fuzz_early_setup: 23| 2|void fuzz_early_setup(void) { 24| | /* Set stderr to point to normal stderr by default */ 25| | fuzz.fake_stderr = stderr; 26| 2|} fuzz_common_setup: 28| 1|void fuzz_common_setup(void) { 29| 1| disallow_core(); 30| 1| fuzz.fuzzing = 1; 31| 1| fuzz.wrapfds = 1; 32| 1| fuzz.do_jmp = 1; 33| 1| fuzz.input = m_malloc(sizeof(buffer)); 34| 1| _dropbear_log = fuzz_dropbear_log; 35| 1| crypto_init(); 36| 1| fuzz_seed("start", 5); 37| | /* let any messages get flushed */ 38| 1| setlinebuf(stdout); 39| |#if DEBUG_TRACE 40| | if (debug_trace) 41| | { 42| | fprintf(stderr, "Dropbear fuzzer: -v specified, not disabling stderr output\n"); 43| | } 44| | else 45| |#endif 46| 1| if (getenv("DROPBEAR_KEEP_STDERR")) { ------------------ | Branch (46:9): [True: 0, False: 1] ------------------ 47| 0| fprintf(stderr, "Dropbear fuzzer: DROPBEAR_KEEP_STDERR, not disabling stderr output\n"); 48| 0| } 49| 1| else 50| 1| { 51| 1| fprintf(stderr, "Dropbear fuzzer: Disabling stderr output\n"); 52| 1| fuzz.fake_stderr = fopen("/dev/null", "w"); 53| | assert(fuzz.fake_stderr); ------------------ | Branch (53:9): [True: 0, False: 1] | Branch (53:9): [True: 1, False: 0] ------------------ 54| 1| } 55| 1|} fuzz_set_input: 57| 2.33k|int fuzz_set_input(const uint8_t *Data, size_t Size) { 58| | 59| 2.33k| fuzz.input->data = (unsigned char*)Data; 60| 2.33k| fuzz.input->size = Size; 61| 2.33k| fuzz.input->len = Size; 62| 2.33k| fuzz.input->pos = 0; 63| | 64| 2.33k| memset(&ses, 0x0, sizeof(ses)); 65| 2.33k| memset(&svr_ses, 0x0, sizeof(svr_ses)); 66| 2.33k| memset(&cli_ses, 0x0, sizeof(cli_ses)); 67| 2.33k| wrapfd_setup(fuzz.input); 68| | // printhex("input", fuzz.input->data, fuzz.input->len); 69| | 70| 2.33k| fuzz_seed(fuzz.input->data, MIN(fuzz.input->len, 16)); ------------------ | Branch (70:33): [True: 151, False: 2.17k] ------------------ 71| | 72| 2.33k| return DROPBEAR_SUCCESS; ------------------ | | 111| 2.33k|#define DROPBEAR_SUCCESS 0 ------------------ 73| 2.33k|} fuzz-common.c:fuzz_dropbear_log: 84| 3.23k|static void fuzz_dropbear_log(int UNUSED(priority), const char* UNUSED(format), va_list UNUSED(param)) { 85| | /* No print */ 86| 3.23k|} wrapfd_setup: 32| 2.33k|void wrapfd_setup(buffer *buf) { 33| 2.33k| TRACE(("wrapfd_setup")) 34| | 35| | // clean old ones 36| 2.33k| int i; 37| 2.33k| for (i = 0; i <= wrapfd_maxfd; i++) { ------------------ | Branch (37:14): [True: 0, False: 2.33k] ------------------ 38| 0| if (wrap_fds[i].mode != UNUSED) { ------------------ | Branch (38:7): [True: 0, False: 0] ------------------ 39| 0| wrapfd_remove(i); 40| 0| } 41| 0| } 42| 2.33k| wrapfd_maxfd = -1; 43| | 44| 2.33k| memset(rand_state, 0x0, sizeof(rand_state)); 45| 2.33k| wrapfd_setseed(50); 46| 2.33k| input_buf = buf; 47| 2.33k|} wrapfd_setseed: 49| 2.33k|void wrapfd_setseed(uint32_t seed) { 50| 2.33k| memcpy(rand_state, &seed, sizeof(seed)); 51| 2.33k| nrand48(rand_state); 52| 2.33k|} LLVMFuzzerTestOneInput: 10| 2.33k|int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { 11| 2.33k| static int once = 0; 12| 2.33k| if (!once) { ------------------ | Branch (12:6): [True: 1, False: 2.32k] ------------------ 13| 1| setup_fuzzer(); 14| 1| once = 1; 15| 1| } 16| | 17| 2.33k| if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) { ------------------ | | 112| 2.33k|#define DROPBEAR_FAILURE -1 ------------------ | Branch (17:6): [True: 0, False: 2.33k] ------------------ 18| 0| return 0; 19| 0| } 20| | 21| 2.33k| m_malloc_set_epoch(1); 22| | 23| 2.33k| if (setjmp(fuzz.jmp) == 0) { ------------------ | Branch (23:6): [True: 2.33k, False: 0] ------------------ 24| 2.33k| buffer *line = buf_getstringbuf(fuzz.input); 25| 2.33k| buffer *keyblob = buf_getstringbuf(fuzz.input); 26| | 27| 2.33k| unsigned int algolen; 28| 2.33k| char* algoname = buf_getstring(keyblob, &algolen); 29| | 30| 2.33k| if (signature_type_from_name(algoname, algolen) == DROPBEAR_SIGNATURE_NONE) { ------------------ | Branch (30:7): [True: 202, False: 2.12k] ------------------ 31| 202| dropbear_exit("fuzzer imagined a bogus algorithm"); 32| 202| } 33| | 34| 2.12k| fuzz_checkpubkey_line(line, 5, "/home/me/authorized_keys", 35| 2.12k| algoname, algolen, 36| 2.12k| keyblob->data, keyblob->len); 37| | 38| 2.12k| buf_free(line); 39| 2.12k| buf_free(keyblob); 40| 2.12k| m_free(algoname); ------------------ | | 24| 2.12k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 2.12k] | | ------------------ ------------------ 41| 2.12k| m_malloc_free_epoch(1, 0); 42| 2.12k| } else { 43| 0| m_malloc_free_epoch(1, 1); 44| 0| TRACE(("dropbear_exit longjmped")) 45| | /* dropbear_exit jumped here */ 46| 0| } 47| | 48| 2.12k| return 0; 49| 2.33k|} fuzzer-pubkey.c:setup_fuzzer: 6| 1|static void setup_fuzzer(void) { 7| 1| fuzz_common_setup(); 8| 1|} sha256_init: 205| 2.33k|{ 206| 2.33k| LTC_ARGCHK(md != NULL); ------------------ | | 32| 2.33k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 2.33k] | | | Branch (32:87): [Folded, False: 2.33k] | | ------------------ ------------------ 207| | 208| 2.33k| md->sha256.curlen = 0; 209| 2.33k| md->sha256.length = 0; 210| 2.33k| md->sha256.state[0] = 0x6A09E667UL; 211| 2.33k| md->sha256.state[1] = 0xBB67AE85UL; 212| 2.33k| md->sha256.state[2] = 0x3C6EF372UL; 213| 2.33k| md->sha256.state[3] = 0xA54FF53AUL; 214| 2.33k| md->sha256.state[4] = 0x510E527FUL; 215| 2.33k| md->sha256.state[5] = 0x9B05688CUL; 216| 2.33k| md->sha256.state[6] = 0x1F83D9ABUL; 217| 2.33k| md->sha256.state[7] = 0x5BE0CD19UL; 218| 2.33k| return CRYPT_OK; 219| 2.33k|} sha256_done: 237| 2.33k|{ 238| 2.33k| int i; 239| | 240| 2.33k| LTC_ARGCHK(md != NULL); ------------------ | | 32| 2.33k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 2.33k] | | | Branch (32:87): [Folded, False: 2.33k] | | ------------------ ------------------ 241| 2.33k| LTC_ARGCHK(out != NULL); ------------------ | | 32| 2.33k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 2.33k] | | | Branch (32:87): [Folded, False: 2.33k] | | ------------------ ------------------ 242| | 243| 2.33k| if (md->sha256.curlen >= sizeof(md->sha256.buf)) { ------------------ | Branch (243:9): [True: 0, False: 2.33k] ------------------ 244| 0| return CRYPT_INVALID_ARG; 245| 0| } 246| | 247| | 248| | /* increase the length of the message */ 249| 2.33k| md->sha256.length += md->sha256.curlen * 8; 250| | 251| | /* append the '1' bit */ 252| 2.33k| md->sha256.buf[md->sha256.curlen++] = (unsigned char)0x80; 253| | 254| | /* if the length is currently above 56 bytes we append zeros 255| | * then compress. Then we can fall back to padding zeros and length 256| | * encoding like normal. 257| | */ 258| 2.33k| if (md->sha256.curlen > 56) { ------------------ | Branch (258:9): [True: 0, False: 2.33k] ------------------ 259| 0| while (md->sha256.curlen < 64) { ------------------ | Branch (259:16): [True: 0, False: 0] ------------------ 260| 0| md->sha256.buf[md->sha256.curlen++] = (unsigned char)0; 261| 0| } 262| 0| sha256_compress(md, md->sha256.buf); 263| 0| md->sha256.curlen = 0; 264| 0| } 265| | 266| | /* pad upto 56 bytes of zeroes */ 267| 66.4k| while (md->sha256.curlen < 56) { ------------------ | Branch (267:12): [True: 64.1k, False: 2.33k] ------------------ 268| 64.1k| md->sha256.buf[md->sha256.curlen++] = (unsigned char)0; 269| 64.1k| } 270| | 271| | /* store length */ 272| 2.33k| STORE64H(md->sha256.length, md->sha256.buf+56); ------------------ | | 101| 2.33k|#define STORE64H(x, y) \ | | 102| 2.33k|do { ulong64 __t = __builtin_bswap64 ((x)); \ | | 103| 2.33k| XMEMCPY ((y), &__t, 8); } while(0) | | ------------------ | | | | 39| 2.33k|#define XMEMCPY memcpy | | ------------------ | | | Branch (103:39): [Folded, False: 2.33k] | | ------------------ ------------------ 273| 2.33k| sha256_compress(md, md->sha256.buf); 274| | 275| | /* copy output */ 276| 20.9k| for (i = 0; i < 8; i++) { ------------------ | Branch (276:17): [True: 18.6k, False: 2.33k] ------------------ 277| 18.6k| STORE32H(md->sha256.state[i], out+(4*i)); ------------------ | | 62| 18.6k|#define STORE32H(x, y) \ | | 63| 18.6k|do { ulong32 __t = __builtin_bswap32 ((x)); \ | | 64| 18.6k| XMEMCPY ((y), &__t, 4); } while(0) | | ------------------ | | | | 39| 18.6k|#define XMEMCPY memcpy | | ------------------ | | | Branch (64:39): [Folded, False: 18.6k] | | ------------------ ------------------ 278| 18.6k| } 279| |#ifdef LTC_CLEAN_STACK 280| | zeromem(md, sizeof(hash_state)); 281| |#endif 282| 2.33k| return CRYPT_OK; 283| 2.33k|} sha256.c:sha256_compress: 71| 2.33k|{ 72| 2.33k| ulong32 S[8], W[64], t0, t1; 73| 2.33k|#ifdef LTC_SMALL_CODE 74| 2.33k| ulong32 t; 75| 2.33k|#endif 76| 2.33k| int i; 77| | 78| | /* copy state into S */ 79| 20.9k| for (i = 0; i < 8; i++) { ------------------ | Branch (79:17): [True: 18.6k, False: 2.33k] ------------------ 80| 18.6k| S[i] = md->sha256.state[i]; 81| 18.6k| } 82| | 83| | /* copy the state into 512-bits into W[0..15] */ 84| 39.6k| for (i = 0; i < 16; i++) { ------------------ | Branch (84:17): [True: 37.2k, False: 2.33k] ------------------ 85| 37.2k| LOAD32H(W[i], buf + (4*i)); ------------------ | | 66| 37.2k|#define LOAD32H(x, y) \ | | 67| 37.2k|do { XMEMCPY (&(x), (y), 4); \ | | ------------------ | | | | 39| 37.2k|#define XMEMCPY memcpy | | ------------------ | | 68| 37.2k| (x) = __builtin_bswap32 ((x)); } while(0) | | ------------------ | | | Branch (68:46): [Folded, False: 37.2k] | | ------------------ ------------------ 86| 37.2k| } 87| | 88| | /* fill W[16..63] */ 89| 114k| for (i = 16; i < 64; i++) { ------------------ | Branch (89:18): [True: 111k, False: 2.33k] ------------------ 90| 111k| W[i] = Gamma1(W[i - 2]) + W[i - 7] + Gamma0(W[i - 15]) + W[i - 16]; ------------------ | | 63| 111k|#define Gamma1(x) (S(x, 17) ^ S(x, 19) ^ R(x, 10)) | | ------------------ | | | | 58| 111k|#define S(x, n) RORc((x),(n)) | | | | ------------------ | | | | | | 283| 111k|#define RORc(word,i) ({ \ | | | | | | 284| 111k| ulong32 __RORc_tmp = (word); \ | | | | | | 285| 111k| __asm__ ("rorl %2, %0" : \ | | | | | | 286| 111k| "=r" (__RORc_tmp) : \ | | | | | | 287| 111k| "0" (__RORc_tmp), \ | | | | | | 288| 111k| "I" (i)); \ | | | | | | 289| 111k| __RORc_tmp; \ | | | | | | 290| 111k| }) | | | | ------------------ | | ------------------ | | #define Gamma1(x) (S(x, 17) ^ S(x, 19) ^ R(x, 10)) | | ------------------ | | | | 58| 111k|#define S(x, n) RORc((x),(n)) | | | | ------------------ | | | | | | 283| 111k|#define RORc(word,i) ({ \ | | | | | | 284| 111k| ulong32 __RORc_tmp = (word); \ | | | | | | 285| 111k| __asm__ ("rorl %2, %0" : \ | | | | | | 286| 111k| "=r" (__RORc_tmp) : \ | | | | | | 287| 111k| "0" (__RORc_tmp), \ | | | | | | 288| 111k| "I" (i)); \ | | | | | | 289| 111k| __RORc_tmp; \ | | | | | | 290| 111k| }) | | | | ------------------ | | ------------------ | | #define Gamma1(x) (S(x, 17) ^ S(x, 19) ^ R(x, 10)) | | ------------------ | | | | 59| 111k|#define R(x, n) (((x)&0xFFFFFFFFUL)>>(n)) | | ------------------ ------------------ W[i] = Gamma1(W[i - 2]) + W[i - 7] + Gamma0(W[i - 15]) + W[i - 16]; ------------------ | | 62| 111k|#define Gamma0(x) (S(x, 7) ^ S(x, 18) ^ R(x, 3)) | | ------------------ | | | | 58| 111k|#define S(x, n) RORc((x),(n)) | | | | ------------------ | | | | | | 283| 111k|#define RORc(word,i) ({ \ | | | | | | 284| 111k| ulong32 __RORc_tmp = (word); \ | | | | | | 285| 111k| __asm__ ("rorl %2, %0" : \ | | | | | | 286| 111k| "=r" (__RORc_tmp) : \ | | | | | | 287| 111k| "0" (__RORc_tmp), \ | | | | | | 288| 111k| "I" (i)); \ | | | | | | 289| 111k| __RORc_tmp; \ | | | | | | 290| 111k| }) | | | | ------------------ | | ------------------ | | #define Gamma0(x) (S(x, 7) ^ S(x, 18) ^ R(x, 3)) | | ------------------ | | | | 58| 111k|#define S(x, n) RORc((x),(n)) | | | | ------------------ | | | | | | 283| 111k|#define RORc(word,i) ({ \ | | | | | | 284| 111k| ulong32 __RORc_tmp = (word); \ | | | | | | 285| 111k| __asm__ ("rorl %2, %0" : \ | | | | | | 286| 111k| "=r" (__RORc_tmp) : \ | | | | | | 287| 111k| "0" (__RORc_tmp), \ | | | | | | 288| 111k| "I" (i)); \ | | | | | | 289| 111k| __RORc_tmp; \ | | | | | | 290| 111k| }) | | | | ------------------ | | ------------------ | | #define Gamma0(x) (S(x, 7) ^ S(x, 18) ^ R(x, 3)) | | ------------------ | | | | 59| 111k|#define R(x, n) (((x)&0xFFFFFFFFUL)>>(n)) | | ------------------ ------------------ 91| 111k| } 92| | 93| | /* Compress */ 94| 2.33k|#ifdef LTC_SMALL_CODE 95| 2.33k|#define RND(a,b,c,d,e,f,g,h,i) \ 96| 2.33k| t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i]; \ 97| 2.33k| t1 = Sigma0(a) + Maj(a, b, c); \ 98| 2.33k| d += t0; \ 99| 2.33k| h = t0 + t1; 100| | 101| 151k| for (i = 0; i < 64; ++i) { ------------------ | Branch (101:18): [True: 149k, False: 2.33k] ------------------ 102| 149k| RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],i); ------------------ | | 96| 149k| t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i]; \ | | ------------------ | | | | 61| 149k|#define Sigma1(x) (S(x, 6) ^ S(x, 11) ^ S(x, 25)) | | | | ------------------ | | | | | | 58| 149k|#define S(x, n) RORc((x),(n)) | | | | | | ------------------ | | | | | | | | 283| 149k|#define RORc(word,i) ({ \ | | | | | | | | 284| 149k| ulong32 __RORc_tmp = (word); \ | | | | | | | | 285| 149k| __asm__ ("rorl %2, %0" : \ | | | | | | | | 286| 149k| "=r" (__RORc_tmp) : \ | | | | | | | | 287| 149k| "0" (__RORc_tmp), \ | | | | | | | | 288| 149k| "I" (i)); \ | | | | | | | | 289| 149k| __RORc_tmp; \ | | | | | | | | 290| 149k| }) | | | | | | ------------------ | | | | ------------------ | | | | #define Sigma1(x) (S(x, 6) ^ S(x, 11) ^ S(x, 25)) | | | | ------------------ | | | | | | 58| 149k|#define S(x, n) RORc((x),(n)) | | | | | | ------------------ | | | | | | | | 283| 149k|#define RORc(word,i) ({ \ | | | | | | | | 284| 149k| ulong32 __RORc_tmp = (word); \ | | | | | | | | 285| 149k| __asm__ ("rorl %2, %0" : \ | | | | | | | | 286| 149k| "=r" (__RORc_tmp) : \ | | | | | | | | 287| 149k| "0" (__RORc_tmp), \ | | | | | | | | 288| 149k| "I" (i)); \ | | | | | | | | 289| 149k| __RORc_tmp; \ | | | | | | | | 290| 149k| }) | | | | | | ------------------ | | | | ------------------ | | | | #define Sigma1(x) (S(x, 6) ^ S(x, 11) ^ S(x, 25)) | | | | ------------------ | | | | | | 58| 149k|#define S(x, n) RORc((x),(n)) | | | | | | ------------------ | | | | | | | | 283| 149k|#define RORc(word,i) ({ \ | | | | | | | | 284| 149k| ulong32 __RORc_tmp = (word); \ | | | | | | | | 285| 149k| __asm__ ("rorl %2, %0" : \ | | | | | | | | 286| 149k| "=r" (__RORc_tmp) : \ | | | | | | | | 287| 149k| "0" (__RORc_tmp), \ | | | | | | | | 288| 149k| "I" (i)); \ | | | | | | | | 289| 149k| __RORc_tmp; \ | | | | | | | | 290| 149k| }) | | | | | | ------------------ | | | | ------------------ | | ------------------ | | t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i]; \ | | ------------------ | | | | 56| 149k|#define Ch(x,y,z) (z ^ (x & (y ^ z))) | | ------------------ | | 97| 149k| t1 = Sigma0(a) + Maj(a, b, c); \ | | ------------------ | | | | 60| 149k|#define Sigma0(x) (S(x, 2) ^ S(x, 13) ^ S(x, 22)) | | | | ------------------ | | | | | | 58| 149k|#define S(x, n) RORc((x),(n)) | | | | | | ------------------ | | | | | | | | 283| 149k|#define RORc(word,i) ({ \ | | | | | | | | 284| 149k| ulong32 __RORc_tmp = (word); \ | | | | | | | | 285| 149k| __asm__ ("rorl %2, %0" : \ | | | | | | | | 286| 149k| "=r" (__RORc_tmp) : \ | | | | | | | | 287| 149k| "0" (__RORc_tmp), \ | | | | | | | | 288| 149k| "I" (i)); \ | | | | | | | | 289| 149k| __RORc_tmp; \ | | | | | | | | 290| 149k| }) | | | | | | ------------------ | | | | ------------------ | | | | #define Sigma0(x) (S(x, 2) ^ S(x, 13) ^ S(x, 22)) | | | | ------------------ | | | | | | 58| 149k|#define S(x, n) RORc((x),(n)) | | | | | | ------------------ | | | | | | | | 283| 149k|#define RORc(word,i) ({ \ | | | | | | | | 284| 149k| ulong32 __RORc_tmp = (word); \ | | | | | | | | 285| 149k| __asm__ ("rorl %2, %0" : \ | | | | | | | | 286| 149k| "=r" (__RORc_tmp) : \ | | | | | | | | 287| 149k| "0" (__RORc_tmp), \ | | | | | | | | 288| 149k| "I" (i)); \ | | | | | | | | 289| 149k| __RORc_tmp; \ | | | | | | | | 290| 149k| }) | | | | | | ------------------ | | | | ------------------ | | | | #define Sigma0(x) (S(x, 2) ^ S(x, 13) ^ S(x, 22)) | | | | ------------------ | | | | | | 58| 149k|#define S(x, n) RORc((x),(n)) | | | | | | ------------------ | | | | | | | | 283| 149k|#define RORc(word,i) ({ \ | | | | | | | | 284| 149k| ulong32 __RORc_tmp = (word); \ | | | | | | | | 285| 149k| __asm__ ("rorl %2, %0" : \ | | | | | | | | 286| 149k| "=r" (__RORc_tmp) : \ | | | | | | | | 287| 149k| "0" (__RORc_tmp), \ | | | | | | | | 288| 149k| "I" (i)); \ | | | | | | | | 289| 149k| __RORc_tmp; \ | | | | | | | | 290| 149k| }) | | | | | | ------------------ | | | | ------------------ | | ------------------ | | t1 = Sigma0(a) + Maj(a, b, c); \ | | ------------------ | | | | 57| 149k|#define Maj(x,y,z) (((x | y) & z) | (x & y)) | | ------------------ | | 98| 149k| d += t0; \ | | 99| 149k| h = t0 + t1; ------------------ 103| 149k| t = S[7]; S[7] = S[6]; S[6] = S[5]; S[5] = S[4]; 104| 149k| S[4] = S[3]; S[3] = S[2]; S[2] = S[1]; S[1] = S[0]; S[0] = t; 105| 149k| } 106| |#else 107| |#define RND(a,b,c,d,e,f,g,h,i,ki) \ 108| | t0 = h + Sigma1(e) + Ch(e, f, g) + ki + W[i]; \ 109| | t1 = Sigma0(a) + Maj(a, b, c); \ 110| | d += t0; \ 111| | h = t0 + t1; 112| | 113| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],0,0x428a2f98); 114| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],1,0x71374491); 115| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],2,0xb5c0fbcf); 116| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],3,0xe9b5dba5); 117| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],4,0x3956c25b); 118| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],5,0x59f111f1); 119| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],6,0x923f82a4); 120| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],7,0xab1c5ed5); 121| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],8,0xd807aa98); 122| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],9,0x12835b01); 123| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],10,0x243185be); 124| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],11,0x550c7dc3); 125| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],12,0x72be5d74); 126| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],13,0x80deb1fe); 127| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],14,0x9bdc06a7); 128| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],15,0xc19bf174); 129| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],16,0xe49b69c1); 130| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],17,0xefbe4786); 131| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],18,0x0fc19dc6); 132| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],19,0x240ca1cc); 133| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],20,0x2de92c6f); 134| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],21,0x4a7484aa); 135| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],22,0x5cb0a9dc); 136| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],23,0x76f988da); 137| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],24,0x983e5152); 138| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],25,0xa831c66d); 139| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],26,0xb00327c8); 140| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],27,0xbf597fc7); 141| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],28,0xc6e00bf3); 142| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],29,0xd5a79147); 143| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],30,0x06ca6351); 144| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],31,0x14292967); 145| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],32,0x27b70a85); 146| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],33,0x2e1b2138); 147| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],34,0x4d2c6dfc); 148| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],35,0x53380d13); 149| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],36,0x650a7354); 150| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],37,0x766a0abb); 151| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],38,0x81c2c92e); 152| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],39,0x92722c85); 153| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],40,0xa2bfe8a1); 154| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],41,0xa81a664b); 155| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],42,0xc24b8b70); 156| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],43,0xc76c51a3); 157| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],44,0xd192e819); 158| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],45,0xd6990624); 159| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],46,0xf40e3585); 160| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],47,0x106aa070); 161| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],48,0x19a4c116); 162| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],49,0x1e376c08); 163| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],50,0x2748774c); 164| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],51,0x34b0bcb5); 165| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],52,0x391c0cb3); 166| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],53,0x4ed8aa4a); 167| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],54,0x5b9cca4f); 168| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],55,0x682e6ff3); 169| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],56,0x748f82ee); 170| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],57,0x78a5636f); 171| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],58,0x84c87814); 172| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],59,0x8cc70208); 173| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],60,0x90befffa); 174| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],61,0xa4506ceb); 175| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],62,0xbef9a3f7); 176| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],63,0xc67178f2); 177| | 178| |#undef RND 179| | 180| |#endif 181| | 182| | /* feedback */ 183| 20.9k| for (i = 0; i < 8; i++) { ------------------ | Branch (183:17): [True: 18.6k, False: 2.33k] ------------------ 184| 18.6k| md->sha256.state[i] = md->sha256.state[i] + S[i]; 185| 18.6k| } 186| 2.33k| return CRYPT_OK; 187| 2.33k|} sha256_process: 491| 4.66k|int func_name (hash_state * md, const unsigned char *in, unsigned long inlen) \ 492| 4.66k|{ \ 493| 4.66k| unsigned long n; \ 494| 4.66k| int err; \ 495| 4.66k| LTC_ARGCHK(md != NULL); \ ------------------ | | 32| 4.66k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 4.66k] | | | Branch (32:87): [Folded, False: 4.66k] | | ------------------ ------------------ 496| 4.66k| LTC_ARGCHK(in != NULL); \ ------------------ | | 32| 4.66k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 4.66k] | | | Branch (32:87): [Folded, False: 4.66k] | | ------------------ ------------------ 497| 4.66k| if (md-> state_var .curlen > sizeof(md-> state_var .buf)) { \ ------------------ | Branch (497:9): [True: 0, False: 4.66k] ------------------ 498| 0| return CRYPT_INVALID_ARG; \ 499| 0| } \ 500| 4.66k| if ((md-> state_var .length + inlen) < md-> state_var .length) { \ ------------------ | Branch (500:9): [True: 0, False: 4.66k] ------------------ 501| 0| return CRYPT_HASH_OVERFLOW; \ 502| 0| } \ 503| 9.32k| while (inlen > 0) { \ ------------------ | Branch (503:12): [True: 4.66k, False: 4.66k] ------------------ 504| 4.66k| if (md-> state_var .curlen == 0 && inlen >= block_size) { \ ------------------ | Branch (504:13): [True: 2.33k, False: 2.33k] | Branch (504:44): [True: 0, False: 2.33k] ------------------ 505| 0| if ((err = compress_name (md, (unsigned char *)in)) != CRYPT_OK) { \ ------------------ | Branch (505:16): [True: 0, False: 0] ------------------ 506| 0| return err; \ 507| 0| } \ 508| 0| md-> state_var .length += block_size * 8; \ 509| 0| in += block_size; \ 510| 0| inlen -= block_size; \ 511| 4.66k| } else { \ 512| 4.66k| n = MIN(inlen, (block_size - md-> state_var .curlen)); \ ------------------ | | 425| 4.66k| #define MIN(x, y) ( ((x)<(y))?(x):(y) ) | | ------------------ | | | Branch (425:24): [True: 4.66k, False: 0] | | ------------------ ------------------ 513| 4.66k| XMEMCPY(md-> state_var .buf + md-> state_var.curlen, in, (size_t)n); \ ------------------ | | 39| 4.66k|#define XMEMCPY memcpy ------------------ 514| 4.66k| md-> state_var .curlen += n; \ 515| 4.66k| in += n; \ 516| 4.66k| inlen -= n; \ 517| 4.66k| if (md-> state_var .curlen == block_size) { \ ------------------ | Branch (517:16): [True: 0, False: 4.66k] ------------------ 518| 0| if ((err = compress_name (md, md-> state_var .buf)) != CRYPT_OK) { \ ------------------ | Branch (518:19): [True: 0, False: 0] ------------------ 519| 0| return err; \ 520| 0| } \ 521| 0| md-> state_var .length += 8*block_size; \ 522| 0| md-> state_var .curlen = 0; \ 523| 0| } \ 524| 4.66k| } \ 525| 4.66k| } \ 526| 4.66k| return CRYPT_OK; \ 527| 4.66k|} base64_decode: 148| 1.51k|{ 149| 1.51k| return _base64_decode_internal(in, inlen, out, outlen, map_base64, relaxed); 150| 1.51k|} base64_decode.c:_base64_decode_internal: 81| 1.51k|{ 82| 1.51k| unsigned long t, x, y, z; 83| 1.51k| unsigned char c; 84| 1.51k| int g; 85| | 86| 1.51k| LTC_ARGCHK(in != NULL); ------------------ | | 32| 1.51k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 1.51k] | | | Branch (32:87): [Folded, False: 1.51k] | | ------------------ ------------------ 87| 1.51k| LTC_ARGCHK(out != NULL); ------------------ | | 32| 1.51k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 1.51k] | | | Branch (32:87): [Folded, False: 1.51k] | | ------------------ ------------------ 88| 1.51k| LTC_ARGCHK(outlen != NULL); ------------------ | | 32| 1.51k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 1.51k] | | | Branch (32:87): [Folded, False: 1.51k] | | ------------------ ------------------ 89| | 90| 1.51k| g = 0; /* '=' counter */ 91| 100k| for (x = y = z = t = 0; x < inlen; x++) { ------------------ | Branch (91:28): [True: 98.6k, False: 1.51k] ------------------ 92| 98.6k| c = map[in[x]&0xFF]; 93| 98.6k| if (c == 254) { ------------------ | Branch (93:12): [True: 5.81k, False: 92.8k] ------------------ 94| 5.81k| g++; 95| 5.81k| continue; 96| 5.81k| } 97| 92.8k| else if (is_strict && g > 0) { ------------------ | Branch (97:17): [True: 0, False: 92.8k] | Branch (97:30): [True: 0, False: 0] ------------------ 98| | /* we only allow '=' to be at the end */ 99| 0| return CRYPT_INVALID_PACKET; 100| 0| } 101| 92.8k| if (c == 255) { ------------------ | Branch (101:12): [True: 14.1k, False: 78.6k] ------------------ 102| 14.1k| if (is_strict) ------------------ | Branch (102:15): [True: 0, False: 14.1k] ------------------ 103| 0| return CRYPT_INVALID_PACKET; 104| 14.1k| else 105| 14.1k| continue; 106| 14.1k| } 107| | 108| 78.6k| t = (t<<6)|c; 109| | 110| 78.6k| if (++y == 4) { ------------------ | Branch (110:12): [True: 18.6k, False: 60.0k] ------------------ 111| 18.6k| if (z + 3 > *outlen) return CRYPT_BUFFER_OVERFLOW; ------------------ | Branch (111:15): [True: 0, False: 18.6k] ------------------ 112| 18.6k| out[z++] = (unsigned char)((t>>16)&255); 113| 18.6k| out[z++] = (unsigned char)((t>>8)&255); 114| 18.6k| out[z++] = (unsigned char)(t&255); 115| 18.6k| y = t = 0; 116| 18.6k| } 117| 78.6k| } 118| | 119| 1.51k| if (y != 0) { ------------------ | Branch (119:8): [True: 1.45k, False: 60] ------------------ 120| 1.45k| int allow_b64url = 0; 121| |#ifdef LTC_BASE64_URL 122| | if (map == map_base64url) { 123| | allow_b64url = 1; 124| | } 125| |#endif 126| 1.45k| if (y == 1) return CRYPT_INVALID_PACKET; ------------------ | Branch (126:11): [True: 28, False: 1.42k] ------------------ 127| 1.42k| if ((y + g) != 4 && is_strict && !allow_b64url) return CRYPT_INVALID_PACKET; ------------------ | Branch (127:11): [True: 1.41k, False: 9] | Branch (127:27): [True: 0, False: 1.41k] | Branch (127:40): [True: 0, False: 0] ------------------ 128| 1.42k| t = t << (6 * (4 - y)); 129| 1.42k| if (z + y - 1 > *outlen) return CRYPT_BUFFER_OVERFLOW; ------------------ | Branch (129:11): [True: 0, False: 1.42k] ------------------ 130| 1.42k| if (y >= 2) out[z++] = (unsigned char) ((t >> 16) & 255); ------------------ | Branch (130:11): [True: 1.42k, False: 0] ------------------ 131| 1.42k| if (y == 3) out[z++] = (unsigned char) ((t >> 8) & 255); ------------------ | Branch (131:11): [True: 1.38k, False: 45] ------------------ 132| 1.42k| } 133| 1.48k| *outlen = z; 134| 1.48k| return CRYPT_OK; 135| 1.51k|} register_cipher: 22| 1|{ 23| 1| int x; 24| | 25| 1| LTC_ARGCHK(cipher != NULL); ------------------ | | 32| 1|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 1] | | | Branch (32:87): [Folded, False: 1] | | ------------------ ------------------ 26| | 27| | /* is it already registered? */ 28| 1| LTC_MUTEX_LOCK(<c_cipher_mutex); 29| 6| for (x = 0; x < TAB_SIZE; x++) { ------------------ | | 14| 6|#define TAB_SIZE 5 ------------------ | Branch (29:16): [True: 5, False: 1] ------------------ 30| 5| if (cipher_descriptor[x].name != NULL && cipher_descriptor[x].ID == cipher->ID) { ------------------ | Branch (30:12): [True: 0, False: 5] | Branch (30:49): [True: 0, False: 0] ------------------ 31| 0| LTC_MUTEX_UNLOCK(<c_cipher_mutex); 32| 0| return x; 33| 0| } 34| 5| } 35| | 36| | /* find a blank spot */ 37| 1| for (x = 0; x < TAB_SIZE; x++) { ------------------ | | 14| 1|#define TAB_SIZE 5 ------------------ | Branch (37:16): [True: 1, False: 0] ------------------ 38| 1| if (cipher_descriptor[x].name == NULL) { ------------------ | Branch (38:12): [True: 1, False: 0] ------------------ 39| 1| XMEMCPY(&cipher_descriptor[x], cipher, sizeof(struct ltc_cipher_descriptor)); ------------------ | | 39| 1|#define XMEMCPY memcpy ------------------ 40| 1| LTC_MUTEX_UNLOCK(<c_cipher_mutex); 41| 1| return x; 42| 1| } 43| 1| } 44| | 45| | /* no spot */ 46| 0| LTC_MUTEX_UNLOCK(<c_cipher_mutex); 47| 0| return -1; 48| 1|} register_hash: 22| 3|{ 23| 3| int x; 24| | 25| 3| LTC_ARGCHK(hash != NULL); ------------------ | | 32| 3|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 3] | | | Branch (32:87): [Folded, False: 3] | | ------------------ ------------------ 26| | 27| | /* is it already registered? */ 28| 3| LTC_MUTEX_LOCK(<c_hash_mutex); 29| 18| for (x = 0; x < TAB_SIZE; x++) { ------------------ | | 14| 18|#define TAB_SIZE 5 ------------------ | Branch (29:16): [True: 15, False: 3] ------------------ 30| 15| if (XMEMCMP(&hash_descriptor[x], hash, sizeof(struct ltc_hash_descriptor)) == 0) { ------------------ | | 45| 15|#define XMEMCMP memcmp ------------------ | Branch (30:12): [True: 0, False: 15] ------------------ 31| 0| LTC_MUTEX_UNLOCK(<c_hash_mutex); 32| 0| return x; 33| 0| } 34| 15| } 35| | 36| | /* find a blank spot */ 37| 6| for (x = 0; x < TAB_SIZE; x++) { ------------------ | | 14| 6|#define TAB_SIZE 5 ------------------ | Branch (37:16): [True: 6, False: 0] ------------------ 38| 6| if (hash_descriptor[x].name == NULL) { ------------------ | Branch (38:12): [True: 3, False: 3] ------------------ 39| 3| XMEMCPY(&hash_descriptor[x], hash, sizeof(struct ltc_hash_descriptor)); ------------------ | | 39| 3|#define XMEMCPY memcpy ------------------ 40| 3| LTC_MUTEX_UNLOCK(<c_hash_mutex); 41| 3| return x; 42| 3| } 43| 6| } 44| | 45| | /* no spot */ 46| 0| LTC_MUTEX_UNLOCK(<c_hash_mutex); 47| 0| return -1; 48| 3|} register_prng: 22| 1|{ 23| 1| int x; 24| | 25| 1| LTC_ARGCHK(prng != NULL); ------------------ | | 32| 1|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 1] | | | Branch (32:87): [Folded, False: 1] | | ------------------ ------------------ 26| | 27| | /* is it already registered? */ 28| 1| LTC_MUTEX_LOCK(<c_prng_mutex); 29| 6| for (x = 0; x < TAB_SIZE; x++) { ------------------ | | 14| 6|#define TAB_SIZE 5 ------------------ | Branch (29:16): [True: 5, False: 1] ------------------ 30| 5| if (XMEMCMP(&prng_descriptor[x], prng, sizeof(struct ltc_prng_descriptor)) == 0) { ------------------ | | 45| 5|#define XMEMCMP memcmp ------------------ | Branch (30:12): [True: 0, False: 5] ------------------ 31| 0| LTC_MUTEX_UNLOCK(<c_prng_mutex); 32| 0| return x; 33| 0| } 34| 5| } 35| | 36| | /* find a blank spot */ 37| 1| for (x = 0; x < TAB_SIZE; x++) { ------------------ | | 14| 1|#define TAB_SIZE 5 ------------------ | Branch (37:16): [True: 1, False: 0] ------------------ 38| 1| if (prng_descriptor[x].name == NULL) { ------------------ | Branch (38:12): [True: 1, False: 0] ------------------ 39| 1| XMEMCPY(&prng_descriptor[x], prng, sizeof(struct ltc_prng_descriptor)); ------------------ | | 39| 1|#define XMEMCPY memcpy ------------------ 40| 1| LTC_MUTEX_UNLOCK(<c_prng_mutex); 41| 1| return x; 42| 1| } 43| 1| } 44| | 45| | /* no spot */ 46| 0| LTC_MUTEX_UNLOCK(<c_prng_mutex); 47| 0| return -1; 48| 1|} mp_rand_source: 10| 1|{ 11| | /* Dropbear, don't reset to platform if source==NULL */ 12| 1| s_mp_rand_source = source; 13| 1|} buf_new: 41| 7.77k|buffer* buf_new(unsigned int size) { 42| 7.77k| buffer* buf; 43| 7.77k| if (size > BUF_MAX_SIZE) { ------------------ | | 35| 7.77k|#define BUF_MAX_SIZE 1000000000 ------------------ | Branch (43:6): [True: 0, False: 7.77k] ------------------ 44| 0| dropbear_exit("buf->size too big"); 45| 0| } 46| | 47| 7.77k| buf = (buffer*)m_malloc(sizeof(buffer)+size); 48| 7.77k| buf->data = (unsigned char*)buf + sizeof(buffer); 49| 7.77k| buf->size = size; 50| 7.77k| return buf; 51| 7.77k|} buf_free: 54| 7.12k|void buf_free(buffer* buf) { 55| | m_free(buf); ------------------ | | 24| 7.12k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 7.12k] | | ------------------ ------------------ 56| 7.12k|} buf_setlen: 95| 1.54k|void buf_setlen(buffer* buf, unsigned int len) { 96| 1.54k| if (len > buf->size) { ------------------ | Branch (96:6): [True: 0, False: 1.54k] ------------------ 97| 0| dropbear_exit("Bad buf_setlen"); 98| 0| } 99| 1.54k| buf->len = len; 100| | buf->pos = MIN(buf->pos, buf->len); ------------------ | Branch (100:13): [True: 1.51k, False: 35] ------------------ 101| 1.54k|} buf_incrlen: 104| 5.96k|void buf_incrlen(buffer* buf, unsigned int incr) { 105| 5.96k| if (incr > BUF_MAX_INCR || buf->len + incr > buf->size) { ------------------ | | 34| 11.9k|#define BUF_MAX_INCR 1000000000 ------------------ | Branch (105:6): [True: 0, False: 5.96k] | Branch (105:29): [True: 0, False: 5.96k] ------------------ 106| 0| dropbear_exit("Bad buf_incrlen"); 107| 0| } 108| 5.96k| buf->len += incr; 109| 5.96k|} buf_setpos: 111| 7.41k|void buf_setpos(buffer* buf, unsigned int pos) { 112| | 113| 7.41k| if (pos > buf->len) { ------------------ | Branch (113:6): [True: 0, False: 7.41k] ------------------ 114| 0| dropbear_exit("Bad buf_setpos"); 115| 0| } 116| 7.41k| buf->pos = pos; 117| 7.41k|} buf_incrwritepos: 120| 1.73k|void buf_incrwritepos(buffer* buf, unsigned int incr) { 121| 1.73k| if (incr > BUF_MAX_INCR || buf->pos + incr > buf->size) { ------------------ | | 34| 3.47k|#define BUF_MAX_INCR 1000000000 ------------------ | Branch (121:6): [True: 0, False: 1.73k] | Branch (121:29): [True: 0, False: 1.73k] ------------------ 122| 0| dropbear_exit("Bad buf_incrwritepos"); 123| 0| } 124| 1.73k| buf->pos += incr; 125| 1.73k| if (buf->pos > buf->len) { ------------------ | Branch (125:6): [True: 1.73k, False: 0] ------------------ 126| 1.73k| buf->len = buf->pos; 127| 1.73k| } 128| 1.73k|} buf_incrpos: 131| 19.7k|void buf_incrpos(buffer* buf, unsigned int incr) { 132| 19.7k| if (incr > BUF_MAX_INCR ------------------ | | 34| 39.4k|#define BUF_MAX_INCR 1000000000 ------------------ | Branch (132:6): [True: 0, False: 19.7k] ------------------ 133| 19.7k| || (buf->pos + incr) > buf->len) { ------------------ | Branch (133:6): [True: 0, False: 19.7k] ------------------ 134| 0| dropbear_exit("Bad buf_incrpos"); 135| 0| } 136| 19.7k| buf->pos += incr; 137| 19.7k|} buf_decrpos: 140| 1.73k|void buf_decrpos(buffer* buf, unsigned int decr) { 141| 1.73k| if (decr > buf->pos) { ------------------ | Branch (141:6): [True: 0, False: 1.73k] ------------------ 142| 0| dropbear_exit("Bad buf_decrpos"); 143| 0| } 144| 1.73k| buf->pos -= decr; 145| 1.73k|} buf_getbyte: 148| 415k|unsigned char buf_getbyte(buffer* buf) { 149| | 150| | /* This check is really just ==, but the >= allows us to check for the 151| | * bad case of pos > len, which should _never_ happen. */ 152| 415k| if (buf->pos >= buf->len) { ------------------ | Branch (152:6): [True: 0, False: 415k] ------------------ 153| 0| dropbear_exit("Bad buf_getbyte"); 154| 0| } 155| 415k| return buf->data[buf->pos++]; 156| 415k|} buf_getptr: 180| 88.7k|unsigned char* buf_getptr(const buffer* buf, unsigned int len) { 181| | 182| 88.7k| if (len > BUF_MAX_INCR || buf->pos + len > buf->len) { ------------------ | | 34| 177k|#define BUF_MAX_INCR 1000000000 ------------------ | Branch (182:6): [True: 0, False: 88.7k] | Branch (182:28): [True: 114, False: 88.6k] ------------------ 183| 114| dropbear_exit("Bad buf_getptr"); 184| 114| } 185| 88.6k| return &buf->data[buf->pos]; 186| 88.7k|} buf_getwriteptr: 190| 7.77k|unsigned char* buf_getwriteptr(const buffer* buf, unsigned int len) { 191| | 192| 7.77k| if (len > BUF_MAX_INCR || buf->pos + len > buf->size) { ------------------ | | 34| 15.5k|#define BUF_MAX_INCR 1000000000 ------------------ | Branch (192:6): [True: 0, False: 7.77k] | Branch (192:28): [True: 0, False: 7.77k] ------------------ 193| 0| dropbear_exit("Bad buf_getwriteptr"); 194| 0| } 195| 7.77k| return &buf->data[buf->pos]; 196| 7.77k|} buf_getstring: 201| 2.22k|char* buf_getstring(buffer* buf, unsigned int *retlen) { 202| | 203| 2.22k| unsigned int len; 204| 2.22k| char* ret; 205| 2.22k| void* src = NULL; 206| 2.22k| len = buf_getint(buf); 207| 2.22k| if (len > MAX_STRING_LEN) { ------------------ | | 253| 2.22k|#define MAX_STRING_LEN (MAX(MAX_CMD_LEN, 2400)) /* Sun SSH needs 2400 for algos, ------------------ | Branch (207:6): [True: 37, False: 2.19k] | Branch (207:12): [True: 2.22k, Folded] ------------------ 208| 37| dropbear_exit("String too long"); 209| 37| } 210| | 211| 2.19k| if (retlen != NULL) { ------------------ | Branch (211:6): [True: 2.18k, False: 3] ------------------ 212| 2.18k| *retlen = len; 213| 2.18k| } 214| 2.19k| src = buf_getptr(buf, len); 215| 2.19k| ret = m_malloc(len+1); 216| 2.19k| memcpy(ret, src, len); 217| 2.19k| buf_incrpos(buf, len); 218| 2.19k| ret[len] = '\0'; 219| | 220| 2.19k| return ret; 221| 2.22k|} buf_getstringbuf: 246| 4.58k|buffer * buf_getstringbuf(buffer *buf) { 247| 4.58k| return buf_getstringbuf_int(buf, 0); 248| 4.58k|} buf_getint: 272| 8.14k|unsigned int buf_getint(buffer* buf) { 273| 8.14k| unsigned int ret; 274| | 275| 8.14k| LOAD32H(ret, buf_getptr(buf, 4)); ------------------ | | 66| 8.14k|#define LOAD32H(x, y) \ | | 67| 8.14k|do { XMEMCPY (&(x), (y), 4); \ | | ------------------ | | | | 39| 8.14k|#define XMEMCPY memcpy | | ------------------ | | 68| 8.14k| (x) = __builtin_bswap32 ((x)); } while(0) | | ------------------ | | | Branch (68:46): [Folded, False: 8.14k] | | ------------------ ------------------ 276| 8.14k| buf_incrpos(buf, 4); 277| 8.14k| return ret; 278| 8.14k|} buf_putbytes: 303| 1.73k|void buf_putbytes(buffer *buf, const unsigned char *bytes, unsigned int len) { 304| 1.73k| memcpy(buf_getwriteptr(buf, len), bytes, len); 305| 1.73k| buf_incrwritepos(buf, len); 306| 1.73k|} buffer.c:buf_getstringbuf_int: 224| 4.58k|static buffer * buf_getstringbuf_int(buffer *buf, int incllen) { 225| 4.58k| buffer *ret = NULL; 226| 4.58k| unsigned int len = buf_getint(buf); 227| 4.58k| int extra = 0; 228| 4.58k| if (len > MAX_STRING_LEN) { ------------------ | | 253| 4.58k|#define MAX_STRING_LEN (MAX(MAX_CMD_LEN, 2400)) /* Sun SSH needs 2400 for algos, ------------------ | Branch (228:6): [True: 42, False: 4.54k] | Branch (228:12): [True: 4.56k, Folded] ------------------ 229| 42| dropbear_exit("String too long"); 230| 42| } 231| 4.54k| if (incllen) { ------------------ | Branch (231:6): [True: 0, False: 4.54k] ------------------ 232| 0| extra = 4; 233| 0| } 234| 4.54k| ret = buf_new(len+extra); 235| 4.54k| if (incllen) { ------------------ | Branch (235:6): [True: 0, False: 4.54k] ------------------ 236| 0| buf_putint(ret, len); 237| 0| } 238| 4.54k| memcpy(buf_getwriteptr(ret, len), buf_getptr(buf, len), len); 239| 4.54k| buf_incrpos(buf, len); 240| 4.54k| buf_incrlen(ret, len); 241| 4.54k| buf_setpos(ret, 0); 242| 4.54k| return ret; 243| 4.58k|} split_address_port: 128| 1.64k|int split_address_port(const char* spec, char **first, char ** second) { 129| 1.64k| char *spec_copy = NULL, *addr = NULL, *colon = NULL; 130| 1.64k| int ret = DROPBEAR_FAILURE; ------------------ | | 112| 1.64k|#define DROPBEAR_FAILURE -1 ------------------ 131| | 132| 1.64k| *first = NULL; 133| 1.64k| *second = NULL; 134| 1.64k| spec_copy = m_strdup(spec); 135| 1.64k| addr = spec_copy; 136| | 137| 1.64k| if (*addr == '[') { ------------------ | Branch (137:6): [True: 322, False: 1.32k] ------------------ 138| 322| addr++; 139| 322| colon = strchr(addr, ']'); 140| 322| if (!colon) { ------------------ | Branch (140:7): [True: 1, False: 321] ------------------ 141| 1| dropbear_log(LOG_WARNING, "Bad address '%s'", spec); 142| 1| goto out; 143| 1| } 144| 321| *colon = '\0'; 145| 321| colon++; 146| 321| if (*colon == '\0') { ------------------ | Branch (146:7): [True: 1, False: 320] ------------------ 147| | /* No port part */ 148| 1| colon = NULL; 149| 320| } else if (*colon != ':') { ------------------ | Branch (149:14): [True: 13, False: 307] ------------------ 150| 13| dropbear_log(LOG_WARNING, "Bad address '%s'", spec); 151| 13| goto out; 152| 13| } 153| 1.32k| } else { 154| | /* search for ':', that separates address and port */ 155| 1.32k| colon = strrchr(addr, ':'); 156| 1.32k| } 157| | 158| | /* colon points to ':' now, or is NULL */ 159| 1.62k| if (colon) { ------------------ | Branch (159:6): [True: 1.59k, False: 34] ------------------ 160| | /* Split the address/port */ 161| 1.59k| *colon = '\0'; 162| 1.59k| colon++; 163| 1.59k| *second = m_strdup(colon); 164| 1.59k| } 165| 1.62k| if (strlen(addr)) { ------------------ | Branch (165:6): [True: 1.61k, False: 13] ------------------ 166| 1.61k| *first = m_strdup(addr); 167| 1.61k| } 168| 1.62k| ret = DROPBEAR_SUCCESS; ------------------ | | 111| 1.62k|#define DROPBEAR_SUCCESS 0 ------------------ 169| | 170| 1.64k|out: 171| | m_free(spec_copy); ------------------ | | 24| 1.64k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 1.64k] | | ------------------ ------------------ 172| 1.64k| return ret; 173| 1.62k|} crypto_init: 21| 1|void crypto_init() { 22| | 23| 1| const struct ltc_cipher_descriptor *regciphers[] = { 24| 1|#if DROPBEAR_AES 25| 1| &aes_desc, 26| 1|#endif 27| |#if DROPBEAR_3DES 28| | &des3_desc, 29| |#endif 30| 1| NULL 31| 1| }; 32| | 33| 1| const struct ltc_hash_descriptor *reghashes[] = { 34| |#if DROPBEAR_SHA1_HMAC 35| | &sha1_desc, 36| |#endif 37| 1|#if DROPBEAR_SHA256 38| 1| &sha256_desc, 39| 1|#endif 40| 1|#if DROPBEAR_SHA384 41| 1| &sha384_desc, 42| 1|#endif 43| 1|#if DROPBEAR_SHA512 44| 1| &sha512_desc, 45| 1|#endif 46| 1| NULL 47| 1| }; 48| 1| int i; 49| | 50| 2| for (i = 0; regciphers[i] != NULL; i++) { ------------------ | Branch (50:14): [True: 1, False: 1] ------------------ 51| 1| if (register_cipher(regciphers[i]) == -1) { ------------------ | Branch (51:7): [True: 0, False: 1] ------------------ 52| 0| dropbear_exit("Error registering crypto"); 53| 0| } 54| 1| } 55| | 56| 4| for (i = 0; reghashes[i] != NULL; i++) { ------------------ | Branch (56:14): [True: 3, False: 1] ------------------ 57| 3| if (register_hash(reghashes[i]) == -1) { ------------------ | Branch (57:7): [True: 0, False: 3] ------------------ 58| 0| dropbear_exit("Error registering crypto"); 59| 0| } 60| 3| } 61| | 62| 1|#if DROPBEAR_LTC_PRNG 63| 1| dropbear_ltc_prng = register_prng(&dropbear_prng_desc); 64| 1| if (dropbear_ltc_prng == -1) { ------------------ | Branch (64:6): [True: 0, False: 1] ------------------ 65| 0| dropbear_exit("Error registering crypto"); 66| 0| } 67| 1|#endif 68| | 69| 1| mp_rand_source(dropbear_rand_source); 70| | 71| 1|#if DROPBEAR_ECC 72| 1| ltc_mp = ltm_desc; 73| 1| dropbear_ecc_fill_dp(); 74| 1|#endif 75| 1|} m_strdup: 12| 4.85k|void * m_strdup(const char * str) { 13| 4.85k| char* ret; 14| 4.85k| unsigned int len; 15| 4.85k| len = strlen(str); 16| | 17| 4.85k| ret = m_malloc(len+1); 18| 4.85k| if (ret == NULL) { ------------------ | Branch (18:9): [True: 0, False: 4.85k] ------------------ 19| 0| dropbear_exit("m_strdup failed"); 20| 0| } 21| 4.85k| memcpy(ret, str, len+1); 22| 4.85k| return ret; 23| 4.85k|} m_malloc_set_epoch: 76| 2.33k|void m_malloc_set_epoch(unsigned int epoch) { 77| 2.33k| current_epoch = epoch; 78| 2.33k|} m_malloc_free_epoch: 80| 2.33k|void m_malloc_free_epoch(unsigned int epoch, int dofree) { 81| 2.33k| struct dbmalloc_header* header; 82| 2.33k| struct dbmalloc_header* nextheader = NULL; 83| 2.33k| struct dbmalloc_header* oldstaple = staple; 84| 2.33k| staple = NULL; 85| | /* free allocations from this epoch, create a new staple-anchored list from 86| | the remainder */ 87| 5.53k| for (header = oldstaple; header; header = nextheader) ------------------ | Branch (87:30): [True: 3.20k, False: 2.33k] ------------------ 88| 3.20k| { 89| 3.20k| nextheader = header->next; 90| 3.20k| if (header->epoch == epoch) { ------------------ | Branch (90:13): [True: 874, False: 2.33k] ------------------ 91| 874| if (dofree) { ------------------ | Branch (91:17): [True: 874, False: 0] ------------------ 92| 874| free(header); 93| 874| } 94| 2.33k| } else { 95| 2.33k| header->prev = NULL; 96| | header->next = NULL; 97| 2.33k| put_alloc(header); 98| 2.33k| } 99| 3.20k| } 100| 2.33k|} m_malloc: 131| 21.3k|void * m_malloc(size_t size) { 132| 21.3k| char* mem = NULL; 133| 21.3k| struct dbmalloc_header* header = NULL; 134| | 135| 21.3k| if (size == 0 || size > 1e9) { ------------------ | Branch (135:9): [True: 0, False: 21.3k] | Branch (135:22): [True: 0, False: 21.3k] ------------------ 136| 0| dropbear_exit("m_malloc failed"); 137| 0| } 138| | 139| 21.3k| size = size + sizeof(struct dbmalloc_header); 140| | 141| 21.3k| mem = calloc(1, size); 142| 21.3k| if (mem == NULL) { ------------------ | Branch (142:9): [True: 0, False: 21.3k] ------------------ 143| 0| dropbear_exit("m_malloc failed"); 144| 0| } 145| 21.3k| header = (struct dbmalloc_header*)mem; 146| 21.3k| put_alloc(header); 147| 21.3k| header->epoch = current_epoch; 148| 21.3k| return &mem[sizeof(struct dbmalloc_header)]; 149| 21.3k|} m_free_direct: 172| 23.2k|void m_free_direct(void* ptr) { 173| 23.2k| struct dbmalloc_header* header = NULL; 174| 23.2k| if (!ptr) { ------------------ | Branch (174:9): [True: 2.68k, False: 20.5k] ------------------ 175| 2.68k| return; 176| 2.68k| } 177| 20.5k| header = get_header(ptr); 178| 20.5k| remove_alloc(header); 179| 20.5k| free(header); 180| 20.5k|} dbmalloc.c:put_alloc: 102| 23.7k|static void put_alloc(struct dbmalloc_header *header) { 103| 23.7k| assert(header->next == NULL); ------------------ | Branch (103:5): [True: 0, False: 23.7k] | Branch (103:5): [True: 23.7k, False: 0] ------------------ 104| 23.7k| assert(header->prev == NULL); ------------------ | Branch (104:5): [True: 0, False: 23.7k] | Branch (104:5): [True: 23.7k, False: 0] ------------------ 105| 23.7k| if (staple) { ------------------ | Branch (105:9): [True: 21.3k, False: 2.33k] ------------------ 106| 21.3k| staple->prev = header; 107| 21.3k| } 108| 23.7k| header->next = staple; 109| 23.7k| staple = header; 110| 23.7k|} dbmalloc.c:get_header: 126| 20.5k|static struct dbmalloc_header* get_header(void* ptr) { 127| 20.5k| char* bptr = ptr; 128| 20.5k| return (struct dbmalloc_header*)&bptr[-sizeof(struct dbmalloc_header)]; 129| 20.5k|} dbmalloc.c:remove_alloc: 112| 20.5k|static void remove_alloc(struct dbmalloc_header *header) { 113| 20.5k| if (header->prev) { ------------------ | Branch (113:9): [True: 13.2k, False: 7.22k] ------------------ 114| 13.2k| header->prev->next = header->next; 115| 13.2k| } 116| 20.5k| if (header->next) { ------------------ | Branch (116:9): [True: 20.5k, False: 0] ------------------ 117| 20.5k| header->next->prev = header->prev; 118| 20.5k| } 119| 20.5k| if (staple == header) { ------------------ | Branch (119:9): [True: 7.22k, False: 13.2k] ------------------ 120| 7.22k| staple = header->next; 121| 7.22k| } 122| 20.5k| header->prev = NULL; 123| | header->next = NULL; 124| 20.5k|} fuzz_seed: 153| 2.33k|void fuzz_seed(const unsigned char* dat, unsigned int len) { 154| 2.33k| hash_state hs; 155| 2.33k| sha256_init(&hs); 156| 2.33k| sha256_process(&hs, "fuzzfuzzfuzz", strlen("fuzzfuzzfuzz")); 157| 2.33k| sha256_process(&hs, dat, len); 158| 2.33k| sha256_done(&hs, hashpool); 159| 2.33k| counter = 0; 160| 2.33k| donerandinit = 1; 161| 2.33k|} dropbear_exit: 105| 395|void dropbear_exit(const char* format, ...) { 106| | 107| 395| va_list param; 108| | 109| 395| va_start(param, format); 110| 395| _dropbear_exit(EXIT_FAILURE, format, param); 111| 395| va_end(param); 112| 0|} dropbear_log: 148| 2.84k|void dropbear_log(int priority, const char* format, ...) { 149| | 150| 2.84k| va_list param; 151| | 152| 2.84k| va_start(param, format); 153| 2.84k| _dropbear_log(priority, format, param); 154| | va_end(param); 155| 2.84k|} disallow_core: 610| 1|void disallow_core() { 611| 1| struct rlimit lim = {0}; 612| 1| if (getrlimit(RLIMIT_CORE, &lim) < 0) { ------------------ | Branch (612:6): [True: 0, False: 1] ------------------ 613| 0| TRACE(("getrlimit(RLIMIT_CORE) failed")); 614| 0| } 615| 1| lim.rlim_cur = 0; 616| 1| if (setrlimit(RLIMIT_CORE, &lim) < 0) { ------------------ | Branch (616:6): [True: 0, False: 1] ------------------ 617| 0| TRACE(("setrlimit(RLIMIT_CORE) failed")); 618| 0| } 619| 1|} m_str_to_uint: 622| 1.22k|int m_str_to_uint(const char* str, unsigned int *val) { 623| 1.22k| unsigned long l; 624| 1.22k| char *endp; 625| | 626| 1.22k| l = strtoul(str, &endp, 10); 627| | 628| 1.22k| if (endp == str || *endp != '\0') { ------------------ | Branch (628:6): [True: 12, False: 1.21k] | Branch (628:21): [True: 7, False: 1.20k] ------------------ 629| | /* parse error */ 630| 19| return DROPBEAR_FAILURE; ------------------ | | 112| 19|#define DROPBEAR_FAILURE -1 ------------------ 631| 19| } 632| | 633| | /* The c99 spec doesn't actually seem to define EINVAL, but most platforms 634| | * I've looked at mention it in their manpage */ 635| 1.20k| if ((l == 0 && errno == EINVAL) ------------------ | Branch (635:7): [True: 479, False: 729] | Branch (635:17): [True: 0, False: 479] ------------------ 636| 1.20k| || (l == ULONG_MAX && errno == ERANGE) ------------------ | Branch (636:7): [True: 3, False: 1.20k] | Branch (636:25): [True: 2, False: 1] ------------------ 637| 1.20k| || (l > UINT_MAX)) { ------------------ | Branch (637:6): [True: 77, False: 1.12k] ------------------ 638| 79| return DROPBEAR_FAILURE; ------------------ | | 112| 79|#define DROPBEAR_FAILURE -1 ------------------ 639| 1.12k| } else { 640| 1.12k| *val = l; 641| 1.12k| return DROPBEAR_SUCCESS; ------------------ | | 111| 1.12k|#define DROPBEAR_SUCCESS 0 ------------------ 642| 1.12k| } 643| 1.20k|} dbutil.c:generic_dropbear_exit: 115| 395| va_list param) { 116| | 117| 395| char fmtbuf[300]; 118| | 119| 395| snprintf(fmtbuf, sizeof(fmtbuf), "Exited: %s", format); 120| | 121| 395| _dropbear_log(LOG_INFO, fmtbuf, param); 122| | 123| 395|#if DROPBEAR_FUZZ 124| 395| if (fuzz.do_jmp) { ------------------ | Branch (124:9): [True: 395, False: 0] ------------------ 125| 395| longjmp(fuzz.jmp, 1); 126| 395| } 127| 0|#endif 128| | 129| 0| exit(exitcode); 130| 395|} dropbear_ecc_fill_dp: 47| 1|void dropbear_ecc_fill_dp() { 48| 1| struct dropbear_ecc_curve **curve; 49| | /* libtomcrypt guarantees they're ordered by size */ 50| 1| const ltc_ecc_set_type *dp = ltc_ecc_sets; 51| 4| for (curve = dropbear_ecc_curves; *curve; curve++) { ------------------ | Branch (51:36): [True: 3, False: 1] ------------------ 52| 5| for (;dp->size > 0; dp++) { ------------------ | Branch (52:9): [True: 5, False: 0] ------------------ 53| 5| if (dp->size == (*curve)->ltc_size) { ------------------ | Branch (53:8): [True: 3, False: 2] ------------------ 54| 3| (*curve)->dp = dp; 55| 3| break; 56| 3| } 57| 5| } 58| 3| if (!(*curve)->dp) { ------------------ | Branch (58:7): [True: 0, False: 3] ------------------ 59| 0| dropbear_exit("Missing ECC params %s", (*curve)->name); 60| 0| } 61| 3| } 62| 1|} list_append: 5| 1.64k|void list_append(m_list *list, void *item) { 6| 1.64k| m_list_elem *elem; 7| | 8| 1.64k| elem = m_malloc(sizeof(*elem)); 9| 1.64k| elem->item = item; 10| 1.64k| elem->list = list; 11| 1.64k| elem->next = NULL; 12| 1.64k| if (!list->first) { ------------------ | Branch (12:6): [True: 249, False: 1.39k] ------------------ 13| 249| list->first = elem; 14| 249| elem->prev = NULL; 15| 1.39k| } else { 16| 1.39k| elem->prev = list->last; 17| 1.39k| list->last->next = elem; 18| 1.39k| } 19| 1.64k| list->last = elem; 20| 1.64k|} list_new: 22| 250|m_list * list_new() { 23| 250| m_list *ret = m_malloc(sizeof(m_list)); 24| | ret->first = ret->last = NULL; 25| 250| return ret; 26| 250|} list_remove: 28| 1.64k|void * list_remove(m_list_elem *elem) { 29| 1.64k| void *item = elem->item; 30| 1.64k| m_list *list = elem->list; 31| 1.64k| if (list->first == elem) ------------------ | Branch (31:6): [True: 1.64k, False: 0] ------------------ 32| 1.64k| { 33| 1.64k| list->first = elem->next; 34| 1.64k| } 35| 1.64k| if (list->last == elem) ------------------ | Branch (35:6): [True: 249, False: 1.39k] ------------------ 36| 249| { 37| 249| list->last = elem->prev; 38| 249| } 39| 1.64k| if (elem->prev) ------------------ | Branch (39:6): [True: 0, False: 1.64k] ------------------ 40| 0| { 41| 0| elem->prev->next = elem->next; 42| 0| } 43| 1.64k| if (elem->next) ------------------ | Branch (43:6): [True: 1.39k, False: 249] ------------------ 44| 1.39k| { 45| 1.39k| elem->next->prev = elem->prev; 46| 1.39k| } 47| | m_free(elem); ------------------ | | 24| 1.64k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 1.64k] | | ------------------ ------------------ 48| 1.64k| return item; 49| 1.64k|} signkey_type_from_name: 86| 2.11k|enum signkey_type signkey_type_from_name(const char* name, unsigned int namelen) { 87| 2.11k| int i; 88| 6.13k| for (i = 0; i < DROPBEAR_SIGNKEY_NUM_NAMED; i++) { ------------------ | Branch (88:14): [True: 5.93k, False: 202] ------------------ 89| 5.93k| const char *fixed_name = signkey_names[i]; 90| 5.93k| if (namelen == strlen(fixed_name) ------------------ | Branch (90:7): [True: 4.01k, False: 1.92k] ------------------ 91| 4.01k| && memcmp(fixed_name, name, namelen) == 0) { ------------------ | Branch (91:7): [True: 1.91k, False: 2.10k] ------------------ 92| | 93| 1.91k|#if DROPBEAR_ECDSA 94| | /* Some of the ECDSA key sizes are defined even if they're not compiled in */ 95| 1.91k| if (0 ------------------ | Branch (95:8): [Folded, False: 1.91k] ------------------ 96| |#if !DROPBEAR_ECC_256 97| | || i == DROPBEAR_SIGNKEY_ECDSA_NISTP256 98| |#endif 99| |#if !DROPBEAR_ECC_384 100| | || i == DROPBEAR_SIGNKEY_ECDSA_NISTP384 101| |#endif 102| |#if !DROPBEAR_ECC_521 103| | || i == DROPBEAR_SIGNKEY_ECDSA_NISTP521 104| |#endif 105| 1.91k| ) { 106| 0| TRACE(("attempt to use ecdsa type %d not compiled in", i)) 107| 0| return DROPBEAR_SIGNKEY_NONE; 108| 0| } 109| 1.91k|#endif 110| | 111| 1.91k| return (enum signkey_type)i; 112| 1.91k| } 113| 5.93k| } 114| | 115| 202| TRACE(("signkey_type_from_name unexpected key type.")) 116| | 117| 202| return DROPBEAR_SIGNKEY_NONE; 118| 2.11k|} signature_type_from_name: 145| 2.15k|enum signature_type signature_type_from_name(const char* name, unsigned int namelen) { 146| 2.15k|#if DROPBEAR_RSA 147| 2.15k|#if DROPBEAR_RSA_SHA256 148| 2.15k| if (namelen == strlen(SSH_SIGNATURE_RSA_SHA256) ------------------ | | 121| 2.15k|#define SSH_SIGNATURE_RSA_SHA256 "rsa-sha2-256" ------------------ | Branch (148:6): [True: 43, False: 2.11k] ------------------ 149| 43| && memcmp(name, SSH_SIGNATURE_RSA_SHA256, namelen) == 0) { ------------------ | | 121| 43|#define SSH_SIGNATURE_RSA_SHA256 "rsa-sha2-256" ------------------ | Branch (149:6): [True: 18, False: 25] ------------------ 150| 18| return DROPBEAR_SIGNATURE_RSA_SHA256; 151| 18| } 152| 2.14k|#endif 153| 2.14k|#if DROPBEAR_RSA_SHA1 154| 2.14k| if (namelen == strlen(SSH_SIGNKEY_RSA) ------------------ | | 116| 2.14k|#define SSH_SIGNKEY_RSA "ssh-rsa" ------------------ | Branch (154:6): [True: 1.85k, False: 285] ------------------ 155| 1.85k| && memcmp(name, SSH_SIGNKEY_RSA, namelen) == 0) { ------------------ | | 116| 1.85k|#define SSH_SIGNKEY_RSA "ssh-rsa" ------------------ | Branch (155:6): [True: 28, False: 1.82k] ------------------ 156| 28| return DROPBEAR_SIGNATURE_RSA_SHA1; 157| 28| } 158| 2.11k|#endif 159| 2.11k|#endif /* DROPBEAR_RSA */ 160| 2.11k| return (enum signature_type)signkey_type_from_name(name, namelen); 161| 2.14k|} cmp_base64_key: 728| 1.54k| const buffer * line, char ** fingerprint) { 729| | 730| 1.54k| buffer * decodekey = NULL; 731| 1.54k| int ret = DROPBEAR_FAILURE; ------------------ | | 112| 1.54k|#define DROPBEAR_FAILURE -1 ------------------ 732| 1.54k| unsigned int len, filealgolen; 733| 1.54k| unsigned long decodekeylen; 734| 1.54k| unsigned char* filealgo = NULL; 735| | 736| | /* now we have the actual data */ 737| 1.54k| len = line->len - line->pos; 738| 1.54k| if (len == 0) { ------------------ | Branch (738:6): [True: 35, False: 1.51k] ------------------ 739| | /* base64_decode doesn't like NULL argument */ 740| 35| return DROPBEAR_FAILURE; ------------------ | | 112| 35|#define DROPBEAR_FAILURE -1 ------------------ 741| 35| } 742| 1.51k| decodekeylen = len * 2; /* big to be safe */ 743| 1.51k| decodekey = buf_new(decodekeylen); 744| | 745| 1.51k| if (base64_decode(buf_getptr(line, len), len, ------------------ | Branch (745:6): [True: 28, False: 1.48k] ------------------ 746| 1.51k| buf_getwriteptr(decodekey, decodekey->size), 747| 1.51k| &decodekeylen) != CRYPT_OK) { 748| 28| TRACE(("checkpubkey: base64 decode failed")) 749| 28| goto out; 750| 28| } 751| 1.48k| TRACE(("checkpubkey: base64_decode success")) 752| 1.48k| buf_incrlen(decodekey, decodekeylen); 753| | 754| 1.48k| if (fingerprint) { ------------------ | Branch (754:6): [True: 0, False: 1.48k] ------------------ 755| 0| *fingerprint = sign_key_fingerprint(buf_getptr(decodekey, decodekeylen), 756| 0| decodekeylen); 757| 0| } 758| | 759| | /* compare the keys */ 760| 1.48k| if ( ( decodekeylen != keybloblen ) ------------------ | Branch (760:7): [True: 144, False: 1.34k] ------------------ 761| 1.34k| || memcmp( buf_getptr(decodekey, decodekey->len), ------------------ | Branch (761:7): [True: 12, False: 1.33k] ------------------ 762| 1.34k| keyblob, decodekey->len) != 0) { 763| 156| TRACE(("checkpubkey: compare failed")) 764| 156| goto out; 765| 156| } 766| | 767| | /* ... and also check that the algo specified and the algo in the key 768| | * itself match */ 769| 1.33k| filealgolen = buf_getint(decodekey); 770| 1.33k| filealgo = buf_getptr(decodekey, filealgolen); 771| 1.33k| if (filealgolen != algolen || memcmp(filealgo, algoname, algolen) != 0) { ------------------ | Branch (771:6): [True: 0, False: 1.33k] | Branch (771:32): [True: 0, False: 1.33k] ------------------ 772| 0| TRACE(("checkpubkey: algo match failed")) 773| 0| goto out; 774| 0| } 775| | 776| | /* All checks passed */ 777| 1.33k| ret = DROPBEAR_SUCCESS; ------------------ | | 111| 1.33k|#define DROPBEAR_SUCCESS 0 ------------------ 778| | 779| 1.51k|out: 780| 1.51k| buf_free(decodekey); 781| | decodekey = NULL; 782| 1.51k| return ret; 783| 1.33k|} fuzz_checkpubkey_line: 643| 1.95k| const unsigned char* keyblob, unsigned int keybloblen) { 644| | struct PubKeyOptions *options = NULL; 645| 1.95k| checkpubkey_line(line, line_num, filename, algo, algolen, keyblob, keybloblen, &options); 646| 1.95k| svr_pubkey_options_cleanup(options); 647| 1.95k|} svr-authpubkey.c:checkpubkey_line: 309| 1.95k| struct PubKeyOptions ** ret_options) { 310| 1.95k| buffer *options_buf = NULL; 311| 1.95k| char *info_str = NULL; 312| 1.95k| unsigned int pos, len, infopos, infolen; 313| 1.95k| int ret = DROPBEAR_FAILURE; ------------------ | | 112| 1.95k|#define DROPBEAR_FAILURE -1 ------------------ 314| | 315| 1.95k| if (ret_options) { ------------------ | Branch (315:6): [True: 1.95k, False: 0] ------------------ 316| 1.95k| *ret_options = NULL; 317| 1.95k| } 318| | 319| 1.95k| if (line->len < MIN_AUTHKEYS_LINE || line->len > MAX_AUTHKEYS_LINE) { ------------------ | | 71| 3.91k|#define MIN_AUTHKEYS_LINE 10 /* "ssh-rsa AB" - short but doesn't matter */ ------------------ if (line->len < MIN_AUTHKEYS_LINE || line->len > MAX_AUTHKEYS_LINE) { ------------------ | | 72| 1.94k|#define MAX_AUTHKEYS_LINE 4200 /* max length of a line in authkeys */ ------------------ | Branch (319:6): [True: 13, False: 1.94k] | Branch (319:39): [True: 2, False: 1.94k] ------------------ 320| 15| TRACE(("checkpubkey_line: bad line length %d", line->len)) 321| 15| goto out; 322| 15| } 323| | 324| 1.94k| if (memchr(line->data, 0x0, line->len) != NULL) { ------------------ | Branch (324:6): [True: 6, False: 1.93k] ------------------ 325| 6| TRACE(("checkpubkey_line: bad line has null char")) 326| 6| goto out; 327| 6| } 328| | 329| | /* compare the algorithm. +3 so we have enough bytes to read a space and some base64 characters too. */ 330| 1.93k| if (line->pos + algolen+3 > line->len) { ------------------ | Branch (330:6): [True: 5, False: 1.93k] ------------------ 331| 5| goto out; 332| 5| } 333| | /* check the key type */ 334| 1.93k| if (strncmp((const char *) buf_getptr(line, algolen), algo, algolen) != 0) { ------------------ | Branch (334:6): [True: 1.76k, False: 168] ------------------ 335| 1.76k| int is_comment = 0; 336| 1.76k| unsigned char *options_start = NULL; 337| 1.76k| int options_len = 0; 338| 1.76k| int escape, quoted; 339| | 340| | /* skip over any comments or leading whitespace */ 341| 25.1k| while (line->pos < line->len) { ------------------ | Branch (341:10): [True: 25.1k, False: 21] ------------------ 342| 25.1k| const char c = buf_getbyte(line); 343| 25.1k| if (c == ' ' || c == '\t') { ------------------ | Branch (343:8): [True: 3.54k, False: 21.5k] | Branch (343:20): [True: 19.8k, False: 1.74k] ------------------ 344| 23.3k| continue; 345| 23.3k| } else if (c == '#') { ------------------ | Branch (345:15): [True: 2, False: 1.73k] ------------------ 346| 2| is_comment = 1; 347| 2| break; 348| 2| } 349| 1.73k| buf_decrpos(line, 1); 350| 1.73k| break; 351| 25.1k| } 352| 1.76k| if (is_comment) { ------------------ | Branch (352:7): [True: 2, False: 1.76k] ------------------ 353| | /* next line */ 354| 2| goto out; 355| 2| } 356| | 357| | /* remember start of options */ 358| 1.76k| options_start = buf_getptr(line, 1); 359| 1.76k| quoted = 0; 360| 1.76k| escape = 0; 361| 1.76k| options_len = 0; 362| | 363| | /* figure out where the options are */ 364| 238k| while (line->pos < line->len) { ------------------ | Branch (364:10): [True: 238k, False: 174] ------------------ 365| 238k| const char c = buf_getbyte(line); 366| 238k| if (!quoted && (c == ' ' || c == '\t')) { ------------------ | Branch (366:8): [True: 141k, False: 97.1k] | Branch (366:20): [True: 83, False: 141k] | Branch (366:32): [True: 1.50k, False: 139k] ------------------ 367| 1.58k| break; 368| 1.58k| } 369| 236k| escape = (!escape && c == '\\'); ------------------ | Branch (369:14): [True: 233k, False: 3.16k] | Branch (369:25): [True: 3.17k, False: 230k] ------------------ 370| 236k| if (!escape && c == '"') { ------------------ | Branch (370:8): [True: 233k, False: 3.17k] | Branch (370:19): [True: 8.20k, False: 225k] ------------------ 371| 8.20k| quoted = !quoted; 372| 8.20k| } 373| 236k| options_len++; 374| 236k| } 375| 1.76k| options_buf = buf_new(options_len); 376| 1.76k| buf_putbytes(options_buf, options_start, options_len); 377| | 378| | /* compare the algorithm. +3 so we have enough bytes to read a space and some base64 characters too. */ 379| 1.76k| if (line->pos + algolen+3 > line->len) { ------------------ | Branch (379:7): [True: 213, False: 1.54k] ------------------ 380| 213| goto out; 381| 213| } 382| 1.54k| if (strncmp((const char *) buf_getptr(line, algolen), algo, algolen) != 0) { ------------------ | Branch (382:7): [True: 131, False: 1.41k] ------------------ 383| 131| goto out; 384| 131| } 385| 1.54k| } 386| 1.58k| buf_incrpos(line, algolen); 387| | 388| | /* check for space (' ') character */ 389| 1.58k| if (buf_getbyte(line) != ' ') { ------------------ | Branch (389:6): [True: 14, False: 1.57k] ------------------ 390| 14| TRACE(("checkpubkey_line: space character expected, isn't there")) 391| 14| goto out; 392| 14| } 393| | 394| | /* find the length of base64 data */ 395| 1.57k| pos = line->pos; 396| 100k| for (len = 0; line->pos < line->len; len++) { ------------------ | Branch (396:16): [True: 98.7k, False: 1.46k] ------------------ 397| 98.7k| if (buf_getbyte(line) == ' ') { ------------------ | Branch (397:7): [True: 103, False: 98.6k] ------------------ 398| 103| break; 399| 103| } 400| 98.7k| } 401| | 402| | /* find out the length of the public key info, stop at the first space */ 403| 1.57k| infopos = line->pos; 404| 6.64k| for (infolen = 0; line->pos < line->len; infolen++) { ------------------ | Branch (404:20): [True: 5.11k, False: 1.53k] ------------------ 405| 5.11k| const char c = buf_getbyte(line); 406| 5.11k| if (c == ' ') { ------------------ | Branch (406:7): [True: 8, False: 5.10k] ------------------ 407| 8| break; 408| 8| } 409| | /* We have an allowlist - authorized_keys lines can't be fully trusted, 410| | some shell scripts may do unsafe things with env var values */ 411| 5.10k| if (!(isalnum(c) || strchr(".,_-+@", c))) { ------------------ | Branch (411:9): [True: 3.95k, False: 1.14k] | Branch (411:23): [True: 1.11k, False: 31] ------------------ 412| 31| TRACE(("Not setting SSH_PUBKEYINFO, special characters")) 413| 31| infolen = 0; 414| 31| break; 415| 31| } 416| 5.10k| } 417| 1.57k| if (infolen > 0) { ------------------ | Branch (417:6): [True: 55, False: 1.51k] ------------------ 418| 55| info_str = m_malloc(infolen + 1); 419| 55| buf_setpos(line, infopos); 420| 55| strncpy(info_str, buf_getptr(line, infolen), infolen); 421| 55| } 422| | 423| | /* truncate to base64 data length */ 424| 1.57k| buf_setpos(line, pos); 425| 1.57k| buf_setlen(line, line->pos + len); 426| | 427| 1.57k| TRACE(("checkpubkey_line: line pos = %d len = %d", line->pos, line->len)) 428| | 429| 1.57k| ret = cmp_base64_key(keyblob, keybloblen, (const unsigned char *) algo, algolen, line, NULL); 430| | 431| | /* free pubkey_info if it is filled */ 432| 1.57k| if (ret == DROPBEAR_SUCCESS) { ------------------ | | 111| 1.57k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (432:6): [True: 1.33k, False: 240] ------------------ 433| 1.33k|#if DROPBEAR_SVR_PUBKEY_OPTIONS_BUILT 434| 1.33k| if (ret_options) { ------------------ | Branch (434:7): [True: 1.33k, False: 0] ------------------ 435| 1.33k| *ret_options = svr_parse_pubkey_options(options_buf, line_num, filename); 436| 1.33k| if (*ret_options == NULL) { ------------------ | Branch (436:8): [True: 1.17k, False: 156] ------------------ 437| 1.17k| ret = DROPBEAR_FAILURE; ------------------ | | 112| 1.17k|#define DROPBEAR_FAILURE -1 ------------------ 438| 1.17k| goto out; 439| 1.17k| } 440| | /* take the (optional) public key information */ 441| 156| (*ret_options)->info_env = info_str; 442| 156| info_str = NULL; 443| 156| } 444| 1.33k|#endif 445| 1.33k| } 446| | 447| 1.93k|out: 448| 1.93k| if (options_buf) { ------------------ | Branch (448:6): [True: 1.73k, False: 196] ------------------ 449| 1.73k| buf_free(options_buf); 450| 1.73k| } 451| 1.93k| if (info_str) { ------------------ | Branch (451:6): [True: 50, False: 1.88k] ------------------ 452| | m_free(info_str); ------------------ | | 24| 50|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 50] | | ------------------ ------------------ 453| 50| } 454| 1.93k| return ret; 455| 1.57k|} svr_pubkey_options_cleanup: 165| 3.10k|void svr_pubkey_options_cleanup(struct PubKeyOptions *pubkey_options) { 166| 3.10k| if (pubkey_options) { ------------------ | Branch (166:6): [True: 1.33k, False: 1.77k] ------------------ 167| 1.33k| m_free(pubkey_options->forced_command); ------------------ | | 24| 1.33k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 1.33k] | | ------------------ ------------------ 168| 1.33k| if (pubkey_options->permit_open_destinations) { ------------------ | Branch (168:7): [True: 250, False: 1.08k] ------------------ 169| 250| m_list_elem *iter = pubkey_options->permit_open_destinations->first; 170| 1.89k| while (iter) { ------------------ | Branch (170:11): [True: 1.64k, False: 250] ------------------ 171| 1.64k| struct PermitTCPFwdEntry *entry = (struct PermitTCPFwdEntry*)list_remove(iter); 172| 1.64k| m_free(entry->host); ------------------ | | 24| 1.64k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 1.64k] | | ------------------ ------------------ 173| 1.64k| m_free(entry); ------------------ | | 24| 1.64k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 1.64k] | | ------------------ ------------------ 174| 1.64k| iter = pubkey_options->permit_open_destinations->first; 175| 1.64k| } 176| 250| m_free(pubkey_options->permit_open_destinations); ------------------ | | 24| 250|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 250] | | ------------------ ------------------ 177| 250| } 178| 1.33k| if (pubkey_options->permit_listens) { ------------------ | Branch (178:7): [True: 0, False: 1.33k] ------------------ 179| 0| m_list_elem *iter = pubkey_options->permit_listens->first; 180| 0| while (iter) { ------------------ | Branch (180:11): [True: 0, False: 0] ------------------ 181| 0| struct PermitTCPFwdEntry *entry = (struct PermitTCPFwdEntry*)list_remove(iter); 182| 0| m_free(entry->host); ------------------ | | 24| 0|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 0] | | ------------------ ------------------ 183| 0| m_free(entry); ------------------ | | 24| 0|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 0] | | ------------------ ------------------ 184| 0| iter = pubkey_options->permit_listens->first; 185| 0| } 186| 0| m_free(pubkey_options->permit_listens); ------------------ | | 24| 0|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 0] | | ------------------ ------------------ 187| 0| } 188| 1.33k| m_free(pubkey_options->info_env); ------------------ | | 24| 1.33k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 1.33k] | | ------------------ ------------------ 189| | m_free(pubkey_options); ------------------ | | 24| 1.33k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 1.33k] | | ------------------ ------------------ 190| 1.33k| } 191| 3.10k|} svr_parse_pubkey_options: 211| 1.33k|svr_parse_pubkey_options(buffer *options_buf, int line_num, const char* filename) { 212| 1.33k| struct PubKeyOptions *pubkey_options = NULL; 213| | 214| 1.33k| TRACE(("enter addpubkeyoptions")) 215| | 216| 1.33k| pubkey_options = (struct PubKeyOptions*)m_malloc(sizeof( struct PubKeyOptions )); 217| | 218| 1.33k| if (!options_buf) { ------------------ | Branch (218:6): [True: 3, False: 1.32k] ------------------ 219| 3| TRACE(("leave addpubkeyoptions, null options")) 220| 3| return pubkey_options; 221| 3| } 222| | 223| 1.32k| buf_setpos(options_buf, 0); 224| 8.47k| while (options_buf->pos < options_buf->len) { ------------------ | Branch (224:9): [True: 8.32k, False: 153] ------------------ 225| 8.32k| if (match_option(options_buf, "no-port-forwarding") == DROPBEAR_SUCCESS) { ------------------ | | 111| 8.32k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (225:7): [True: 243, False: 8.08k] ------------------ 226| 243| dropbear_log(LOG_WARNING, "Port forwarding disabled."); 227| 243| pubkey_options->no_port_forwarding_flag = 1; 228| 243| goto next_option; 229| 243| } 230| 8.08k| if (match_option(options_buf, "no-agent-forwarding") == DROPBEAR_SUCCESS) { ------------------ | | 111| 8.08k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (230:7): [True: 241, False: 7.84k] ------------------ 231| 241|#if DROPBEAR_SVR_AGENTFWD 232| 241| dropbear_log(LOG_WARNING, "Agent forwarding disabled."); 233| 241| pubkey_options->no_agent_forwarding_flag = 1; 234| 241|#endif 235| 241| goto next_option; 236| 241| } 237| 7.84k| if (match_option(options_buf, "no-X11-forwarding") == DROPBEAR_SUCCESS) { ------------------ | | 111| 7.84k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (237:7): [True: 221, False: 7.61k] ------------------ 238| |#if DROPBEAR_X11FWD 239| | dropbear_log(LOG_WARNING, "X11 forwarding disabled."); 240| | pubkey_options->no_x11_forwarding_flag = 1; 241| |#endif 242| 221| goto next_option; 243| 221| } 244| 7.61k| if (match_option(options_buf, "no-pty") == DROPBEAR_SUCCESS) { ------------------ | | 111| 7.61k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (244:7): [True: 431, False: 7.18k] ------------------ 245| 431| dropbear_log(LOG_WARNING, "Pty allocation disabled."); 246| 431| pubkey_options->no_pty_flag = 1; 247| 431| goto next_option; 248| 431| } 249| 7.18k| if (match_option(options_buf, "restrict") == DROPBEAR_SUCCESS) { ------------------ | | 111| 7.18k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (249:7): [True: 279, False: 6.90k] ------------------ 250| 279| dropbear_log(LOG_WARNING, "Restrict option set"); 251| 279| pubkey_options->no_port_forwarding_flag = 1; 252| 279|#if DROPBEAR_SVR_AGENTFWD 253| 279| pubkey_options->no_agent_forwarding_flag = 1; 254| 279|#endif 255| |#if DROPBEAR_X11FWD 256| | pubkey_options->no_x11_forwarding_flag = 1; 257| |#endif 258| 279| pubkey_options->no_pty_flag = 1; 259| 279| goto next_option; 260| 279| } 261| 6.90k| if (match_option(options_buf, "command=\"") == DROPBEAR_SUCCESS) { ------------------ | | 111| 6.90k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (261:7): [True: 65, False: 6.84k] ------------------ 262| 65| int escaped = 0; 263| 65| const unsigned char* command_start = buf_getptr(options_buf, 0); 264| | 265| 65| if (pubkey_options->forced_command) { ------------------ | Branch (265:8): [True: 2, False: 63] ------------------ 266| | /* multiple command= options */ 267| 2| goto bad_option; 268| 2| } 269| | 270| 21.3k| while (options_buf->pos < options_buf->len) { ------------------ | Branch (270:11): [True: 21.2k, False: 19] ------------------ 271| 21.2k| const char c = buf_getbyte(options_buf); 272| 21.2k| if (!escaped && c == '"') { ------------------ | Branch (272:9): [True: 20.5k, False: 746] | Branch (272:21): [True: 44, False: 20.5k] ------------------ 273| 44| const int command_len = buf_getptr(options_buf, 0) - command_start; 274| 44| pubkey_options->forced_command = m_malloc(command_len); 275| 44| memcpy(pubkey_options->forced_command, 276| 44| command_start, command_len-1); 277| 44| pubkey_options->forced_command[command_len-1] = '\0'; 278| 44| goto next_option; 279| 44| } 280| 21.2k| escaped = (!escaped && c == '\\'); ------------------ | Branch (280:16): [True: 20.5k, False: 746] | Branch (280:28): [True: 746, False: 19.7k] ------------------ 281| 21.2k| } 282| 19| dropbear_log(LOG_WARNING, "Badly formatted command= authorized_keys option"); 283| 19| goto bad_option; 284| 63| } 285| | 286| 6.84k| if (match_option(options_buf, "permitopen=\"") == DROPBEAR_SUCCESS) { ------------------ | | 111| 6.84k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (286:7): [True: 1.64k, False: 5.20k] ------------------ 287| 1.64k| int valid_option = 0; 288| 1.64k| const unsigned char* permitopen_start = buf_getptr(options_buf, 0); 289| | 290| 1.64k| if (!pubkey_options->permit_open_destinations) { ------------------ | Branch (290:8): [True: 250, False: 1.39k] ------------------ 291| 250| pubkey_options->permit_open_destinations = list_new(); 292| 250| } 293| | 294| 16.9k| while (options_buf->pos < options_buf->len) { ------------------ | Branch (294:11): [True: 16.9k, False: 1] ------------------ 295| 16.9k| const char c = buf_getbyte(options_buf); 296| 16.9k| if (c == '"') { ------------------ | Branch (296:9): [True: 1.64k, False: 15.3k] ------------------ 297| 1.64k| char *spec = NULL; 298| 1.64k| char *portstring = NULL; 299| 1.64k| const int permitopen_len = buf_getptr(options_buf, 0) - permitopen_start; 300| 1.64k| struct PermitTCPFwdEntry *entry = 301| 1.64k| (struct PermitTCPFwdEntry*)m_malloc(sizeof(struct PermitTCPFwdEntry)); 302| | 303| 1.64k| list_append(pubkey_options->permit_open_destinations, entry); 304| 1.64k| spec = m_malloc(permitopen_len); 305| 1.64k| memcpy(spec, permitopen_start, permitopen_len - 1); 306| 1.64k| spec[permitopen_len - 1] = '\0'; 307| 1.64k| if ((split_address_port(spec, &entry->host, &portstring) == DROPBEAR_SUCCESS) ------------------ | | 111| 1.64k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (307:10): [True: 1.62k, False: 14] ------------------ 308| 1.62k| && entry->host && portstring) { ------------------ | Branch (308:10): [True: 1.61k, False: 13] | Branch (308:25): [True: 1.58k, False: 28] ------------------ 309| 1.58k| if (strcmp(portstring, "*") == 0) { ------------------ | Branch (309:11): [True: 360, False: 1.22k] ------------------ 310| 360| valid_option = 1; 311| 360| entry->port = PUBKEY_OPTIONS_ANY_PORT; ------------------ | | 116| 360|#define PUBKEY_OPTIONS_ANY_PORT UINT_MAX ------------------ 312| 360| TRACE(("local port forwarding allowed to host '%s'", entry->host)); 313| 1.22k| } else if (m_str_to_uint(portstring, &entry->port) == DROPBEAR_SUCCESS) { ------------------ | | 111| 1.22k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (313:18): [True: 1.12k, False: 98] ------------------ 314| 1.12k| valid_option = 1; 315| 1.12k| TRACE(("local port forwarding allowed to host '%s' and port '%u'", 316| 1.12k| entry->host, entry->port)); 317| 1.12k| } 318| 1.58k| } 319| | 320| 1.64k| m_free(spec); ------------------ | | 24| 1.64k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 1.64k] | | ------------------ ------------------ 321| 1.64k| m_free(portstring); ------------------ | | 24| 1.64k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 1.64k] | | ------------------ ------------------ 322| 1.64k| break; 323| 1.64k| } 324| 16.9k| } 325| | 326| 1.64k| if (valid_option) { ------------------ | Branch (326:8): [True: 1.48k, False: 154] ------------------ 327| 1.48k| goto next_option; 328| 1.48k| } else { 329| 154| dropbear_log(LOG_WARNING, "Badly formatted permitopen= authorized_keys option"); 330| 154| goto bad_option; 331| 154| } 332| 1.64k| } 333| | 334| 5.20k| if (match_option(options_buf, "permitlisten=\"") == DROPBEAR_SUCCESS) { ------------------ | | 111| 5.20k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (334:7): [True: 0, False: 5.20k] ------------------ 335| 0| int valid_option = 0; 336| 0| const unsigned char* permitlisten_start = buf_getptr(options_buf, 0); 337| | 338| 0| if (!pubkey_options->permit_listens) { ------------------ | Branch (338:8): [True: 0, False: 0] ------------------ 339| 0| pubkey_options->permit_listens = list_new(); 340| 0| } 341| | 342| 0| while (options_buf->pos < options_buf->len) { ------------------ | Branch (342:11): [True: 0, False: 0] ------------------ 343| 0| const char c = buf_getbyte(options_buf); 344| 0| if (c == '"') { ------------------ | Branch (344:9): [True: 0, False: 0] ------------------ 345| 0| char *spec = NULL; 346| 0| const int permitlisten_len = buf_getptr(options_buf, 0) - permitlisten_start; 347| 0| struct PermitTCPFwdEntry *entry = 348| 0| (struct PermitTCPFwdEntry*)m_malloc(sizeof(struct PermitTCPFwdEntry)); 349| | 350| 0| list_append(pubkey_options->permit_listens, entry); 351| | /* permitlisten_len includes trailing '"' */ 352| 0| spec = m_malloc(permitlisten_len); 353| 0| memcpy(spec, permitlisten_start, permitlisten_len - 1); 354| 0| spec[permitlisten_len - 1] = '\0'; 355| | 356| | /* Only a plain port accepted. 357| | * OpenSSH supports [host:]port, but that isn't implemented. 358| | * port="*" isn't supported either, since it only is useful 359| | * with a host: part. */ 360| | 361| 0| if (m_str_to_uint(spec, &entry->port) == DROPBEAR_SUCCESS) { ------------------ | | 111| 0|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (361:10): [True: 0, False: 0] ------------------ 362| 0| valid_option = 1; 363| 0| TRACE(("remote forwarding allows listening on port %u", 364| 0| entry->port)); 365| 0| } 366| | 367| 0| m_free(spec); ------------------ | | 24| 0|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 0] | | ------------------ ------------------ 368| 0| break; 369| 0| } 370| 0| } 371| | 372| 0| if (valid_option) { ------------------ | Branch (372:8): [True: 0, False: 0] ------------------ 373| 0| goto next_option; 374| 0| } else { 375| 0| dropbear_log(LOG_WARNING, "Badly formatted permitlisten= authorized_keys option"); 376| 0| goto bad_option; 377| 0| } 378| 0| } 379| | 380| 5.20k| if (match_option(options_buf, "no-touch-required") == DROPBEAR_SUCCESS) { ------------------ | | 111| 5.20k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (380:7): [True: 91, False: 5.11k] ------------------ 381| 91|#if DROPBEAR_SK_ECDSA || DROPBEAR_SK_ED25519 382| 91| dropbear_log(LOG_WARNING, "No user presence check required for U2F/FIDO key."); 383| 91| pubkey_options->no_touch_required_flag = 1; 384| 91|#endif 385| 91| goto next_option; 386| 91| } 387| 5.11k| if (match_option(options_buf, "verify-required") == DROPBEAR_SUCCESS) { ------------------ | | 111| 5.11k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (387:7): [True: 198, False: 4.91k] ------------------ 388| 198|#if DROPBEAR_SK_ECDSA || DROPBEAR_SK_ED25519 389| 198| dropbear_log(LOG_WARNING, "User verification required for U2F/FIDO key."); 390| 198| pubkey_options->verify_required_flag = 1; 391| 198|#endif 392| 198| goto next_option; 393| 198| } 394| | 395| 8.14k|next_option: 396| | /* 397| | * Skip the comma, and move to the next option 398| | * (or break out if there are no more). 399| | */ 400| 8.14k| if (options_buf->pos < options_buf->len ------------------ | Branch (400:7): [True: 8.01k, False: 134] ------------------ 401| 8.01k| && buf_getbyte(options_buf) != ',') { ------------------ | Branch (401:8): [True: 999, False: 7.01k] ------------------ 402| 999| goto bad_option; 403| 999| } 404| | /* Process the next option. */ 405| 8.14k| } 406| | /* parsed all options with no problem */ 407| 153| goto end; 408| | 409| 1.17k|bad_option: 410| 1.17k| svr_pubkey_options_cleanup(pubkey_options); 411| 1.17k| pubkey_options = NULL; 412| 1.17k| dropbear_log(LOG_WARNING, "Bad public key options at %s:%d", filename, line_num); 413| | 414| 1.32k|end: 415| 1.32k| TRACE(("leave addpubkeyoptions")) 416| 1.32k| return pubkey_options; 417| 1.17k|} svr-authpubkeyoptions.c:match_option: 195| 68.3k|static int match_option(buffer *options_buf, const char *opt_name) { 196| 68.3k| const unsigned int len = strlen(opt_name); 197| 68.3k| if (options_buf->len - options_buf->pos < len) { ------------------ | Branch (197:6): [True: 7.26k, False: 61.0k] ------------------ 198| 7.26k| return DROPBEAR_FAILURE; ------------------ | | 112| 7.26k|#define DROPBEAR_FAILURE -1 ------------------ 199| 7.26k| } 200| 61.0k| if (strncasecmp((const char *) buf_getptr(options_buf, len), opt_name, len) == 0) { ------------------ | Branch (200:6): [True: 3.41k, False: 57.6k] ------------------ 201| 3.41k| buf_incrpos(options_buf, len); 202| 3.41k| return DROPBEAR_SUCCESS; ------------------ | | 111| 3.41k|#define DROPBEAR_SUCCESS 0 ------------------ 203| 3.41k| } 204| 57.6k| return DROPBEAR_FAILURE; ------------------ | | 112| 57.6k|#define DROPBEAR_FAILURE -1 ------------------ 205| 61.0k|}