bin_to_base64: 281| 164|{ 282| 164| uint8_t *base64 = NULL; 283| 164| uint8_t *ptr = NULL; 284| 164| size_t flen = 0; 285| | 286| | /* Set the artificial upper limit for the input. Otherwise on 32b arch, the 287| | * following line could overflow for sizes larger than SIZE_MAX / 4 */ 288| 164| if (len > BASE64_MAX_INPUT_LEN) { ------------------ | | 33| 164|#define BASE64_MAX_INPUT_LEN 256 * 1024 * 1024 ------------------ | Branch (288:9): [True: 0, False: 164] ------------------ 289| 0| return NULL; 290| 0| } 291| | 292| 164| flen = len + (3 - (len % 3)); /* round to upper 3 multiple */ 293| 164| flen = (4 * flen) / 3 + 1; 294| | 295| 164| base64 = malloc(flen); 296| 164| if (base64 == NULL) { ------------------ | Branch (296:9): [True: 42, False: 122] ------------------ 297| 42| return NULL; 298| 42| } 299| 122| ptr = base64; 300| | 301| 3.89M| while (len > 0) { ------------------ | Branch (301:12): [True: 3.89M, False: 58] ------------------ 302| 3.89M| _bin_to_base64(ptr, source, len > 3 ? 3 : len); ------------------ | Branch (302:37): [True: 3.89M, False: 122] ------------------ 303| 3.89M| ptr += 4; 304| 3.89M| if (len < 3) { ------------------ | Branch (304:13): [True: 64, False: 3.89M] ------------------ 305| 64| break; 306| 64| } 307| 3.89M| source += 3; 308| 3.89M| len -= 3; 309| 3.89M| } 310| 122| ptr[0] = '\0'; 311| | 312| 122| return base64; 313| 164|} base64.c:_bin_to_base64: 248| 3.89M|{ 249| 3.89M|#define BITS(n) ((1 << (n)) - 1) 250| 3.89M| switch (len) { ------------------ | Branch (250:13): [True: 3.89M, False: 0] ------------------ 251| 45| case 1: ------------------ | Branch (251:9): [True: 45, False: 3.89M] ------------------ 252| 45| dest[0] = alphabet[(source[0] >> 2)]; 253| 45| dest[1] = alphabet[((source[0] & BITS(2)) << 4)]; ------------------ | | 249| 45|#define BITS(n) ((1 << (n)) - 1) ------------------ 254| 45| dest[2] = '='; 255| 45| dest[3] = '='; 256| 45| break; 257| 19| case 2: ------------------ | Branch (257:9): [True: 19, False: 3.89M] ------------------ 258| 19| dest[0] = alphabet[source[0] >> 2]; 259| 19| dest[1] = alphabet[(source[1] >> 4) | ((source[0] & BITS(2)) << 4)]; ------------------ | | 249| 19|#define BITS(n) ((1 << (n)) - 1) ------------------ 260| 19| dest[2] = alphabet[(source[1] & BITS(4)) << 2]; ------------------ | | 249| 19|#define BITS(n) ((1 << (n)) - 1) ------------------ 261| 19| dest[3] = '='; 262| 19| break; 263| 3.89M| case 3: ------------------ | Branch (263:9): [True: 3.89M, False: 64] ------------------ 264| 3.89M| dest[0] = alphabet[(source[0] >> 2)]; 265| 3.89M| dest[1] = alphabet[(source[1] >> 4) | ((source[0] & BITS(2)) << 4)]; ------------------ | | 249| 3.89M|#define BITS(n) ((1 << (n)) - 1) ------------------ 266| 3.89M| dest[2] = alphabet[(source[2] >> 6) | (source[1] & BITS(4)) << 2]; ------------------ | | 249| 3.89M|#define BITS(n) ((1 << (n)) - 1) ------------------ 267| 3.89M| dest[3] = alphabet[source[2] & BITS(6)]; ------------------ | | 249| 3.89M|#define BITS(n) ((1 << (n)) - 1) ------------------ 268| 3.89M| break; 269| 3.89M| } 270| 3.89M|#undef BITS 271| 3.89M|} ssh_dh_init: 235| 2|{ 236| 2| unsigned long g_int = 2 ; /* G is defined as 2 by the ssh2 standards */ 237| 2| int rc; 238| 2| if (dh_crypto_initialized) { ------------------ | Branch (238:9): [True: 0, False: 2] ------------------ 239| 0| return SSH_OK; ------------------ | | 316| 0|#define SSH_OK 0 /* No error */ ------------------ 240| 0| } 241| 2| dh_crypto_initialized = 1; 242| | 243| 2| ssh_dh_generator = bignum_new(); ------------------ | | 70| 2|#define bignum_new() BN_new() ------------------ 244| 2| if (ssh_dh_generator == NULL) { ------------------ | Branch (244:9): [True: 0, False: 2] ------------------ 245| 0| goto error; 246| 0| } 247| 2| rc = bignum_set_word(ssh_dh_generator, g_int); ------------------ | | 77| 2|#define bignum_set_word(bn,n) BN_set_word(bn,n) ------------------ 248| 2| if (rc != 1) { ------------------ | Branch (248:9): [True: 0, False: 2] ------------------ 249| 0| goto error; 250| 0| } 251| | 252| 2| bignum_bin2bn(p_group1_value, P_GROUP1_LEN, &ssh_dh_group1); ------------------ | | 79| 2| do { \ | | 80| 2| (*dest) = BN_new(); \ | | 81| 2| if ((*dest) != NULL) { \ | | ------------------ | | | Branch (81:13): [True: 2, False: 0] | | ------------------ | | 82| 2| BN_bin2bn(data,datalen,(*dest)); \ | | 83| 2| } \ | | 84| 2| } while(0) | | ------------------ | | | Branch (84:13): [Folded, False: 2] | | ------------------ ------------------ 253| 2| if (ssh_dh_group1 == NULL) { ------------------ | Branch (253:9): [True: 0, False: 2] ------------------ 254| 0| goto error; 255| 0| } 256| 2| bignum_bin2bn(p_group14_value, P_GROUP14_LEN, &ssh_dh_group14); ------------------ | | 79| 2| do { \ | | 80| 2| (*dest) = BN_new(); \ | | 81| 2| if ((*dest) != NULL) { \ | | ------------------ | | | Branch (81:13): [True: 2, False: 0] | | ------------------ | | 82| 2| BN_bin2bn(data,datalen,(*dest)); \ | | 83| 2| } \ | | 84| 2| } while(0) | | ------------------ | | | Branch (84:13): [Folded, False: 2] | | ------------------ ------------------ 257| 2| if (ssh_dh_group14 == NULL) { ------------------ | Branch (257:9): [True: 0, False: 2] ------------------ 258| 0| goto error; 259| 0| } 260| 2| bignum_bin2bn(p_group16_value, P_GROUP16_LEN, &ssh_dh_group16); ------------------ | | 79| 2| do { \ | | 80| 2| (*dest) = BN_new(); \ | | 81| 2| if ((*dest) != NULL) { \ | | ------------------ | | | Branch (81:13): [True: 2, False: 0] | | ------------------ | | 82| 2| BN_bin2bn(data,datalen,(*dest)); \ | | 83| 2| } \ | | 84| 2| } while(0) | | ------------------ | | | Branch (84:13): [Folded, False: 2] | | ------------------ ------------------ 261| 2| if (ssh_dh_group16 == NULL) { ------------------ | Branch (261:9): [True: 0, False: 2] ------------------ 262| 0| goto error; 263| 0| } 264| 2| bignum_bin2bn(p_group18_value, P_GROUP18_LEN, &ssh_dh_group18); ------------------ | | 79| 2| do { \ | | 80| 2| (*dest) = BN_new(); \ | | 81| 2| if ((*dest) != NULL) { \ | | ------------------ | | | Branch (81:13): [True: 2, False: 0] | | ------------------ | | 82| 2| BN_bin2bn(data,datalen,(*dest)); \ | | 83| 2| } \ | | 84| 2| } while(0) | | ------------------ | | | Branch (84:13): [Folded, False: 2] | | ------------------ ------------------ 265| 2| if (ssh_dh_group18 == NULL) { ------------------ | Branch (265:9): [True: 0, False: 2] ------------------ 266| 0| goto error; 267| 0| } 268| | 269| 2| return 0; 270| 0|error: 271| 0| ssh_dh_finalize(); 272| 0| return SSH_ERROR; ------------------ | | 317| 0|#define SSH_ERROR -1 /* Error of some kind */ ------------------ 273| 2|} libssh_constructor: 114| 2|{ 115| | 116| 2| int rc; 117| | 118| 2| rc = _ssh_init(1); 119| | 120| 2| if (rc < 0) { ------------------ | Branch (120:9): [True: 0, False: 2] ------------------ 121| 0| fprintf(stderr, "Error in auto_init()\n"); 122| 0| } 123| | 124| 2| return; 125| 2|} ssh_init: 156| 2|int ssh_init(void) { 157| 2| return _ssh_init(0); 158| 2|} ssh_finalize: 241| 2|int ssh_finalize(void) { 242| 2| return _ssh_finalize(0); 243| 2|} init.c:_ssh_init: 62| 4|static int _ssh_init(unsigned constructor) { 63| | 64| 4| int rc = 0; 65| | 66| 4| if (!constructor) { ------------------ | Branch (66:9): [True: 2, False: 2] ------------------ 67| 2| ssh_mutex_lock(&ssh_init_mutex); 68| 2| } 69| | 70| 4| _ssh_initialized++; 71| | 72| 4| if (_ssh_initialized > 1) { ------------------ | Branch (72:9): [True: 2, False: 2] ------------------ 73| 2| rc = _ssh_init_ret; 74| 2| goto _ret; 75| 2| } 76| | 77| 2| rc = ssh_threads_init(); 78| 2| if (rc) { ------------------ | Branch (78:9): [True: 0, False: 2] ------------------ 79| 0| goto _ret; 80| 0| } 81| | 82| 2| rc = ssh_crypto_init(); 83| 2| if (rc) { ------------------ | Branch (83:9): [True: 0, False: 2] ------------------ 84| 0| goto _ret; 85| 0| } 86| | 87| 2| rc = ssh_dh_init(); 88| 2| if (rc) { ------------------ | Branch (88:9): [True: 0, False: 2] ------------------ 89| 0| goto _ret; 90| 0| } 91| | 92| 2| rc = ssh_socket_init(); 93| 2| if (rc) { ------------------ | Branch (93:9): [True: 0, False: 2] ------------------ 94| 0| goto _ret; 95| 0| } 96| | 97| 4|_ret: 98| 4| _ssh_init_ret = rc; 99| | 100| 4| if (!constructor) { ------------------ | Branch (100:9): [True: 2, False: 2] ------------------ 101| 2| ssh_mutex_unlock(&ssh_init_mutex); 102| 2| } 103| | 104| 4| return rc; 105| 2|} init.c:_ssh_finalize: 160| 2|static int _ssh_finalize(unsigned destructor) { 161| | 162| 2| if (!destructor) { ------------------ | Branch (162:9): [True: 2, False: 0] ------------------ 163| 2| ssh_mutex_lock(&ssh_init_mutex); 164| | 165| 2| if (_ssh_initialized > 1) { ------------------ | Branch (165:13): [True: 2, False: 0] ------------------ 166| 2| _ssh_initialized--; 167| 2| ssh_mutex_unlock(&ssh_init_mutex); 168| 2| return 0; 169| 2| } 170| | 171| 0| if (_ssh_initialized == 1) { ------------------ | Branch (171:13): [True: 0, False: 0] ------------------ 172| 0| if (_ssh_init_ret < 0) { ------------------ | Branch (172:17): [True: 0, False: 0] ------------------ 173| 0| ssh_mutex_unlock(&ssh_init_mutex); 174| 0| return 0; 175| 0| } 176| 0| } 177| 0| } 178| | 179| | /* If the counter reaches zero or it is the destructor calling, finalize */ 180| 0| ssh_dh_finalize(); 181| 0| ssh_crypto_finalize(); 182| 0| ssh_socket_cleanup(); 183| | /* It is important to finalize threading after CRYPTO because 184| | * it still depends on it */ 185| 0| ssh_threads_finalize(); 186| | 187| 0| _ssh_initialized = 0; 188| | 189| 0| if (!destructor) { ------------------ | Branch (189:9): [True: 0, False: 0] ------------------ 190| 0| ssh_mutex_unlock(&ssh_init_mutex); 191| 0| } 192| | 193| |#if (defined(_WIN32) && !defined(HAVE_PTHREAD)) 194| | if (ssh_init_mutex != NULL) { 195| | DeleteCriticalSection(ssh_init_mutex); 196| | SAFE_FREE(ssh_init_mutex); 197| | } 198| |#endif 199| | 200| 0| return 0; 201| 2|} ssh_crypto_init: 1391| 2|{ 1392| |#ifndef HAVE_OPENSSL_EVP_CHACHA20 1393| | size_t i; 1394| |#endif 1395| | 1396| 2| if (libcrypto_initialized) { ------------------ | Branch (1396:9): [True: 0, False: 2] ------------------ 1397| 0| return SSH_OK; ------------------ | | 316| 0|#define SSH_OK 0 /* No error */ ------------------ 1398| 0| } 1399| 2| if (OpenSSL_version_num() != OPENSSL_VERSION_NUMBER) { ------------------ | Branch (1399:9): [True: 0, False: 2] ------------------ 1400| 0| SSH_LOG(SSH_LOG_DEBUG, ------------------ | | 281| 0| _ssh_log(priority, __func__, __VA_ARGS__) ------------------ 1401| 0| "libssh compiled with %s " 1402| 0| "headers, currently running with %s.", 1403| 0| OPENSSL_VERSION_TEXT, 1404| 0| OpenSSL_version(OpenSSL_version_num())); 1405| 0| } 1406| |#ifdef CAN_DISABLE_AESNI 1407| | /* 1408| | * disable AES-NI when running within Valgrind, because they generate 1409| | * too many "uninitialized memory access" false positives 1410| | */ 1411| | if (RUNNING_ON_VALGRIND) { 1412| | SSH_LOG(SSH_LOG_INFO, "Running within Valgrind, disabling AES-NI"); 1413| | /* Bit #57 denotes AES-NI instruction set extension */ 1414| | OPENSSL_ia32cap &= ~(1LL << 57); 1415| | } 1416| |#endif /* CAN_DISABLE_AESNI */ 1417| | 1418| |#ifndef HAVE_OPENSSL_EVP_CHACHA20 1419| | for (i = 0; ssh_ciphertab[i].name != NULL; i++) { 1420| | int cmp; 1421| | 1422| | cmp = strcmp(ssh_ciphertab[i].name, "chacha20-poly1305@openssh.com"); 1423| | if (cmp == 0) { 1424| | memcpy(&ssh_ciphertab[i], 1425| | ssh_get_chacha20poly1305_cipher(), 1426| | sizeof(struct ssh_cipher_struct)); 1427| | break; 1428| | } 1429| | } 1430| |#endif /* HAVE_OPENSSL_EVP_CHACHA20 */ 1431| | 1432| 2| libcrypto_initialized = 1; 1433| | 1434| 2| return SSH_OK; ------------------ | | 316| 2|#define SSH_OK 0 /* No error */ ------------------ 1435| 2|} _ssh_log: 168| 244|{ 169| 244| va_list va; 170| | 171| 244| if (verbosity <= ssh_get_log_level()) { ------------------ | Branch (171:9): [True: 0, False: 244] ------------------ 172| 0| va_start(va, format); 173| 0| ssh_vlog(verbosity, function, format, &va); 174| | va_end(va); 175| 0| } 176| 244|} ssh_get_log_level: 252| 244|int ssh_get_log_level(void) { 253| 244| return ssh_log_level; 254| 244|} ssh_pki_import_privkey_base64: 1082| 122|{ 1083| 122| ssh_key key = NULL; 1084| 122| const char *openssh_header = NULL; 1085| | 1086| 122| if (b64_key == NULL || pkey == NULL) { ------------------ | Branch (1086:9): [True: 0, False: 122] | Branch (1086:28): [True: 0, False: 122] ------------------ 1087| 0| return SSH_ERROR; ------------------ | | 317| 0|#define SSH_ERROR -1 /* Error of some kind */ ------------------ 1088| 0| } 1089| | 1090| 122| if (b64_key == NULL || !*b64_key) { ------------------ | Branch (1090:9): [True: 0, False: 122] | Branch (1090:28): [True: 0, False: 122] ------------------ 1091| 0| return SSH_ERROR; ------------------ | | 317| 0|#define SSH_ERROR -1 /* Error of some kind */ ------------------ 1092| 0| } 1093| | 1094| 122| SSH_LOG(SSH_LOG_DEBUG, ------------------ | | 281| 244| _ssh_log(priority, __func__, __VA_ARGS__) | | ------------------ | | | Branch (281:34): [True: 0, False: 122] | | ------------------ ------------------ 1095| 122| "Trying to decode privkey passphrase=%s", 1096| 122| passphrase ? "true" : "false"); 1097| | 1098| | /* Test for OpenSSH key format first */ 1099| 122| openssh_header = strstr(b64_key, OPENSSH_HEADER_BEGIN); ------------------ | | 43| 122|#define OPENSSH_HEADER_BEGIN "-----BEGIN OPENSSH PRIVATE KEY-----" ------------------ 1100| 122| if (openssh_header != NULL) { ------------------ | Branch (1100:9): [True: 0, False: 122] ------------------ 1101| 0| key = ssh_pki_openssh_privkey_import(openssh_header, 1102| 0| passphrase, 1103| 0| auth_fn, 1104| 0| auth_data); 1105| 122| } else { 1106| | /* fallback on PEM decoder */ 1107| 122| key = pki_private_key_from_base64(b64_key, 1108| 122| passphrase, 1109| 122| auth_fn, 1110| 122| auth_data); 1111| 122| } 1112| 122| if (key == NULL) { ------------------ | Branch (1112:9): [True: 122, False: 0] ------------------ 1113| 122| return SSH_ERROR; ------------------ | | 317| 122|#define SSH_ERROR -1 /* Error of some kind */ ------------------ 1114| 122| } 1115| | 1116| 0| *pkey = key; 1117| | 1118| 0| return SSH_OK; ------------------ | | 316| 0|#define SSH_OK 0 /* No error */ ------------------ 1119| 122|} pki_private_key_from_base64: 1135| 122|{ 1136| 122| BIO *mem = NULL; 1137| 122|#if OPENSSL_VERSION_NUMBER < 0x30000000L 1138| 122| EC_KEY *ecdsa = NULL; 1139| 122|#endif /* OPENSSL_VERSION_NUMBER */ 1140| 122| ssh_key key = NULL; 1141| 122| enum ssh_keytypes_e type = SSH_KEYTYPE_UNKNOWN; 1142| 122| EVP_PKEY *pkey = NULL; 1143| | 1144| 122| mem = BIO_new_mem_buf((void*)b64_key, -1); 1145| | 1146| 122| if (passphrase == NULL) { ------------------ | Branch (1146:9): [True: 122, False: 0] ------------------ 1147| 122| if (auth_fn) { ------------------ | Branch (1147:13): [True: 0, False: 122] ------------------ 1148| 0| struct pem_get_password_struct pgp = { auth_fn, auth_data }; 1149| | 1150| 0| pkey = PEM_read_bio_PrivateKey(mem, NULL, pem_get_password, &pgp); 1151| 122| } else { 1152| | /* openssl uses its own callback to get the passphrase here */ 1153| 122| pkey = PEM_read_bio_PrivateKey(mem, NULL, NULL, NULL); 1154| 122| } 1155| 122| } else { 1156| 0| pkey = PEM_read_bio_PrivateKey(mem, NULL, NULL, (void *) passphrase); 1157| 0| } 1158| | 1159| 122| BIO_free(mem); 1160| | 1161| 122| if (pkey == NULL) { ------------------ | Branch (1161:9): [True: 122, False: 0] ------------------ 1162| 122| SSH_LOG(SSH_LOG_TRACE, ------------------ | | 281| 122| _ssh_log(priority, __func__, __VA_ARGS__) ------------------ 1163| 122| "Error parsing private key: %s", 1164| 122| ERR_error_string(ERR_get_error(), NULL)); 1165| 122| return NULL; 1166| 122| } 1167| 0| switch (EVP_PKEY_base_id(pkey)) { 1168| 0| case EVP_PKEY_RSA: ------------------ | Branch (1168:5): [True: 0, False: 0] ------------------ 1169| 0| type = SSH_KEYTYPE_RSA; 1170| 0| break; 1171| 0| case EVP_PKEY_EC: ------------------ | Branch (1171:5): [True: 0, False: 0] ------------------ 1172| 0|#ifdef HAVE_OPENSSL_ECC 1173| 0|#if OPENSSL_VERSION_NUMBER < 0x30000000L 1174| 0| ecdsa = EVP_PKEY_get0_EC_KEY(pkey); 1175| 0| if (ecdsa == NULL) { ------------------ | Branch (1175:13): [True: 0, False: 0] ------------------ 1176| 0| SSH_LOG(SSH_LOG_TRACE, ------------------ | | 281| 0| _ssh_log(priority, __func__, __VA_ARGS__) ------------------ 1177| 0| "Error parsing private key: %s", 1178| 0| ERR_error_string(ERR_get_error(), NULL)); 1179| 0| goto fail; 1180| 0| } 1181| 0|#endif /* OPENSSL_VERSION_NUMBER */ 1182| | 1183| | /* pki_privatekey_type_from_string always returns P256 for ECDSA 1184| | * keys, so we need to figure out the correct type here */ 1185| 0|#if OPENSSL_VERSION_NUMBER < 0x30000000L 1186| 0| type = pki_key_ecdsa_to_key_type(ecdsa); 1187| |#else 1188| | type = pki_key_ecdsa_to_key_type(pkey); 1189| |#endif /* OPENSSL_VERSION_NUMBER */ 1190| 0| if (type == SSH_KEYTYPE_UNKNOWN) { ------------------ | Branch (1190:13): [True: 0, False: 0] ------------------ 1191| 0| SSH_LOG(SSH_LOG_TRACE, "Invalid private key."); ------------------ | | 281| 0| _ssh_log(priority, __func__, __VA_ARGS__) ------------------ 1192| 0| goto fail; 1193| 0| } 1194| | 1195| 0| break; 1196| 0|#endif /* HAVE_OPENSSL_ECC */ 1197| 0| case EVP_PKEY_ED25519: ------------------ | Branch (1197:5): [True: 0, False: 0] ------------------ 1198| 0| type = SSH_KEYTYPE_ED25519; 1199| 0| break; 1200| 0| default: ------------------ | Branch (1200:5): [True: 0, False: 0] ------------------ 1201| 0| SSH_LOG(SSH_LOG_TRACE, "Unknown or invalid private key type %d", ------------------ | | 281| 0| _ssh_log(priority, __func__, __VA_ARGS__) ------------------ 1202| 0| EVP_PKEY_base_id(pkey)); 1203| 0| EVP_PKEY_free(pkey); 1204| 0| return NULL; 1205| 0| } 1206| | 1207| 0| key = ssh_key_new(); 1208| 0| if (key == NULL) { ------------------ | Branch (1208:9): [True: 0, False: 0] ------------------ 1209| 0| goto fail; 1210| 0| } 1211| | 1212| 0| key->type = type; 1213| 0| key->type_c = ssh_key_type_to_char(type); 1214| 0| key->flags = SSH_KEY_FLAG_PRIVATE | SSH_KEY_FLAG_PUBLIC; ------------------ | | 55| 0|#define SSH_KEY_FLAG_PRIVATE 0x0002 ------------------ key->flags = SSH_KEY_FLAG_PRIVATE | SSH_KEY_FLAG_PUBLIC; ------------------ | | 54| 0|#define SSH_KEY_FLAG_PUBLIC 0x0001 ------------------ 1215| 0| key->key = pkey; 1216| 0|#ifdef HAVE_OPENSSL_ECC 1217| 0| if (is_ecdsa_key_type(key->type)) { ------------------ | | 143| 0| ((t) >= SSH_KEYTYPE_ECDSA_P256 && (t) <= SSH_KEYTYPE_ECDSA_P521) | | ------------------ | | | Branch (143:6): [True: 0, False: 0] | | | Branch (143:39): [True: 0, False: 0] | | ------------------ ------------------ 1218| 0|#if OPENSSL_VERSION_NUMBER < 0x30000000L 1219| 0| key->ecdsa_nid = pki_key_ecdsa_to_nid(ecdsa); 1220| |#else 1221| | key->ecdsa_nid = pki_key_ecdsa_to_nid(key->key); 1222| |#endif /* OPENSSL_VERSION_NUMBER */ 1223| 0| } 1224| 0|#endif /* HAVE_OPENSSL_ECC */ 1225| | 1226| 0| return key; 1227| 0|fail: 1228| 0| EVP_PKEY_free(pkey); 1229| 0| ssh_key_free(key); 1230| | return NULL; 1231| 0|} ssh_poll_init: 91| 2|{ 92| 2| return; 93| 2|} ssh_socket_init: 132| 2|{ 133| 2| if (sockets_initialized == 0) { ------------------ | Branch (133:9): [True: 2, False: 0] ------------------ 134| |#ifdef _WIN32 135| | struct WSAData wsaData; 136| | 137| | /* Initiates use of the Winsock DLL by a process. */ 138| | if (WSAStartup(MAKEWORD(2, 0), &wsaData) != 0) { 139| | return -1; 140| | } 141| |#endif 142| 2| ssh_poll_init(); 143| | 144| 2| sockets_initialized = 1; 145| 2| } 146| | 147| 2| return 0; 148| 2|} ssh_threads_init: 42| 2|{ 43| 2| static int threads_initialized = 0; 44| 2| int rc; 45| | 46| 2| if (threads_initialized) { ------------------ | Branch (46:9): [True: 0, False: 2] ------------------ 47| 0| return SSH_OK; ------------------ | | 316| 0|#define SSH_OK 0 /* No error */ ------------------ 48| 0| } 49| | 50| | /* first initialize the user_callbacks with our default handlers if not 51| | * already the case 52| | */ 53| 2| if (user_callbacks == NULL){ ------------------ | Branch (53:9): [True: 2, False: 0] ------------------ 54| 2| user_callbacks = ssh_threads_get_default(); 55| 2| } 56| | 57| | /* Then initialize the crypto libraries threading callbacks */ 58| 2| rc = crypto_thread_init(user_callbacks); 59| 2| if (rc == SSH_OK) { ------------------ | | 316| 2|#define SSH_OK 0 /* No error */ ------------------ | Branch (59:9): [True: 2, False: 0] ------------------ 60| 2| threads_initialized = 1; 61| 2| } 62| 2| return rc; 63| 2|} crypto_thread_init: 28| 2|{ 29| 2| (void) cb; 30| 2| return SSH_OK; ------------------ | | 316| 2|#define SSH_OK 0 /* No error */ ------------------ 31| 2|} ssh_mutex_lock: 102| 4|{ 103| 4| int rc; 104| | 105| 4| if (mutex == NULL) { ------------------ | Branch (105:9): [True: 0, False: 4] ------------------ 106| 0| exit(EINVAL); 107| 0| } 108| | 109| 4| rc = pthread_mutex_lock(mutex); 110| | 111| 4| if (rc) { ------------------ | Branch (111:9): [True: 0, False: 4] ------------------ 112| 0| exit(rc); 113| 0| } 114| 4|} ssh_mutex_unlock: 117| 4|{ 118| 4| int rc; 119| | 120| 4| if (mutex == NULL) { ------------------ | Branch (120:9): [True: 0, False: 4] ------------------ 121| 0| exit(EINVAL); 122| 0| } 123| | 124| 4| rc = pthread_mutex_unlock(mutex); 125| | 126| 4| if (rc) { ------------------ | Branch (126:9): [True: 0, False: 4] ------------------ 127| 0| exit(rc); 128| 0| } 129| 4|} ssh_threads_get_default: 132| 2|{ 133| 2| return &ssh_threads_pthread; 134| 2|} nalloc_init: 114| 2|{ 115| 2| if (nalloc_initialized) { ------------------ | Branch (115:9): [True: 0, False: 2] ------------------ 116| 0| return; 117| 0| } 118| 2| nalloc_initialized = true; 119| 2| char *bitmask = getenv("NALLOC_FREQ"); 120| 2| if (bitmask) { ------------------ | Branch (120:9): [True: 0, False: 2] ------------------ 121| 0| int shift = atoi(bitmask); 122| 0| if (shift > 0 && shift < 31) { ------------------ | Branch (122:13): [True: 0, False: 0] | Branch (122:26): [True: 0, False: 0] ------------------ 123| 0| nalloc_bitmask = 1 << shift; 124| 0| nalloc_random_bitmask = false; 125| 0| } else if (shift == 0) { ------------------ | Branch (125:20): [True: 0, False: 0] ------------------ 126| 0| nalloc_random_bitmask = false; 127| 0| nalloc_bitmask = 0; 128| 0| } 129| 2| } else if (prog == NULL || strstr(prog, "nalloc") == NULL) { ------------------ | Branch (129:16): [True: 0, False: 2] | Branch (129:32): [True: 0, False: 2] ------------------ 130| 0| nalloc_random_bitmask = false; 131| 0| nalloc_bitmask = 0; 132| 0| return; 133| 0| } 134| | 135| 2| char *verbose = getenv("NALLOC_VERBOSE"); 136| 2| if (verbose) { ------------------ | Branch (136:9): [True: 0, False: 2] ------------------ 137| | nalloc_verbose = true; 138| 0| } 139| 2|} calloc: 307| 4|{ 308| 4| if (nalloc_fail(size, "calloc")) { ------------------ | Branch (308:9): [True: 0, False: 4] ------------------ 309| 0| errno = ENOMEM; 310| 0| return NULL; 311| 0| } 312| 4| return nalloc_calloc(nmemb, size); ------------------ | | 259| 4|#define nalloc_calloc(s, n) __libc_calloc(s, n) ------------------ 313| 4|} malloc: 316| 6.60k|{ 317| 6.60k| if (nalloc_fail(size, "malloc")) { ------------------ | Branch (317:9): [True: 163, False: 6.44k] ------------------ 318| 163| errno = ENOMEM; 319| 163| return NULL; 320| 163| } 321| 6.44k| return nalloc_malloc(size); ------------------ | | 258| 6.44k|#define nalloc_malloc(s) __libc_malloc(s) ------------------ 322| 6.60k|} realloc: 325| 8|{ 326| 8| if (nalloc_fail(size, "realloc")) { ------------------ | Branch (326:9): [True: 0, False: 8] ------------------ 327| 0| errno = ENOMEM; 328| 0| return NULL; 329| 0| } 330| 8| return nalloc_realloc(ptr, size); ------------------ | | 260| 8|#define nalloc_realloc(p, s) __libc_realloc(p, s) ------------------ 331| 8|} ssh_privkey_fuzzer.c:nalloc_fail: 194| 6.61k|{ 195| | // do not fail before thread init 196| 6.61k| if (nalloc_runs == 0) { ------------------ | Branch (196:9): [True: 1.64k, False: 4.96k] ------------------ 197| 1.64k| return false; 198| 1.64k| } 199| 4.96k| if (__sync_fetch_and_add(&nalloc_running, 1) != 1) { ------------------ | Branch (199:9): [True: 822, False: 4.14k] ------------------ 200| | // do not fail allocations outside of fuzzer input 201| | // and do not fail inside of this function 202| 822| __sync_fetch_and_sub(&nalloc_running, 1); 203| 822| return false; 204| 822| } 205| 4.14k| nalloc_random_update((uint8_t)size); 206| 4.14k| if (size >= 0x100) { ------------------ | Branch (206:9): [True: 172, False: 3.97k] ------------------ 207| 172| nalloc_random_update((uint8_t)(size >> 8)); 208| 172| if (size >= 0x10000) { ------------------ | Branch (208:13): [True: 26, False: 146] ------------------ 209| 26| nalloc_random_update((uint8_t)(size >> 16)); 210| | // bigger may already fail or oom 211| 26| } 212| 172| } 213| 4.14k| if (((nalloc_random_state ^ nalloc_magic) & nalloc_bitmask) == 0) { ------------------ | Branch (213:9): [True: 163, False: 3.98k] ------------------ 214| 163| if (nalloc_backtrace_exclude(size, op)) { ------------------ | Branch (214:13): [True: 0, False: 163] ------------------ 215| 0| __sync_fetch_and_sub(&nalloc_running, 1); 216| 0| return false; 217| 0| } 218| 163| __sync_fetch_and_sub(&nalloc_running, 1); 219| 163| return true; 220| 163| } 221| 3.98k| __sync_fetch_and_sub(&nalloc_running, 1); 222| | return false; 223| 4.14k|} ssh_privkey_fuzzer.c:nalloc_random_update: 143| 14.4M|{ 144| 14.4M| nalloc_random_state = 145| 14.4M| ((uint32_t)((uint32_t)nalloc_random_state << 8)) ^ 146| 14.4M| nalloc_crc32_table[((nalloc_random_state >> 24) ^ b) & 0xFF]; 147| 14.4M|} ssh_privkey_fuzzer.c:nalloc_backtrace_exclude: 181| 163|{ 182| 163| if (nalloc_verbose) { ------------------ | Branch (182:9): [True: 0, False: 163] ------------------ 183| 0| fprintf(stderr, "failed %s(%zu) \n", op, size); 184| |#ifdef NALLOC_ASAN 185| | __sanitizer_print_stack_trace(); 186| |#endif 187| 0| } 188| | 189| | return false; 190| 163|} ssh_privkey_fuzzer.c:nalloc_start: 151| 164|{ 152| 164| if (nalloc_random_bitmask) { ------------------ | Branch (152:9): [True: 164, False: 0] ------------------ 153| 164| if (nalloc_random_state & 0x10) { ------------------ | Branch (153:13): [True: 75, False: 89] ------------------ 154| 75| nalloc_bitmask = 0xFFFFFFFF; 155| 89| } else { 156| 89| nalloc_bitmask = 1 << (5 + (nalloc_random_state & 0xF)); 157| 89| } 158| 164| } else if (nalloc_bitmask == 0) { ------------------ | Branch (158:16): [True: 0, False: 0] ------------------ 159| | // nalloc disabled 160| 0| return 2; 161| 0| } 162| 164| nalloc_random_state = 0; 163| 14.4M| for (size_t i = 0; i < size; i++) { ------------------ | Branch (163:24): [True: 14.4M, False: 164] ------------------ 164| 14.4M| nalloc_random_update(data[i]); 165| 14.4M| } 166| 164| if (__sync_fetch_and_add(&nalloc_running, 1)) { ------------------ | Branch (166:9): [True: 0, False: 164] ------------------ 167| 0| __sync_fetch_and_sub(&nalloc_running, 1); 168| 0| return 0; 169| 0| } 170| 164| nalloc_runs++; 171| 164| return 1; 172| 164|} ssh_privkey_fuzzer.c:nalloc_end: 176| 164|{ 177| 164| __sync_fetch_and_sub(&nalloc_running, 1); 178| 164|} LLVMFuzzerInitialize: 36| 2|{ 37| 2| (void)argc; 38| | 39| 2| nalloc_init(*argv[0]); 40| | 41| 2| ssh_init(); 42| | 43| 2| atexit(_fuzz_finalize); 44| | 45| 2| return 0; 46| 2|} LLVMFuzzerTestOneInput: 49| 164|{ 50| 164| ssh_key pkey = NULL; 51| 164| uint8_t *input = NULL; 52| 164| int rc; 53| | 54| 164| assert(nalloc_start(data, size) > 0); ------------------ | Branch (54:5): [True: 0, False: 164] | Branch (54:5): [True: 164, False: 0] ------------------ 55| | 56| 164| input = bin_to_base64(data, size); 57| 164| if (input == NULL) { ------------------ | Branch (57:9): [True: 42, False: 122] ------------------ 58| 42| goto out; 59| 42| } 60| | 61| 122| rc = ssh_pki_import_privkey_base64((char *)input, NULL, NULL, NULL, &pkey); 62| 122| free(input); 63| 122| if (rc != SSH_OK) { ------------------ | | 316| 122|#define SSH_OK 0 /* No error */ ------------------ | Branch (63:9): [True: 122, False: 0] ------------------ 64| 122| goto out; 65| 122| } 66| 0| ssh_key_free(pkey); 67| | 68| 164|out: 69| 164| nalloc_end(); 70| 164| return 0; 71| 0|} ssh_privkey_fuzzer.c:_fuzz_finalize: 31| 2|{ 32| 2| ssh_finalize(); 33| 2|}