fuzz_early_setup: 23| 2|void fuzz_early_setup(void) { 24| | /* Set stderr to point to normal stderr by default */ 25| | fuzz.fake_stderr = stderr; 26| 2|} fuzz_common_setup: 28| 1|void fuzz_common_setup(void) { 29| 1| disallow_core(); 30| 1| fuzz.fuzzing = 1; 31| 1| fuzz.wrapfds = 1; 32| 1| fuzz.do_jmp = 1; 33| 1| fuzz.input = m_malloc(sizeof(buffer)); 34| 1| _dropbear_log = fuzz_dropbear_log; 35| 1| crypto_init(); 36| 1| fuzz_seed("start", 5); 37| | /* let any messages get flushed */ 38| 1| setlinebuf(stdout); 39| |#if DEBUG_TRACE 40| | if (debug_trace) 41| | { 42| | fprintf(stderr, "Dropbear fuzzer: -v specified, not disabling stderr output\n"); 43| | } 44| | else 45| |#endif 46| 1| if (getenv("DROPBEAR_KEEP_STDERR")) { ------------------ | Branch (46:9): [True: 0, False: 1] ------------------ 47| 0| fprintf(stderr, "Dropbear fuzzer: DROPBEAR_KEEP_STDERR, not disabling stderr output\n"); 48| 0| } 49| 1| else 50| 1| { 51| 1| fprintf(stderr, "Dropbear fuzzer: Disabling stderr output\n"); 52| 1| fuzz.fake_stderr = fopen("/dev/null", "w"); 53| | assert(fuzz.fake_stderr); ------------------ | Branch (53:9): [True: 0, False: 1] | Branch (53:9): [True: 1, False: 0] ------------------ 54| 1| } 55| 1|} fuzz_set_input: 57| 2.55k|int fuzz_set_input(const uint8_t *Data, size_t Size) { 58| | 59| 2.55k| fuzz.input->data = (unsigned char*)Data; 60| 2.55k| fuzz.input->size = Size; 61| 2.55k| fuzz.input->len = Size; 62| 2.55k| fuzz.input->pos = 0; 63| | 64| 2.55k| memset(&ses, 0x0, sizeof(ses)); 65| 2.55k| memset(&svr_ses, 0x0, sizeof(svr_ses)); 66| 2.55k| memset(&cli_ses, 0x0, sizeof(cli_ses)); 67| 2.55k| wrapfd_setup(fuzz.input); 68| | // printhex("input", fuzz.input->data, fuzz.input->len); 69| | 70| 2.55k| fuzz_seed(fuzz.input->data, MIN(fuzz.input->len, 16)); ------------------ | Branch (70:33): [True: 140, False: 2.41k] ------------------ 71| | 72| 2.55k| return DROPBEAR_SUCCESS; ------------------ | | 111| 2.55k|#define DROPBEAR_SUCCESS 0 ------------------ 73| 2.55k|} fuzz-common.c:fuzz_dropbear_log: 84| 3.37k|static void fuzz_dropbear_log(int UNUSED(priority), const char* UNUSED(format), va_list UNUSED(param)) { 85| | /* No print */ 86| 3.37k|} wrapfd_setup: 32| 2.55k|void wrapfd_setup(buffer *buf) { 33| 2.55k| TRACE(("wrapfd_setup")) 34| | 35| | // clean old ones 36| 2.55k| int i; 37| 2.55k| for (i = 0; i <= wrapfd_maxfd; i++) { ------------------ | Branch (37:14): [True: 0, False: 2.55k] ------------------ 38| 0| if (wrap_fds[i].mode != UNUSED) { ------------------ | Branch (38:7): [True: 0, False: 0] ------------------ 39| 0| wrapfd_remove(i); 40| 0| } 41| 0| } 42| 2.55k| wrapfd_maxfd = -1; 43| | 44| 2.55k| memset(rand_state, 0x0, sizeof(rand_state)); 45| 2.55k| wrapfd_setseed(50); 46| 2.55k| input_buf = buf; 47| 2.55k|} wrapfd_setseed: 49| 2.55k|void wrapfd_setseed(uint32_t seed) { 50| 2.55k| memcpy(rand_state, &seed, sizeof(seed)); 51| 2.55k| nrand48(rand_state); 52| 2.55k|} LLVMFuzzerTestOneInput: 10| 2.55k|int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { 11| 2.55k| static int once = 0; 12| 2.55k| if (!once) { ------------------ | Branch (12:6): [True: 1, False: 2.55k] ------------------ 13| 1| setup_fuzzer(); 14| 1| once = 1; 15| 1| } 16| | 17| 2.55k| if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) { ------------------ | | 112| 2.55k|#define DROPBEAR_FAILURE -1 ------------------ | Branch (17:6): [True: 0, False: 2.55k] ------------------ 18| 0| return 0; 19| 0| } 20| | 21| 2.55k| m_malloc_set_epoch(1); 22| | 23| 2.55k| if (setjmp(fuzz.jmp) == 0) { ------------------ | Branch (23:6): [True: 2.55k, False: 0] ------------------ 24| 2.55k| buffer *line = buf_getstringbuf(fuzz.input); 25| 2.55k| buffer *keyblob = buf_getstringbuf(fuzz.input); 26| | 27| 2.55k| unsigned int algolen; 28| 2.55k| char* algoname = buf_getstring(keyblob, &algolen); 29| | 30| 2.55k| if (signature_type_from_name(algoname, algolen) == DROPBEAR_SIGNATURE_NONE) { ------------------ | Branch (30:7): [True: 196, False: 2.35k] ------------------ 31| 196| dropbear_exit("fuzzer imagined a bogus algorithm"); 32| 196| } 33| | 34| 2.35k| fuzz_checkpubkey_line(line, 5, "/home/me/authorized_keys", 35| 2.35k| algoname, algolen, 36| 2.35k| keyblob->data, keyblob->len); 37| | 38| 2.35k| buf_free(line); 39| 2.35k| buf_free(keyblob); 40| 2.35k| m_free(algoname); ------------------ | | 24| 2.35k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 2.35k] | | ------------------ ------------------ 41| 2.35k| m_malloc_free_epoch(1, 0); 42| 2.35k| } else { 43| 0| m_malloc_free_epoch(1, 1); 44| 0| TRACE(("dropbear_exit longjmped")) 45| | /* dropbear_exit jumped here */ 46| 0| } 47| | 48| 2.35k| return 0; 49| 2.55k|} fuzzer-pubkey.c:setup_fuzzer: 6| 1|static void setup_fuzzer(void) { 7| 1| fuzz_common_setup(); 8| 1|} sha256_init: 205| 2.55k|{ 206| 2.55k| LTC_ARGCHK(md != NULL); ------------------ | | 32| 2.55k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 2.55k] | | | Branch (32:87): [Folded, False: 2.55k] | | ------------------ ------------------ 207| | 208| 2.55k| md->sha256.curlen = 0; 209| 2.55k| md->sha256.length = 0; 210| 2.55k| md->sha256.state[0] = 0x6A09E667UL; 211| 2.55k| md->sha256.state[1] = 0xBB67AE85UL; 212| 2.55k| md->sha256.state[2] = 0x3C6EF372UL; 213| 2.55k| md->sha256.state[3] = 0xA54FF53AUL; 214| 2.55k| md->sha256.state[4] = 0x510E527FUL; 215| 2.55k| md->sha256.state[5] = 0x9B05688CUL; 216| 2.55k| md->sha256.state[6] = 0x1F83D9ABUL; 217| 2.55k| md->sha256.state[7] = 0x5BE0CD19UL; 218| 2.55k| return CRYPT_OK; 219| 2.55k|} sha256_done: 237| 2.55k|{ 238| 2.55k| int i; 239| | 240| 2.55k| LTC_ARGCHK(md != NULL); ------------------ | | 32| 2.55k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 2.55k] | | | Branch (32:87): [Folded, False: 2.55k] | | ------------------ ------------------ 241| 2.55k| LTC_ARGCHK(out != NULL); ------------------ | | 32| 2.55k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 2.55k] | | | Branch (32:87): [Folded, False: 2.55k] | | ------------------ ------------------ 242| | 243| 2.55k| if (md->sha256.curlen >= sizeof(md->sha256.buf)) { ------------------ | Branch (243:9): [True: 0, False: 2.55k] ------------------ 244| 0| return CRYPT_INVALID_ARG; 245| 0| } 246| | 247| | 248| | /* increase the length of the message */ 249| 2.55k| md->sha256.length += md->sha256.curlen * 8; 250| | 251| | /* append the '1' bit */ 252| 2.55k| md->sha256.buf[md->sha256.curlen++] = (unsigned char)0x80; 253| | 254| | /* if the length is currently above 56 bytes we append zeros 255| | * then compress. Then we can fall back to padding zeros and length 256| | * encoding like normal. 257| | */ 258| 2.55k| if (md->sha256.curlen > 56) { ------------------ | Branch (258:9): [True: 0, False: 2.55k] ------------------ 259| 0| while (md->sha256.curlen < 64) { ------------------ | Branch (259:16): [True: 0, False: 0] ------------------ 260| 0| md->sha256.buf[md->sha256.curlen++] = (unsigned char)0; 261| 0| } 262| 0| sha256_compress(md, md->sha256.buf); 263| 0| md->sha256.curlen = 0; 264| 0| } 265| | 266| | /* pad upto 56 bytes of zeroes */ 267| 72.6k| while (md->sha256.curlen < 56) { ------------------ | Branch (267:12): [True: 70.0k, False: 2.55k] ------------------ 268| 70.0k| md->sha256.buf[md->sha256.curlen++] = (unsigned char)0; 269| 70.0k| } 270| | 271| | /* store length */ 272| 2.55k| STORE64H(md->sha256.length, md->sha256.buf+56); ------------------ | | 101| 2.55k|#define STORE64H(x, y) \ | | 102| 2.55k|do { ulong64 __t = __builtin_bswap64 ((x)); \ | | 103| 2.55k| XMEMCPY ((y), &__t, 8); } while(0) | | ------------------ | | | | 39| 2.55k|#define XMEMCPY memcpy | | ------------------ | | | Branch (103:39): [Folded, False: 2.55k] | | ------------------ ------------------ 273| 2.55k| sha256_compress(md, md->sha256.buf); 274| | 275| | /* copy output */ 276| 22.9k| for (i = 0; i < 8; i++) { ------------------ | Branch (276:17): [True: 20.4k, False: 2.55k] ------------------ 277| 20.4k| STORE32H(md->sha256.state[i], out+(4*i)); ------------------ | | 62| 20.4k|#define STORE32H(x, y) \ | | 63| 20.4k|do { ulong32 __t = __builtin_bswap32 ((x)); \ | | 64| 20.4k| XMEMCPY ((y), &__t, 4); } while(0) | | ------------------ | | | | 39| 20.4k|#define XMEMCPY memcpy | | ------------------ | | | Branch (64:39): [Folded, False: 20.4k] | | ------------------ ------------------ 278| 20.4k| } 279| |#ifdef LTC_CLEAN_STACK 280| | zeromem(md, sizeof(hash_state)); 281| |#endif 282| 2.55k| return CRYPT_OK; 283| 2.55k|} sha256.c:sha256_compress: 71| 2.55k|{ 72| 2.55k| ulong32 S[8], W[64], t0, t1; 73| 2.55k|#ifdef LTC_SMALL_CODE 74| 2.55k| ulong32 t; 75| 2.55k|#endif 76| 2.55k| int i; 77| | 78| | /* copy state into S */ 79| 22.9k| for (i = 0; i < 8; i++) { ------------------ | Branch (79:17): [True: 20.4k, False: 2.55k] ------------------ 80| 20.4k| S[i] = md->sha256.state[i]; 81| 20.4k| } 82| | 83| | /* copy the state into 512-bits into W[0..15] */ 84| 43.4k| for (i = 0; i < 16; i++) { ------------------ | Branch (84:17): [True: 40.8k, False: 2.55k] ------------------ 85| 40.8k| LOAD32H(W[i], buf + (4*i)); ------------------ | | 66| 40.8k|#define LOAD32H(x, y) \ | | 67| 40.8k|do { XMEMCPY (&(x), (y), 4); \ | | ------------------ | | | | 39| 40.8k|#define XMEMCPY memcpy | | ------------------ | | 68| 40.8k| (x) = __builtin_bswap32 ((x)); } while(0) | | ------------------ | | | Branch (68:46): [Folded, False: 40.8k] | | ------------------ ------------------ 86| 40.8k| } 87| | 88| | /* fill W[16..63] */ 89| 125k| for (i = 16; i < 64; i++) { ------------------ | Branch (89:18): [True: 122k, False: 2.55k] ------------------ 90| 122k| W[i] = Gamma1(W[i - 2]) + W[i - 7] + Gamma0(W[i - 15]) + W[i - 16]; ------------------ | | 63| 122k|#define Gamma1(x) (S(x, 17) ^ S(x, 19) ^ R(x, 10)) | | ------------------ | | | | 58| 122k|#define S(x, n) RORc((x),(n)) | | | | ------------------ | | | | | | 283| 122k|#define RORc(word,i) ({ \ | | | | | | 284| 122k| ulong32 __RORc_tmp = (word); \ | | | | | | 285| 122k| __asm__ ("rorl %2, %0" : \ | | | | | | 286| 122k| "=r" (__RORc_tmp) : \ | | | | | | 287| 122k| "0" (__RORc_tmp), \ | | | | | | 288| 122k| "I" (i)); \ | | | | | | 289| 122k| __RORc_tmp; \ | | | | | | 290| 122k| }) | | | | ------------------ | | ------------------ | | #define Gamma1(x) (S(x, 17) ^ S(x, 19) ^ R(x, 10)) | | ------------------ | | | | 58| 122k|#define S(x, n) RORc((x),(n)) | | | | ------------------ | | | | | | 283| 122k|#define RORc(word,i) ({ \ | | | | | | 284| 122k| ulong32 __RORc_tmp = (word); \ | | | | | | 285| 122k| __asm__ ("rorl %2, %0" : \ | | | | | | 286| 122k| "=r" (__RORc_tmp) : \ | | | | | | 287| 122k| "0" (__RORc_tmp), \ | | | | | | 288| 122k| "I" (i)); \ | | | | | | 289| 122k| __RORc_tmp; \ | | | | | | 290| 122k| }) | | | | ------------------ | | ------------------ | | #define Gamma1(x) (S(x, 17) ^ S(x, 19) ^ R(x, 10)) | | ------------------ | | | | 59| 122k|#define R(x, n) (((x)&0xFFFFFFFFUL)>>(n)) | | ------------------ ------------------ W[i] = Gamma1(W[i - 2]) + W[i - 7] + Gamma0(W[i - 15]) + W[i - 16]; ------------------ | | 62| 122k|#define Gamma0(x) (S(x, 7) ^ S(x, 18) ^ R(x, 3)) | | ------------------ | | | | 58| 122k|#define S(x, n) RORc((x),(n)) | | | | ------------------ | | | | | | 283| 122k|#define RORc(word,i) ({ \ | | | | | | 284| 122k| ulong32 __RORc_tmp = (word); \ | | | | | | 285| 122k| __asm__ ("rorl %2, %0" : \ | | | | | | 286| 122k| "=r" (__RORc_tmp) : \ | | | | | | 287| 122k| "0" (__RORc_tmp), \ | | | | | | 288| 122k| "I" (i)); \ | | | | | | 289| 122k| __RORc_tmp; \ | | | | | | 290| 122k| }) | | | | ------------------ | | ------------------ | | #define Gamma0(x) (S(x, 7) ^ S(x, 18) ^ R(x, 3)) | | ------------------ | | | | 58| 122k|#define S(x, n) RORc((x),(n)) | | | | ------------------ | | | | | | 283| 122k|#define RORc(word,i) ({ \ | | | | | | 284| 122k| ulong32 __RORc_tmp = (word); \ | | | | | | 285| 122k| __asm__ ("rorl %2, %0" : \ | | | | | | 286| 122k| "=r" (__RORc_tmp) : \ | | | | | | 287| 122k| "0" (__RORc_tmp), \ | | | | | | 288| 122k| "I" (i)); \ | | | | | | 289| 122k| __RORc_tmp; \ | | | | | | 290| 122k| }) | | | | ------------------ | | ------------------ | | #define Gamma0(x) (S(x, 7) ^ S(x, 18) ^ R(x, 3)) | | ------------------ | | | | 59| 122k|#define R(x, n) (((x)&0xFFFFFFFFUL)>>(n)) | | ------------------ ------------------ 91| 122k| } 92| | 93| | /* Compress */ 94| 2.55k|#ifdef LTC_SMALL_CODE 95| 2.55k|#define RND(a,b,c,d,e,f,g,h,i) \ 96| 2.55k| t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i]; \ 97| 2.55k| t1 = Sigma0(a) + Maj(a, b, c); \ 98| 2.55k| d += t0; \ 99| 2.55k| h = t0 + t1; 100| | 101| 165k| for (i = 0; i < 64; ++i) { ------------------ | Branch (101:18): [True: 163k, False: 2.55k] ------------------ 102| 163k| RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],i); ------------------ | | 96| 163k| t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i]; \ | | ------------------ | | | | 61| 163k|#define Sigma1(x) (S(x, 6) ^ S(x, 11) ^ S(x, 25)) | | | | ------------------ | | | | | | 58| 163k|#define S(x, n) RORc((x),(n)) | | | | | | ------------------ | | | | | | | | 283| 163k|#define RORc(word,i) ({ \ | | | | | | | | 284| 163k| ulong32 __RORc_tmp = (word); \ | | | | | | | | 285| 163k| __asm__ ("rorl %2, %0" : \ | | | | | | | | 286| 163k| "=r" (__RORc_tmp) : \ | | | | | | | | 287| 163k| "0" (__RORc_tmp), \ | | | | | | | | 288| 163k| "I" (i)); \ | | | | | | | | 289| 163k| __RORc_tmp; \ | | | | | | | | 290| 163k| }) | | | | | | ------------------ | | | | ------------------ | | | | #define Sigma1(x) (S(x, 6) ^ S(x, 11) ^ S(x, 25)) | | | | ------------------ | | | | | | 58| 163k|#define S(x, n) RORc((x),(n)) | | | | | | ------------------ | | | | | | | | 283| 163k|#define RORc(word,i) ({ \ | | | | | | | | 284| 163k| ulong32 __RORc_tmp = (word); \ | | | | | | | | 285| 163k| __asm__ ("rorl %2, %0" : \ | | | | | | | | 286| 163k| "=r" (__RORc_tmp) : \ | | | | | | | | 287| 163k| "0" (__RORc_tmp), \ | | | | | | | | 288| 163k| "I" (i)); \ | | | | | | | | 289| 163k| __RORc_tmp; \ | | | | | | | | 290| 163k| }) | | | | | | ------------------ | | | | ------------------ | | | | #define Sigma1(x) (S(x, 6) ^ S(x, 11) ^ S(x, 25)) | | | | ------------------ | | | | | | 58| 163k|#define S(x, n) RORc((x),(n)) | | | | | | ------------------ | | | | | | | | 283| 163k|#define RORc(word,i) ({ \ | | | | | | | | 284| 163k| ulong32 __RORc_tmp = (word); \ | | | | | | | | 285| 163k| __asm__ ("rorl %2, %0" : \ | | | | | | | | 286| 163k| "=r" (__RORc_tmp) : \ | | | | | | | | 287| 163k| "0" (__RORc_tmp), \ | | | | | | | | 288| 163k| "I" (i)); \ | | | | | | | | 289| 163k| __RORc_tmp; \ | | | | | | | | 290| 163k| }) | | | | | | ------------------ | | | | ------------------ | | ------------------ | | t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i]; \ | | ------------------ | | | | 56| 163k|#define Ch(x,y,z) (z ^ (x & (y ^ z))) | | ------------------ | | 97| 163k| t1 = Sigma0(a) + Maj(a, b, c); \ | | ------------------ | | | | 60| 163k|#define Sigma0(x) (S(x, 2) ^ S(x, 13) ^ S(x, 22)) | | | | ------------------ | | | | | | 58| 163k|#define S(x, n) RORc((x),(n)) | | | | | | ------------------ | | | | | | | | 283| 163k|#define RORc(word,i) ({ \ | | | | | | | | 284| 163k| ulong32 __RORc_tmp = (word); \ | | | | | | | | 285| 163k| __asm__ ("rorl %2, %0" : \ | | | | | | | | 286| 163k| "=r" (__RORc_tmp) : \ | | | | | | | | 287| 163k| "0" (__RORc_tmp), \ | | | | | | | | 288| 163k| "I" (i)); \ | | | | | | | | 289| 163k| __RORc_tmp; \ | | | | | | | | 290| 163k| }) | | | | | | ------------------ | | | | ------------------ | | | | #define Sigma0(x) (S(x, 2) ^ S(x, 13) ^ S(x, 22)) | | | | ------------------ | | | | | | 58| 163k|#define S(x, n) RORc((x),(n)) | | | | | | ------------------ | | | | | | | | 283| 163k|#define RORc(word,i) ({ \ | | | | | | | | 284| 163k| ulong32 __RORc_tmp = (word); \ | | | | | | | | 285| 163k| __asm__ ("rorl %2, %0" : \ | | | | | | | | 286| 163k| "=r" (__RORc_tmp) : \ | | | | | | | | 287| 163k| "0" (__RORc_tmp), \ | | | | | | | | 288| 163k| "I" (i)); \ | | | | | | | | 289| 163k| __RORc_tmp; \ | | | | | | | | 290| 163k| }) | | | | | | ------------------ | | | | ------------------ | | | | #define Sigma0(x) (S(x, 2) ^ S(x, 13) ^ S(x, 22)) | | | | ------------------ | | | | | | 58| 163k|#define S(x, n) RORc((x),(n)) | | | | | | ------------------ | | | | | | | | 283| 163k|#define RORc(word,i) ({ \ | | | | | | | | 284| 163k| ulong32 __RORc_tmp = (word); \ | | | | | | | | 285| 163k| __asm__ ("rorl %2, %0" : \ | | | | | | | | 286| 163k| "=r" (__RORc_tmp) : \ | | | | | | | | 287| 163k| "0" (__RORc_tmp), \ | | | | | | | | 288| 163k| "I" (i)); \ | | | | | | | | 289| 163k| __RORc_tmp; \ | | | | | | | | 290| 163k| }) | | | | | | ------------------ | | | | ------------------ | | ------------------ | | t1 = Sigma0(a) + Maj(a, b, c); \ | | ------------------ | | | | 57| 163k|#define Maj(x,y,z) (((x | y) & z) | (x & y)) | | ------------------ | | 98| 163k| d += t0; \ | | 99| 163k| h = t0 + t1; ------------------ 103| 163k| t = S[7]; S[7] = S[6]; S[6] = S[5]; S[5] = S[4]; 104| 163k| S[4] = S[3]; S[3] = S[2]; S[2] = S[1]; S[1] = S[0]; S[0] = t; 105| 163k| } 106| |#else 107| |#define RND(a,b,c,d,e,f,g,h,i,ki) \ 108| | t0 = h + Sigma1(e) + Ch(e, f, g) + ki + W[i]; \ 109| | t1 = Sigma0(a) + Maj(a, b, c); \ 110| | d += t0; \ 111| | h = t0 + t1; 112| | 113| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],0,0x428a2f98); 114| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],1,0x71374491); 115| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],2,0xb5c0fbcf); 116| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],3,0xe9b5dba5); 117| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],4,0x3956c25b); 118| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],5,0x59f111f1); 119| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],6,0x923f82a4); 120| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],7,0xab1c5ed5); 121| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],8,0xd807aa98); 122| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],9,0x12835b01); 123| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],10,0x243185be); 124| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],11,0x550c7dc3); 125| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],12,0x72be5d74); 126| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],13,0x80deb1fe); 127| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],14,0x9bdc06a7); 128| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],15,0xc19bf174); 129| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],16,0xe49b69c1); 130| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],17,0xefbe4786); 131| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],18,0x0fc19dc6); 132| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],19,0x240ca1cc); 133| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],20,0x2de92c6f); 134| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],21,0x4a7484aa); 135| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],22,0x5cb0a9dc); 136| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],23,0x76f988da); 137| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],24,0x983e5152); 138| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],25,0xa831c66d); 139| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],26,0xb00327c8); 140| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],27,0xbf597fc7); 141| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],28,0xc6e00bf3); 142| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],29,0xd5a79147); 143| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],30,0x06ca6351); 144| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],31,0x14292967); 145| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],32,0x27b70a85); 146| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],33,0x2e1b2138); 147| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],34,0x4d2c6dfc); 148| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],35,0x53380d13); 149| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],36,0x650a7354); 150| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],37,0x766a0abb); 151| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],38,0x81c2c92e); 152| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],39,0x92722c85); 153| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],40,0xa2bfe8a1); 154| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],41,0xa81a664b); 155| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],42,0xc24b8b70); 156| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],43,0xc76c51a3); 157| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],44,0xd192e819); 158| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],45,0xd6990624); 159| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],46,0xf40e3585); 160| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],47,0x106aa070); 161| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],48,0x19a4c116); 162| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],49,0x1e376c08); 163| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],50,0x2748774c); 164| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],51,0x34b0bcb5); 165| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],52,0x391c0cb3); 166| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],53,0x4ed8aa4a); 167| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],54,0x5b9cca4f); 168| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],55,0x682e6ff3); 169| | RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],56,0x748f82ee); 170| | RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],57,0x78a5636f); 171| | RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],58,0x84c87814); 172| | RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],59,0x8cc70208); 173| | RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],60,0x90befffa); 174| | RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],61,0xa4506ceb); 175| | RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],62,0xbef9a3f7); 176| | RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],63,0xc67178f2); 177| | 178| |#undef RND 179| | 180| |#endif 181| | 182| | /* feedback */ 183| 22.9k| for (i = 0; i < 8; i++) { ------------------ | Branch (183:17): [True: 20.4k, False: 2.55k] ------------------ 184| 20.4k| md->sha256.state[i] = md->sha256.state[i] + S[i]; 185| 20.4k| } 186| 2.55k| return CRYPT_OK; 187| 2.55k|} sha256_process: 491| 5.10k|int func_name (hash_state * md, const unsigned char *in, unsigned long inlen) \ 492| 5.10k|{ \ 493| 5.10k| unsigned long n; \ 494| 5.10k| int err; \ 495| 5.10k| LTC_ARGCHK(md != NULL); \ ------------------ | | 32| 5.10k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 5.10k] | | | Branch (32:87): [Folded, False: 5.10k] | | ------------------ ------------------ 496| 5.10k| LTC_ARGCHK(in != NULL); \ ------------------ | | 32| 5.10k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 5.10k] | | | Branch (32:87): [Folded, False: 5.10k] | | ------------------ ------------------ 497| 5.10k| if (md-> state_var .curlen > sizeof(md-> state_var .buf)) { \ ------------------ | Branch (497:9): [True: 0, False: 5.10k] ------------------ 498| 0| return CRYPT_INVALID_ARG; \ 499| 0| } \ 500| 5.10k| if ((md-> state_var .length + inlen) < md-> state_var .length) { \ ------------------ | Branch (500:9): [True: 0, False: 5.10k] ------------------ 501| 0| return CRYPT_HASH_OVERFLOW; \ 502| 0| } \ 503| 10.2k| while (inlen > 0) { \ ------------------ | Branch (503:12): [True: 5.10k, False: 5.10k] ------------------ 504| 5.10k| if (md-> state_var .curlen == 0 && inlen >= block_size) { \ ------------------ | Branch (504:13): [True: 2.55k, False: 2.55k] | Branch (504:44): [True: 0, False: 2.55k] ------------------ 505| 0| if ((err = compress_name (md, (unsigned char *)in)) != CRYPT_OK) { \ ------------------ | Branch (505:16): [True: 0, False: 0] ------------------ 506| 0| return err; \ 507| 0| } \ 508| 0| md-> state_var .length += block_size * 8; \ 509| 0| in += block_size; \ 510| 0| inlen -= block_size; \ 511| 5.10k| } else { \ 512| 5.10k| n = MIN(inlen, (block_size - md-> state_var .curlen)); \ ------------------ | | 425| 5.10k| #define MIN(x, y) ( ((x)<(y))?(x):(y) ) | | ------------------ | | | Branch (425:24): [True: 5.10k, False: 0] | | ------------------ ------------------ 513| 5.10k| XMEMCPY(md-> state_var .buf + md-> state_var.curlen, in, (size_t)n); \ ------------------ | | 39| 5.10k|#define XMEMCPY memcpy ------------------ 514| 5.10k| md-> state_var .curlen += n; \ 515| 5.10k| in += n; \ 516| 5.10k| inlen -= n; \ 517| 5.10k| if (md-> state_var .curlen == block_size) { \ ------------------ | Branch (517:16): [True: 0, False: 5.10k] ------------------ 518| 0| if ((err = compress_name (md, md-> state_var .buf)) != CRYPT_OK) { \ ------------------ | Branch (518:19): [True: 0, False: 0] ------------------ 519| 0| return err; \ 520| 0| } \ 521| 0| md-> state_var .length += 8*block_size; \ 522| 0| md-> state_var .curlen = 0; \ 523| 0| } \ 524| 5.10k| } \ 525| 5.10k| } \ 526| 5.10k| return CRYPT_OK; \ 527| 5.10k|} base64_decode: 148| 1.72k|{ 149| 1.72k| return _base64_decode_internal(in, inlen, out, outlen, map_base64, relaxed); 150| 1.72k|} base64_decode.c:_base64_decode_internal: 81| 1.72k|{ 82| 1.72k| unsigned long t, x, y, z; 83| 1.72k| unsigned char c; 84| 1.72k| int g; 85| | 86| 1.72k| LTC_ARGCHK(in != NULL); ------------------ | | 32| 1.72k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 1.72k] | | | Branch (32:87): [Folded, False: 1.72k] | | ------------------ ------------------ 87| 1.72k| LTC_ARGCHK(out != NULL); ------------------ | | 32| 1.72k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 1.72k] | | | Branch (32:87): [Folded, False: 1.72k] | | ------------------ ------------------ 88| 1.72k| LTC_ARGCHK(outlen != NULL); ------------------ | | 32| 1.72k|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 1.72k] | | | Branch (32:87): [Folded, False: 1.72k] | | ------------------ ------------------ 89| | 90| 1.72k| g = 0; /* '=' counter */ 91| 70.9k| for (x = y = z = t = 0; x < inlen; x++) { ------------------ | Branch (91:28): [True: 69.2k, False: 1.72k] ------------------ 92| 69.2k| c = map[in[x]&0xFF]; 93| 69.2k| if (c == 254) { ------------------ | Branch (93:12): [True: 3.11k, False: 66.1k] ------------------ 94| 3.11k| g++; 95| 3.11k| continue; 96| 3.11k| } 97| 66.1k| else if (is_strict && g > 0) { ------------------ | Branch (97:17): [True: 0, False: 66.1k] | Branch (97:30): [True: 0, False: 0] ------------------ 98| | /* we only allow '=' to be at the end */ 99| 0| return CRYPT_INVALID_PACKET; 100| 0| } 101| 66.1k| if (c == 255) { ------------------ | Branch (101:12): [True: 8.52k, False: 57.5k] ------------------ 102| 8.52k| if (is_strict) ------------------ | Branch (102:15): [True: 0, False: 8.52k] ------------------ 103| 0| return CRYPT_INVALID_PACKET; 104| 8.52k| else 105| 8.52k| continue; 106| 8.52k| } 107| | 108| 57.5k| t = (t<<6)|c; 109| | 110| 57.5k| if (++y == 4) { ------------------ | Branch (110:12): [True: 13.1k, False: 44.4k] ------------------ 111| 13.1k| if (z + 3 > *outlen) return CRYPT_BUFFER_OVERFLOW; ------------------ | Branch (111:15): [True: 0, False: 13.1k] ------------------ 112| 13.1k| out[z++] = (unsigned char)((t>>16)&255); 113| 13.1k| out[z++] = (unsigned char)((t>>8)&255); 114| 13.1k| out[z++] = (unsigned char)(t&255); 115| 13.1k| y = t = 0; 116| 13.1k| } 117| 57.5k| } 118| | 119| 1.72k| if (y != 0) { ------------------ | Branch (119:8): [True: 1.66k, False: 61] ------------------ 120| 1.66k| int allow_b64url = 0; 121| |#ifdef LTC_BASE64_URL 122| | if (map == map_base64url) { 123| | allow_b64url = 1; 124| | } 125| |#endif 126| 1.66k| if (y == 1) return CRYPT_INVALID_PACKET; ------------------ | Branch (126:11): [True: 29, False: 1.63k] ------------------ 127| 1.63k| if ((y + g) != 4 && is_strict && !allow_b64url) return CRYPT_INVALID_PACKET; ------------------ | Branch (127:11): [True: 1.63k, False: 7] | Branch (127:27): [True: 0, False: 1.63k] | Branch (127:40): [True: 0, False: 0] ------------------ 128| 1.63k| t = t << (6 * (4 - y)); 129| 1.63k| if (z + y - 1 > *outlen) return CRYPT_BUFFER_OVERFLOW; ------------------ | Branch (129:11): [True: 0, False: 1.63k] ------------------ 130| 1.63k| if (y >= 2) out[z++] = (unsigned char) ((t >> 16) & 255); ------------------ | Branch (130:11): [True: 1.63k, False: 0] ------------------ 131| 1.63k| if (y == 3) out[z++] = (unsigned char) ((t >> 8) & 255); ------------------ | Branch (131:11): [True: 1.59k, False: 40] ------------------ 132| 1.63k| } 133| 1.70k| *outlen = z; 134| 1.70k| return CRYPT_OK; 135| 1.72k|} register_cipher: 22| 1|{ 23| 1| int x; 24| | 25| 1| LTC_ARGCHK(cipher != NULL); ------------------ | | 32| 1|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 1] | | | Branch (32:87): [Folded, False: 1] | | ------------------ ------------------ 26| | 27| | /* is it already registered? */ 28| 1| LTC_MUTEX_LOCK(<c_cipher_mutex); 29| 6| for (x = 0; x < TAB_SIZE; x++) { ------------------ | | 14| 6|#define TAB_SIZE 5 ------------------ | Branch (29:16): [True: 5, False: 1] ------------------ 30| 5| if (cipher_descriptor[x].name != NULL && cipher_descriptor[x].ID == cipher->ID) { ------------------ | Branch (30:12): [True: 0, False: 5] | Branch (30:49): [True: 0, False: 0] ------------------ 31| 0| LTC_MUTEX_UNLOCK(<c_cipher_mutex); 32| 0| return x; 33| 0| } 34| 5| } 35| | 36| | /* find a blank spot */ 37| 1| for (x = 0; x < TAB_SIZE; x++) { ------------------ | | 14| 1|#define TAB_SIZE 5 ------------------ | Branch (37:16): [True: 1, False: 0] ------------------ 38| 1| if (cipher_descriptor[x].name == NULL) { ------------------ | Branch (38:12): [True: 1, False: 0] ------------------ 39| 1| XMEMCPY(&cipher_descriptor[x], cipher, sizeof(struct ltc_cipher_descriptor)); ------------------ | | 39| 1|#define XMEMCPY memcpy ------------------ 40| 1| LTC_MUTEX_UNLOCK(<c_cipher_mutex); 41| 1| return x; 42| 1| } 43| 1| } 44| | 45| | /* no spot */ 46| 0| LTC_MUTEX_UNLOCK(<c_cipher_mutex); 47| 0| return -1; 48| 1|} register_hash: 22| 3|{ 23| 3| int x; 24| | 25| 3| LTC_ARGCHK(hash != NULL); ------------------ | | 32| 3|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 3] | | | Branch (32:87): [Folded, False: 3] | | ------------------ ------------------ 26| | 27| | /* is it already registered? */ 28| 3| LTC_MUTEX_LOCK(<c_hash_mutex); 29| 18| for (x = 0; x < TAB_SIZE; x++) { ------------------ | | 14| 18|#define TAB_SIZE 5 ------------------ | Branch (29:16): [True: 15, False: 3] ------------------ 30| 15| if (XMEMCMP(&hash_descriptor[x], hash, sizeof(struct ltc_hash_descriptor)) == 0) { ------------------ | | 45| 15|#define XMEMCMP memcmp ------------------ | Branch (30:12): [True: 0, False: 15] ------------------ 31| 0| LTC_MUTEX_UNLOCK(<c_hash_mutex); 32| 0| return x; 33| 0| } 34| 15| } 35| | 36| | /* find a blank spot */ 37| 6| for (x = 0; x < TAB_SIZE; x++) { ------------------ | | 14| 6|#define TAB_SIZE 5 ------------------ | Branch (37:16): [True: 6, False: 0] ------------------ 38| 6| if (hash_descriptor[x].name == NULL) { ------------------ | Branch (38:12): [True: 3, False: 3] ------------------ 39| 3| XMEMCPY(&hash_descriptor[x], hash, sizeof(struct ltc_hash_descriptor)); ------------------ | | 39| 3|#define XMEMCPY memcpy ------------------ 40| 3| LTC_MUTEX_UNLOCK(<c_hash_mutex); 41| 3| return x; 42| 3| } 43| 6| } 44| | 45| | /* no spot */ 46| 0| LTC_MUTEX_UNLOCK(<c_hash_mutex); 47| 0| return -1; 48| 3|} register_prng: 22| 1|{ 23| 1| int x; 24| | 25| 1| LTC_ARGCHK(prng != NULL); ------------------ | | 32| 1|#define LTC_ARGCHK(x) do { if (!(x)) { crypt_argchk(#x, __FILE__, __LINE__); } }while(0) | | ------------------ | | | Branch (32:32): [True: 0, False: 1] | | | Branch (32:87): [Folded, False: 1] | | ------------------ ------------------ 26| | 27| | /* is it already registered? */ 28| 1| LTC_MUTEX_LOCK(<c_prng_mutex); 29| 6| for (x = 0; x < TAB_SIZE; x++) { ------------------ | | 14| 6|#define TAB_SIZE 5 ------------------ | Branch (29:16): [True: 5, False: 1] ------------------ 30| 5| if (XMEMCMP(&prng_descriptor[x], prng, sizeof(struct ltc_prng_descriptor)) == 0) { ------------------ | | 45| 5|#define XMEMCMP memcmp ------------------ | Branch (30:12): [True: 0, False: 5] ------------------ 31| 0| LTC_MUTEX_UNLOCK(<c_prng_mutex); 32| 0| return x; 33| 0| } 34| 5| } 35| | 36| | /* find a blank spot */ 37| 1| for (x = 0; x < TAB_SIZE; x++) { ------------------ | | 14| 1|#define TAB_SIZE 5 ------------------ | Branch (37:16): [True: 1, False: 0] ------------------ 38| 1| if (prng_descriptor[x].name == NULL) { ------------------ | Branch (38:12): [True: 1, False: 0] ------------------ 39| 1| XMEMCPY(&prng_descriptor[x], prng, sizeof(struct ltc_prng_descriptor)); ------------------ | | 39| 1|#define XMEMCPY memcpy ------------------ 40| 1| LTC_MUTEX_UNLOCK(<c_prng_mutex); 41| 1| return x; 42| 1| } 43| 1| } 44| | 45| | /* no spot */ 46| 0| LTC_MUTEX_UNLOCK(<c_prng_mutex); 47| 0| return -1; 48| 1|} mp_rand_source: 10| 1|{ 11| | /* Dropbear, don't reset to platform if source==NULL */ 12| 1| s_mp_rand_source = source; 13| 1|} buf_new: 41| 8.64k|buffer* buf_new(unsigned int size) { 42| 8.64k| buffer* buf; 43| 8.64k| if (size > BUF_MAX_SIZE) { ------------------ | | 35| 8.64k|#define BUF_MAX_SIZE 1000000000 ------------------ | Branch (43:6): [True: 0, False: 8.64k] ------------------ 44| 0| dropbear_exit("buf->size too big"); 45| 0| } 46| | 47| 8.64k| buf = (buffer*)m_malloc(sizeof(buffer)+size); 48| 8.64k| buf->data = (unsigned char*)buf + sizeof(buffer); 49| 8.64k| buf->size = size; 50| 8.64k| return buf; 51| 8.64k|} buf_free: 54| 8.01k|void buf_free(buffer* buf) { 55| | m_free(buf); ------------------ | | 24| 8.01k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 8.01k] | | ------------------ ------------------ 56| 8.01k|} buf_setlen: 95| 1.80k|void buf_setlen(buffer* buf, unsigned int len) { 96| 1.80k| if (len > buf->size) { ------------------ | Branch (96:6): [True: 0, False: 1.80k] ------------------ 97| 0| dropbear_exit("Bad buf_setlen"); 98| 0| } 99| 1.80k| buf->len = len; 100| | buf->pos = MIN(buf->pos, buf->len); ------------------ | Branch (100:13): [True: 1.72k, False: 74] ------------------ 101| 1.80k|} buf_incrlen: 104| 6.64k|void buf_incrlen(buffer* buf, unsigned int incr) { 105| 6.64k| if (incr > BUF_MAX_INCR || buf->len + incr > buf->size) { ------------------ | | 34| 13.2k|#define BUF_MAX_INCR 1000000000 ------------------ | Branch (105:6): [True: 0, False: 6.64k] | Branch (105:29): [True: 0, False: 6.64k] ------------------ 106| 0| dropbear_exit("Bad buf_incrlen"); 107| 0| } 108| 6.64k| buf->len += incr; 109| 6.64k|} buf_setpos: 111| 8.36k|void buf_setpos(buffer* buf, unsigned int pos) { 112| | 113| 8.36k| if (pos > buf->len) { ------------------ | Branch (113:6): [True: 0, False: 8.36k] ------------------ 114| 0| dropbear_exit("Bad buf_setpos"); 115| 0| } 116| 8.36k| buf->pos = pos; 117| 8.36k|} buf_incrwritepos: 120| 1.93k|void buf_incrwritepos(buffer* buf, unsigned int incr) { 121| 1.93k| if (incr > BUF_MAX_INCR || buf->pos + incr > buf->size) { ------------------ | | 34| 3.86k|#define BUF_MAX_INCR 1000000000 ------------------ | Branch (121:6): [True: 0, False: 1.93k] | Branch (121:29): [True: 0, False: 1.93k] ------------------ 122| 0| dropbear_exit("Bad buf_incrwritepos"); 123| 0| } 124| 1.93k| buf->pos += incr; 125| 1.93k| if (buf->pos > buf->len) { ------------------ | Branch (125:6): [True: 1.93k, False: 0] ------------------ 126| 1.93k| buf->len = buf->pos; 127| 1.93k| } 128| 1.93k|} buf_incrpos: 131| 21.2k|void buf_incrpos(buffer* buf, unsigned int incr) { 132| 21.2k| if (incr > BUF_MAX_INCR ------------------ | | 34| 42.4k|#define BUF_MAX_INCR 1000000000 ------------------ | Branch (132:6): [True: 0, False: 21.2k] ------------------ 133| 21.2k| || (buf->pos + incr) > buf->len) { ------------------ | Branch (133:6): [True: 0, False: 21.2k] ------------------ 134| 0| dropbear_exit("Bad buf_incrpos"); 135| 0| } 136| 21.2k| buf->pos += incr; 137| 21.2k|} buf_decrpos: 140| 1.93k|void buf_decrpos(buffer* buf, unsigned int decr) { 141| 1.93k| if (decr > buf->pos) { ------------------ | Branch (141:6): [True: 0, False: 1.93k] ------------------ 142| 0| dropbear_exit("Bad buf_decrpos"); 143| 0| } 144| 1.93k| buf->pos -= decr; 145| 1.93k|} buf_getbyte: 148| 277k|unsigned char buf_getbyte(buffer* buf) { 149| | 150| | /* This check is really just ==, but the >= allows us to check for the 151| | * bad case of pos > len, which should _never_ happen. */ 152| 277k| if (buf->pos >= buf->len) { ------------------ | Branch (152:6): [True: 0, False: 277k] ------------------ 153| 0| dropbear_exit("Bad buf_getbyte"); 154| 0| } 155| 277k| return buf->data[buf->pos++]; 156| 277k|} buf_getptr: 180| 86.6k|unsigned char* buf_getptr(const buffer* buf, unsigned int len) { 181| | 182| 86.6k| if (len > BUF_MAX_INCR || buf->pos + len > buf->len) { ------------------ | | 34| 173k|#define BUF_MAX_INCR 1000000000 ------------------ | Branch (182:6): [True: 0, False: 86.6k] | Branch (182:28): [True: 110, False: 86.4k] ------------------ 183| 110| dropbear_exit("Bad buf_getptr"); 184| 110| } 185| 86.4k| return &buf->data[buf->pos]; 186| 86.6k|} buf_getwriteptr: 190| 8.64k|unsigned char* buf_getwriteptr(const buffer* buf, unsigned int len) { 191| | 192| 8.64k| if (len > BUF_MAX_INCR || buf->pos + len > buf->size) { ------------------ | | 34| 17.2k|#define BUF_MAX_INCR 1000000000 ------------------ | Branch (192:6): [True: 0, False: 8.64k] | Branch (192:28): [True: 0, False: 8.64k] ------------------ 193| 0| dropbear_exit("Bad buf_getwriteptr"); 194| 0| } 195| 8.64k| return &buf->data[buf->pos]; 196| 8.64k|} buf_getstring: 201| 2.45k|char* buf_getstring(buffer* buf, unsigned int *retlen) { 202| | 203| 2.45k| unsigned int len; 204| 2.45k| char* ret; 205| 2.45k| void* src = NULL; 206| 2.45k| len = buf_getint(buf); 207| 2.45k| if (len > MAX_STRING_LEN) { ------------------ | | 259| 2.45k|#define MAX_STRING_LEN (MAX(MAX_CMD_LEN, 2400)) /* Sun SSH needs 2400 for algos, ------------------ | Branch (207:6): [True: 33, False: 2.42k] | Branch (207:12): [True: 2.45k, Folded] ------------------ 208| 33| dropbear_exit("String too long"); 209| 33| } 210| | 211| 2.42k| if (retlen != NULL) { ------------------ | Branch (211:6): [True: 2.42k, False: 4] ------------------ 212| 2.42k| *retlen = len; 213| 2.42k| } 214| 2.42k| src = buf_getptr(buf, len); 215| 2.42k| ret = m_malloc(len+1); 216| 2.42k| memcpy(ret, src, len); 217| 2.42k| buf_incrpos(buf, len); 218| 2.42k| ret[len] = '\0'; 219| | 220| 2.42k| return ret; 221| 2.45k|} buf_getstringbuf: 246| 5.03k|buffer * buf_getstringbuf(buffer *buf) { 247| 5.03k| return buf_getstringbuf_int(buf, 0); 248| 5.03k|} buf_getint: 272| 9.03k|unsigned int buf_getint(buffer* buf) { 273| 9.03k| unsigned int ret; 274| | 275| 9.03k| LOAD32H(ret, buf_getptr(buf, 4)); ------------------ | | 66| 9.03k|#define LOAD32H(x, y) \ | | 67| 9.03k|do { XMEMCPY (&(x), (y), 4); \ | | ------------------ | | | | 39| 9.03k|#define XMEMCPY memcpy | | ------------------ | | 68| 9.03k| (x) = __builtin_bswap32 ((x)); } while(0) | | ------------------ | | | Branch (68:46): [Folded, False: 9.03k] | | ------------------ ------------------ 276| 9.03k| buf_incrpos(buf, 4); 277| 9.03k| return ret; 278| 9.03k|} buf_putbytes: 303| 1.93k|void buf_putbytes(buffer *buf, const unsigned char *bytes, unsigned int len) { 304| 1.93k| memcpy(buf_getwriteptr(buf, len), bytes, len); 305| 1.93k| buf_incrwritepos(buf, len); 306| 1.93k|} buffer.c:buf_getstringbuf_int: 224| 5.03k|static buffer * buf_getstringbuf_int(buffer *buf, int incllen) { 225| 5.03k| buffer *ret = NULL; 226| 5.03k| unsigned int len = buf_getint(buf); 227| 5.03k| int extra = 0; 228| 5.03k| if (len > MAX_STRING_LEN) { ------------------ | | 259| 5.03k|#define MAX_STRING_LEN (MAX(MAX_CMD_LEN, 2400)) /* Sun SSH needs 2400 for algos, ------------------ | Branch (228:6): [True: 35, False: 4.99k] | Branch (228:12): [True: 5.01k, Folded] ------------------ 229| 35| dropbear_exit("String too long"); 230| 35| } 231| 4.99k| if (incllen) { ------------------ | Branch (231:6): [True: 0, False: 4.99k] ------------------ 232| 0| extra = 4; 233| 0| } 234| 4.99k| ret = buf_new(len+extra); 235| 4.99k| if (incllen) { ------------------ | Branch (235:6): [True: 0, False: 4.99k] ------------------ 236| 0| buf_putint(ret, len); 237| 0| } 238| 4.99k| memcpy(buf_getwriteptr(ret, len), buf_getptr(buf, len), len); 239| 4.99k| buf_incrpos(buf, len); 240| 4.99k| buf_incrlen(ret, len); 241| 4.99k| buf_setpos(ret, 0); 242| 4.99k| return ret; 243| 5.03k|} split_address_port: 128| 1.35k|int split_address_port(const char* spec, char **first, char ** second) { 129| 1.35k| char *spec_copy = NULL, *addr = NULL, *colon = NULL; 130| 1.35k| int ret = DROPBEAR_FAILURE; ------------------ | | 112| 1.35k|#define DROPBEAR_FAILURE -1 ------------------ 131| | 132| 1.35k| *first = NULL; 133| 1.35k| *second = NULL; 134| 1.35k| spec_copy = m_strdup(spec); 135| 1.35k| addr = spec_copy; 136| | 137| 1.35k| if (*addr == '[') { ------------------ | Branch (137:6): [True: 138, False: 1.21k] ------------------ 138| 138| addr++; 139| 138| colon = strchr(addr, ']'); 140| 138| if (!colon) { ------------------ | Branch (140:7): [True: 2, False: 136] ------------------ 141| 2| dropbear_log(LOG_WARNING, "Bad address '%s'", spec); 142| 2| goto out; 143| 2| } 144| 136| *colon = '\0'; 145| 136| colon++; 146| 136| if (*colon == '\0') { ------------------ | Branch (146:7): [True: 2, False: 134] ------------------ 147| | /* No port part */ 148| 2| colon = NULL; 149| 134| } else if (*colon != ':') { ------------------ | Branch (149:14): [True: 14, False: 120] ------------------ 150| 14| dropbear_log(LOG_WARNING, "Bad address '%s'", spec); 151| 14| goto out; 152| 14| } 153| 1.21k| } else { 154| | /* search for ':', that separates address and port */ 155| 1.21k| colon = strrchr(addr, ':'); 156| 1.21k| } 157| | 158| | /* colon points to ':' now, or is NULL */ 159| 1.34k| if (colon) { ------------------ | Branch (159:6): [True: 1.30k, False: 33] ------------------ 160| | /* Split the address/port */ 161| 1.30k| *colon = '\0'; 162| 1.30k| colon++; 163| 1.30k| *second = m_strdup(colon); 164| 1.30k| } 165| 1.34k| if (strlen(addr)) { ------------------ | Branch (165:6): [True: 1.32k, False: 14] ------------------ 166| 1.32k| *first = m_strdup(addr); 167| 1.32k| } 168| 1.34k| ret = DROPBEAR_SUCCESS; ------------------ | | 111| 1.34k|#define DROPBEAR_SUCCESS 0 ------------------ 169| | 170| 1.35k|out: 171| | m_free(spec_copy); ------------------ | | 24| 1.35k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 1.35k] | | ------------------ ------------------ 172| 1.35k| return ret; 173| 1.34k|} crypto_init: 21| 1|void crypto_init() { 22| | 23| 1| const struct ltc_cipher_descriptor *regciphers[] = { 24| 1|#if DROPBEAR_AES 25| 1| &aes_desc, 26| 1|#endif 27| |#if DROPBEAR_3DES 28| | &des3_desc, 29| |#endif 30| 1| NULL 31| 1| }; 32| | 33| 1| const struct ltc_hash_descriptor *reghashes[] = { 34| |#if DROPBEAR_SHA1_HMAC 35| | &sha1_desc, 36| |#endif 37| 1|#if DROPBEAR_SHA256 38| 1| &sha256_desc, 39| 1|#endif 40| 1|#if DROPBEAR_SHA384 41| 1| &sha384_desc, 42| 1|#endif 43| 1|#if DROPBEAR_SHA512 44| 1| &sha512_desc, 45| 1|#endif 46| 1| NULL 47| 1| }; 48| 1| int i; 49| | 50| 2| for (i = 0; regciphers[i] != NULL; i++) { ------------------ | Branch (50:14): [True: 1, False: 1] ------------------ 51| 1| if (register_cipher(regciphers[i]) == -1) { ------------------ | Branch (51:7): [True: 0, False: 1] ------------------ 52| 0| dropbear_exit("Error registering crypto"); 53| 0| } 54| 1| } 55| | 56| 4| for (i = 0; reghashes[i] != NULL; i++) { ------------------ | Branch (56:14): [True: 3, False: 1] ------------------ 57| 3| if (register_hash(reghashes[i]) == -1) { ------------------ | Branch (57:7): [True: 0, False: 3] ------------------ 58| 0| dropbear_exit("Error registering crypto"); 59| 0| } 60| 3| } 61| | 62| 1|#if DROPBEAR_LTC_PRNG 63| 1| dropbear_ltc_prng = register_prng(&dropbear_prng_desc); 64| 1| if (dropbear_ltc_prng == -1) { ------------------ | Branch (64:6): [True: 0, False: 1] ------------------ 65| 0| dropbear_exit("Error registering crypto"); 66| 0| } 67| 1|#endif 68| | 69| 1| mp_rand_source(dropbear_rand_source); 70| | 71| 1|#if DROPBEAR_ECC 72| 1| ltc_mp = ltm_desc; 73| 1| dropbear_ecc_fill_dp(); 74| 1|#endif 75| 1|} ascii_isdigit: 10| 1.52k|int ascii_isdigit(char c) { 11| 1.52k| return c >= '0' && c <= '9'; ------------------ | Branch (11:12): [True: 364, False: 1.15k] | Branch (11:24): [True: 324, False: 40] ------------------ 12| 1.52k|} ascii_isalpha: 14| 6.01k|int ascii_isalpha(char c) { 15| 6.01k| return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z'); ------------------ | Branch (15:13): [True: 3.86k, False: 2.15k] | Branch (15:25): [True: 3.86k, False: 4] | Branch (15:39): [True: 659, False: 1.49k] | Branch (15:51): [True: 632, False: 27] ------------------ 16| 6.01k|} ascii_isalnum: 18| 6.01k|int ascii_isalnum(char c) { 19| 6.01k| return ascii_isalpha(c) || ascii_isdigit(c); ------------------ | Branch (19:12): [True: 4.49k, False: 1.52k] | Branch (19:32): [True: 324, False: 1.19k] ------------------ 20| 6.01k|} m_strdup: 12| 3.99k|void * m_strdup(const char * str) { 13| 3.99k| char* ret; 14| 3.99k| unsigned int len; 15| 3.99k| len = strlen(str); 16| | 17| 3.99k| ret = m_malloc(len+1); 18| 3.99k| if (ret == NULL) { ------------------ | Branch (18:9): [True: 0, False: 3.99k] ------------------ 19| 0| dropbear_exit("m_strdup failed"); 20| 0| } 21| 3.99k| memcpy(ret, str, len+1); 22| 3.99k| return ret; 23| 3.99k|} m_malloc_set_epoch: 76| 2.55k|void m_malloc_set_epoch(unsigned int epoch) { 77| 2.55k| current_epoch = epoch; 78| 2.55k|} m_malloc_free_epoch: 80| 2.55k|void m_malloc_free_epoch(unsigned int epoch, int dofree) { 81| 2.55k| struct dbmalloc_header* header; 82| 2.55k| struct dbmalloc_header* nextheader = NULL; 83| 2.55k| struct dbmalloc_header* oldstaple = staple; 84| 2.55k| staple = NULL; 85| | /* free allocations from this epoch, create a new staple-anchored list from 86| | the remainder */ 87| 5.94k| for (header = oldstaple; header; header = nextheader) ------------------ | Branch (87:30): [True: 3.39k, False: 2.55k] ------------------ 88| 3.39k| { 89| 3.39k| nextheader = header->next; 90| 3.39k| if (header->epoch == epoch) { ------------------ | Branch (90:13): [True: 839, False: 2.55k] ------------------ 91| 839| if (dofree) { ------------------ | Branch (91:17): [True: 839, False: 0] ------------------ 92| 839| free(header); 93| 839| } 94| 2.55k| } else { 95| 2.55k| header->prev = NULL; 96| | header->next = NULL; 97| 2.55k| put_alloc(header); 98| 2.55k| } 99| 3.39k| } 100| 2.55k|} m_malloc: 131| 21.8k|void * m_malloc(size_t size) { 132| 21.8k| char* mem = NULL; 133| 21.8k| struct dbmalloc_header* header = NULL; 134| | 135| 21.8k| if (size == 0 || size > 1e9) { ------------------ | Branch (135:9): [True: 0, False: 21.8k] | Branch (135:22): [True: 0, False: 21.8k] ------------------ 136| 0| dropbear_exit("m_malloc failed"); 137| 0| } 138| | 139| 21.8k| size = size + sizeof(struct dbmalloc_header); 140| | 141| 21.8k| mem = calloc(1, size); 142| 21.8k| if (mem == NULL) { ------------------ | Branch (142:9): [True: 0, False: 21.8k] ------------------ 143| 0| dropbear_exit("m_malloc failed"); 144| 0| } 145| 21.8k| header = (struct dbmalloc_header*)mem; 146| 21.8k| put_alloc(header); 147| 21.8k| header->epoch = current_epoch; 148| 21.8k| return &mem[sizeof(struct dbmalloc_header)]; 149| 21.8k|} m_free_direct: 172| 24.3k|void m_free_direct(void* ptr) { 173| 24.3k| struct dbmalloc_header* header = NULL; 174| 24.3k| if (!ptr) { ------------------ | Branch (174:9): [True: 3.35k, False: 20.9k] ------------------ 175| 3.35k| return; 176| 3.35k| } 177| 20.9k| header = get_header(ptr); 178| 20.9k| remove_alloc(header); 179| 20.9k| free(header); 180| 20.9k|} dbmalloc.c:put_alloc: 102| 24.3k|static void put_alloc(struct dbmalloc_header *header) { 103| 24.3k| assert(header->next == NULL); ------------------ | Branch (103:5): [True: 0, False: 24.3k] | Branch (103:5): [True: 24.3k, False: 0] ------------------ 104| 24.3k| assert(header->prev == NULL); ------------------ | Branch (104:5): [True: 0, False: 24.3k] | Branch (104:5): [True: 24.3k, False: 0] ------------------ 105| 24.3k| if (staple) { ------------------ | Branch (105:9): [True: 21.8k, False: 2.55k] ------------------ 106| 21.8k| staple->prev = header; 107| 21.8k| } 108| 24.3k| header->next = staple; 109| 24.3k| staple = header; 110| 24.3k|} dbmalloc.c:get_header: 126| 20.9k|static struct dbmalloc_header* get_header(void* ptr) { 127| 20.9k| char* bptr = ptr; 128| 20.9k| return (struct dbmalloc_header*)&bptr[-sizeof(struct dbmalloc_header)]; 129| 20.9k|} dbmalloc.c:remove_alloc: 112| 20.9k|static void remove_alloc(struct dbmalloc_header *header) { 113| 20.9k| if (header->prev) { ------------------ | Branch (113:9): [True: 12.3k, False: 8.65k] ------------------ 114| 12.3k| header->prev->next = header->next; 115| 12.3k| } 116| 20.9k| if (header->next) { ------------------ | Branch (116:9): [True: 20.9k, False: 0] ------------------ 117| 20.9k| header->next->prev = header->prev; 118| 20.9k| } 119| 20.9k| if (staple == header) { ------------------ | Branch (119:9): [True: 8.65k, False: 12.3k] ------------------ 120| 8.65k| staple = header->next; 121| 8.65k| } 122| 20.9k| header->prev = NULL; 123| | header->next = NULL; 124| 20.9k|} fuzz_seed: 153| 2.55k|void fuzz_seed(const unsigned char* dat, unsigned int len) { 154| 2.55k| hash_state hs; 155| 2.55k| sha256_init(&hs); 156| 2.55k| sha256_process(&hs, "fuzzfuzzfuzz", strlen("fuzzfuzzfuzz")); 157| 2.55k| sha256_process(&hs, dat, len); 158| 2.55k| sha256_done(&hs, hashpool); 159| 2.55k| counter = 0; 160| 2.55k| donerandinit = 1; 161| 2.55k|} dropbear_exit: 105| 374|void dropbear_exit(const char* format, ...) { 106| | 107| 374| va_list param; 108| | 109| 374| va_start(param, format); 110| 374| _dropbear_exit(EXIT_FAILURE, format, param); 111| 374| va_end(param); 112| 0|} dropbear_log: 148| 2.99k|void dropbear_log(int priority, const char* format, ...) { 149| | 150| 2.99k| va_list param; 151| | 152| 2.99k| va_start(param, format); 153| 2.99k| _dropbear_log(priority, format, param); 154| | va_end(param); 155| 2.99k|} disallow_core: 660| 1|void disallow_core() { 661| 1| struct rlimit lim = {0}; 662| 1| if (getrlimit(RLIMIT_CORE, &lim) < 0) { ------------------ | Branch (662:6): [True: 0, False: 1] ------------------ 663| 0| TRACE(("getrlimit(RLIMIT_CORE) failed")); 664| 0| } 665| 1| lim.rlim_cur = 0; 666| 1| if (setrlimit(RLIMIT_CORE, &lim) < 0) { ------------------ | Branch (666:6): [True: 0, False: 1] ------------------ 667| 0| TRACE(("setrlimit(RLIMIT_CORE) failed")); 668| 0| } 669| 1|} m_str_to_uint: 672| 1.18k|int m_str_to_uint(const char* str, unsigned int *val) { 673| 1.18k| unsigned long l; 674| 1.18k| char *endp; 675| | 676| 1.18k| l = strtoul(str, &endp, 10); 677| | 678| 1.18k| if (endp == str || *endp != '\0') { ------------------ | Branch (678:6): [True: 26, False: 1.15k] | Branch (678:21): [True: 11, False: 1.14k] ------------------ 679| | /* parse error */ 680| 37| return DROPBEAR_FAILURE; ------------------ | | 112| 37|#define DROPBEAR_FAILURE -1 ------------------ 681| 37| } 682| | 683| | /* The c99 spec doesn't actually seem to define EINVAL, but most platforms 684| | * I've looked at mention it in their manpage */ 685| 1.14k| if ((l == 0 && errno == EINVAL) ------------------ | Branch (685:7): [True: 488, False: 658] | Branch (685:17): [True: 0, False: 488] ------------------ 686| 1.14k| || (l == ULONG_MAX && errno == ERANGE) ------------------ | Branch (686:7): [True: 3, False: 1.14k] | Branch (686:25): [True: 2, False: 1] ------------------ 687| 1.14k| || (l > UINT_MAX)) { ------------------ | Branch (687:6): [True: 79, False: 1.06k] ------------------ 688| 81| return DROPBEAR_FAILURE; ------------------ | | 112| 81|#define DROPBEAR_FAILURE -1 ------------------ 689| 1.06k| } else { 690| 1.06k| *val = l; 691| 1.06k| return DROPBEAR_SUCCESS; ------------------ | | 111| 1.06k|#define DROPBEAR_SUCCESS 0 ------------------ 692| 1.06k| } 693| 1.14k|} dbutil.c:generic_dropbear_exit: 115| 374| va_list param) { 116| | 117| 374| char fmtbuf[300]; 118| | 119| 374| snprintf(fmtbuf, sizeof(fmtbuf), "Exited: %s", format); 120| | 121| 374| _dropbear_log(LOG_INFO, fmtbuf, param); 122| | 123| 374|#if DROPBEAR_FUZZ 124| 374| if (fuzz.do_jmp) { ------------------ | Branch (124:9): [True: 374, False: 0] ------------------ 125| 374| longjmp(fuzz.jmp, 1); 126| 374| } 127| 0|#endif 128| | 129| 0| exit(exitcode); 130| 374|} dropbear_ecc_fill_dp: 47| 1|void dropbear_ecc_fill_dp() { 48| 1| struct dropbear_ecc_curve **curve; 49| | /* libtomcrypt guarantees they're ordered by size */ 50| 1| const ltc_ecc_set_type *dp = ltc_ecc_sets; 51| 4| for (curve = dropbear_ecc_curves; *curve; curve++) { ------------------ | Branch (51:36): [True: 3, False: 1] ------------------ 52| 5| for (;dp->size > 0; dp++) { ------------------ | Branch (52:9): [True: 5, False: 0] ------------------ 53| 5| if (dp->size == (*curve)->ltc_size) { ------------------ | Branch (53:8): [True: 3, False: 2] ------------------ 54| 3| (*curve)->dp = dp; 55| 3| break; 56| 3| } 57| 5| } 58| 3| if (!(*curve)->dp) { ------------------ | Branch (58:7): [True: 0, False: 3] ------------------ 59| 0| dropbear_exit("Missing ECC params %s", (*curve)->name); 60| 0| } 61| 3| } 62| 1|} list_append: 5| 1.59k|void list_append(m_list *list, void *item) { 6| 1.59k| m_list_elem *elem; 7| | 8| 1.59k| elem = m_malloc(sizeof(*elem)); 9| 1.59k| elem->item = item; 10| 1.59k| elem->list = list; 11| 1.59k| elem->next = NULL; 12| 1.59k| if (!list->first) { ------------------ | Branch (12:6): [True: 355, False: 1.24k] ------------------ 13| 355| list->first = elem; 14| 355| elem->prev = NULL; 15| 1.24k| } else { 16| 1.24k| elem->prev = list->last; 17| 1.24k| list->last->next = elem; 18| 1.24k| } 19| 1.59k| list->last = elem; 20| 1.59k|} list_new: 22| 359|m_list * list_new() { 23| 359| m_list *ret = m_malloc(sizeof(m_list)); 24| | ret->first = ret->last = NULL; 25| 359| return ret; 26| 359|} list_remove: 28| 1.59k|void * list_remove(m_list_elem *elem) { 29| 1.59k| void *item = elem->item; 30| 1.59k| m_list *list = elem->list; 31| 1.59k| if (list->first == elem) ------------------ | Branch (31:6): [True: 1.59k, False: 0] ------------------ 32| 1.59k| { 33| 1.59k| list->first = elem->next; 34| 1.59k| } 35| 1.59k| if (list->last == elem) ------------------ | Branch (35:6): [True: 355, False: 1.24k] ------------------ 36| 355| { 37| 355| list->last = elem->prev; 38| 355| } 39| 1.59k| if (elem->prev) ------------------ | Branch (39:6): [True: 0, False: 1.59k] ------------------ 40| 0| { 41| 0| elem->prev->next = elem->next; 42| 0| } 43| 1.59k| if (elem->next) ------------------ | Branch (43:6): [True: 1.24k, False: 355] ------------------ 44| 1.24k| { 45| 1.24k| elem->next->prev = elem->prev; 46| 1.24k| } 47| | m_free(elem); ------------------ | | 24| 1.59k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 1.59k] | | ------------------ ------------------ 48| 1.59k| return item; 49| 1.59k|} signkey_type_from_name: 86| 2.35k|enum signkey_type signkey_type_from_name(const char* name, unsigned int namelen) { 87| 2.35k| int i; 88| 6.57k| for (i = 0; i < DROPBEAR_SIGNKEY_NUM_NAMED; i++) { ------------------ | Branch (88:14): [True: 6.37k, False: 196] ------------------ 89| 6.37k| const char *fixed_name = signkey_names[i]; 90| 6.37k| if (namelen == strlen(fixed_name) ------------------ | Branch (90:7): [True: 4.50k, False: 1.87k] ------------------ 91| 4.50k| && memcmp(fixed_name, name, namelen) == 0) { ------------------ | Branch (91:7): [True: 2.15k, False: 2.34k] ------------------ 92| | 93| 2.15k|#if DROPBEAR_ECDSA 94| | /* Some of the ECDSA key sizes are defined even if they're not compiled in */ 95| 2.15k| if (0 ------------------ | Branch (95:8): [Folded, False: 2.15k] ------------------ 96| |#if !DROPBEAR_ECC_256 97| | || i == DROPBEAR_SIGNKEY_ECDSA_NISTP256 98| |#endif 99| |#if !DROPBEAR_ECC_384 100| | || i == DROPBEAR_SIGNKEY_ECDSA_NISTP384 101| |#endif 102| |#if !DROPBEAR_ECC_521 103| | || i == DROPBEAR_SIGNKEY_ECDSA_NISTP521 104| |#endif 105| 2.15k| ) { 106| 0| TRACE(("attempt to use ecdsa type %d not compiled in", i)) 107| 0| return DROPBEAR_SIGNKEY_NONE; 108| 0| } 109| 2.15k|#endif 110| | 111| 2.15k| return (enum signkey_type)i; 112| 2.15k| } 113| 6.37k| } 114| | 115| 196| TRACE(("signkey_type_from_name unexpected key type.")) 116| | 117| 196| return DROPBEAR_SIGNKEY_NONE; 118| 2.35k|} signature_type_from_name: 145| 2.39k|enum signature_type signature_type_from_name(const char* name, unsigned int namelen) { 146| 2.39k|#if DROPBEAR_RSA 147| 2.39k|#if DROPBEAR_RSA_SHA256 148| 2.39k| if (namelen == strlen(SSH_SIGNATURE_RSA_SHA256) ------------------ | | 121| 2.39k|#define SSH_SIGNATURE_RSA_SHA256 "rsa-sha2-256" ------------------ | Branch (148:6): [True: 40, False: 2.35k] ------------------ 149| 40| && memcmp(name, SSH_SIGNATURE_RSA_SHA256, namelen) == 0) { ------------------ | | 121| 40|#define SSH_SIGNATURE_RSA_SHA256 "rsa-sha2-256" ------------------ | Branch (149:6): [True: 18, False: 22] ------------------ 150| 18| return DROPBEAR_SIGNATURE_RSA_SHA256; 151| 18| } 152| 2.37k|#endif 153| 2.37k|#if DROPBEAR_RSA_SHA1 154| 2.37k| if (namelen == strlen(SSH_SIGNKEY_RSA) ------------------ | | 116| 2.37k|#define SSH_SIGNKEY_RSA "ssh-rsa" ------------------ | Branch (154:6): [True: 2.09k, False: 281] ------------------ 155| 2.09k| && memcmp(name, SSH_SIGNKEY_RSA, namelen) == 0) { ------------------ | | 116| 2.09k|#define SSH_SIGNKEY_RSA "ssh-rsa" ------------------ | Branch (155:6): [True: 24, False: 2.07k] ------------------ 156| 24| return DROPBEAR_SIGNATURE_RSA_SHA1; 157| 24| } 158| 2.35k|#endif 159| 2.35k|#endif /* DROPBEAR_RSA */ 160| 2.35k| return (enum signature_type)signkey_type_from_name(name, namelen); 161| 2.37k|} cmp_base64_key: 728| 1.80k| const buffer * line, char ** fingerprint) { 729| | 730| 1.80k| buffer * decodekey = NULL; 731| 1.80k| int ret = DROPBEAR_FAILURE; ------------------ | | 112| 1.80k|#define DROPBEAR_FAILURE -1 ------------------ 732| 1.80k| unsigned int len, filealgolen; 733| 1.80k| unsigned long decodekeylen; 734| 1.80k| unsigned char* filealgo = NULL; 735| | 736| | /* now we have the actual data */ 737| 1.80k| len = line->len - line->pos; 738| 1.80k| if (len == 0) { ------------------ | Branch (738:6): [True: 74, False: 1.72k] ------------------ 739| | /* base64_decode doesn't like NULL argument */ 740| 74| return DROPBEAR_FAILURE; ------------------ | | 112| 74|#define DROPBEAR_FAILURE -1 ------------------ 741| 74| } 742| 1.72k| decodekeylen = len * 2; /* big to be safe */ 743| 1.72k| decodekey = buf_new(decodekeylen); 744| | 745| 1.72k| if (base64_decode(buf_getptr(line, len), len, ------------------ | Branch (745:6): [True: 29, False: 1.70k] ------------------ 746| 1.72k| buf_getwriteptr(decodekey, decodekey->size), 747| 1.72k| &decodekeylen) != CRYPT_OK) { 748| 29| TRACE(("checkpubkey: base64 decode failed")) 749| 29| goto out; 750| 29| } 751| 1.70k| TRACE(("checkpubkey: base64_decode success")) 752| 1.70k| buf_incrlen(decodekey, decodekeylen); 753| | 754| 1.70k| if (fingerprint) { ------------------ | Branch (754:6): [True: 0, False: 1.70k] ------------------ 755| 0| *fingerprint = sign_key_fingerprint(buf_getptr(decodekey, decodekeylen), 756| 0| decodekeylen); 757| 0| } 758| | 759| | /* compare the keys */ 760| 1.70k| if ( ( decodekeylen != keybloblen ) ------------------ | Branch (760:7): [True: 139, False: 1.56k] ------------------ 761| 1.56k| || memcmp( buf_getptr(decodekey, decodekey->len), ------------------ | Branch (761:7): [True: 19, False: 1.54k] ------------------ 762| 1.56k| keyblob, decodekey->len) != 0) { 763| 158| TRACE(("checkpubkey: compare failed")) 764| 158| goto out; 765| 158| } 766| | 767| | /* ... and also check that the algo specified and the algo in the key 768| | * itself match */ 769| 1.54k| filealgolen = buf_getint(decodekey); 770| 1.54k| filealgo = buf_getptr(decodekey, filealgolen); 771| 1.54k| if (filealgolen != algolen || memcmp(filealgo, algoname, algolen) != 0) { ------------------ | Branch (771:6): [True: 0, False: 1.54k] | Branch (771:32): [True: 0, False: 1.54k] ------------------ 772| 0| TRACE(("checkpubkey: algo match failed")) 773| 0| goto out; 774| 0| } 775| | 776| | /* All checks passed */ 777| 1.54k| ret = DROPBEAR_SUCCESS; ------------------ | | 111| 1.54k|#define DROPBEAR_SUCCESS 0 ------------------ 778| | 779| 1.72k|out: 780| 1.72k| buf_free(decodekey); 781| | decodekey = NULL; 782| 1.72k| return ret; 783| 1.54k|} fuzz_checkpubkey_line: 647| 2.19k| const unsigned char* keyblob, unsigned int keybloblen) { 648| | struct PubKeyOptions *options = NULL; 649| 2.19k| checkpubkey_line(line, line_num, filename, algo, algolen, keyblob, keybloblen, &options); 650| 2.19k| svr_pubkey_options_cleanup(options); 651| 2.19k|} svr-authpubkey.c:checkpubkey_line: 313| 2.19k| struct PubKeyOptions ** ret_options) { 314| 2.19k| buffer *options_buf = NULL; 315| 2.19k| char *info_str = NULL; 316| 2.19k| unsigned int pos, len, infopos, infolen; 317| 2.19k| int ret = DROPBEAR_FAILURE; ------------------ | | 112| 2.19k|#define DROPBEAR_FAILURE -1 ------------------ 318| | 319| 2.19k| if (ret_options) { ------------------ | Branch (319:6): [True: 2.19k, False: 0] ------------------ 320| 2.19k| *ret_options = NULL; 321| 2.19k| } 322| | 323| 2.19k| if (line->len < MIN_AUTHKEYS_LINE || line->len > MAX_AUTHKEYS_LINE) { ------------------ | | 72| 4.39k|#define MIN_AUTHKEYS_LINE 10 ------------------ if (line->len < MIN_AUTHKEYS_LINE || line->len > MAX_AUTHKEYS_LINE) { ------------------ | | 76| 2.18k|#define MAX_AUTHKEYS_LINE 3000 ------------------ | Branch (323:6): [True: 13, False: 2.18k] | Branch (323:39): [True: 3, False: 2.18k] ------------------ 324| 16| TRACE(("checkpubkey_line: bad line length %d", line->len)) 325| 16| goto out; 326| 16| } 327| | 328| 2.18k| if (memchr(line->data, 0x0, line->len) != NULL) { ------------------ | Branch (328:6): [True: 9, False: 2.17k] ------------------ 329| 9| TRACE(("checkpubkey_line: bad line has null char")) 330| 9| goto out; 331| 9| } 332| | 333| | /* compare the algorithm. +3 so we have enough bytes to read a space and some base64 characters too. */ 334| 2.17k| if (line->pos + algolen+3 > line->len) { ------------------ | Branch (334:6): [True: 5, False: 2.16k] ------------------ 335| 5| goto out; 336| 5| } 337| | /* check the key type */ 338| 2.16k| if (strncmp((const char *) buf_getptr(line, algolen), algo, algolen) != 0) { ------------------ | Branch (338:6): [True: 1.95k, False: 213] ------------------ 339| 1.95k| int is_comment = 0; 340| 1.95k| unsigned char *options_start = NULL; 341| 1.95k| int options_len = 0; 342| 1.95k| int escape, quoted; 343| | 344| | /* skip over any comments or leading whitespace */ 345| 12.6k| while (line->pos < line->len) { ------------------ | Branch (345:10): [True: 12.5k, False: 19] ------------------ 346| 12.5k| const char c = buf_getbyte(line); 347| 12.5k| if (c == ' ' || c == '\t') { ------------------ | Branch (347:8): [True: 2.86k, False: 9.72k] | Branch (347:20): [True: 7.78k, False: 1.93k] ------------------ 348| 10.6k| continue; 349| 10.6k| } else if (c == '#') { ------------------ | Branch (349:15): [True: 3, False: 1.93k] ------------------ 350| 3| is_comment = 1; 351| 3| break; 352| 3| } 353| 1.93k| buf_decrpos(line, 1); 354| 1.93k| break; 355| 12.5k| } 356| 1.95k| if (is_comment) { ------------------ | Branch (356:7): [True: 3, False: 1.95k] ------------------ 357| | /* next line */ 358| 3| goto out; 359| 3| } 360| | 361| | /* remember start of options */ 362| 1.95k| options_start = buf_getptr(line, 1); 363| 1.95k| quoted = 0; 364| 1.95k| escape = 0; 365| 1.95k| options_len = 0; 366| | 367| | /* figure out where the options are */ 368| 157k| while (line->pos < line->len) { ------------------ | Branch (368:10): [True: 157k, False: 164] ------------------ 369| 157k| const char c = buf_getbyte(line); 370| 157k| if (!quoted && (c == ' ' || c == '\t')) { ------------------ | Branch (370:8): [True: 104k, False: 52.7k] | Branch (370:20): [True: 77, False: 104k] | Branch (370:32): [True: 1.71k, False: 103k] ------------------ 371| 1.78k| break; 372| 1.78k| } 373| 155k| escape = (!escape && c == '\\'); ------------------ | Branch (373:14): [True: 154k, False: 1.73k] | Branch (373:25): [True: 1.74k, False: 152k] ------------------ 374| 155k| if (!escape && c == '"') { ------------------ | Branch (374:8): [True: 154k, False: 1.74k] | Branch (374:19): [True: 5.77k, False: 148k] ------------------ 375| 5.77k| quoted = !quoted; 376| 5.77k| } 377| 155k| options_len++; 378| 155k| } 379| 1.95k| options_buf = buf_new(options_len); 380| 1.95k| buf_putbytes(options_buf, options_start, options_len); 381| | 382| | /* compare the algorithm. +3 so we have enough bytes to read a space and some base64 characters too. */ 383| 1.95k| if (line->pos + algolen+3 > line->len) { ------------------ | Branch (383:7): [True: 198, False: 1.75k] ------------------ 384| 198| goto out; 385| 198| } 386| 1.75k| if (strncmp((const char *) buf_getptr(line, algolen), algo, algolen) != 0) { ------------------ | Branch (386:7): [True: 130, False: 1.62k] ------------------ 387| 130| goto out; 388| 130| } 389| 1.75k| } 390| 1.83k| buf_incrpos(line, algolen); 391| | 392| | /* check for space (' ') character */ 393| 1.83k| if (buf_getbyte(line) != ' ') { ------------------ | Branch (393:6): [True: 14, False: 1.82k] ------------------ 394| 14| TRACE(("checkpubkey_line: space character expected, isn't there")) 395| 14| goto out; 396| 14| } 397| | 398| | /* find the length of base64 data */ 399| 1.82k| pos = line->pos; 400| 71.0k| for (len = 0; line->pos < line->len; len++) { ------------------ | Branch (400:16): [True: 69.3k, False: 1.68k] ------------------ 401| 69.3k| if (buf_getbyte(line) == ' ') { ------------------ | Branch (401:7): [True: 140, False: 69.2k] ------------------ 402| 140| break; 403| 140| } 404| 69.3k| } 405| | 406| | /* find out the length of the public key info, stop at the first space */ 407| 1.82k| infopos = line->pos; 408| 7.79k| for (infolen = 0; line->pos < line->len; infolen++) { ------------------ | Branch (408:20): [True: 6.02k, False: 1.76k] ------------------ 409| 6.02k| const char c = buf_getbyte(line); 410| 6.02k| if (c == ' ') { ------------------ | Branch (410:7): [True: 7, False: 6.01k] ------------------ 411| 7| break; 412| 7| } 413| | /* We have an allowlist - authorized_keys lines can't be fully trusted, 414| | some shell scripts may do unsafe things with env var values */ 415| 6.01k| if (!(ascii_isalnum(c) || strchr(".,_-+@", c))) { ------------------ | Branch (415:9): [True: 4.82k, False: 1.19k] | Branch (415:29): [True: 1.15k, False: 48] ------------------ 416| 48| TRACE(("Not setting SSH_PUBKEYINFO, special characters")) 417| 48| infolen = 0; 418| 48| break; 419| 48| } 420| 6.01k| } 421| 1.82k| if (infolen > 0) { ------------------ | Branch (421:6): [True: 81, False: 1.74k] ------------------ 422| 81| info_str = m_malloc(infolen + 1); 423| 81| buf_setpos(line, infopos); 424| 81| strncpy(info_str, buf_getptr(line, infolen), infolen); 425| 81| } 426| | 427| | /* truncate to base64 data length */ 428| 1.82k| buf_setpos(line, pos); 429| 1.82k| buf_setlen(line, line->pos + len); 430| | 431| 1.82k| TRACE(("checkpubkey_line: line pos = %d len = %d", line->pos, line->len)) 432| | 433| 1.82k| ret = cmp_base64_key(keyblob, keybloblen, (const unsigned char *) algo, algolen, line, NULL); 434| | 435| | /* free pubkey_info if it is filled */ 436| 1.82k| if (ret == DROPBEAR_SUCCESS) { ------------------ | | 111| 1.82k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (436:6): [True: 1.54k, False: 280] ------------------ 437| 1.54k|#if DROPBEAR_SVR_PUBKEY_OPTIONS_BUILT 438| 1.54k| if (ret_options) { ------------------ | Branch (438:7): [True: 1.54k, False: 0] ------------------ 439| 1.54k| *ret_options = svr_parse_pubkey_options(options_buf, line_num, filename); 440| 1.54k| if (*ret_options == NULL) { ------------------ | Branch (440:8): [True: 1.39k, False: 147] ------------------ 441| 1.39k| ret = DROPBEAR_FAILURE; ------------------ | | 112| 1.39k|#define DROPBEAR_FAILURE -1 ------------------ 442| 1.39k| goto out; 443| 1.39k| } 444| | /* take the (optional) public key information */ 445| 147| (*ret_options)->info_env = info_str; 446| 147| info_str = NULL; 447| 147| } 448| 1.54k|#endif 449| 1.54k| } 450| | 451| 2.17k|out: 452| 2.17k| if (options_buf) { ------------------ | Branch (452:6): [True: 1.93k, False: 246] ------------------ 453| 1.93k| buf_free(options_buf); 454| 1.93k| } 455| 2.17k| if (info_str) { ------------------ | Branch (455:6): [True: 76, False: 2.10k] ------------------ 456| | m_free(info_str); ------------------ | | 24| 76|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 76] | | ------------------ ------------------ 457| 76| } 458| 2.17k| return ret; 459| 1.82k|} svr_pubkey_options_cleanup: 165| 3.57k|void svr_pubkey_options_cleanup(struct PubKeyOptions *pubkey_options) { 166| 3.57k| if (pubkey_options) { ------------------ | Branch (166:6): [True: 1.54k, False: 2.03k] ------------------ 167| 1.54k| m_free(pubkey_options->forced_command); ------------------ | | 24| 1.54k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 1.54k] | | ------------------ ------------------ 168| 1.54k| if (pubkey_options->permit_open_destinations) { ------------------ | Branch (168:7): [True: 269, False: 1.27k] ------------------ 169| 269| m_list_elem *iter = pubkey_options->permit_open_destinations->first; 170| 1.62k| while (iter) { ------------------ | Branch (170:11): [True: 1.35k, False: 269] ------------------ 171| 1.35k| struct PermitTCPFwdEntry *entry = (struct PermitTCPFwdEntry*)list_remove(iter); 172| 1.35k| m_free(entry->host); ------------------ | | 24| 1.35k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 1.35k] | | ------------------ ------------------ 173| 1.35k| m_free(entry); ------------------ | | 24| 1.35k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 1.35k] | | ------------------ ------------------ 174| 1.35k| iter = pubkey_options->permit_open_destinations->first; 175| 1.35k| } 176| 269| m_free(pubkey_options->permit_open_destinations); ------------------ | | 24| 269|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 269] | | ------------------ ------------------ 177| 269| } 178| 1.54k| if (pubkey_options->permit_listens) { ------------------ | Branch (178:7): [True: 90, False: 1.45k] ------------------ 179| 90| m_list_elem *iter = pubkey_options->permit_listens->first; 180| 328| while (iter) { ------------------ | Branch (180:11): [True: 238, False: 90] ------------------ 181| 238| struct PermitTCPFwdEntry *entry = (struct PermitTCPFwdEntry*)list_remove(iter); 182| 238| m_free(entry->host); ------------------ | | 24| 238|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 238] | | ------------------ ------------------ 183| 238| m_free(entry); ------------------ | | 24| 238|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 238] | | ------------------ ------------------ 184| 238| iter = pubkey_options->permit_listens->first; 185| 238| } 186| 90| m_free(pubkey_options->permit_listens); ------------------ | | 24| 90|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 90] | | ------------------ ------------------ 187| 90| } 188| 1.54k| m_free(pubkey_options->info_env); ------------------ | | 24| 1.54k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 1.54k] | | ------------------ ------------------ 189| | m_free(pubkey_options); ------------------ | | 24| 1.54k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 1.54k] | | ------------------ ------------------ 190| 1.54k| } 191| 3.57k|} svr_parse_pubkey_options: 211| 1.54k|svr_parse_pubkey_options(buffer *options_buf, int line_num, const char* filename) { 212| 1.54k| struct PubKeyOptions *pubkey_options = NULL; 213| | 214| 1.54k| TRACE(("enter addpubkeyoptions")) 215| | 216| 1.54k| pubkey_options = (struct PubKeyOptions*)m_malloc(sizeof( struct PubKeyOptions )); 217| | 218| 1.54k| if (!options_buf) { ------------------ | Branch (218:6): [True: 3, False: 1.53k] ------------------ 219| 3| TRACE(("leave addpubkeyoptions, null options")) 220| 3| return pubkey_options; 221| 3| } 222| | 223| 1.53k| buf_setpos(options_buf, 0); 224| 7.80k| while (options_buf->pos < options_buf->len) { ------------------ | Branch (224:9): [True: 7.65k, False: 144] ------------------ 225| 7.65k| if (match_option(options_buf, "no-port-forwarding") == DROPBEAR_SUCCESS) { ------------------ | | 111| 7.65k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (225:7): [True: 215, False: 7.44k] ------------------ 226| 215| dropbear_log(LOG_WARNING, "Port forwarding disabled."); 227| 215| pubkey_options->no_port_forwarding_flag = 1; 228| 215| goto next_option; 229| 215| } 230| 7.44k| if (match_option(options_buf, "no-agent-forwarding") == DROPBEAR_SUCCESS) { ------------------ | | 111| 7.44k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (230:7): [True: 227, False: 7.21k] ------------------ 231| 227|#if DROPBEAR_SVR_AGENTFWD 232| 227| dropbear_log(LOG_WARNING, "Agent forwarding disabled."); 233| 227| pubkey_options->no_agent_forwarding_flag = 1; 234| 227|#endif 235| 227| goto next_option; 236| 227| } 237| 7.21k| if (match_option(options_buf, "no-X11-forwarding") == DROPBEAR_SUCCESS) { ------------------ | | 111| 7.21k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (237:7): [True: 72, False: 7.14k] ------------------ 238| |#if DROPBEAR_X11FWD 239| | dropbear_log(LOG_WARNING, "X11 forwarding disabled."); 240| | pubkey_options->no_x11_forwarding_flag = 1; 241| |#endif 242| 72| goto next_option; 243| 72| } 244| 7.14k| if (match_option(options_buf, "no-pty") == DROPBEAR_SUCCESS) { ------------------ | | 111| 7.14k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (244:7): [True: 362, False: 6.78k] ------------------ 245| 362| dropbear_log(LOG_WARNING, "Pty allocation disabled."); 246| 362| pubkey_options->no_pty_flag = 1; 247| 362| goto next_option; 248| 362| } 249| 6.78k| if (match_option(options_buf, "restrict") == DROPBEAR_SUCCESS) { ------------------ | | 111| 6.78k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (249:7): [True: 225, False: 6.55k] ------------------ 250| 225| dropbear_log(LOG_WARNING, "Restrict option set"); 251| 225| pubkey_options->no_port_forwarding_flag = 1; 252| 225|#if DROPBEAR_SVR_AGENTFWD 253| 225| pubkey_options->no_agent_forwarding_flag = 1; 254| 225|#endif 255| |#if DROPBEAR_X11FWD 256| | pubkey_options->no_x11_forwarding_flag = 1; 257| |#endif 258| 225| pubkey_options->no_pty_flag = 1; 259| 225| goto next_option; 260| 225| } 261| 6.55k| if (match_option(options_buf, "command=\"") == DROPBEAR_SUCCESS) { ------------------ | | 111| 6.55k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (261:7): [True: 65, False: 6.49k] ------------------ 262| 65| int escaped = 0; 263| 65| const unsigned char* command_start = buf_getptr(options_buf, 0); 264| | 265| 65| if (pubkey_options->forced_command) { ------------------ | Branch (265:8): [True: 2, False: 63] ------------------ 266| | /* multiple command= options */ 267| 2| goto bad_option; 268| 2| } 269| | 270| 11.5k| while (options_buf->pos < options_buf->len) { ------------------ | Branch (270:11): [True: 11.5k, False: 18] ------------------ 271| 11.5k| const char c = buf_getbyte(options_buf); 272| 11.5k| if (!escaped && c == '"') { ------------------ | Branch (272:9): [True: 11.1k, False: 370] | Branch (272:21): [True: 45, False: 11.1k] ------------------ 273| 45| const int command_len = buf_getptr(options_buf, 0) - command_start; 274| 45| pubkey_options->forced_command = m_malloc(command_len); 275| 45| memcpy(pubkey_options->forced_command, 276| 45| command_start, command_len-1); 277| 45| pubkey_options->forced_command[command_len-1] = '\0'; 278| 45| goto next_option; 279| 45| } 280| 11.4k| escaped = (!escaped && c == '\\'); ------------------ | Branch (280:16): [True: 11.1k, False: 370] | Branch (280:28): [True: 370, False: 10.7k] ------------------ 281| 11.4k| } 282| 18| dropbear_log(LOG_WARNING, "Badly formatted command= authorized_keys option"); 283| 18| goto bad_option; 284| 63| } 285| | 286| 6.49k| if (match_option(options_buf, "permitopen=\"") == DROPBEAR_SUCCESS) { ------------------ | | 111| 6.49k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (286:7): [True: 1.35k, False: 5.13k] ------------------ 287| 1.35k| int valid_option = 0; 288| 1.35k| const unsigned char* permitopen_start = buf_getptr(options_buf, 0); 289| | 290| 1.35k| if (!pubkey_options->permit_open_destinations) { ------------------ | Branch (290:8): [True: 269, False: 1.08k] ------------------ 291| 269| pubkey_options->permit_open_destinations = list_new(); 292| 269| } 293| | 294| 9.30k| while (options_buf->pos < options_buf->len) { ------------------ | Branch (294:11): [True: 9.30k, False: 1] ------------------ 295| 9.30k| const char c = buf_getbyte(options_buf); 296| 9.30k| if (c == '"') { ------------------ | Branch (296:9): [True: 1.35k, False: 7.94k] ------------------ 297| 1.35k| char *spec = NULL; 298| 1.35k| char *portstring = NULL; 299| 1.35k| const int permitopen_len = buf_getptr(options_buf, 0) - permitopen_start; 300| 1.35k| struct PermitTCPFwdEntry *entry = 301| 1.35k| (struct PermitTCPFwdEntry*)m_malloc(sizeof(struct PermitTCPFwdEntry)); 302| | 303| 1.35k| list_append(pubkey_options->permit_open_destinations, entry); 304| 1.35k| spec = m_malloc(permitopen_len); 305| 1.35k| memcpy(spec, permitopen_start, permitopen_len - 1); 306| 1.35k| spec[permitopen_len - 1] = '\0'; 307| 1.35k| if ((split_address_port(spec, &entry->host, &portstring) == DROPBEAR_SUCCESS) ------------------ | | 111| 1.35k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (307:10): [True: 1.34k, False: 16] ------------------ 308| 1.34k| && entry->host && portstring) { ------------------ | Branch (308:10): [True: 1.32k, False: 14] | Branch (308:25): [True: 1.30k, False: 24] ------------------ 309| 1.30k| if (strcmp(portstring, "*") == 0) { ------------------ | Branch (309:11): [True: 358, False: 945] ------------------ 310| 358| valid_option = 1; 311| 358| entry->port = PUBKEY_OPTIONS_ANY_PORT; ------------------ | | 116| 358|#define PUBKEY_OPTIONS_ANY_PORT UINT_MAX ------------------ 312| 358| TRACE(("local port forwarding allowed to host '%s'", entry->host)); 313| 945| } else if (m_str_to_uint(portstring, &entry->port) == DROPBEAR_SUCCESS ------------------ | | 111| 1.89k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (313:18): [True: 846, False: 99] ------------------ 314| 846| && entry->port <= 65535) { ------------------ | Branch (314:11): [True: 798, False: 48] ------------------ 315| 798| valid_option = 1; 316| 798| TRACE(("local port forwarding allowed to host '%s' and port '%u'", 317| 798| entry->host, entry->port)); 318| 798| } 319| 1.30k| } 320| | 321| 1.35k| m_free(spec); ------------------ | | 24| 1.35k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 1.35k] | | ------------------ ------------------ 322| 1.35k| m_free(portstring); ------------------ | | 24| 1.35k|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 1.35k] | | ------------------ ------------------ 323| 1.35k| break; 324| 1.35k| } 325| 9.30k| } 326| | 327| 1.35k| if (valid_option) { ------------------ | Branch (327:8): [True: 1.15k, False: 202] ------------------ 328| 1.15k| goto next_option; 329| 1.15k| } else { 330| 202| dropbear_log(LOG_WARNING, "Badly formatted permitopen= authorized_keys option"); 331| 202| goto bad_option; 332| 202| } 333| 1.35k| } 334| | 335| 5.13k| if (match_option(options_buf, "permitlisten=\"") == DROPBEAR_SUCCESS) { ------------------ | | 111| 5.13k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (335:7): [True: 241, False: 4.89k] ------------------ 336| 241| int valid_option = 0; 337| 241| const unsigned char* permitlisten_start = buf_getptr(options_buf, 0); 338| | 339| 241| if (!pubkey_options->permit_listens) { ------------------ | Branch (339:8): [True: 90, False: 151] ------------------ 340| 90| pubkey_options->permit_listens = list_new(); 341| 90| } 342| | 343| 1.67k| while (options_buf->pos < options_buf->len) { ------------------ | Branch (343:11): [True: 1.67k, False: 3] ------------------ 344| 1.67k| const char c = buf_getbyte(options_buf); 345| 1.67k| if (c == '"') { ------------------ | Branch (345:9): [True: 238, False: 1.43k] ------------------ 346| 238| char *spec = NULL; 347| 238| const int permitlisten_len = buf_getptr(options_buf, 0) - permitlisten_start; 348| 238| struct PermitTCPFwdEntry *entry = 349| 238| (struct PermitTCPFwdEntry*)m_malloc(sizeof(struct PermitTCPFwdEntry)); 350| | 351| 238| list_append(pubkey_options->permit_listens, entry); 352| | /* permitlisten_len includes trailing '"' */ 353| 238| spec = m_malloc(permitlisten_len); 354| 238| memcpy(spec, permitlisten_start, permitlisten_len - 1); 355| 238| spec[permitlisten_len - 1] = '\0'; 356| | 357| | /* Only a plain port accepted. 358| | * OpenSSH supports [host:]port, but that isn't implemented. 359| | * port="*" isn't supported either, since it only is useful 360| | * with a host: part. */ 361| | 362| 238| if (m_str_to_uint(spec, &entry->port) == DROPBEAR_SUCCESS ------------------ | | 111| 476|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (362:10): [True: 219, False: 19] ------------------ 363| 219| && entry->port <= 65535) { ------------------ | Branch (363:10): [True: 189, False: 30] ------------------ 364| 189| valid_option = 1; 365| 189| TRACE(("remote forwarding allows listening on port %u", 366| 189| entry->port)); 367| 189| } 368| | 369| 238| m_free(spec); ------------------ | | 24| 238|#define m_free(X) do {m_free_direct(X); (X) = NULL;} while (0) | | ------------------ | | | Branch (24:61): [Folded, False: 238] | | ------------------ ------------------ 370| 238| break; 371| 238| } 372| 1.67k| } 373| | 374| 241| if (valid_option) { ------------------ | Branch (374:8): [True: 189, False: 52] ------------------ 375| 189| goto next_option; 376| 189| } else { 377| 52| dropbear_log(LOG_WARNING, "Badly formatted permitlisten= authorized_keys option"); 378| 52| goto bad_option; 379| 52| } 380| 241| } 381| | 382| 4.89k| if (match_option(options_buf, "no-touch-required") == DROPBEAR_SUCCESS) { ------------------ | | 111| 4.89k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (382:7): [True: 82, False: 4.81k] ------------------ 383| 82|#if DROPBEAR_SK_ECDSA || DROPBEAR_SK_ED25519 384| 82| dropbear_log(LOG_WARNING, "No user presence check required for U2F/FIDO key."); 385| 82| pubkey_options->no_touch_required_flag = 1; 386| 82|#endif 387| 82| goto next_option; 388| 82| } 389| 4.81k| if (match_option(options_buf, "verify-required") == DROPBEAR_SUCCESS) { ------------------ | | 111| 4.81k|#define DROPBEAR_SUCCESS 0 ------------------ | Branch (389:7): [True: 202, False: 4.60k] ------------------ 390| 202|#if DROPBEAR_SK_ECDSA || DROPBEAR_SK_ED25519 391| 202| dropbear_log(LOG_WARNING, "User verification required for U2F/FIDO key."); 392| 202| pubkey_options->verify_required_flag = 1; 393| 202|#endif 394| 202| goto next_option; 395| 202| } 396| | 397| 7.38k|next_option: 398| | /* 399| | * Skip the comma, and move to the next option 400| | * (or break out if there are no more). 401| | */ 402| 7.38k| if (options_buf->pos < options_buf->len ------------------ | Branch (402:7): [True: 7.26k, False: 122] ------------------ 403| 7.26k| && buf_getbyte(options_buf) != ',') { ------------------ | Branch (403:8): [True: 1.12k, False: 6.14k] ------------------ 404| 1.12k| goto bad_option; 405| 1.12k| } 406| | /* Process the next option. */ 407| 7.38k| } 408| | /* parsed all options with no problem */ 409| 144| goto end; 410| | 411| 1.39k|bad_option: 412| 1.39k| svr_pubkey_options_cleanup(pubkey_options); 413| 1.39k| pubkey_options = NULL; 414| 1.39k| dropbear_log(LOG_WARNING, "Bad public key options at %s:%d", filename, line_num); 415| | 416| 1.53k|end: 417| 1.53k| TRACE(("leave addpubkeyoptions")) 418| 1.53k| return pubkey_options; 419| 1.39k|} svr-authpubkeyoptions.c:match_option: 195| 64.1k|static int match_option(buffer *options_buf, const char *opt_name) { 196| 64.1k| const unsigned int len = strlen(opt_name); 197| 64.1k| if (options_buf->len - options_buf->pos < len) { ------------------ | Branch (197:6): [True: 8.01k, False: 56.1k] ------------------ 198| 8.01k| return DROPBEAR_FAILURE; ------------------ | | 112| 8.01k|#define DROPBEAR_FAILURE -1 ------------------ 199| 8.01k| } 200| 56.1k| if (strncasecmp((const char *) buf_getptr(options_buf, len), opt_name, len) == 0) { ------------------ | Branch (200:6): [True: 3.04k, False: 53.0k] ------------------ 201| 3.04k| buf_incrpos(options_buf, len); 202| 3.04k| return DROPBEAR_SUCCESS; ------------------ | | 111| 3.04k|#define DROPBEAR_SUCCESS 0 ------------------ 203| 3.04k| } 204| 53.0k| return DROPBEAR_FAILURE; ------------------ | | 112| 53.0k|#define DROPBEAR_FAILURE -1 ------------------ 205| 56.1k|}