| 0| md->sha256.buf[md->sha256.curlen++] = (unsigned char)0; 261| 0| } 262| 0| sha256_compress(md, md->sha256.buf); 263| 0| md->sha256.curlen = 0; 264| 0| } 265| | 266| | /* pad upto 56 bytes of zeroes */ 267| 68.0k| while (md->sha256.curlen < 56) { ------------------ | Branch (267:12): [True: 65.6k, False: 2.38k] ------------------ 268| 65.6k| md->sha256.buf[md->sha256.curlen++] = (unsigned char)0; 269| 65.6k| } 270| | 271| | /* store length */ 272| 2.38k| STORE64H(md->sha256.length, md->sha256.buf+56); ------------------ | | 101| 2.38k|#define STORE64H(x, y) \ | | 102| 2.38k|do { ulong64 __t = __builtin_bswap64 ((x)); \ | | 103| 2.38k| XMEMCPY ((y), &__t, 8); } while(0) | | ------------------ | | | | 39| 2.38k|#define XMEMCPY memcpy | | ------------------ | | | Branch (103:39): [Folded - Ignored] | | ------------------ ------------------ 273| 2.38k| sha256_compress(md, md->sha256.buf); 274| | 275| | /* copy output */ 276| 21.4k| for (i = 0; i < 8; i++) { ------------------ | Branch (276:17): [True: 19.0k, False: 2.38k] ------------------ 277| 19.0k| STORE32H(md->sha256.state[i], out+(4*i)); ------------------ | | 62| 19.0k|#define STORE32H(x, y) \ | | 63| 19.0k|do { ulong32 __t = __builtin_bswap32 ((x)); \ | | 64| 19.0k| XMEMCPY ((y), &__t, 4); } while(0) | | ------------------ | | | | 39| 19.0k|#define XMEMCPY memcpy | | ------------------ | | | Branch (64:39): [Folded - Ignored] | | ------------------ ------------------ 278| 19.0k| } 279| |#ifdef LTC_CLEAN_STACK 280| | zeromem(md, sizeof(hash_state)); 281| |#endif 282| 2.38k| return CRYPT_OK; 283| 2.38k|} sha256.c:sha256_compress: 71| 2.38k|{ 72| 2.38k| ulong32 S[8], W[64], t0, t1; 73| 2.38k|#ifdef LTC_SMALL_CODE 74| 2.38k| ulong32 t; 75| 2.38k|#endif 76| 2.38k| int i; 77| | 78| | /* copy state into S */ 79| 21.4k| for (i = 0; i < 8; i++) { ------------------ | Branch (79:17): [True: 19.0k, False: 2.38k] ------------------ 80| 19.0k| S[i] = md->sha256.state[i]; 81| 19.0k| } 82| | 83| | /* copy the state into 512-bits into W[0..15] */ 84| 40.5k| for (i = 0; i < 16; i++) { ------------------ | Branch (84:17): [True: 38.1k, False: 2.38k] ------------------ 85| 38.1k| LOAD32H(W[i], buf + (4*i)); ------------------ | | 66| 38.1k|#define LOAD32H(x, y) \ | | 67| 38.1k|do { XMEMCPY (&(x), (y), 4); \ | | ------------------ | | | | 39| 38.1k|#define XMEMCPY memcpy | | ------------------ | | 68| 38.1k| (x) = __builtin_bswap32 ((x)); } while(0) | | ------------------ | | | Branch (68:46): [Folded - Ignored] | | ------------------ ------------------ 86| 38.1k| } 87| | 88| | /* fill W[16..63] */ 89| 116k| for (i = 16; i < 64; i++) { ------------------ | Branch (89:18): [True: 114k, False: 2.38k] ------------------ 90| 114k| W[i] = Gamma1(W[i - 2]) + W[i - 7] + Gamma0(W[i - 15]) + W[i - 16]; ------------------ | | 63| 114k|#define Gamma1(x) (S(x, 17) ^ S(x, 19) ^ R(x, 10)) | | ------------------ | | | | 58| 114k|#define S(x, n) RORc((x),(n)) | | | | ------------------ | | | | | | 283| 114k|#define RORc(word,i) ({ \ | | | | | | 284| 114k| ulong32 __RORc_tmp = (word); \ | | | | | | 285| 114k| __asm__ ("rorl %2, %0" : \ | | | | | | 286| 114k| "=r" (__RORc_tmp) : \ | | | | | | 287| 114k| "0" (__RORc_tmp), \ | | | | | | 288| 114k| "I" (i)); \ | | | | | | 289| 114k| __RORc_tmp; \ | | | | | | 290| 114k| }) | | | | ------------------ | | ------------------ | | #define Gamma1(x) (S(x, 17) ^ S(x, 19) ^ R(x, 10)) | | ------------------ | | | | 58| 114k|#define S(x, n) RORc((x),(n)) | | | | ------------------ | | | | | | 283| 114k|#define RORc(word,i) ({ \ | | | | | | 284| 114k| ulong32 __RORc_tmp = (word); \ | | | | | | 285| 114k| __asm__ ("rorl %2, %0" : \ | | | | | | 286| 114k| "=r" (__RORc_tmp) : \ | | | | | | 287| 114k| "0" (__RORc_tmp), \ | | | | | | 288| 114k| "I" (i)); \ | | | | | | 289| 114k| __RORc_tmp; \ | | | | | | 290| 114k| }) | | | | ------------------ | | ------------------ | | #define Gamma1(x) (S(x, 17) ^ S(x, 19) ^ R(x, 10)) | | ------------------ | | | | 59| 114k|#define R(x, n) (((x)&0xFFFFFFFFUL)>>(n)) | | ------------------ ------------------ W[i] = Gamma1(W[i - 2]) + W[i - 7] + Gamma0(W[i - 15]) + W[i - 16]; ------------------ | | 62| 114k|#define Gamma0(x) (S(x, 7) ^ S(x, 18) ^ R(x, 3)) | | ------------------ | | | | 58| 114k|#define S(x, n) RORc((x),(n)) | | | | ------------------ | | | | | | 283| 114k|#define RORc(word,i) ({ \ | | | | | | 284| 114k| ulong32 __RORc_tmp = (word); \ | | | | | | 285| 114k| __asm__ ("rorl %2, %0" : \ | | | | | | 286| 114k| "=r" (__RORc_tmp) : \ | | | | | | 287| 114k| "0" (__RORc_tmp), \ | | | | | | 288| 114k| "I" (i)); \ | | | | | | 289| 114k| __RORc_tmp; \ | | | | | | 290| 114k| }) | | | | ------------------ | | ------------------ | | #define Gamma0(x) (S(x, 7) ^ S(x, 18) ^ R(x, 3)) | | ------------------ | | | | 58| 114k|#define S(x, n) RORc((x),(n)) | | | | ------------------ | | | | | | 283| 114k|#define RORc(word,i) ({ \ | | | | | | 284| 114k| ulong32 __RORc_tmp = (word); \ | | | | | | 285| 114k| __asm__ ("rorl %2, %0" : \ | | | | | | 286| 114k| "=r" (__RORc_tmp) : \ | | | | | | 287| 114k| "0" (__RORc_tmp), \ | | | | | | 288| 114k| "I" (i)); \ | | | | | | 289| 114k| __RORc_tmp; \ | | | | | | 290| 114k| }) | | | | ------------------ | | ------------------ | | #define Gamma0(x) (S(x, 7) ^ S(x, 18) ^ R(x, 3)) | | ------------------ | | | | 59| 114k|#define R(x, n) (((x)&0xFFFFFFFFUL)>>(n)) | | ------------------ ------------------ 91| 114k| } 92| | 93| | /* Compress */ 94| 2.38k|#ifdef LTC_SMALL_CODE 95| 2.38k|#define RND(a,b,c,d,e,f,g,h,i) \ 96| 2.38k| t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i]; \ 97| 2.38k| t1 = Sigma0(a) + Maj(a, b, c); \ 98| 2.38k| d += t0; \ 99| 2.38k| h = t0 + t1; 100| | 101| 155k| for (i = 0; i < 64; ++i) { ------------------ | Branch (101:18): [True: 152k, False: 2.38k] ------------------ 102| 152k| RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],i); ------------------ | | 96| 152k| t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i]; \ | | ------------------ | | | | 61| 152k|#define Sigma1(x) (S(x, 6) ^ S(x, 11) ^ S(x, 25)) | | | | ------------------ | | | | | | 58| 152k|#define S(x, n) RORc((x),(n)) | | | | | | ------------------ | | | | | | | | 283| 152k|#define RORc(word,i) ({ \ | | | | | | | | 284| 152k| ulong32 __RORc_tmp = (word); \ | | | | | | | | 285| 152k| __asm__ ("rorl %2, %0" : \ | | | | | | | | 286| 152k| "=r" (__RORc_tmp) : \ | | | | | | | | 287| 152k| "0" (__RORc_tmp), \ | | | | | | | | 288| 152k| "I" (i)); \ | | | | | | | | 289| 152k| __RORc_tmp; \ | | | | | | | | 290| 152k| }) | | | | | | ------------------ | | | | ------------------ | | | | #define Sigma1(x) (S(x, 6) ^ S(x, 11) ^ S(x, 25)) | | | | ------------------ | | | | | | 58| 152k|#define S(x, n) RORc((x),(n)) | | | | | | ------------------ | | | | | | | | 283| 152k|#define RORc(word,i) ({ \ | | | | | | | | 284| 152k| ulong32 __RORc_tmp = (word); \ | | | | | | | | 285| 152k| __asm__ ("rorl %2, %0" : \ | | | | | | | | 286| 152k| "=r" (__RORc_tmp) : \ | | | | | | | | 287| 152k| "0" (__RORc_tmp), \ | | | | | | | | 288| 152k| "I" (i)); \ | | | | | | | | 289| 152k| __RORc_tmp; \ | | | | | | | | 290| 152k| }) | | | | | | ------------------ | | | | ------------------ | | | | #define Sigma1(x) (S(x, 6) ^ S(x, 11) ^ S(x, 25)) | | | | ------------------ | | | | | | 58| 152k|#define S(x, n) RORc((x),(n)) | | | | | | ------------------ | | | | | | | | 283| 152k|#define RORc(word,i) ({ \ | | | | | | | | 284| 152k| ulong32 __RORc_tmp = (word); \ | | | | | | | | 285| 152k| __asm__ ("rorl %2, %0" : \ | | | | | | | | 286| 152k| "=r" (__RORc_tmp) : \ | | | | | | | | 287| 152k| "0" (__RORc_tmp), \ | | | | | | | | 288| 152k| "I" (i)); \ | | | | | | | | 289| 152k| __RORc_tmp; \ | | | | | | | | 290| 152k| }) | | | | | | ------------------ | | | | ------------------ | | ------------------ | | t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i]; \ | | ------------------ | | | | 56| 152k|#define Ch(x,y,z) (z ^ (x & (y ^ z))) | | ------------------ | | 97| 152k| t1 = Sigma0(a) + Maj(a, b, c); \ | | ------------------ | | | | 60| 152k|#define Sigma0(x) (S(x, 2) ^ S(x, 13) ^ S(x, 22)) | | | | ------------------ | | | | | | 58| 152k|#define S(x, n) RORc((x),(n)) | | | | | | ------------------ | | | | | | | | 283| 152k|#define RORc(word,i) ({ \ | | | | | | | | 284| 152k| ulong32 __RORc_tmp = (word); \ | | | | | | | | 285| 152k| __asm__ ("rorl %2, %0" : \ | | | | | | | | 286| 152k| "=r" (__RORc_tmp) : \ | | | | | | | | 287| 152k| "0" (__RORc_tmp), \ | | | | | | | | 288| 152k| "I" (i)); \ | | | | | | | | 289| 152k| __RORc_tmp; \ | | | | | | | | 290| 152k| }) | | | | | | ------------------ | | | | ------------------ | | | | #define Sigma0(x) (S(x, 2) ^ S(x, 13) ^ S(x, 22)) | | | | ------------------ | | | | | | 58| 152k|#define S(x, n) RORc((x),(n)) | | | | | | ------------------ | | | | | | | | 283| 152k|#define RORc(word,i) ({ \ | | | | | | | | 284| 152k| ulong32 __RORc_tmp = (word); \ | | | | | | | | 285| 152k| __asm__ ("rorl %2, %0" : \ | | | | | | | | 286| 152k| "=r" (__RORc_tmp) : \ | | | | | | | | 287| 152k| "0" (__RORc_tmp), \ | | | | | | | | 288| 152k| "I" (i)); \ | | | | | | | | 289| 152k| __RORc_tmp; \ | | | | | | | | 290| 152k| }) | | | | | | ------------------ | | | | ------------------ | | | | #define Sigma0(x) (S(x, 2) ^ S(x, 13) ^ S(x, 22)) | | | | ------------------ | | | | | | 58| 152k|#define S(x, n) RORc((x),(n)) | | | | | | ------------------ | | | | | | | | 283| 152k|#define RORc(word,i) ({ \ | | | | | | | | 284| 152k| ulong32 __RORc_tmp = (word); \ | | | | | | | | 285| 152k| __asm__ ("rorl %2, %0" : \ | | | | | | | | 286| 152k| "=r" (__RORc_tmp) : \ | | | | | | | | 287| 152k| "0" (__RORc_tmp), \ | | | | | | | | 288| 152k| "I" (i)); \ | | | | | | | | 289| 152k| __RORc_tmp; \ | | | | | | | | 290| 152k| }) | | | | | | ------------------ | | | | ------------------ | | ------------------ | | t1 = Sigma0(a) + Maj(a, b, c); \ | | ------------------ | | | | 57| 152k|#define Maj(x,y,z) (((x | y) & z) | (x & y)) | | ------------------ | | 98| 152k| d += t0; \ | | 99| 152k| h = t0 + t1; ------------------ 103| 152k| t = S[7]; S[7] = S[6]; S[6] = S[5]; S[5] = S[4]; 104| 152k| S[4] = S[3]; S[3] = S[2]; S[2] = S[1]; S[1] = S[0]; S[0] = t; 105| 152k| } 106| |#else 107| |#define RND(a,b,c,d,e,f,g,h,i,ki) \ 108| | t0 = h + Sigma1(e) + Ch(e, f, g) + ki + W[i]; \ 109| | t1 = Sigma0(a) + Maj(a, b, c); \ 110| | d += t0; \ 111| | h = t0 + t1; 112| | 113| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],0,0x428a2f98); 114| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],1,0x71374491); 115| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],2,0xb5c0fbcf); 116| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],3,0xe9b5dba5); 117| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],4,0x3956c25b); 118| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],5,0x59f111f1); 119| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],6,0x923f82a4); 120| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],7,0xab1c5ed5); 121| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],8,0xd807aa98); 122| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],9,0x12835b01); 123| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],10,0x243185be); 124| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],11,0x550c7dc3); 125| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],12,0x72be5d74); 126| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],13,0x80deb1fe); 127| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],14,0x9bdc06a7); 128| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],15,0xc19bf174); 129| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],16,0xe49b69c1); 130| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],17,0xefbe4786); 131| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],18,0x0fc19dc6); 132| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],19,0x240ca1cc); 133| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],20,0x2de92c6f); 134| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],21,0x4a7484aa); 135| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],22,0x5cb0a9dc); 136| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],23,0x76f988da); 137| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],24,0x983e5152); 138| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],25,0xa831c66d); 139| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],26,0xb00327c8); 140| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],27,0xbf597fc7); 141| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],28,0xc6e00bf3); 142| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],29,0xd5a79147); 143| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],30,0x06ca6351); 144| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],31,0x14292967); 145| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],32,0x27b70a85); 146| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],33,0x2e1b2138); 147| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],34,0x4d2c6dfc); 148| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],35,0x53380d13); 149| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],36,0x650a7354); 150| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],37,0x766a0abb); 151| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],38,0x81c2c92e); 152| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],39,0x92722c85); 153| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],40,0xa2bfe8a1); 154| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],41,0xa81a664b); 155| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],42,0xc24b8b70); 156| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],43,0xc76c51a3); 157| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],44,0xd192e819); 158| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],45,0xd6990624); 159| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],46,0xf40e3585); 160| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],47,0x106aa070); 161| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],48,0x19a4c116); 162| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],49,0x1e376c08); 163| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],50,0x2748774c); 164| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],51,0x34b0bcb5); 165| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],52,0x391c0cb3); 166| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],53,0x4ed8aa4a); 167| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],54,0x5b9cca4f); 168| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],55,0x682e6ff3); 169| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],56,0x748f82ee); 170| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],57,0x78a5636f); 171| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],58,0x84c87814); 172| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],59,0x8cc70208); 173| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],60,0x90befffa); 174| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],61,0xa4506ceb); 175| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],62,0xbef9a3f7); 176| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],63,0xc67178f2); 177| | 178| |#undef RND 179| | 180| |#endif 181| | 182| | /* feedback */ 183| 21.4k| for (i = 0; i < 8; i++) { ------------------ | Branch (183:17): [True: 19.0k, False: 2.38k] ------------------ 184| 19.0k| md->sha256.state[i] = md->sha256.state[i] + S[i]; 185| 19.0k| } 186| 2.38k| return CRYPT_OK; 187| 2.38k|} sha256_process: 491| 4.77k|int func_name (hash_state * md, const unsigned char *in, unsigned long inlen) \ 492| 4.77k|{ \ 493| 4.77k| unsigned long n; \ 494| 4.77k| int err; \ 495| 4.77k| LTC_ARGCHK(md != NULL); \ ------------------ | | 32| 4.77k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 4.77k] | | | Branch (32:87): [Folded - Ignored] | | ------------------ ------------------ 496| 4.77k| LTC_ARGCHK(in != NULL); \ ------------------ | | 32| 4.77k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 4.77k] | | | Branch (32:87): [Folded - Ignored] | | ------------------ ------------------ 497| 4.77k| if (md-> state_var .curlen > sizeof(md-> state_var .buf)) { \ ------------------ | Branch (497:9): [True: 0, False: 4.77k] ------------------ 498| 0| return CRYPT_INVALID_ARG; \ 499| 0| } \ 500| 4.77k| if ((md-> state_var .length + inlen) < md-> state_var .length) { \ ------------------ | Branch (500:9): [True: 0, False: 4.77k] ------------------ 501| 0| return CRYPT_HASH_OVERFLOW; \ 502| 0| } \ 503| 9.54k| while (inlen > 0) { \ ------------------ | Branch (503:12): [True: 4.77k, False: 4.77k] ------------------ 504| 4.77k| if (md-> state_var .curlen == 0 && inlen >= block_size) { \ ------------------ | Branch (504:13): [True: 2.38k, False: 2.38k] | Branch (504:44): [True: 0, False: 2.38k] ------------------ 505| 0| if ((err = compress_name (md, (unsigned char *)in)) != CRYPT_OK) { \ ------------------ | Branch (505:16): [True: 0, False: 0] ------------------ 506| 0| return err; \ 507| 0| } \ 508| 0| md-> state_var .length += block_size * 8; \ 509| 0| in += block_size; \ 510| 0| inlen -= block_size; \ 511| 4.77k| } else { \ 512| 4.77k| n = MIN(inlen, (block_size - md-> state_var .curlen)); \ ------------------ | | 425| 4.77k| #define MIN(x, y) ( ((x)<(y))?(x):(y) ) | | ------------------ | | | Branch (425:24): [True: 4.77k, False: 0] | | ------------------ ------------------ 513| 4.77k| XMEMCPY(md-> state_var .buf + md-> state_var.curlen, in, (size_t)n); \ ------------------ | | 39| 4.77k|#define XMEMCPY memcpy ------------------ 514| 4.77k| md-> state_var .curlen += n; \ 515| 4.77k| in += n; \ 516| 4.77k| inlen -= n; \ 517| 4.77k| if (md-> state_var .curlen == block_size) { \ ------------------ | Branch (517:16): [True: 0, False: 4.77k] ------------------ 518| 0| if ((err = compress_name (md, md-> state_var .buf)) != CRYPT_OK) { \ ------------------ | Branch (518:19): [True: 0, False: 0] ------------------ 519| 0| return err; \ 520| 0| } \ 521| 0| md-> state_var .length += 8*block_size; \ 522| 0| md-> state_var .curlen = 0; \ 523| 0| } \ 524| 4.77k| } \ 525| 4.77k| } \ 526| 4.77k| return CRYPT_OK; \ 527| 4.77k|} base64_decode: 148| 1.54k|{ 149| 1.54k| return _base64_decode_internal(in, inlen, out, outlen, map_base64, relaxed); 150| 1.54k|} base64_decode.c:_base64_decode_internal: 81| 1.54k|{ 82| 1.54k| unsigned long t, x, y, z; 83| 1.54k| unsigned char c; 84| 1.54k| int g; 85| | 86| 1.54k| LTC_ARGCHK(in != NULL); ------------------ | | 32| 1.54k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 1.54k] | | | Branch (32:87): [Folded - Ignored] | | ------------------ ------------------ 87| 1.54k| LTC_ARGCHK(out != NULL); ------------------ | | 32| 1.54k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 1.54k] | | | Branch (32:87): [Folded - Ignored] | | ------------------ ------------------ 88| 1.54k| LTC_ARGCHK(outlen != NULL); ------------------ | | 32| 1.54k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 1.54k] | | | Branch (32:87): [Folded - Ignored] | | ------------------ ------------------ 89| | 90| 1.54k| g = 0; /* '=' counter */ 91| 85.6k| for (x = y = z = t = 0; x < inlen; x++) { ------------------ | Branch (91:28): [True: 84.1k, False: 1.54k] ------------------ 92| 84.1k| c = map[in[x]&0xFF]; 93| 84.1k| if (c == 254) { ------------------ | Branch (93:12): [True: 4.54k, False: 79.5k] ------------------ 94| 4.54k| g++; 95| 4.54k| continue; 96| 4.54k| } 97| 79.5k| else if (is_strict && g > 0) { ------------------ | Branch (97:17): [True: 0, False: 79.5k] | Branch (97:30): [True: 0, False: 0] ------------------ 98| | /* we only allow '=' to be at the end */ 99| 0| return CRYPT_INVALID_PACKET; 100| 0| } 101| 79.5k| if (c == 255) { ------------------ | Branch (101:12): [True: 12.0k, False: 67.5k] ------------------ 102| 12.0k| if (is_strict) ------------------ | Branch (102:15): [True: 0, False: 12.0k] ------------------ 103| 0| return CRYPT_INVALID_PACKET; 104| 12.0k| else 105| 12.0k| continue; 106| 12.0k| } 107| | 108| 67.5k| t = (t<<6)|c; 109| | 110| 67.5k| if (++y == 4) { ------------------ | Branch (110:12): [True: 15.8k, False: 51.7k] ------------------ 111| 15.8k| if (z + 3 > *outlen) return CRYPT_BUFFER_OVERFLOW; ------------------ | Branch (111:15): [True: 0, False: 15.8k] ------------------ 112| 15.8k| out[z++] = (unsigned char)((t>>16)&255); 113| 15.8k| out[z++] = (unsigned char)((t>>8)&255); 114| 15.8k| out[z++] = (unsigned char)(t&255); 115| 15.8k| y = t = 0; 116| 15.8k| } 117| 67.5k| } 118| | 119| 1.54k| if (y != 0) { ------------------ | Branch (119:8): [True: 1.48k, False: 59] ------------------ 120| 1.48k| int allow_b64url = 0; 121| |#ifdef LTC_BASE64_URL 122| | if (map == map_base64url) { 123| | allow_b64url = 1; 124| | } 125| |#endif 126| 1.48k| if (y == 1) return CRYPT_INVALID_PACKET; ------------------ | Branch (126:11): [True: 21, False: 1.46k] ------------------ 127| 1.46k| if ((y + g) != 4 && is_strict && !allow_b64url) return CRYPT_INVALID_PACKET; ------------------ | Branch (127:11): [True: 1.45k, False: 6] | Branch (127:27): [True: 0, False: 1.45k] | Branch (127:40): [True: 0, False: 0] ------------------ 128| 1.46k| t = t << (6 * (4 - y)); 129| 1.46k| if (z + y - 1 > *outlen) return CRYPT_BUFFER_OVERFLOW; ------------------ | Branch (129:11): [True: 0, False: 1.46k] ------------------ 130| 1.46k| if (y >= 2) out[z++] = (unsigned char) ((t >> 16) & 255); ------------------ | Branch (130:11): [True: 1.46k, False: 0] ------------------ 131| 1.46k| if (y == 3) out[z++] = (unsigned char) ((t >> 8) & 255); ------------------ | Branch (131:11): [True: 1.41k, False: 53] ------------------ 132| 1.46k| } 133| 1.52k| *outlen = z; 134| 1.52k| return CRYPT_OK; 135| 1.54k|} register_cipher: 22| 1|{ 23| 1| int x; 24| | 25| 1| LTC_ARGCHK(cipher != NULL); ------------------ | | 32| 1|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 1] | | | Branch (32:87): [Folded - Ignored] | | ------------------ ------------------ 26| | 27| | /* is it already registered? */ 28| 1| LTC_MUTEX_LOCK(<c_cipher_mutex); 29| 6| for (x = 0; x < TAB_SIZE; x++) { ------------------ | | 14| 6|#define TAB_SIZE 5 ------------------ | Branch (29:16): [True: 5, False: 1] ------------------ 30| 5| if (cipher_descriptor[x].name != NULL && cipher_descriptor[x].ID == cipher->ID) { ------------------ | Branch (30:12): [True: 0, False: 5] | Branch (30:49): [True: 0, False: 0] ------------------ 31| 0| LTC_MUTEX_UNLOCK(<c_cipher_mutex); 32| 0| return x; 33| 0| } 34| 5| } 35| | 36| | /* find a blank spot */ 37| 1| for (x = 0; x < TAB_SIZE; x++) { ------------------ | | 14| 1|#define TAB_SIZE 5 ------------------ | Branch (37:16): [True: 1, False: 0] ------------------ 38| 1| if (cipher_descriptor[x].name == NULL) { ------------------ | Branch (38:12): [True: 1, False: 0] ------------------ 39| 1| XMEMCPY(&cipher_descriptor[x], cipher, sizeof(struct ltc_cipher_descriptor)); ------------------ | | 39| 1|#define XMEMCPY memcpy ------------------ 40| 1| LTC_MUTEX_UNLOCK(<c_cipher_mutex); 41| 1| return x; 42| 1| } 43| 1| } 44| | 45| | /* no spot */ 46| 0| LTC_MUTEX_UNLOCK(<c_cipher_mutex); 47| 0| return -1; 48| 1|} register_hash: 22| 4|{ 23| 4| int x; 24| | 25| 4| LTC_ARGCHK(hash != NULL); ------------------ | | 32| 4|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 4] | | | Branch (32:87): [Folded - Ignored] | | ------------------ ------------------ 26| | 27| | /* is it already registered? */ 28| 4| LTC_MUTEX_LOCK(<c_hash_mutex); 29| 24| for (x = 0; x < TAB_SIZE; x++) { ------------------ | | 14| 24|#define TAB_SIZE 5 ------------------ | Branch (29:16): [True: 20, False: 4] ------------------ 30| 20| if (XMEMCMP(&hash_descriptor[x], hash, sizeof(struct ltc_hash_descriptor)) == 0) { ------------------ | | 45| 20|#define XMEMCMP memcmp ------------------ | Branch (30:12): [True: 0, False: 20] ------------------ 31| 0| LTC_MUTEX_UNLOCK(<c_hash_mutex); 32| 0| return x; 33| 0| } 34| 20| } 35| | 36| | /* find a blank spot */ 37| 10| for (x = 0; x < TAB_SIZE; x++) { ------------------ | | 14| 10|#define TAB_SIZE 5 ------------------ | Branch (37:16): [True: 10, False: 0] ------------------ 38| 10| if (hash_descriptor[x].name == NULL) { ------------------ | Branch (38:12): [True: 4, False: 6] ------------------ 39| 4| XMEMCPY(&hash_descriptor[x], hash, sizeof(struct ltc_hash_descriptor)); ------------------ | | 39| 4|#define XMEMCPY memcpy ------------------ 40| 4| LTC_MUTEX_UNLOCK(<c_hash_mutex); 41| 4| return x; 42| 4| } 43| 10| } 44| | 45| | /* no spot */ 46| 0| LTC_MUTEX_UNLOCK(<c_hash_mutex); 47| 0| return -1; 48| 4|} register_prng: 22| 1|{ 23| 1| int x; 24| | 25| 1| LTC_ARGCHK(prng != NULL); ------------------ | | 32| 1|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 1] | | | Branch (32:87): [Folded - Ignored] | | ------------------ ------------------ 26| | 27| | /* is it already registered? */ 28| 1| LTC_MUTEX_LOCK(<c_prng_mutex); 29| 6| for (x = 0; x < TAB_SIZE; x++) { ------------------ | | 14| 6|#define TAB_SIZE 5 ------------------ | Branch (29:16): [True: 5, False: 1] ------------------ 30| 5| if (XMEMCMP(&prng_descriptor[x], prng, sizeof(struct ltc_prng_descriptor)) == 0) { ------------------ | | 45| 5|#define XMEMCMP memcmp ------------------ | Branch (30:12): [True: 0, False: 5] ------------------ 31| 0| LTC_MUTEX_UNLOCK(<c_prng_mutex); 32| 0| return x; 33| 0| } 34| 5| } 35| | 36| | /* find a blank spot */ 37| 1| for (x = 0; x < TAB_SIZE; x++) { ------------------ | | 14| 1|#define TAB_SIZE 5 ------------------ | Branch (37:16): [True: 1, False: 0] ------------------ 38| 1| if (prng_descriptor[x].name == NULL) { ------------------ | Branch (38:12): [True: 1, False: 0] ------------------ 39| 1| XMEMCPY(&prng_descriptor[x], prng, sizeof(struct ltc_prng_descriptor)); ------------------ | | 39| 1|#define XMEMCPY memcpy ------------------ 40| 1| LTC_MUTEX_UNLOCK(<c_prng_mutex); 41| 1| return x; 42| 1| } 43| 1| } 44| | 45| | /* no spot */ 46| 0| LTC_MUTEX_UNLOCK(<c_prng_mutex); 47| 0| return -1; 48| 1|} mp_rand_source: 10| 1|{ 11| | /* Dropbear, don't reset to platform if source==NULL */ 12| 1| s_mp_rand_source = source; 13| 1|} buf_new: 41| 7.96k|buffer* buf_new(unsigned int size) { 42| 7.96k| buffer* buf; 43| 7.96k| if (size > BUF_MAX_SIZE) { ------------------ | | 35| 7.96k|#define BUF_MAX_SIZE 1000000000 ------------------ | Branch (43:6): [True: 0, False: 7.96k] ------------------ 44| 0| dropbear_exit("buf->size too big"); 45| 0| } 46| | 47| 7.96k| buf = (buffer*)m_malloc(sizeof(buffer)+size); 48| 7.96k| buf->data = (unsigned char*)buf + sizeof(buffer); 49| 7.96k| buf->size = size; 50| 7.96k| return buf; 51| 7.96k|} buf_free: 54| 7.27k|void buf_free(buffer* buf) { 55| 7.27k| m_free(buf); ------------------ | | 24| 7.27k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded - Ignored] | | ------------------ ------------------ 56| 7.27k|} buf_setlen: 95| 1.58k|void buf_setlen(buffer* buf, unsigned int len) { 96| 1.58k| if (len > buf->size) { ------------------ | Branch (96:6): [True: 0, False: 1.58k] ------------------ 97| 0| dropbear_exit("Bad buf_setlen"); 98| 0| } 99| 1.58k| buf->len = len; 100| 1.58k| buf->pos = MIN(buf->pos, buf->len); 101| 1.58k|} buf_incrlen: 104| 6.11k|void buf_incrlen(buffer* buf, unsigned int incr) { 105| 6.11k| if (incr > BUF_MAX_INCR || buf->len + incr > buf->size) { ------------------ | | 34| 12.2k|#define BUF_MAX_INCR 1000000000 ------------------ | Branch (105:6): [True: 0, False: 6.11k] | Branch (105:29): [True: 0, False: 6.11k] ------------------ 106| 0| dropbear_exit("Bad buf_incrlen"); 107| 0| } 108| 6.11k| buf->len += incr; 109| 6.11k|} buf_setpos: 111| 7.58k|void buf_setpos(buffer* buf, unsigned int pos) { 112| | 113| 7.58k| if (pos > buf->len) { ------------------ | Branch (113:6): [True: 0, False: 7.58k] ------------------ 114| 0| dropbear_exit("Bad buf_setpos"); 115| 0| } 116| 7.58k| buf->pos = pos; 117| 7.58k|} buf_incrwritepos: 120| 1.78k|void buf_incrwritepos(buffer* buf, unsigned int incr) { 121| 1.78k| if (incr > BUF_MAX_INCR || buf->pos + incr > buf->size) { ------------------ | | 34| 3.56k|#define BUF_MAX_INCR 1000000000 ------------------ | Branch (121:6): [True: 0, False: 1.78k] | Branch (121:29): [True: 0, False: 1.78k] ------------------ 122| 0| dropbear_exit("Bad buf_incrwritepos"); 123| 0| } 124| 1.78k| buf->pos += incr; 125| 1.78k| if (buf->pos > buf->len) { ------------------ | Branch (125:6): [True: 1.78k, False: 0] ------------------ 126| 1.78k| buf->len = buf->pos; 127| 1.78k| } 128| 1.78k|} buf_incrpos: 131| 19.8k|void buf_incrpos(buffer* buf, unsigned int incr) { 132| 19.8k| if (incr > BUF_MAX_INCR ------------------ | | 34| 39.6k|#define BUF_MAX_INCR 1000000000 ------------------ | Branch (132:6): [True: 0, False: 19.8k] ------------------ 133| 19.8k| || (buf->pos + incr) > buf->len) { ------------------ | Branch (133:6): [True: 0, False: 19.8k] ------------------ 134| 0| dropbear_exit("Bad buf_incrpos"); 135| 0| } 136| 19.8k| buf->pos += incr; 137| 19.8k|} buf_decrpos: 140| 1.78k|void buf_decrpos(buffer* buf, unsigned int decr) { 141| 1.78k| if (decr > buf->pos) { ------------------ | Branch (141:6): [True: 0, False: 1.78k] ------------------ 142| 0| dropbear_exit("Bad buf_decrpos"); 143| 0| } 144| 1.78k| buf->pos -= decr; 145| 1.78k|} buf_getbyte: 148| 392k|unsigned char buf_getbyte(buffer* buf) { 149| | 150| | /* This check is really just ==, but the >= allows us to check for the 151| | * bad case of pos > len, which should _never_ happen. */ 152| 392k| if (buf->pos >= buf->len) { ------------------ | Branch (152:6): [True: 0, False: 392k] ------------------ 153| 0| dropbear_exit("Bad buf_getbyte"); 154| 0| } 155| 392k| return buf->data[buf->pos++]; 156| 392k|} buf_getptr: 180| 90.9k|unsigned char* buf_getptr(const buffer* buf, unsigned int len) { 181| | 182| 90.9k| if (len > BUF_MAX_INCR || buf->pos + len > buf->len) { ------------------ | | 34| 181k|#define BUF_MAX_INCR 1000000000 ------------------ | Branch (182:6): [True: 0, False: 90.9k] | Branch (182:28): [True: 132, False: 90.8k] ------------------ 183| 132| dropbear_exit("Bad buf_getptr"); 184| 132| } 185| 90.8k| return &buf->data[buf->pos]; 186| 90.9k|} buf_getwriteptr: 190| 7.96k|unsigned char* buf_getwriteptr(const buffer* buf, unsigned int len) { 191| | 192| 7.96k| if (len > BUF_MAX_INCR || buf->pos + len > buf->size) { ------------------ | | 34| 15.9k|#define BUF_MAX_INCR 1000000000 ------------------ | Branch (192:6): [True: 0, False: 7.96k] | Branch (192:28): [True: 0, False: 7.96k] ------------------ 193| 0| dropbear_exit("Bad buf_getwriteptr"); 194| 0| } 195| 7.96k| return &buf->data[buf->pos]; 196| 7.96k|} buf_getstring: 201| 2.28k|char* buf_getstring(buffer* buf, unsigned int *retlen) { 202| | 203| 2.28k| unsigned int len; 204| 2.28k| char* ret; 205| 2.28k| void* src = NULL; 206| 2.28k| len = buf_getint(buf); 207| 2.28k| if (len > MAX_STRING_LEN) { ------------------ | | 228| 2.28k|#define MAX_STRING_LEN (MAX(MAX_CMD_LEN, 2400)) /* Sun SSH needs 2400 for algos, ------------------ | Branch (207:6): [True: 36, False: 2.24k] ------------------ 208| 36| dropbear_exit("String too long"); 209| 36| } 210| | 211| 2.24k| if (retlen != NULL) { ------------------ | Branch (211:6): [True: 2.24k, False: 6] ------------------ 212| 2.24k| *retlen = len; 213| 2.24k| } 214| 2.24k| src = buf_getptr(buf, len); 215| 2.24k| ret = m_malloc(len+1); 216| 2.24k| memcpy(ret, src, len); 217| 2.24k| buf_incrpos(buf, len); 218| 2.24k| ret[len] = '\0'; 219| | 220| 2.24k| return ret; 221| 2.28k|} buf_getstringbuf: 246| 4.68k|buffer * buf_getstringbuf(buffer *buf) { 247| 4.68k| return buf_getstringbuf_int(buf, 0); 248| 4.68k|} buf_getint: 263| 8.32k|unsigned int buf_getint(buffer* buf) { 264| 8.32k| unsigned int ret; 265| | 266| 8.32k| LOAD32H(ret, buf_getptr(buf, 4)); ------------------ | | 66| 8.32k|#define LOAD32H(x, y) \ | | 67| 8.32k|do { XMEMCPY (&(x), (y), 4); \ | | ------------------ | | | | 39| 8.32k|#define XMEMCPY memcpy | | ------------------ | | 68| 8.32k| (x) = __builtin_bswap32 ((x)); } while(0) | | ------------------ | | | Branch (68:46): [Folded - Ignored] | | ------------------ ------------------ 267| 8.32k| buf_incrpos(buf, 4); 268| 8.32k| return ret; 269| 8.32k|} buf_putbytes: 294| 1.78k|void buf_putbytes(buffer *buf, const unsigned char *bytes, unsigned int len) { 295| 1.78k| memcpy(buf_getwriteptr(buf, len), bytes, len); 296| 1.78k| buf_incrwritepos(buf, len); 297| 1.78k|} buffer.c:buf_getstringbuf_int: 224| 4.68k|static buffer * buf_getstringbuf_int(buffer *buf, int incllen) { 225| 4.68k| buffer *ret = NULL; 226| 4.68k| unsigned int len = buf_getint(buf); 227| 4.68k| int extra = 0; 228| 4.68k| if (len > MAX_STRING_LEN) { ------------------ | | 228| 4.68k|#define MAX_STRING_LEN (MAX(MAX_CMD_LEN, 2400)) /* Sun SSH needs 2400 for algos, ------------------ | Branch (228:6): [True: 34, False: 4.65k] ------------------ 229| 34| dropbear_exit("String too long"); 230| 34| } 231| 4.65k| if (incllen) { ------------------ | Branch (231:6): [True: 0, False: 4.65k] ------------------ 232| 0| extra = 4; 233| 0| } 234| 4.65k| ret = buf_new(len+extra); 235| 4.65k| if (incllen) { ------------------ | Branch (235:6): [True: 0, False: 4.65k] ------------------ 236| 0| buf_putint(ret, len); 237| 0| } 238| 4.65k| memcpy(buf_getwriteptr(ret, len), buf_getptr(buf, len), len); 239| 4.65k| buf_incrpos(buf, len); 240| 4.65k| buf_incrlen(ret, len); 241| 4.65k| buf_setpos(ret, 0); 242| 4.65k| return ret; 243| 4.68k|} split_address_port: 128| 1.52k|int split_address_port(const char* spec, char **first, char ** second) { 129| 1.52k| char *spec_copy = NULL, *addr = NULL, *colon = NULL; 130| 1.52k| int ret = DROPBEAR_FAILURE; ------------------ | | 103| 1.52k|#define DROPBEAR_FAILURE -1 ------------------ 131| | 132| 1.52k| *first = NULL; 133| 1.52k| *second = NULL; 134| 1.52k| spec_copy = m_strdup(spec); 135| 1.52k| addr = spec_copy; 136| | 137| 1.52k| if (*addr == '[') { ------------------ | Branch (137:6): [True: 691, False: 830] ------------------ 138| 691| addr++; 139| 691| colon = strchr(addr, ']'); 140| 691| if (!colon) { ------------------ | Branch (140:7): [True: 2, False: 689] ------------------ 141| 2| dropbear_log(LOG_WARNING, "Bad address '%s'", spec); 142| 2| goto out; 143| 2| } 144| 689| *colon = '\0'; 145| 689| colon++; 146| 689| if (*colon == '\0') { ------------------ | Branch (146:7): [True: 4, False: 685] ------------------ 147| | /* No port part */ 148| 4| colon = NULL; 149| 685| } else if (*colon != ':') { ------------------ | Branch (149:14): [True: 17, False: 668] ------------------ 150| 17| dropbear_log(LOG_WARNING, "Bad address '%s'", spec); 151| 17| goto out; 152| 17| } 153| 830| } else { 154| | /* search for ':', that separates address and port */ 155| 830| colon = strrchr(addr, ':'); 156| 830| } 157| | 158| | /* colon points to ':' now, or is NULL */ 159| 1.50k| if (colon) { ------------------ | Branch (159:6): [True: 1.47k, False: 27] ------------------ 160| | /* Split the address/port */ 161| 1.47k| *colon = '\0'; 162| 1.47k| colon++; 163| 1.47k| *second = m_strdup(colon); 164| 1.47k| } 165| 1.50k| if (strlen(addr)) { ------------------ | Branch (165:6): [True: 1.49k, False: 5] ------------------ 166| 1.49k| *first = m_strdup(addr); 167| 1.49k| } 168| 1.50k| ret = DROPBEAR_SUCCESS; ------------------ | | 102| 1.50k|#define DROPBEAR_SUCCESS 0 ------------------ 169| | 170| 1.52k|out: 171| 1.52k| m_free(spec_copy); ------------------ | | 24| 1.52k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded - Ignored] | | ------------------ ------------------ 172| 1.52k| return ret; 173| 1.50k|} crypto_init: 21| 1|void crypto_init() { 22| | 23| 1| const struct ltc_cipher_descriptor *regciphers[] = { 24| 1|#if DROPBEAR_AES 25| 1| &aes_desc, 26| 1|#endif 27| |#if DROPBEAR_3DES 28| | &des3_desc, 29| |#endif 30| 1| NULL 31| 1| }; 32| | 33| 1| const struct ltc_hash_descriptor *reghashes[] = { 34| 1|#if DROPBEAR_SHA1_HMAC 35| 1| &sha1_desc, 36| 1|#endif 37| 1|#if DROPBEAR_SHA256 38| 1| &sha256_desc, 39| 1|#endif 40| 1|#if DROPBEAR_SHA384 41| 1| &sha384_desc, 42| 1|#endif 43| 1|#if DROPBEAR_SHA512 44| 1| &sha512_desc, 45| 1|#endif 46| 1| NULL 47| 1| }; 48| 1| int i; 49| | 50| 2| for (i = 0; regciphers[i] != NULL; i++) { ------------------ | Branch (50:14): [True: 1, False: 1] ------------------ 51| 1| if (register_cipher(regciphers[i]) == -1) { ------------------ | Branch (51:7): [True: 0, False: 1] ------------------ 52| 0| dropbear_exit("Error registering crypto"); 53| 0| } 54| 1| } 55| | 56| 5| for (i = 0; reghashes[i] != NULL; i++) { ------------------ | Branch (56:14): [True: 4, False: 1] ------------------ 57| 4| if (register_hash(reghashes[i]) == -1) { ------------------ | Branch (57:7): [True: 0, False: 4] ------------------ 58| 0| dropbear_exit("Error registering crypto"); 59| 0| } 60| 4| } 61| | 62| 1|#if DROPBEAR_LTC_PRNG 63| 1| dropbear_ltc_prng = register_prng(&dropbear_prng_desc); 64| 1| if (dropbear_ltc_prng == -1) { ------------------ | Branch (64:6): [True: 0, False: 1] ------------------ 65| 0| dropbear_exit("Error registering crypto"); 66| 0| } 67| 1|#endif 68| | 69| 1| mp_rand_source(dropbear_rand_source); 70| | 71| 1|#if DROPBEAR_ECC 72| 1| ltc_mp = ltm_desc; 73| 1| dropbear_ecc_fill_dp(); 74| 1|#endif 75| 1|} m_strdup: 12| 4.49k|void * m_strdup(const char * str) { 13| 4.49k| char* ret; 14| 4.49k| unsigned int len; 15| 4.49k| len = strlen(str); 16| | 17| 4.49k| ret = m_malloc(len+1); 18| 4.49k| if (ret == NULL) { ------------------ | Branch (18:9): [True: 0, False: 4.49k] ------------------ 19| 0| dropbear_exit("m_strdup failed"); 20| 0| } 21| 4.49k| memcpy(ret, str, len+1); 22| 4.49k| return ret; 23| 4.49k|} m_malloc_set_epoch: 76| 2.38k|void m_malloc_set_epoch(unsigned int epoch) { 77| 2.38k| current_epoch = epoch; 78| 2.38k|} m_malloc_free_epoch: 80| 2.38k|void m_malloc_free_epoch(unsigned int epoch, int dofree) { 81| 2.38k| struct dbmalloc_header* header; 82| 2.38k| struct dbmalloc_header* nextheader = NULL; 83| 2.38k| struct dbmalloc_header* oldstaple = staple; 84| 2.38k| staple = NULL; 85| | /* free allocations from this epoch, create a new staple-anchored list from 86| | the remainder */ 87| 5.68k| for (header = oldstaple; header; header = nextheader) ------------------ | Branch (87:30): [True: 3.30k, False: 2.38k] ------------------ 88| 3.30k| { 89| 3.30k| nextheader = header->next; 90| 3.30k| if (header->epoch == epoch) { ------------------ | Branch (90:13): [True: 916, False: 2.38k] ------------------ 91| 916| if (dofree) { ------------------ | Branch (91:17): [True: 916, False: 0] ------------------ 92| 916| free(header); 93| 916| } 94| 2.38k| } else { 95| 2.38k| header->prev = NULL; 96| 2.38k| header->next = NULL; 97| 2.38k| put_alloc(header); 98| 2.38k| } 99| 3.30k| } 100| 2.38k|} m_malloc: 131| 20.9k|void * m_malloc(size_t size) { 132| 20.9k| char* mem = NULL; 133| 20.9k| struct dbmalloc_header* header = NULL; 134| | 135| 20.9k| if (size == 0 || size > 1e9) { ------------------ | Branch (135:9): [True: 0, False: 20.9k] | Branch (135:22): [True: 0, False: 20.9k] ------------------ 136| 0| dropbear_exit("m_malloc failed"); 137| 0| } 138| | 139| 20.9k| size = size + sizeof(struct dbmalloc_header); 140| | 141| 20.9k| mem = calloc(1, size); 142| 20.9k| if (mem == NULL) { ------------------ | Branch (142:9): [True: 0, False: 20.9k] ------------------ 143| 0| dropbear_exit("m_malloc failed"); 144| 0| } 145| 20.9k| header = (struct dbmalloc_header*)mem; 146| 20.9k| put_alloc(header); 147| 20.9k| header->epoch = current_epoch; 148| 20.9k| return &mem[sizeof(struct dbmalloc_header)]; 149| 20.9k|} m_free_direct: 172| 20.0k|void m_free_direct(void* ptr) { 173| 20.0k| struct dbmalloc_header* header = NULL; 174| 20.0k| if (!ptr) { ------------------ | Branch (174:9): [True: 70, False: 20.0k] ------------------ 175| 70| return; 176| 70| } 177| 20.0k| header = get_header(ptr); 178| 20.0k| remove_alloc(header); 179| 20.0k| free(header); 180| 20.0k|} dbmalloc.c:put_alloc: 102| 23.3k|static void put_alloc(struct dbmalloc_header *header) { 103| 23.3k| assert(header->next == NULL); 104| 23.3k| assert(header->prev == NULL); 105| 23.3k| if (staple) { ------------------ | Branch (105:9): [True: 20.9k, False: 2.38k] ------------------ 106| 20.9k| staple->prev = header; 107| 20.9k| } 108| 23.3k| header->next = staple; 109| 23.3k| staple = header; 110| 23.3k|} dbmalloc.c:get_header: 126| 20.0k|static struct dbmalloc_header* get_header(void* ptr) { 127| 20.0k| char* bptr = ptr; 128| 20.0k| return (struct dbmalloc_header*)&bptr[-sizeof(struct dbmalloc_header)]; 129| 20.0k|} dbmalloc.c:remove_alloc: 112| 20.0k|static void remove_alloc(struct dbmalloc_header *header) { 113| 20.0k| if (header->prev) { ------------------ | Branch (113:9): [True: 12.6k, False: 7.35k] ------------------ 114| 12.6k| header->prev->next = header->next; 115| 12.6k| } 116| 20.0k| if (header->next) { ------------------ | Branch (116:9): [True: 20.0k, False: 0] ------------------ 117| 20.0k| header->next->prev = header->prev; 118| 20.0k| } 119| 20.0k| if (staple == header) { ------------------ | Branch (119:9): [True: 7.35k, False: 12.6k] ------------------ 120| 7.35k| staple = header->next; 121| 7.35k| } 122| 20.0k| header->prev = NULL; 123| 20.0k| header->next = NULL; 124| 20.0k|} fuzz_seed: 153| 2.38k|void fuzz_seed(const unsigned char* dat, unsigned int len) { 154| 2.38k| hash_state hs; 155| 2.38k| sha256_init(&hs); 156| 2.38k| sha256_process(&hs, "fuzzfuzzfuzz", strlen("fuzzfuzzfuzz")); 157| 2.38k| sha256_process(&hs, dat, len); 158| 2.38k| sha256_done(&hs, hashpool); 159| 2.38k| counter = 0; 160| 2.38k| donerandinit = 1; 161| 2.38k|} dropbear_exit: 105| 409|void dropbear_exit(const char* format, ...) { 106| | 107| 409| va_list param; 108| | 109| 409| va_start(param, format); 110| 409| _dropbear_exit(EXIT_FAILURE, format, param); 111| 0| va_end(param); 112| 0|} dropbear_log: 148| 2.69k|void dropbear_log(int priority, const char* format, ...) { 149| | 150| 2.69k| va_list param; 151| | 152| 2.69k| va_start(param, format); 153| 2.69k| _dropbear_log(priority, format, param); 154| 2.69k| va_end(param); 155| 2.69k|} disallow_core: 601| 1|void disallow_core() { 602| 1| struct rlimit lim = {0}; 603| 1| if (getrlimit(RLIMIT_CORE, &lim) < 0) { ------------------ | Branch (603:6): [True: 0, False: 1] ------------------ 604| 0| TRACE(("getrlimit(RLIMIT_CORE) failed")); 605| 0| } 606| 1| lim.rlim_cur = 0; 607| 1| if (setrlimit(RLIMIT_CORE, &lim) < 0) { ------------------ | Branch (607:6): [True: 0, False: 1] ------------------ 608| 0| TRACE(("setrlimit(RLIMIT_CORE) failed")); 609| 0| } 610| 1|} m_str_to_uint: 613| 1.12k|int m_str_to_uint(const char* str, unsigned int *val) { 614| 1.12k| unsigned long l; 615| 1.12k| char *endp; 616| | 617| 1.12k| l = strtoul(str, &endp, 10); 618| | 619| 1.12k| if (endp == str || *endp != '\0') { ------------------ | Branch (619:6): [True: 4, False: 1.12k] | Branch (619:21): [True: 8, False: 1.11k] ------------------ 620| | /* parse error */ 621| 12| return DROPBEAR_FAILURE; ------------------ | | 103| 12|#define DROPBEAR_FAILURE -1 ------------------ 622| 12| } 623| | 624| | /* The c99 spec doesn't actually seem to define EINVAL, but most platforms 625| | * I've looked at mention it in their manpage */ 626| 1.11k| if ((l == 0 && errno == EINVAL) ------------------ | Branch (626:7): [True: 568, False: 547] | Branch (626:17): [True: 0, False: 568] ------------------ 627| 1.11k| || (l == ULONG_MAX && errno == ERANGE) ------------------ | Branch (627:7): [True: 2, False: 1.11k] | Branch (627:25): [True: 1, False: 1] ------------------ 628| 1.11k| || (l > UINT_MAX)) { ------------------ | Branch (628:6): [True: 81, False: 1.03k] ------------------ 629| 82| return DROPBEAR_FAILURE; ------------------ | | 103| 82|#define DROPBEAR_FAILURE -1 ------------------ 630| 1.03k| } else { 631| 1.03k| *val = l; 632| 1.03k| return DROPBEAR_SUCCESS; ------------------ | | 102| 1.03k|#define DROPBEAR_SUCCESS 0 ------------------ 633| 1.03k| } 634| 1.11k|} dbutil.c:generic_dropbear_exit: 115| 409| va_list param) { 116| | 117| 409| char fmtbuf[300]; 118| | 119| 409| snprintf(fmtbuf, sizeof(fmtbuf), "Exited: %s", format); 120| | 121| 409| _dropbear_log(LOG_INFO, fmtbuf, param); 122| | 123| 409|#if DROPBEAR_FUZZ 124| 409| if (fuzz.do_jmp) { ------------------ | Branch (124:9): [True: 409, False: 0] ------------------ 125| 409| longjmp(fuzz.jmp, 1); 126| 409| } 127| 0|#endif 128| | 129| 0| exit(exitcode); 130| 409|} dropbear_ecc_fill_dp: 47| 1|void dropbear_ecc_fill_dp() { 48| 1| struct dropbear_ecc_curve **curve; 49| | /* libtomcrypt guarantees they're ordered by size */ 50| 1| const ltc_ecc_set_type *dp = ltc_ecc_sets; 51| 4| for (curve = dropbear_ecc_curves; *curve; curve++) { ------------------ | Branch (51:36): [True: 3, False: 1] ------------------ 52| 10| for (;dp->size > 0; dp++) { ------------------ | Branch (52:9): [True: 10, False: 0] ------------------ 53| 10| if (dp->size == (*curve)->ltc_size) { ------------------ | Branch (53:8): [True: 3, False: 7] ------------------ 54| 3| (*curve)->dp = dp; 55| 3| break; 56| 3| } 57| 10| } 58| 3| if (!(*curve)->dp) { ------------------ | Branch (58:7): [True: 0, False: 3] ------------------ 59| 0| dropbear_exit("Missing ECC params %s", (*curve)->name); 60| 0| } 61| 3| } 62| 1|} list_append: 5| 1.52k|void list_append(m_list *list, void *item) { 6| 1.52k| m_list_elem *elem; 7| | 8| 1.52k| elem = m_malloc(sizeof(*elem)); 9| 1.52k| elem->item = item; 10| 1.52k| elem->list = list; 11| 1.52k| elem->next = NULL; 12| 1.52k| if (!list->first) { ------------------ | Branch (12:6): [True: 248, False: 1.27k] ------------------ 13| 248| list->first = elem; 14| 248| elem->prev = NULL; 15| 1.27k| } else { 16| 1.27k| elem->prev = list->last; 17| 1.27k| list->last->next = elem; 18| 1.27k| } 19| 1.52k| list->last = elem; 20| 1.52k|} list_new: 22| 249|m_list * list_new() { 23| 249| m_list *ret = m_malloc(sizeof(m_list)); 24| 249| ret->first = ret->last = NULL; 25| 249| return ret; 26| 249|} list_remove: 28| 1.52k|void * list_remove(m_list_elem *elem) { 29| 1.52k| void *item = elem->item; 30| 1.52k| m_list *list = elem->list; 31| 1.52k| if (list->first == elem) ------------------ | Branch (31:6): [True: 1.52k, False: 0] ------------------ 32| 1.52k| { 33| 1.52k| list->first = elem->next; 34| 1.52k| } 35| 1.52k| if (list->last == elem) ------------------ | Branch (35:6): [True: 248, False: 1.27k] ------------------ 36| 248| { 37| 248| list->last = elem->prev; 38| 248| } 39| 1.52k| if (elem->prev) ------------------ | Branch (39:6): [True: 0, False: 1.52k] ------------------ 40| 0| { 41| 0| elem->prev->next = elem->next; 42| 0| } 43| 1.52k| if (elem->next) ------------------ | Branch (43:6): [True: 1.27k, False: 248] ------------------ 44| 1.27k| { 45| 1.27k| elem->next->prev = elem->prev; 46| 1.27k| } 47| 1.52k| m_free(elem); ------------------ | | 24| 1.52k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded - Ignored] | | ------------------ ------------------ 48| 1.52k| return item; 49| 1.52k|} signkey_type_from_name: 86| 2.15k|enum signkey_type signkey_type_from_name(const char* name, unsigned int namelen) { 87| 2.15k| int i; 88| 6.29k| for (i = 0; i < DROPBEAR_SIGNKEY_NUM_NAMED; i++) { ------------------ | Branch (88:14): [True: 6.08k, False: 207] ------------------ 89| 6.08k| const char *fixed_name = signkey_names[i]; 90| 6.08k| if (namelen == strlen(fixed_name) ------------------ | Branch (90:7): [True: 4.11k, False: 1.96k] ------------------ 91| 6.08k| && memcmp(fixed_name, name, namelen) == 0) { ------------------ | Branch (91:7): [True: 1.94k, False: 2.17k] ------------------ 92| | 93| 1.94k|#if DROPBEAR_ECDSA 94| | /* Some of the ECDSA key sizes are defined even if they're not compiled in */ 95| 1.94k| if (0 ------------------ | Branch (95:8): [Folded - Ignored] ------------------ 96| |#if !DROPBEAR_ECC_256 97| | || i == DROPBEAR_SIGNKEY_ECDSA_NISTP256 98| |#endif 99| |#if !DROPBEAR_ECC_384 100| | || i == DROPBEAR_SIGNKEY_ECDSA_NISTP384 101| |#endif 102| |#if !DROPBEAR_ECC_521 103| | || i == DROPBEAR_SIGNKEY_ECDSA_NISTP521 104| |#endif 105| 1.94k| ) { 106| 0| TRACE(("attempt to use ecdsa type %d not compiled in", i)) 107| 0| return DROPBEAR_SIGNKEY_NONE; 108| 0| } 109| 1.94k|#endif 110| | 111| 1.94k| return (enum signkey_type)i; 112| 1.94k| } 113| 6.08k| } 114| | 115| 207| TRACE(("signkey_type_from_name unexpected key type.")) 116| | 117| 207| return DROPBEAR_SIGNKEY_NONE; 118| 2.15k|} signature_type_from_name: 145| 2.20k|enum signature_type signature_type_from_name(const char* name, unsigned int namelen) { 146| 2.20k|#if DROPBEAR_RSA 147| 2.20k|#if DROPBEAR_RSA_SHA256 148| 2.20k| if (namelen == strlen(SSH_SIGNATURE_RSA_SHA256) ------------------ | | 117| 2.20k|#define SSH_SIGNATURE_RSA_SHA256 "rsa-sha2-256" ------------------ | Branch (148:6): [True: 42, False: 2.16k] ------------------ 149| 2.20k| && memcmp(name, SSH_SIGNATURE_RSA_SHA256, namelen) == 0) { ------------------ | | 117| 42|#define SSH_SIGNATURE_RSA_SHA256 "rsa-sha2-256" ------------------ | Branch (149:6): [True: 18, False: 24] ------------------ 150| 18| return DROPBEAR_SIGNATURE_RSA_SHA256; 151| 18| } 152| 2.18k|#endif 153| 2.18k|#if DROPBEAR_RSA_SHA1 154| 2.18k| if (namelen == strlen(SSH_SIGNKEY_RSA) ------------------ | | 112| 2.18k|#define SSH_SIGNKEY_RSA "ssh-rsa" ------------------ | Branch (154:6): [True: 1.89k, False: 292] ------------------ 155| 2.18k| && memcmp(name, SSH_SIGNKEY_RSA, namelen) == 0) { ------------------ | | 112| 1.89k|#define SSH_SIGNKEY_RSA "ssh-rsa" ------------------ | Branch (155:6): [True: 35, False: 1.86k] ------------------ 156| 35| return DROPBEAR_SIGNATURE_RSA_SHA1; 157| 35| } 158| 2.15k|#endif 159| 2.15k|#endif /* DROPBEAR_RSA */ 160| 2.15k| return (enum signature_type)signkey_type_from_name(name, namelen); 161| 2.18k|} cmp_base64_key: 724| 1.58k| const buffer * line, char ** fingerprint) { 725| | 726| 1.58k| buffer * decodekey = NULL; 727| 1.58k| int ret = DROPBEAR_FAILURE; ------------------ | | 103| 1.58k|#define DROPBEAR_FAILURE -1 ------------------ 728| 1.58k| unsigned int len, filealgolen; 729| 1.58k| unsigned long decodekeylen; 730| 1.58k| unsigned char* filealgo = NULL; 731| | 732| | /* now we have the actual data */ 733| 1.58k| len = line->len - line->pos; 734| 1.58k| if (len == 0) { ------------------ | Branch (734:6): [True: 40, False: 1.54k] ------------------ 735| | /* base64_decode doesn't like NULL argument */ 736| 40| return DROPBEAR_FAILURE; ------------------ | | 103| 40|#define DROPBEAR_FAILURE -1 ------------------ 737| 40| } 738| 1.54k| decodekeylen = len * 2; /* big to be safe */ 739| 1.54k| decodekey = buf_new(decodekeylen); 740| | 741| 1.54k| if (base64_decode(buf_getptr(line, len), len, ------------------ | Branch (741:6): [True: 21, False: 1.52k] ------------------ 742| 1.54k| buf_getwriteptr(decodekey, decodekey->size), 743| 1.54k| &decodekeylen) != CRYPT_OK) { 744| 21| TRACE(("checkpubkey: base64 decode failed")) 745| 21| goto out; 746| 21| } 747| 1.52k| TRACE(("checkpubkey: base64_decode success")) 748| 1.52k| buf_incrlen(decodekey, decodekeylen); 749| | 750| 1.52k| if (fingerprint) { ------------------ | Branch (750:6): [True: 0, False: 1.52k] ------------------ 751| 0| *fingerprint = sign_key_fingerprint(buf_getptr(decodekey, decodekeylen), 752| 0| decodekeylen); 753| 0| } 754| | 755| | /* compare the keys */ 756| 1.52k| if ( ( decodekeylen != keybloblen ) ------------------ | Branch (756:7): [True: 144, False: 1.38k] ------------------ 757| 1.52k| || memcmp( buf_getptr(decodekey, decodekey->len), ------------------ | Branch (757:7): [True: 23, False: 1.35k] ------------------ 758| 1.38k| keyblob, decodekey->len) != 0) { 759| 167| TRACE(("checkpubkey: compare failed")) 760| 167| goto out; 761| 167| } 762| | 763| | /* ... and also check that the algo specified and the algo in the key 764| | * itself match */ 765| 1.35k| filealgolen = buf_getint(decodekey); 766| 1.35k| filealgo = buf_getptr(decodekey, filealgolen); 767| 1.35k| if (filealgolen != algolen || memcmp(filealgo, algoname, algolen) != 0) { ------------------ | Branch (767:6): [True: 0, False: 1.35k] | Branch (767:32): [True: 0, False: 1.35k] ------------------ 768| 0| TRACE(("checkpubkey: algo match failed")) 769| 0| goto out; 770| 0| } 771| | 772| | /* All checks passed */ 773| 1.35k| ret = DROPBEAR_SUCCESS; ------------------ | | 102| 1.35k|#define DROPBEAR_SUCCESS 0 ------------------ 774| | 775| 1.54k|out: 776| 1.54k| buf_free(decodekey); 777| 1.54k| decodekey = NULL; 778| 1.54k| return ret; 779| 1.35k|} fuzz_checkpubkey_line: 619| 1.99k| const unsigned char* keyblob, unsigned int keybloblen) { 620| 1.99k| return checkpubkey_line(line, line_num, filename, algo, algolen, keyblob, keybloblen, NULL); 621| 1.99k|} svr-authpubkey.c:checkpubkey_line: 289| 1.99k| char ** ret_info) { 290| 1.99k| buffer *options_buf = NULL; 291| 1.99k| char *info_str = NULL; 292| 1.99k| unsigned int pos, len, infopos, infolen; 293| 1.99k| int ret = DROPBEAR_FAILURE; ------------------ | | 103| 1.99k|#define DROPBEAR_FAILURE -1 ------------------ 294| | 295| 1.99k| if (line->len < MIN_AUTHKEYS_LINE || line->len > MAX_AUTHKEYS_LINE) { ------------------ | | 71| 3.99k|#define MIN_AUTHKEYS_LINE 10 /* "ssh-rsa AB" - short but doesn't matter */ ------------------ if (line->len < MIN_AUTHKEYS_LINE || line->len > MAX_AUTHKEYS_LINE) { ------------------ | | 72| 1.98k|#define MAX_AUTHKEYS_LINE 4200 /* max length of a line in authkeys */ ------------------ | Branch (295:6): [True: 12, False: 1.98k] | Branch (295:39): [True: 2, False: 1.98k] ------------------ 296| 14| TRACE(("checkpubkey_line: bad line length %d", line->len)) 297| 14| goto out; 298| 14| } 299| | 300| 1.98k| if (memchr(line->data, 0x0, line->len) != NULL) { ------------------ | Branch (300:6): [True: 7, False: 1.97k] ------------------ 301| 7| TRACE(("checkpubkey_line: bad line has null char")) 302| 7| goto out; 303| 7| } 304| | 305| | /* compare the algorithm. +3 so we have enough bytes to read a space and some base64 characters too. */ 306| 1.97k| if (line->pos + algolen+3 > line->len) { ------------------ | Branch (306:6): [True: 5, False: 1.97k] ------------------ 307| 5| goto out; 308| 5| } 309| | /* check the key type */ 310| 1.97k| if (strncmp((const char *) buf_getptr(line, algolen), algo, algolen) != 0) { ------------------ | Branch (310:6): [True: 1.80k, False: 168] ------------------ 311| 1.80k| int is_comment = 0; 312| 1.80k| unsigned char *options_start = NULL; 313| 1.80k| int options_len = 0; 314| 1.80k| int escape, quoted; 315| | 316| | /* skip over any comments or leading whitespace */ 317| 32.1k| while (line->pos < line->len) { ------------------ | Branch (317:10): [True: 32.1k, False: 23] ------------------ 318| 32.1k| const char c = buf_getbyte(line); 319| 32.1k| if (c == ' ' || c == '\t') { ------------------ | Branch (319:8): [True: 3.92k, False: 28.1k] | Branch (319:20): [True: 26.4k, False: 1.78k] ------------------ 320| 30.3k| continue; 321| 30.3k| } else if (c == '#') { ------------------ | Branch (321:15): [True: 1, False: 1.78k] ------------------ 322| 1| is_comment = 1; 323| 1| break; 324| 1| } 325| 1.78k| buf_decrpos(line, 1); 326| 1.78k| break; 327| 32.1k| } 328| 1.80k| if (is_comment) { ------------------ | Branch (328:7): [True: 1, False: 1.80k] ------------------ 329| | /* next line */ 330| 1| goto out; 331| 1| } 332| | 333| | /* remember start of options */ 334| 1.80k| options_start = buf_getptr(line, 1); 335| 1.80k| quoted = 0; 336| 1.80k| escape = 0; 337| 1.80k| options_len = 0; 338| | 339| | /* figure out where the options are */ 340| 232k| while (line->pos < line->len) { ------------------ | Branch (340:10): [True: 232k, False: 159] ------------------ 341| 232k| const char c = buf_getbyte(line); 342| 232k| if (!quoted && (c == ' ' || c == '\t')) { ------------------ | Branch (342:8): [True: 140k, False: 92.2k] | Branch (342:20): [True: 79, False: 140k] | Branch (342:32): [True: 1.56k, False: 138k] ------------------ 343| 1.64k| break; 344| 1.64k| } 345| 231k| escape = (!escape && c == '\\'); ------------------ | Branch (345:14): [True: 229k, False: 1.70k] | Branch (345:25): [True: 1.71k, False: 227k] ------------------ 346| 231k| if (!escape && c == '"') { ------------------ | Branch (346:8): [True: 229k, False: 1.71k] | Branch (346:19): [True: 8.82k, False: 220k] ------------------ 347| 8.82k| quoted = !quoted; 348| 8.82k| } 349| 231k| options_len++; 350| 231k| } 351| 1.80k| options_buf = buf_new(options_len); 352| 1.80k| buf_putbytes(options_buf, options_start, options_len); 353| | 354| | /* compare the algorithm. +3 so we have enough bytes to read a space and some base64 characters too. */ 355| 1.80k| if (line->pos + algolen+3 > line->len) { ------------------ | Branch (355:7): [True: 212, False: 1.59k] ------------------ 356| 212| goto out; 357| 212| } 358| 1.59k| if (strncmp((const char *) buf_getptr(line, algolen), algo, algolen) != 0) { ------------------ | Branch (358:7): [True: 134, False: 1.45k] ------------------ 359| 134| goto out; 360| 134| } 361| 1.59k| } 362| 1.62k| buf_incrpos(line, algolen); 363| | 364| | /* check for space (' ') character */ 365| 1.62k| if (buf_getbyte(line) != ' ') { ------------------ | Branch (365:6): [True: 17, False: 1.60k] ------------------ 366| 17| TRACE(("checkpubkey_line: space character expected, isn't there")) 367| 17| goto out; 368| 17| } 369| | 370| | /* find the length of base64 data */ 371| 1.60k| pos = line->pos; 372| 85.7k| for (len = 0; line->pos < line->len; len++) { ------------------ | Branch (372:16): [True: 84.2k, False: 1.50k] ------------------ 373| 84.2k| if (buf_getbyte(line) == ' ') { ------------------ | Branch (373:7): [True: 103, False: 84.1k] ------------------ 374| 103| break; 375| 103| } 376| 84.2k| } 377| | 378| | /* find out the length of the public key info, stop at the first space */ 379| 1.60k| infopos = line->pos; 380| 6.55k| for (infolen = 0; line->pos < line->len; infolen++) { ------------------ | Branch (380:20): [True: 4.98k, False: 1.56k] ------------------ 381| 4.98k| const char c = buf_getbyte(line); 382| 4.98k| if (c == ' ') { ------------------ | Branch (382:7): [True: 15, False: 4.97k] ------------------ 383| 15| break; 384| 15| } 385| | /* We have an allowlist - authorized_keys lines can't be fully trusted, 386| | some shell scripts may do unsafe things with env var values */ 387| 4.97k| if (!(isalnum(c) || strchr(".,_-+@", c))) { ------------------ | Branch (387:23): [True: 1.03k, False: 29] ------------------ 388| 29| TRACE(("Not setting SSH_PUBKEYINFO, special characters")) 389| 29| infolen = 0; 390| 29| break; 391| 29| } 392| 4.97k| } 393| 1.60k| if (infolen > 0) { ------------------ | Branch (393:6): [True: 58, False: 1.55k] ------------------ 394| 58| info_str = m_malloc(infolen + 1); 395| 58| buf_setpos(line, infopos); 396| 58| strncpy(info_str, buf_getptr(line, infolen), infolen); 397| 58| } 398| | 399| | /* truncate to base64 data length */ 400| 1.60k| buf_setpos(line, pos); 401| 1.60k| buf_setlen(line, line->pos + len); 402| | 403| 1.60k| TRACE(("checkpubkey_line: line pos = %d len = %d", line->pos, line->len)) 404| | 405| 1.60k| ret = cmp_base64_key(keyblob, keybloblen, (const unsigned char *) algo, algolen, line, NULL); 406| | 407| | /* free pubkey_info if it is filled */ 408| 1.60k| if (ret_info && *ret_info) { ------------------ | Branch (408:6): [True: 0, False: 1.60k] | Branch (408:18): [True: 0, False: 0] ------------------ 409| 0| m_free(*ret_info); ------------------ | | 24| 0|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded - Ignored] | | ------------------ ------------------ 410| 0| *ret_info = NULL; 411| 0| } 412| | 413| 1.60k| if (ret == DROPBEAR_SUCCESS) { ------------------ | | 102| 1.60k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (413:6): [True: 1.35k, False: 251] ------------------ 414| 1.35k| if (options_buf) { ------------------ | Branch (414:7): [True: 1.35k, False: 3] ------------------ 415| 1.35k| ret = svr_add_pubkey_options(options_buf, line_num, filename); 416| 1.35k| } 417| 1.35k| if (ret_info) { ------------------ | Branch (417:7): [True: 0, False: 1.35k] ------------------ 418| | /* take the (optional) public key information */ 419| 0| *ret_info = info_str; 420| 0| info_str = NULL; 421| 0| } 422| 1.35k| } 423| | 424| 1.97k|out: 425| 1.97k| if (options_buf) { ------------------ | Branch (425:6): [True: 1.78k, False: 195] ------------------ 426| 1.78k| buf_free(options_buf); 427| 1.78k| } 428| 1.97k| if (info_str) { ------------------ | Branch (428:6): [True: 58, False: 1.91k] ------------------ 429| 58| m_free(info_str); ------------------ | | 24| 58|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded - Ignored] | | ------------------ ------------------ 430| 58| } 431| 1.97k| return ret; 432| 1.60k|} svr_pubkey_options_cleanup: 135| 1.35k|void svr_pubkey_options_cleanup() { 136| 1.35k| if (ses.authstate.pubkey_options) { ------------------ | Branch (136:6): [True: 1.35k, False: 3] ------------------ 137| 1.35k| if (ses.authstate.pubkey_options->forced_command) { ------------------ | Branch (137:7): [True: 43, False: 1.31k] ------------------ 138| 43| m_free(ses.authstate.pubkey_options->forced_command); ------------------ | | 24| 43|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded - Ignored] | | ------------------ ------------------ 139| 43| } 140| 1.35k| if (ses.authstate.pubkey_options->permit_open_destinations) { ------------------ | Branch (140:7): [True: 249, False: 1.10k] ------------------ 141| 249| m_list_elem *iter = ses.authstate.pubkey_options->permit_open_destinations->first; 142| 1.77k| while (iter) { ------------------ | Branch (142:11): [True: 1.52k, False: 249] ------------------ 143| 1.52k| struct PermitTCPFwdEntry *entry = (struct PermitTCPFwdEntry*)list_remove(iter); 144| 1.52k| m_free(entry->host); ------------------ | | 24| 1.52k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded - Ignored] | | ------------------ ------------------ 145| 1.52k| m_free(entry); ------------------ | | 24| 1.52k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded - Ignored] | | ------------------ ------------------ 146| 1.52k| iter = ses.authstate.pubkey_options->permit_open_destinations->first; 147| 1.52k| } 148| 249| m_free(ses.authstate.pubkey_options->permit_open_destinations); ------------------ | | 24| 249|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded - Ignored] | | ------------------ ------------------ 149| 249| } 150| 1.35k| m_free(ses.authstate.pubkey_options); ------------------ | | 24| 1.35k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded - Ignored] | | ------------------ ------------------ 151| 1.35k| } 152| 1.35k| if (ses.authstate.pubkey_info) { ------------------ | Branch (152:6): [True: 0, False: 1.35k] ------------------ 153| 0| m_free(ses.authstate.pubkey_info); ------------------ | | 24| 0|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded - Ignored] | | ------------------ ------------------ 154| 0| } 155| 1.35k|} svr_add_pubkey_options: 173| 1.35k|int svr_add_pubkey_options(buffer *options_buf, int line_num, const char* filename) { 174| 1.35k| int ret = DROPBEAR_FAILURE; ------------------ | | 103| 1.35k|#define DROPBEAR_FAILURE -1 ------------------ 175| | 176| 1.35k| TRACE(("enter addpubkeyoptions")) 177| | 178| 1.35k| ses.authstate.pubkey_options = (struct PubKeyOptions*)m_malloc(sizeof( struct PubKeyOptions )); 179| | 180| 1.35k| buf_setpos(options_buf, 0); 181| 9.15k| while (options_buf->pos < options_buf->len) { ------------------ | Branch (181:9): [True: 8.99k, False: 154] ------------------ 182| 8.99k| if (match_option(options_buf, "no-port-forwarding") == DROPBEAR_SUCCESS) { ------------------ | | 102| 8.99k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (182:7): [True: 217, False: 8.78k] ------------------ 183| 217| dropbear_log(LOG_WARNING, "Port forwarding disabled."); 184| 217| ses.authstate.pubkey_options->no_port_forwarding_flag = 1; 185| 217| goto next_option; 186| 217| } 187| 8.78k| if (match_option(options_buf, "no-agent-forwarding") == DROPBEAR_SUCCESS) { ------------------ | | 102| 8.78k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (187:7): [True: 247, False: 8.53k] ------------------ 188| 247|#if DROPBEAR_SVR_AGENTFWD 189| 247| dropbear_log(LOG_WARNING, "Agent forwarding disabled."); 190| 247| ses.authstate.pubkey_options->no_agent_forwarding_flag = 1; 191| 247|#endif 192| 247| goto next_option; 193| 247| } 194| 8.53k| if (match_option(options_buf, "no-X11-forwarding") == DROPBEAR_SUCCESS) { ------------------ | | 102| 8.53k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (194:7): [True: 221, False: 8.31k] ------------------ 195| |#if DROPBEAR_X11FWD 196| | dropbear_log(LOG_WARNING, "X11 forwarding disabled."); 197| | ses.authstate.pubkey_options->no_x11_forwarding_flag = 1; 198| |#endif 199| 221| goto next_option; 200| 221| } 201| 8.31k| if (match_option(options_buf, "no-pty") == DROPBEAR_SUCCESS) { ------------------ | | 102| 8.31k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (201:7): [True: 281, False: 8.03k] ------------------ 202| 281| dropbear_log(LOG_WARNING, "Pty allocation disabled."); 203| 281| ses.authstate.pubkey_options->no_pty_flag = 1; 204| 281| goto next_option; 205| 281| } 206| 8.03k| if (match_option(options_buf, "restrict") == DROPBEAR_SUCCESS) { ------------------ | | 102| 8.03k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (206:7): [True: 342, False: 7.68k] ------------------ 207| 342| dropbear_log(LOG_WARNING, "Restrict option set"); 208| 342| ses.authstate.pubkey_options->no_port_forwarding_flag = 1; 209| 342|#if DROPBEAR_SVR_AGENTFWD 210| 342| ses.authstate.pubkey_options->no_agent_forwarding_flag = 1; 211| 342|#endif 212| |#if DROPBEAR_X11FWD 213| | ses.authstate.pubkey_options->no_x11_forwarding_flag = 1; 214| |#endif 215| 342| ses.authstate.pubkey_options->no_pty_flag = 1; 216| 342| goto next_option; 217| 342| } 218| 7.68k| if (match_option(options_buf, "command=\"") == DROPBEAR_SUCCESS) { ------------------ | | 102| 7.68k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (218:7): [True: 64, False: 7.62k] ------------------ 219| 64| int escaped = 0; 220| 64| const unsigned char* command_start = buf_getptr(options_buf, 0); 221| | 222| 64| if (ses.authstate.pubkey_options->forced_command) { ------------------ | Branch (222:8): [True: 1, False: 63] ------------------ 223| | /* multiple command= options */ 224| 1| goto bad_option; 225| 1| } 226| | 227| 15.3k| while (options_buf->pos < options_buf->len) { ------------------ | Branch (227:11): [True: 15.2k, False: 20] ------------------ 228| 15.2k| const char c = buf_getbyte(options_buf); 229| 15.2k| if (!escaped && c == '"') { ------------------ | Branch (229:9): [True: 14.9k, False: 320] | Branch (229:21): [True: 43, False: 14.9k] ------------------ 230| 43| const int command_len = buf_getptr(options_buf, 0) - command_start; 231| 43| ses.authstate.pubkey_options->forced_command = m_malloc(command_len); 232| 43| memcpy(ses.authstate.pubkey_options->forced_command, 233| 43| command_start, command_len-1); 234| 43| ses.authstate.pubkey_options->forced_command[command_len-1] = '\0'; 235| 43| goto next_option; 236| 43| } 237| 15.2k| escaped = (!escaped && c == '\\'); ------------------ | Branch (237:16): [True: 14.9k, False: 320] | Branch (237:28): [True: 320, False: 14.6k] ------------------ 238| 15.2k| } 239| 20| dropbear_log(LOG_WARNING, "Badly formatted command= authorized_keys option"); 240| 20| goto bad_option; 241| 63| } 242| | 243| 7.62k| if (match_option(options_buf, "permitopen=\"") == DROPBEAR_SUCCESS) { ------------------ | | 102| 7.62k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (243:7): [True: 1.52k, False: 6.10k] ------------------ 244| 1.52k| int valid_option = 0; 245| 1.52k| const unsigned char* permitopen_start = buf_getptr(options_buf, 0); 246| | 247| 1.52k| if (!ses.authstate.pubkey_options->permit_open_destinations) { ------------------ | Branch (247:8): [True: 249, False: 1.27k] ------------------ 248| 249| ses.authstate.pubkey_options->permit_open_destinations = list_new(); 249| 249| } 250| | 251| 13.1k| while (options_buf->pos < options_buf->len) { ------------------ | Branch (251:11): [True: 13.1k, False: 1] ------------------ 252| 13.1k| const char c = buf_getbyte(options_buf); 253| 13.1k| if (c == '"') { ------------------ | Branch (253:9): [True: 1.52k, False: 11.6k] ------------------ 254| 1.52k| char *spec = NULL; 255| 1.52k| char *portstring = NULL; 256| 1.52k| const int permitopen_len = buf_getptr(options_buf, 0) - permitopen_start; 257| 1.52k| struct PermitTCPFwdEntry *entry = 258| 1.52k| (struct PermitTCPFwdEntry*)m_malloc(sizeof(struct PermitTCPFwdEntry)); 259| | 260| 1.52k| list_append(ses.authstate.pubkey_options->permit_open_destinations, entry); 261| 1.52k| spec = m_malloc(permitopen_len); 262| 1.52k| memcpy(spec, permitopen_start, permitopen_len - 1); 263| 1.52k| spec[permitopen_len - 1] = '\0'; 264| 1.52k| if ((split_address_port(spec, &entry->host, &portstring) == DROPBEAR_SUCCESS) ------------------ | | 102| 1.52k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (264:10): [True: 1.50k, False: 19] ------------------ 265| 1.52k| && entry->host && portstring) { ------------------ | Branch (265:10): [True: 1.49k, False: 5] | Branch (265:25): [True: 1.47k, False: 25] ------------------ 266| 1.47k| if (strcmp(portstring, "*") == 0) { ------------------ | Branch (266:11): [True: 345, False: 1.12k] ------------------ 267| 345| valid_option = 1; 268| 345| entry->port = PUBKEY_OPTIONS_ANY_PORT; ------------------ | | 101| 345|#define PUBKEY_OPTIONS_ANY_PORT UINT_MAX ------------------ 269| 345| TRACE(("local port forwarding allowed to host '%s'", entry->host)); 270| 1.12k| } else if (m_str_to_uint(portstring, &entry->port) == DROPBEAR_SUCCESS) { ------------------ | | 102| 1.12k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (270:18): [True: 1.03k, False: 94] ------------------ 271| 1.03k| valid_option = 1; 272| 1.03k| TRACE(("local port forwarding allowed to host '%s' and port '%u'", 273| 1.03k| entry->host, entry->port)); 274| 1.03k| } 275| 1.47k| } 276| | 277| 1.52k| m_free(spec); ------------------ | | 24| 1.52k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded - Ignored] | | ------------------ ------------------ 278| 1.52k| m_free(portstring); ------------------ | | 24| 1.52k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded - Ignored] | | ------------------ ------------------ 279| 1.52k| break; 280| 1.52k| } 281| 13.1k| } 282| | 283| 1.52k| if (valid_option) { ------------------ | Branch (283:8): [True: 1.37k, False: 144] ------------------ 284| 1.37k| goto next_option; 285| 1.37k| } else { 286| 144| dropbear_log(LOG_WARNING, "Badly formatted permitopen= authorized_keys option"); 287| 144| goto bad_option; 288| 144| } 289| 1.52k| } 290| | 291| 6.10k| if (match_option(options_buf, "no-touch-required") == DROPBEAR_SUCCESS) { ------------------ | | 102| 6.10k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (291:7): [True: 105, False: 5.99k] ------------------ 292| 105|#if DROPBEAR_SK_ECDSA || DROPBEAR_SK_ED25519 293| 105| dropbear_log(LOG_WARNING, "No user presence check required for U2F/FIDO key."); 294| 105| ses.authstate.pubkey_options->no_touch_required_flag = 1; 295| 105|#endif 296| 105| goto next_option; 297| 105| } 298| 5.99k| if (match_option(options_buf, "verify-required") == DROPBEAR_SUCCESS) { ------------------ | | 102| 5.99k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (298:7): [True: 116, False: 5.88k] ------------------ 299| 116|#if DROPBEAR_SK_ECDSA || DROPBEAR_SK_ED25519 300| 116| dropbear_log(LOG_WARNING, "User verification required for U2F/FIDO key."); 301| 116| ses.authstate.pubkey_options->verify_required_flag = 1; 302| 116|#endif 303| 116| goto next_option; 304| 116| } 305| | 306| 8.83k|next_option: 307| | /* 308| | * Skip the comma, and move to the next option 309| | * (or break out if there are no more). 310| | */ 311| 8.83k| if (options_buf->pos < options_buf->len ------------------ | Branch (311:7): [True: 8.69k, False: 136] ------------------ 312| 8.83k| && buf_getbyte(options_buf) != ',') { ------------------ | Branch (312:8): [True: 1.03k, False: 7.66k] ------------------ 313| 1.03k| goto bad_option; 314| 1.03k| } 315| | /* Process the next option. */ 316| 8.83k| } 317| | /* parsed all options with no problem */ 318| 154| ret = DROPBEAR_SUCCESS; ------------------ | | 102| 154|#define DROPBEAR_SUCCESS 0 ------------------ 319| 154| goto end; 320| | 321| 1.20k|bad_option: 322| 1.20k| ret = DROPBEAR_FAILURE; ------------------ | | 103| 1.20k|#define DROPBEAR_FAILURE -1 ------------------ 323| 1.20k| svr_pubkey_options_cleanup(); 324| 1.20k| dropbear_log(LOG_WARNING, "Bad public key options at %s:%d", filename, line_num); 325| | 326| 1.35k|end: 327| 1.35k| TRACE(("leave addpubkeyoptions")) 328| 1.35k| return ret; 329| 1.20k|} svr-authpubkeyoptions.c:match_option: 159| 70.0k|static int match_option(buffer *options_buf, const char *opt_name) { 160| 70.0k| const unsigned int len = strlen(opt_name); 161| 70.0k| if (options_buf->len - options_buf->pos < len) { ------------------ | Branch (161:6): [True: 7.10k, False: 62.9k] ------------------ 162| 7.10k| return DROPBEAR_FAILURE; ------------------ | | 103| 7.10k|#define DROPBEAR_FAILURE -1 ------------------ 163| 7.10k| } 164| 62.9k| if (strncasecmp((const char *) buf_getptr(options_buf, len), opt_name, len) == 0) { ------------------ | Branch (164:6): [True: 3.11k, False: 59.8k] ------------------ 165| 3.11k| buf_incrpos(options_buf, len); 166| 3.11k| return DROPBEAR_SUCCESS; ------------------ | | 102| 3.11k|#define DROPBEAR_SUCCESS 0 ------------------ 167| 3.11k| } 168| 59.8k| return DROPBEAR_FAILURE; ------------------ | | 103| 59.8k|#define DROPBEAR_FAILURE -1 ------------------ 169| 62.9k|}