sshfatal: 39| 668|{ 40| 668| va_list args; 41| | 42| 668| va_start(args, fmt); 43| 668| sshlogv(file, func, line, showfunc, level, suffix, fmt, args); 44| | va_end(args); 45| 668| cleanup_exit(255); 46| 668|} log_init: 196| 1|{ 197| |#if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT) 198| | struct syslog_data sdata = SYSLOG_DATA_INIT; 199| |#endif 200| | 201| 1| argv0 = av0; 202| | 203| 1| if (log_change_level(level) != 0) { ------------------ | Branch (203:6): [True: 0, False: 1] ------------------ 204| 0| fprintf(stderr, "Unrecognized internal syslog level code %d\n", 205| 0| (int) level); 206| 0| exit(1); 207| 0| } 208| | 209| 1| log_handler = NULL; 210| 1| log_handler_ctx = NULL; 211| | 212| 1| log_on_stderr = on_stderr; 213| 1| if (on_stderr) ------------------ | Branch (213:6): [True: 0, False: 1] ------------------ 214| 0| return; 215| | 216| 1| switch (facility) { 217| 0| case SYSLOG_FACILITY_DAEMON: ------------------ | Branch (217:2): [True: 0, False: 1] ------------------ 218| 0| log_facility = LOG_DAEMON; 219| 0| break; 220| 0| case SYSLOG_FACILITY_USER: ------------------ | Branch (220:2): [True: 0, False: 1] ------------------ 221| 0| log_facility = LOG_USER; 222| 0| break; 223| 1| case SYSLOG_FACILITY_AUTH: ------------------ | Branch (223:2): [True: 1, False: 0] ------------------ 224| 1| log_facility = LOG_AUTH; 225| 1| break; 226| 0|#ifdef LOG_AUTHPRIV 227| 0| case SYSLOG_FACILITY_AUTHPRIV: ------------------ | Branch (227:2): [True: 0, False: 1] ------------------ 228| 0| log_facility = LOG_AUTHPRIV; 229| 0| break; 230| 0|#endif 231| 0| case SYSLOG_FACILITY_LOCAL0: ------------------ | Branch (231:2): [True: 0, False: 1] ------------------ 232| 0| log_facility = LOG_LOCAL0; 233| 0| break; 234| 0| case SYSLOG_FACILITY_LOCAL1: ------------------ | Branch (234:2): [True: 0, False: 1] ------------------ 235| 0| log_facility = LOG_LOCAL1; 236| 0| break; 237| 0| case SYSLOG_FACILITY_LOCAL2: ------------------ | Branch (237:2): [True: 0, False: 1] ------------------ 238| 0| log_facility = LOG_LOCAL2; 239| 0| break; 240| 0| case SYSLOG_FACILITY_LOCAL3: ------------------ | Branch (240:2): [True: 0, False: 1] ------------------ 241| 0| log_facility = LOG_LOCAL3; 242| 0| break; 243| 0| case SYSLOG_FACILITY_LOCAL4: ------------------ | Branch (243:2): [True: 0, False: 1] ------------------ 244| 0| log_facility = LOG_LOCAL4; 245| 0| break; 246| 0| case SYSLOG_FACILITY_LOCAL5: ------------------ | Branch (246:2): [True: 0, False: 1] ------------------ 247| 0| log_facility = LOG_LOCAL5; 248| 0| break; 249| 0| case SYSLOG_FACILITY_LOCAL6: ------------------ | Branch (249:2): [True: 0, False: 1] ------------------ 250| 0| log_facility = LOG_LOCAL6; 251| 0| break; 252| 0| case SYSLOG_FACILITY_LOCAL7: ------------------ | Branch (252:2): [True: 0, False: 1] ------------------ 253| 0| log_facility = LOG_LOCAL7; 254| 0| break; 255| 0| default: ------------------ | Branch (255:2): [True: 0, False: 1] ------------------ 256| 0| fprintf(stderr, 257| 0| "Unrecognized internal syslog facility code %d\n", 258| 0| (int) facility); 259| 0| exit(1); 260| 1| } 261| | 262| | /* 263| | * If an external library (eg libwrap) attempts to use syslog 264| | * immediately after reexec, syslog may be pointing to the wrong 265| | * facility, so we force an open/close of syslog here. 266| | */ 267| |#if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT) 268| | openlog_r(argv0 ? argv0 : __progname, LOG_PID, log_facility, &sdata); 269| | closelog_r(&sdata); 270| |#else 271| 1| openlog(argv0 ? argv0 : __progname, LOG_PID, log_facility); ------------------ | Branch (271:10): [True: 1, False: 0] ------------------ 272| 1| closelog(); 273| 1|#endif 274| 1|} log_change_level: 278| 1|{ 279| | /* no-op if log_init has not been called */ 280| 1| if (argv0 == NULL) ------------------ | Branch (280:6): [True: 0, False: 1] ------------------ 281| 0| return 0; 282| | 283| 1| switch (new_log_level) { 284| 0| case SYSLOG_LEVEL_QUIET: ------------------ | Branch (284:2): [True: 0, False: 1] ------------------ 285| 0| case SYSLOG_LEVEL_FATAL: ------------------ | Branch (285:2): [True: 0, False: 1] ------------------ 286| 1| case SYSLOG_LEVEL_ERROR: ------------------ | Branch (286:2): [True: 1, False: 0] ------------------ 287| 1| case SYSLOG_LEVEL_INFO: ------------------ | Branch (287:2): [True: 0, False: 1] ------------------ 288| 1| case SYSLOG_LEVEL_VERBOSE: ------------------ | Branch (288:2): [True: 0, False: 1] ------------------ 289| 1| case SYSLOG_LEVEL_DEBUG1: ------------------ | Branch (289:2): [True: 0, False: 1] ------------------ 290| 1| case SYSLOG_LEVEL_DEBUG2: ------------------ | Branch (290:2): [True: 0, False: 1] ------------------ 291| 1| case SYSLOG_LEVEL_DEBUG3: ------------------ | Branch (291:2): [True: 0, False: 1] ------------------ 292| 1| log_level = new_log_level; 293| 1| return 0; 294| 0| default: ------------------ | Branch (294:2): [True: 0, False: 1] ------------------ 295| 0| return -1; 296| 1| } 297| 1|} sshlog: 430| 343k|{ 431| 343k| va_list args; 432| | 433| 343k| va_start(args, fmt); 434| 343k| sshlogv(file, func, line, showfunc, level, suffix, fmt, args); 435| | va_end(args); 436| 343k|} sshlogv: 454| 343k|{ 455| 343k| char tag[128], fmt2[MSGBUFSIZ + 128]; 456| 343k| int forced = 0; 457| 343k| const char *cp; 458| 343k| size_t i; 459| | 460| | /* short circuit processing early if we're not going to log anything */ 461| 343k| if (nlog_verbose == 0 && level > log_level) ------------------ | Branch (461:6): [True: 343k, False: 0] | Branch (461:27): [True: 342k, False: 1.24k] ------------------ 462| 342k| return; 463| | 464| 1.24k| snprintf(tag, sizeof(tag), "%.48s:%.48s():%d (bin=%s, pid=%ld)", 465| 1.24k| (cp = strrchr(file, '/')) == NULL ? file : cp + 1, func, line, ------------------ | Branch (465:6): [True: 148, False: 1.09k] ------------------ 466| 1.24k| argv0 == NULL ? "UNKNOWN" : argv0, (long)getpid()); ------------------ | Branch (466:6): [True: 0, False: 1.24k] ------------------ 467| 1.24k| for (i = 0; i < nlog_verbose; i++) { ------------------ | Branch (467:14): [True: 0, False: 1.24k] ------------------ 468| 0| if (match_pattern_list(tag, log_verbose[i], 0) == 1) { ------------------ | Branch (468:7): [True: 0, False: 0] ------------------ 469| 0| forced = 1; 470| 0| break; 471| 0| } 472| 0| } 473| | 474| 1.24k| if (forced) ------------------ | Branch (474:6): [True: 0, False: 1.24k] ------------------ 475| 0| snprintf(fmt2, sizeof(fmt2), "%s: %s", tag, fmt); 476| 1.24k| else if (showfunc) ------------------ | Branch (476:11): [True: 915, False: 330] ------------------ 477| 915| snprintf(fmt2, sizeof(fmt2), "%s: %s", func, fmt); 478| 330| else 479| 330| strlcpy(fmt2, fmt, sizeof(fmt2)); 480| | 481| 1.24k| do_log(level, forced, suffix, fmt2, args); 482| 1.24k|} log.c:do_log: 339| 1.24k|{ 340| |#if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT) 341| | struct syslog_data sdata = SYSLOG_DATA_INIT; 342| |#endif 343| 1.24k| char msgbuf[MSGBUFSIZ]; 344| 1.24k| char fmtbuf[MSGBUFSIZ]; 345| 1.24k| char *txt = NULL; 346| 1.24k| int pri = LOG_INFO; 347| 1.24k| int saved_errno = errno; 348| 1.24k| log_handler_fn *tmp_handler; 349| 1.24k| const char *progname = argv0 != NULL ? argv0 : __progname; ------------------ | Branch (349:25): [True: 1.24k, False: 0] ------------------ 350| | 351| 1.24k| if (!force && level > log_level) ------------------ | Branch (351:6): [True: 1.24k, False: 0] | Branch (351:16): [True: 0, False: 1.24k] ------------------ 352| 0| return; 353| | 354| 1.24k| switch (level) { 355| 668| case SYSLOG_LEVEL_FATAL: ------------------ | Branch (355:2): [True: 668, False: 577] ------------------ 356| 668| if (!log_on_stderr) ------------------ | Branch (356:7): [True: 668, False: 0] ------------------ 357| 668| txt = "fatal"; 358| 668| pri = LOG_CRIT; 359| 668| break; 360| 577| case SYSLOG_LEVEL_ERROR: ------------------ | Branch (360:2): [True: 577, False: 668] ------------------ 361| 577| if (!log_on_stderr) ------------------ | Branch (361:7): [True: 577, False: 0] ------------------ 362| 577| txt = "error"; 363| 577| pri = LOG_ERR; 364| 577| break; 365| 0| case SYSLOG_LEVEL_INFO: ------------------ | Branch (365:2): [True: 0, False: 1.24k] ------------------ 366| 0| pri = LOG_INFO; 367| 0| break; 368| 0| case SYSLOG_LEVEL_VERBOSE: ------------------ | Branch (368:2): [True: 0, False: 1.24k] ------------------ 369| 0| pri = LOG_INFO; 370| 0| break; 371| 0| case SYSLOG_LEVEL_DEBUG1: ------------------ | Branch (371:2): [True: 0, False: 1.24k] ------------------ 372| 0| txt = "debug1"; 373| 0| pri = LOG_DEBUG; 374| 0| break; 375| 0| case SYSLOG_LEVEL_DEBUG2: ------------------ | Branch (375:2): [True: 0, False: 1.24k] ------------------ 376| 0| txt = "debug2"; 377| 0| pri = LOG_DEBUG; 378| 0| break; 379| 0| case SYSLOG_LEVEL_DEBUG3: ------------------ | Branch (379:2): [True: 0, False: 1.24k] ------------------ 380| 0| txt = "debug3"; 381| 0| pri = LOG_DEBUG; 382| 0| break; 383| 0| default: ------------------ | Branch (383:2): [True: 0, False: 1.24k] ------------------ 384| 0| txt = "internal error"; 385| 0| pri = LOG_ERR; 386| 0| break; 387| 1.24k| } 388| 1.24k| if (txt != NULL && log_handler == NULL) { ------------------ | Branch (388:6): [True: 1.24k, False: 0] | Branch (388:21): [True: 1.24k, False: 0] ------------------ 389| 1.24k| snprintf(fmtbuf, sizeof(fmtbuf), "%s: %s", txt, fmt); 390| 1.24k| vsnprintf(msgbuf, sizeof(msgbuf), fmtbuf, args); 391| 1.24k| } else { 392| 0| vsnprintf(msgbuf, sizeof(msgbuf), fmt, args); 393| 0| } 394| 1.24k| if (suffix != NULL) { ------------------ | Branch (394:6): [True: 668, False: 577] ------------------ 395| 668| snprintf(fmtbuf, sizeof(fmtbuf), "%s: %s", msgbuf, suffix); 396| 668| strlcpy(msgbuf, fmtbuf, sizeof(msgbuf)); 397| 668| } 398| 1.24k| strnvis(fmtbuf, msgbuf, sizeof(fmtbuf), 399| 1.24k| log_on_stderr ? LOG_STDERR_VIS : LOG_SYSLOG_VIS); ------------------ | | 69| 0|#define LOG_STDERR_VIS (VIS_SAFE|VIS_OCTAL) | | ------------------ | | | | 60| 0|#define VIS_SAFE 0x20 /* only encode "unsafe" characters */ | | ------------------ | | #define LOG_STDERR_VIS (VIS_SAFE|VIS_OCTAL) | | ------------------ | | | | 49| 0|#define VIS_OCTAL 0x01 /* use octal \ddd format */ | | ------------------ ------------------ log_on_stderr ? LOG_STDERR_VIS : LOG_SYSLOG_VIS); ------------------ | | 68| 1.24k|#define LOG_SYSLOG_VIS (VIS_CSTYLE|VIS_NL|VIS_TAB|VIS_OCTAL) | | ------------------ | | | | 50| 1.24k|#define VIS_CSTYLE 0x02 /* use \[nrft0..] where appropriate */ | | ------------------ | | #define LOG_SYSLOG_VIS (VIS_CSTYLE|VIS_NL|VIS_TAB|VIS_OCTAL) | | ------------------ | | | | 58| 1.24k|#define VIS_NL 0x10 /* also encode newline */ | | ------------------ | | #define LOG_SYSLOG_VIS (VIS_CSTYLE|VIS_NL|VIS_TAB|VIS_OCTAL) | | ------------------ | | | | 57| 1.24k|#define VIS_TAB 0x08 /* also encode tab */ | | ------------------ | | #define LOG_SYSLOG_VIS (VIS_CSTYLE|VIS_NL|VIS_TAB|VIS_OCTAL) | | ------------------ | | | | 49| 1.24k|#define VIS_OCTAL 0x01 /* use octal \ddd format */ | | ------------------ ------------------ | Branch (399:6): [True: 0, False: 1.24k] ------------------ 400| 1.24k| if (log_handler != NULL) { ------------------ | Branch (400:6): [True: 0, False: 1.24k] ------------------ 401| | /* Avoid recursion */ 402| 0| tmp_handler = log_handler; 403| 0| log_handler = NULL; 404| | /* Note: this sends the raw (i.e. no strnvis) log message */ 405| 0| tmp_handler(level, force, msgbuf, log_handler_ctx); 406| 0| log_handler = tmp_handler; 407| 1.24k| } else if (log_on_stderr) { ------------------ | Branch (407:13): [True: 0, False: 1.24k] ------------------ 408| 0| snprintf(msgbuf, sizeof msgbuf, "%s%s%.*s\r\n", 409| 0| (log_on_stderr > 1) ? progname : "", ------------------ | Branch (409:7): [True: 0, False: 0] ------------------ 410| 0| (log_on_stderr > 1) ? ": " : "", ------------------ | Branch (410:7): [True: 0, False: 0] ------------------ 411| 0| (int)sizeof msgbuf - 3, fmtbuf); 412| 0| (void)write(log_stderr_fd, msgbuf, strlen(msgbuf)); 413| 1.24k| } else { 414| |#if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT) 415| | openlog_r(progname, LOG_PID, log_facility, &sdata); 416| | syslog_r(pri, &sdata, "%.500s", fmtbuf); 417| | closelog_r(&sdata); 418| |#else 419| 1.24k| openlog(progname, LOG_PID, log_facility); 420| 1.24k| syslog(pri, "%.500s", fmtbuf); 421| 1.24k| closelog(); 422| 1.24k|#endif 423| 1.24k| } 424| | errno = saved_errno; 425| 1.24k|} tilde_expand: 1277| 162|{ 1278| 162| char *ocopy = NULL, *copy, *s = NULL; 1279| 162| const char *path = NULL, *user = NULL; 1280| 162| struct passwd *pw; 1281| 162| size_t len; 1282| 162| int ret = -1, r, slash; 1283| | 1284| 162| *retp = NULL; 1285| 162| if (*filename != '~') { ------------------ | Branch (1285:6): [True: 0, False: 162] ------------------ 1286| 0| *retp = xstrdup(filename); 1287| 0| return 0; 1288| 0| } 1289| 162| ocopy = copy = xstrdup(filename + 1); 1290| | 1291| 162| if (*copy == '\0') /* ~ */ ------------------ | Branch (1291:6): [True: 0, False: 162] ------------------ 1292| 0| path = NULL; 1293| 162| else if (*copy == '/') { ------------------ | Branch (1293:11): [True: 0, False: 162] ------------------ 1294| 0| copy += strspn(copy, "/"); 1295| 0| if (*copy == '\0') ------------------ | Branch (1295:7): [True: 0, False: 0] ------------------ 1296| 0| path = NULL; /* ~/ */ 1297| 0| else 1298| 0| path = copy; /* ~/path */ 1299| 162| } else { 1300| 162| user = copy; 1301| 162| if ((path = strchr(copy, '/')) != NULL) { ------------------ | Branch (1301:7): [True: 20, False: 142] ------------------ 1302| 20| copy[path - copy] = '\0'; 1303| 20| path++; 1304| 20| path += strspn(path, "/"); 1305| 20| if (*path == '\0') /* ~user/ */ ------------------ | Branch (1305:8): [True: 2, False: 18] ------------------ 1306| 2| path = NULL; 1307| | /* else ~user/path */ 1308| 20| } 1309| | /* else ~user */ 1310| 162| } 1311| 162| if (user != NULL) { ------------------ | Branch (1311:6): [True: 162, False: 0] ------------------ 1312| 162| if ((pw = getpwnam(user)) == NULL) { ------------------ | Branch (1312:7): [True: 148, False: 14] ------------------ 1313| 148| error_f("No such user %s", user); ------------------ | | 125| 148|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1314| 148| goto out; 1315| 148| } 1316| 162| } else if ((pw = getpwuid(uid)) == NULL) { ------------------ | Branch (1316:13): [True: 0, False: 0] ------------------ 1317| 0| error_f("No such uid %ld", (long)uid); ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1318| 0| goto out; 1319| 0| } 1320| | 1321| | /* Make sure directory has a trailing '/' */ 1322| 14| slash = (len = strlen(pw->pw_dir)) == 0 || pw->pw_dir[len - 1] != '/'; ------------------ | Branch (1322:10): [True: 0, False: 14] | Branch (1322:45): [True: 14, False: 0] ------------------ 1323| | 1324| 14| if ((r = xasprintf(&s, "%s%s%s", pw->pw_dir, ------------------ | Branch (1324:6): [True: 0, False: 14] ------------------ 1325| 14| slash ? "/" : "", path != NULL ? path : "")) <= 0) { ------------------ | Branch (1325:6): [True: 14, False: 0] | Branch (1325:24): [True: 9, False: 5] ------------------ 1326| 0| error_f("xasprintf failed"); ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1327| 0| goto out; 1328| 0| } 1329| 14| if (r >= PATH_MAX) { ------------------ | Branch (1329:6): [True: 0, False: 14] ------------------ 1330| 0| error_f("Path too long"); ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1331| 0| goto out; 1332| 0| } 1333| | /* success */ 1334| 14| ret = 0; 1335| 14| *retp = s; 1336| 14| s = NULL; 1337| 162| out: 1338| 162| free(s); 1339| 162| free(ocopy); 1340| 162| return ret; 1341| 14|} get_u32: 1696| 3.77k|{ 1697| 3.77k| const u_char *p = (const u_char *)vp; 1698| 3.77k| uint32_t v; 1699| | 1700| 3.77k| v = (uint32_t)p[0] << 24; 1701| 3.77k| v |= (uint32_t)p[1] << 16; 1702| 3.77k| v |= (uint32_t)p[2] << 8; 1703| 3.77k| v |= (uint32_t)p[3]; 1704| | 1705| 3.77k| return (v); 1706| 3.77k|} put_u32: 1751| 4|{ 1752| 4| u_char *p = (u_char *)vp; 1753| | 1754| 4| p[0] = (u_char)(v >> 24) & 0xff; 1755| 4| p[1] = (u_char)(v >> 16) & 0xff; 1756| 4| p[2] = (u_char)(v >> 8) & 0xff; 1757| 4| p[3] = (u_char)v & 0xff; 1758| 4|} freezero: 26| 11.3k|{ 27| 11.3k| if (ptr == NULL) ------------------ | Branch (27:6): [True: 0, False: 11.3k] ------------------ 28| 0| return; 29| 11.3k| explicit_bzero(ptr, sz); 30| 11.3k| free(ptr); 31| 11.3k|} recallocarray: 37| 15.6k|{ 38| 15.6k| size_t oldsize, newsize; 39| 15.6k| void *newptr; 40| | 41| 15.6k| if (ptr == NULL) ------------------ | Branch (41:6): [True: 0, False: 15.6k] ------------------ 42| 0| return calloc(newnmemb, size); 43| | 44| 15.6k| if ((newnmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) && ------------------ | | 33| 31.3k|#define MUL_NO_OVERFLOW ((size_t)1 << (sizeof(size_t) * 4)) ------------------ if ((newnmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) && ------------------ | | 33| 15.6k|#define MUL_NO_OVERFLOW ((size_t)1 << (sizeof(size_t) * 4)) ------------------ | Branch (44:7): [True: 0, False: 15.6k] | Branch (44:38): [True: 0, False: 15.6k] ------------------ 45| 15.6k| newnmemb > 0 && SIZE_MAX / newnmemb < size) { ------------------ | Branch (45:6): [True: 0, False: 0] | Branch (45:22): [True: 0, False: 0] ------------------ 46| 0| errno = ENOMEM; 47| 0| return NULL; 48| 0| } 49| 15.6k| newsize = newnmemb * size; 50| | 51| 15.6k| if ((oldnmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) && ------------------ | | 33| 31.3k|#define MUL_NO_OVERFLOW ((size_t)1 << (sizeof(size_t) * 4)) ------------------ if ((oldnmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) && ------------------ | | 33| 15.6k|#define MUL_NO_OVERFLOW ((size_t)1 << (sizeof(size_t) * 4)) ------------------ | Branch (51:7): [True: 0, False: 15.6k] | Branch (51:38): [True: 0, False: 15.6k] ------------------ 52| 15.6k| oldnmemb > 0 && SIZE_MAX / oldnmemb < size) { ------------------ | Branch (52:6): [True: 0, False: 0] | Branch (52:22): [True: 0, False: 0] ------------------ 53| 0| errno = EINVAL; 54| 0| return NULL; 55| 0| } 56| 15.6k| oldsize = oldnmemb * size; 57| | 58| | /* 59| | * Don't bother too much if we're shrinking just a bit, 60| | * we do not shrink for series of small steps, oh well. 61| | */ 62| 15.6k| if (newsize <= oldsize) { ------------------ | Branch (62:6): [True: 3.77k, False: 11.9k] ------------------ 63| 3.77k| size_t d = oldsize - newsize; 64| | 65| 3.77k| if (d < oldsize / 2 && d < (size_t)getpagesize()) { ------------------ | Branch (65:7): [True: 0, False: 3.77k] | Branch (65:26): [True: 0, False: 0] ------------------ 66| 0| memset((char *)ptr + newsize, 0, d); 67| 0| return ptr; 68| 0| } 69| 3.77k| } 70| | 71| 15.6k| newptr = malloc(newsize); 72| 15.6k| if (newptr == NULL) ------------------ | Branch (72:6): [True: 0, False: 15.6k] ------------------ 73| 0| return NULL; 74| | 75| 15.6k| if (newsize > oldsize) { ------------------ | Branch (75:6): [True: 11.9k, False: 3.77k] ------------------ 76| 11.9k| memcpy(newptr, ptr, oldsize); 77| 11.9k| memset((char *)newptr + oldsize, 0, newsize - oldsize); 78| 11.9k| } else 79| 3.77k| memcpy(newptr, ptr, newsize); 80| | 81| 15.6k| explicit_bzero(ptr, oldsize); 82| 15.6k| free(ptr); 83| | 84| 15.6k| return newptr; 85| 15.6k|} strlcat: 36| 1.55k|{ 37| 1.55k| char *d = dst; 38| 1.55k| const char *s = src; 39| 1.55k| size_t n = siz; 40| 1.55k| size_t dlen; 41| | 42| | /* Find the end of dst and adjust bytes left but don't go past end */ 43| 10.6k| while (n-- != 0 && *d != '\0') ------------------ | Branch (43:9): [True: 10.6k, False: 0] | Branch (43:21): [True: 9.09k, False: 1.55k] ------------------ 44| 9.09k| d++; 45| 1.55k| dlen = d - dst; 46| 1.55k| n = siz - dlen; 47| | 48| 1.55k| if (n == 0) ------------------ | Branch (48:6): [True: 0, False: 1.55k] ------------------ 49| 0| return(dlen + strlen(s)); 50| 439k| while (*s != '\0') { ------------------ | Branch (50:9): [True: 437k, False: 1.55k] ------------------ 51| 437k| if (n != 1) { ------------------ | Branch (51:7): [True: 437k, False: 67] ------------------ 52| 437k| *d++ = *s; 53| 437k| n--; 54| 437k| } 55| 437k| s++; 56| 437k| } 57| 1.55k| *d = '\0'; 58| | 59| 1.55k| return(dlen + (s - src)); /* count does not include NUL */ 60| 1.55k|} strlcpy: 34| 1.45k|{ 35| 1.45k| char *d = dst; 36| 1.45k| const char *s = src; 37| 1.45k| size_t n = siz; 38| | 39| | /* Copy as many bytes as will fit */ 40| 1.45k| if (n != 0) { ------------------ | Branch (40:6): [True: 1.45k, False: 0] ------------------ 41| 556k| while (--n != 0) { ------------------ | Branch (41:10): [True: 556k, False: 2] ------------------ 42| 556k| if ((*d++ = *s++) == '\0') ------------------ | Branch (42:8): [True: 1.45k, False: 554k] ------------------ 43| 1.45k| break; 44| 556k| } 45| 1.45k| } 46| | 47| | /* Not enough room in dst, add NUL and traverse rest of src */ 48| 1.45k| if (n == 0) { ------------------ | Branch (48:6): [True: 2, False: 1.45k] ------------------ 49| 2| if (siz != 0) ------------------ | Branch (49:7): [True: 2, False: 0] ------------------ 50| 2| *d = '\0'; /* NUL-terminate dst */ 51| 4| while (*s++) ------------------ | Branch (51:10): [True: 2, False: 2] ------------------ 52| 2| ; 53| 2| } 54| | 55| 1.45k| return(s - src - 1); /* count does not include NUL */ 56| 1.45k|} vis: 63| 36.6k|{ 64| 36.6k| if (isvisible(c, flag)) { ------------------ | | 47| 36.6k| (((c) == '\\' || (flag & VIS_ALL) == 0) && \ | | ------------------ | | | | 62| 36.1k|#define VIS_ALL 0x400 /* encode all characters */ | | ------------------ | | | Branch (47:4): [True: 432, False: 36.1k] | | | Branch (47:19): [True: 36.1k, False: 0] | | ------------------ | | 48| 36.6k| (((u_int)(c) <= UCHAR_MAX && isascii((u_char)(c)) && \ | | ------------------ | | | Branch (48:4): [True: 14.1k, False: 22.4k] | | ------------------ | | 49| 36.6k| (((c) != '*' && (c) != '?' && (c) != '[' && (c) != '#') || \ | | ------------------ | | | Branch (49:4): [True: 13.9k, False: 253] | | | Branch (49:18): [True: 13.7k, False: 226] | | | Branch (49:32): [True: 13.4k, False: 243] | | | Branch (49:46): [True: 13.1k, False: 278] | | ------------------ | | 50| 14.1k| (flag & VIS_GLOB) == 0) && isgraph((u_char)(c))) || \ | | ------------------ | | | | 68| 1.00k|#define VIS_GLOB 0x100 /* encode glob(3) magics and '#' */ | | ------------------ | | | Branch (50:3): [True: 1.00k, False: 0] | | ------------------ | | 51| 36.6k| ((flag & VIS_SP) == 0 && (c) == ' ') || \ | | ------------------ | | | | 56| 34.1k|#define VIS_SP 0x04 /* also encode space */ | | ------------------ | | | Branch (51:3): [True: 34.1k, False: 0] | | | Branch (51:27): [True: 319, False: 33.8k] | | ------------------ | | 52| 36.6k| ((flag & VIS_TAB) == 0 && (c) == '\t') || \ | | ------------------ | | | | 57| 33.8k|#define VIS_TAB 0x08 /* also encode tab */ | | ------------------ | | | Branch (52:3): [True: 0, False: 33.8k] | | | Branch (52:28): [True: 0, False: 0] | | ------------------ | | 53| 36.6k| ((flag & VIS_NL) == 0 && (c) == '\n') || \ | | ------------------ | | | | 58| 33.8k|#define VIS_NL 0x10 /* also encode newline */ | | ------------------ | | | Branch (53:3): [True: 0, False: 33.8k] | | | Branch (53:27): [True: 0, False: 0] | | ------------------ | | 54| 36.6k| ((flag & VIS_SAFE) && ((c) == '\b' || \ | | ------------------ | | | | 60| 33.8k|#define VIS_SAFE 0x20 /* only encode "unsafe" characters */ | | ------------------ | | | Branch (54:3): [True: 0, False: 33.8k] | | | Branch (54:25): [True: 0, False: 0] | | ------------------ | | 55| 0| (c) == '\007' || (c) == '\r' || \ | | ------------------ | | | Branch (55:3): [True: 0, False: 0] | | | Branch (55:20): [True: 0, False: 0] | | ------------------ | | 56| 0| isgraph((u_char)(c)))))) ------------------ | Branch (64:6): [True: 14.1k, False: 0] | Branch (64:6): [True: 2.46k, False: 11.7k] | Branch (64:6): [True: 0, False: 0] ------------------ 65| 2.77k| if ((c == '"' && (flag & VIS_DQ) != 0) || ------------------ | | 61| 299|#define VIS_DQ 0x200 /* backslash-escape double quotes */ ------------------ | Branch (65:8): [True: 299, False: 2.48k] | Branch (65:20): [True: 0, False: 299] ------------------ 66| 2.77k| (c == '\\' && (flag & VIS_NOSLASH) == 0)) ------------------ | | 67| 432|#define VIS_NOSLASH 0x40 /* inhibit printing '\' */ ------------------ | Branch (66:8): [True: 432, False: 2.34k] | Branch (66:21): [True: 432, False: 0] ------------------ 67| 432| *dst++ = '\\'; 68| 2.77k| *dst++ = c; 69| 2.77k| *dst = '\0'; 70| 2.77k| return (dst); 71| 2.77k| } 72| | 73| 33.8k| if (flag & VIS_CSTYLE) { ------------------ | | 50| 33.8k|#define VIS_CSTYLE 0x02 /* use \[nrft0..] where appropriate */ ------------------ | Branch (73:6): [True: 33.8k, False: 0] ------------------ 74| 33.8k| switch(c) { ------------------ | Branch (74:10): [True: 9.08k, False: 24.7k] ------------------ 75| 311| case '\n': ------------------ | Branch (75:3): [True: 311, False: 33.5k] ------------------ 76| 311| *dst++ = '\\'; 77| 311| *dst++ = 'n'; 78| 311| goto done; 79| 274| case '\r': ------------------ | Branch (79:3): [True: 274, False: 33.5k] ------------------ 80| 274| *dst++ = '\\'; 81| 274| *dst++ = 'r'; 82| 274| goto done; 83| 847| case '\b': ------------------ | Branch (83:3): [True: 847, False: 33.0k] ------------------ 84| 847| *dst++ = '\\'; 85| 847| *dst++ = 'b'; 86| 847| goto done; 87| 6.41k| case '\a': ------------------ | Branch (87:3): [True: 6.41k, False: 27.4k] ------------------ 88| 6.41k| *dst++ = '\\'; 89| 6.41k| *dst++ = 'a'; 90| 6.41k| goto done; 91| 328| case '\v': ------------------ | Branch (91:3): [True: 328, False: 33.5k] ------------------ 92| 328| *dst++ = '\\'; 93| 328| *dst++ = 'v'; 94| 328| goto done; 95| 623| case '\t': ------------------ | Branch (95:3): [True: 623, False: 33.2k] ------------------ 96| 623| *dst++ = '\\'; 97| 623| *dst++ = 't'; 98| 623| goto done; 99| 290| case '\f': ------------------ | Branch (99:3): [True: 290, False: 33.5k] ------------------ 100| 290| *dst++ = '\\'; 101| 290| *dst++ = 'f'; 102| 290| goto done; 103| 0| case ' ': ------------------ | Branch (103:3): [True: 0, False: 33.8k] ------------------ 104| 0| *dst++ = '\\'; 105| 0| *dst++ = 's'; 106| 0| goto done; 107| 0| case '\0': ------------------ | Branch (107:3): [True: 0, False: 33.8k] ------------------ 108| 0| *dst++ = '\\'; 109| 0| *dst++ = '0'; 110| 0| if (isoctal(nextc)) { ------------------ | | 45| 0|#define isoctal(c) (((u_char)(c)) >= '0' && ((u_char)(c)) <= '7') | | ------------------ | | | Branch (45:21): [True: 0, False: 0] | | | Branch (45:45): [True: 0, False: 0] | | ------------------ ------------------ 111| 0| *dst++ = '0'; 112| 0| *dst++ = '0'; 113| 0| } 114| 0| goto done; 115| 33.8k| } 116| 33.8k| } 117| 24.7k| if (((c & 0177) == ' ') || (flag & VIS_OCTAL) || ------------------ | | 49| 21.6k|#define VIS_OCTAL 0x01 /* use octal \ddd format */ ------------------ | Branch (117:6): [True: 3.12k, False: 21.6k] | Branch (117:29): [True: 21.6k, False: 0] ------------------ 118| 24.7k| ((flag & VIS_GLOB) && (c == '*' || c == '?' || c == '[' || c == '#'))) { ------------------ | | 68| 0|#define VIS_GLOB 0x100 /* encode glob(3) magics and '#' */ ------------------ | Branch (118:7): [True: 0, False: 0] | Branch (118:29): [True: 0, False: 0] | Branch (118:41): [True: 0, False: 0] | Branch (118:53): [True: 0, False: 0] | Branch (118:65): [True: 0, False: 0] ------------------ 119| 24.7k| *dst++ = '\\'; 120| 24.7k| *dst++ = ((u_char)c >> 6 & 07) + '0'; 121| 24.7k| *dst++ = ((u_char)c >> 3 & 07) + '0'; 122| 24.7k| *dst++ = ((u_char)c & 07) + '0'; 123| 24.7k| goto done; 124| 24.7k| } 125| 0| if ((flag & VIS_NOSLASH) == 0) ------------------ | | 67| 0|#define VIS_NOSLASH 0x40 /* inhibit printing '\' */ ------------------ | Branch (125:6): [True: 0, False: 0] ------------------ 126| 0| *dst++ = '\\'; 127| 0| if (c & 0200) { ------------------ | Branch (127:6): [True: 0, False: 0] ------------------ 128| 0| c &= 0177; 129| 0| *dst++ = 'M'; 130| 0| } 131| 0| if (iscntrl((u_char)c)) { ------------------ | Branch (131:6): [True: 0, False: 0] ------------------ 132| 0| *dst++ = '^'; 133| 0| if (c == 0177) ------------------ | Branch (133:7): [True: 0, False: 0] ------------------ 134| 0| *dst++ = '?'; 135| 0| else 136| 0| *dst++ = c + '@'; 137| 0| } else { 138| 0| *dst++ = '-'; 139| 0| *dst++ = c; 140| 0| } 141| 33.8k|done: 142| 33.8k| *dst = '\0'; 143| 33.8k| return (dst); 144| 0|} strnvis: 175| 1.24k|{ 176| 1.24k| char *start, *end; 177| 1.24k| char tbuf[5]; 178| 1.24k| int c, i; 179| | 180| 1.24k| i = 0; 181| 103k| for (start = dst, end = start + siz - 1; (c = *src) && dst < end; ) { ------------------ | Branch (181:43): [True: 102k, False: 1.16k] | Branch (181:57): [True: 102k, False: 30] ------------------ 182| 102k| if (isvisible(c, flag)) { ------------------ | | 47| 102k| (((c) == '\\' || (flag & VIS_ALL) == 0) && \ | | ------------------ | | | | 62| 98.8k|#define VIS_ALL 0x400 /* encode all characters */ | | ------------------ | | | Branch (47:4): [True: 3.33k, False: 98.8k] | | | Branch (47:19): [True: 98.8k, False: 0] | | ------------------ | | 48| 102k| (((u_int)(c) <= UCHAR_MAX && isascii((u_char)(c)) && \ | | ------------------ | | | Branch (48:4): [True: 81.8k, False: 20.3k] | | ------------------ | | 49| 102k| (((c) != '*' && (c) != '?' && (c) != '[' && (c) != '#') || \ | | ------------------ | | | Branch (49:4): [True: 81.4k, False: 405] | | | Branch (49:18): [True: 80.8k, False: 541] | | | Branch (49:32): [True: 80.4k, False: 399] | | | Branch (49:46): [True: 80.2k, False: 266] | | ------------------ | | 50| 81.8k| (flag & VIS_GLOB) == 0) && isgraph((u_char)(c))) || \ | | ------------------ | | | | 68| 1.61k|#define VIS_GLOB 0x100 /* encode glob(3) magics and '#' */ | | ------------------ | | | Branch (50:3): [True: 1.61k, False: 0] | | ------------------ | | 51| 102k| ((flag & VIS_SP) == 0 && (c) == ' ') || \ | | ------------------ | | | | 56| 35.8k|#define VIS_SP 0x04 /* also encode space */ | | ------------------ | | | Branch (51:3): [True: 35.8k, False: 0] | | | Branch (51:27): [True: 6.63k, False: 29.1k] | | ------------------ | | 52| 102k| ((flag & VIS_TAB) == 0 && (c) == '\t') || \ | | ------------------ | | | | 57| 29.1k|#define VIS_TAB 0x08 /* also encode tab */ | | ------------------ | | | Branch (52:3): [True: 0, False: 29.1k] | | | Branch (52:28): [True: 0, False: 0] | | ------------------ | | 53| 102k| ((flag & VIS_NL) == 0 && (c) == '\n') || \ | | ------------------ | | | | 58| 29.1k|#define VIS_NL 0x10 /* also encode newline */ | | ------------------ | | | Branch (53:3): [True: 0, False: 29.1k] | | | Branch (53:27): [True: 0, False: 0] | | ------------------ | | 54| 102k| ((flag & VIS_SAFE) && ((c) == '\b' || \ | | ------------------ | | | | 60| 29.1k|#define VIS_SAFE 0x20 /* only encode "unsafe" characters */ | | ------------------ | | | Branch (54:3): [True: 0, False: 29.1k] | | | Branch (54:25): [True: 0, False: 0] | | ------------------ | | 55| 0| (c) == '\007' || (c) == '\r' || \ | | ------------------ | | | Branch (55:3): [True: 0, False: 0] | | | Branch (55:20): [True: 0, False: 0] | | ------------------ | | 56| 0| isgraph((u_char)(c)))))) ------------------ | Branch (182:7): [True: 81.8k, False: 0] | Branch (182:7): [True: 66.3k, False: 15.4k] | Branch (182:7): [True: 0, False: 0] ------------------ 183| 72.9k| if ((c == '"' && (flag & VIS_DQ) != 0) || ------------------ | | 61| 889|#define VIS_DQ 0x200 /* backslash-escape double quotes */ ------------------ | Branch (183:9): [True: 889, False: 72.0k] | Branch (183:21): [True: 0, False: 889] ------------------ 184| 72.9k| (c == '\\' && (flag & VIS_NOSLASH) == 0)) { ------------------ | | 67| 3.33k|#define VIS_NOSLASH 0x40 /* inhibit printing '\' */ ------------------ | Branch (184:9): [True: 3.33k, False: 69.6k] | Branch (184:22): [True: 3.33k, False: 0] ------------------ 185| | /* need space for the extra '\\' */ 186| 3.33k| if (dst + 1 >= end) { ------------------ | Branch (186:9): [True: 7, False: 3.32k] ------------------ 187| 7| i = 2; 188| 7| break; 189| 7| } 190| 3.32k| *dst++ = '\\'; 191| 3.32k| } 192| 72.9k| i = 1; 193| 72.9k| *dst++ = c; 194| 72.9k| src++; 195| 72.9k| } else { 196| 29.1k| i = vis(tbuf, c, flag, *++src) - tbuf; 197| 29.1k| if (dst + i <= end) { ------------------ | Branch (197:8): [True: 29.1k, False: 47] ------------------ 198| 29.1k| memcpy(dst, tbuf, i); 199| 29.1k| dst += i; 200| 29.1k| } else { 201| 47| src--; 202| 47| break; 203| 47| } 204| 29.1k| } 205| 102k| } 206| 1.24k| if (siz > 0) ------------------ | Branch (206:6): [True: 1.24k, False: 0] ------------------ 207| 1.24k| *dst = '\0'; 208| 1.24k| if (dst + i > end) { ------------------ | Branch (208:6): [True: 85, False: 1.16k] ------------------ 209| | /* adjust return value for truncation */ 210| 7.52k| while ((c = *src)) ------------------ | Branch (210:10): [True: 7.43k, False: 85] ------------------ 211| 7.43k| dst += vis(tbuf, c, flag, *++src) - tbuf; 212| 85| } 213| 1.24k| return (dst - start); 214| 1.24k|} __wrap_malloc: 83| 50.8k|{ 84| 50.8k| void *p = __real_malloc(size); 85| 50.8k| arena_track(p); 86| 50.8k| return p; 87| 50.8k|} __wrap_calloc: 91| 15.2k|{ 92| 15.2k| void *p = __real_calloc(nmemb, size); 93| 15.2k| arena_track(p); 94| 15.2k| return p; 95| 15.2k|} __wrap_free: 108| 90.7k|{ 109| 90.7k| arena_untrack(ptr); 110| 90.7k| __real_free(ptr); 111| 90.7k|} __wrap_strdup: 115| 1.83k|{ 116| 1.83k| size_t len; 117| 1.83k| char *p; 118| 1.83k| if (s == NULL) ------------------ | Branch (118:6): [True: 0, False: 1.83k] ------------------ 119| 0| return NULL; 120| 1.83k| len = strlen(s) + 1; 121| 1.83k| p = (char *)__real_malloc(len); 122| 1.83k| if (p == NULL) ------------------ | Branch (122:6): [True: 0, False: 1.83k] ------------------ 123| 0| return NULL; 124| 1.83k| memcpy(p, s, len); 125| 1.83k| arena_track(p); 126| 1.83k| return p; 127| 1.83k|} fuzz_arena_begin: 131| 1.83k|{ 132| 1.83k| tracking = 1; 133| 1.83k|} fuzz_arena_release: 137| 1.16k|{ 138| 1.16k| struct arena_node *n; 139| 1.16k| tracking = 0; 140| 1.16k| while (arena_head != NULL) { ------------------ | Branch (140:9): [True: 0, False: 1.16k] ------------------ 141| 0| n = arena_head; 142| 0| arena_head = n->next; 143| 0| __real_free(n); 144| 0| } 145| 1.16k|} fuzz_arena_cleanup: 149| 668|{ 150| 668| struct arena_node *n; 151| 668| tracking = 0; 152| 5.65k| while (arena_head != NULL) { ------------------ | Branch (152:9): [True: 4.98k, False: 668] ------------------ 153| 4.98k| n = arena_head; 154| 4.98k| arena_head = n->next; 155| 4.98k| __real_free(n->ptr); 156| 4.98k| __real_free(n); 157| 4.98k| } 158| 668|} fuzz_arena.c:arena_track: 53| 67.9k|{ 54| 67.9k| struct arena_node *n; 55| 67.9k| if (!tracking || p == NULL) ------------------ | Branch (55:6): [True: 22.3k, False: 45.5k] | Branch (55:19): [True: 0, False: 45.5k] ------------------ 56| 22.3k| return; 57| 45.5k| n = (struct arena_node *)__real_malloc(sizeof(*n)); 58| 45.5k| if (n == NULL) ------------------ | Branch (58:6): [True: 0, False: 45.5k] ------------------ 59| 0| return; 60| 45.5k| n->ptr = p; 61| 45.5k| n->next = arena_head; 62| 45.5k| arena_head = n; 63| 45.5k|} fuzz_arena.c:arena_untrack: 67| 90.7k|{ 68| 90.7k| struct arena_node **pp; 69| 90.7k| if (p == NULL) ------------------ | Branch (69:6): [True: 29.7k, False: 61.0k] ------------------ 70| 29.7k| return; 71| 99.3k| for (pp = &arena_head; *pp != NULL; pp = &(*pp)->next) { ------------------ | Branch (71:25): [True: 78.9k, False: 20.4k] ------------------ 72| 78.9k| if ((*pp)->ptr == p) { ------------------ | Branch (72:7): [True: 40.6k, False: 38.3k] ------------------ 73| 40.6k| struct arena_node *n = *pp; 74| 40.6k| *pp = n->next; 75| 40.6k| __real_free(n); 76| 40.6k| return; 77| 40.6k| } 78| 78.9k| } 79| 61.0k|} LLVMFuzzerTestOneInput: 20| 1.84k|{ 21| 1.84k| fuzz_server_one(data, size); 22| 1.84k| return 0; 23| 1.84k|} cleanup_exit: 60| 668|{ 61| 668| if (in_fuzz_server) ------------------ | Branch (61:6): [True: 668, False: 0] ------------------ 62| 668| longjmp(fuzz_server_env, code ? code : 1); ------------------ | Branch (62:28): [True: 668, False: 0] ------------------ 63| 0| _exit(code); 64| 668|} fuzz_server_one: 122| 1.84k|{ 123| 1.84k| if (!log_initialized) { ------------------ | Branch (123:6): [True: 1, False: 1.84k] ------------------ 124| 1| log_initialized = 1; 125| 1| log_init("sftp_server_msg_fuzz", SYSLOG_LEVEL_ERROR, 126| 1| SYSLOG_FACILITY_AUTH, 0); 127| | 128| | /* Confine filesystem syscalls (process_open/mkdir/symlink) to a fresh tmpdir. */ 129| 1| char tmpdir[] = "/tmp/sftp_fuzz_XXXXXX"; 130| 1| if (mkdtemp(tmpdir) != NULL && chdir(tmpdir) != 0) ------------------ | Branch (130:7): [True: 1, False: 0] | Branch (130:34): [True: 0, False: 1] ------------------ 131| 0| _exit(1); 132| | 133| 1| memset(&fuzz_pw, 0, sizeof(fuzz_pw)); 134| 1| fuzz_pw.pw_name = (char *)"fuzz"; 135| 1| fuzz_pw.pw_uid = getuid(); 136| 1| fuzz_pw.pw_gid = getgid(); 137| 1| fuzz_pw.pw_dir = (char *)"/tmp"; 138| 1| fuzz_pw.pw_shell = (char *)"/bin/sh"; 139| 1| } 140| | 141| 1.84k| if (size == 0 || size > 65000) ------------------ | Branch (141:6): [True: 0, False: 1.84k] | Branch (141:19): [True: 11, False: 1.83k] ------------------ 142| 11| return; 143| | 144| 1.83k| reset_module_globals(); 145| | 146| 1.83k| fuzz_arena_begin(); 147| 1.83k| in_fuzz_server = 1; 148| 1.83k| if (setjmp(fuzz_server_env) == 0) { ------------------ | Branch (148:6): [True: 1.83k, False: 0] ------------------ 149| 1.83k| client_addr = strdup("127.0.0.1"); 150| 1.83k| iqueue = sshbuf_new(); 151| 1.83k| oqueue = sshbuf_new(); 152| 1.83k| if (iqueue == NULL || oqueue == NULL) ------------------ | Branch (152:7): [True: 0, False: 1.83k] | Branch (152:25): [True: 0, False: 1.83k] ------------------ 153| 0| goto out; 154| | 155| 1.83k| const uint8_t init_msg[] = { 156| 1.83k| 0x00, 0x00, 0x00, 0x05, 157| 1.83k| SSH2_FXP_INIT, ------------------ | | 35| 1.83k|#define SSH2_FXP_INIT 1 ------------------ 158| 1.83k| 0x00, 0x00, 0x00, 0x03, 159| 1.83k| }; 160| 1.83k| if (sshbuf_put(iqueue, init_msg, sizeof(init_msg)) != 0) ------------------ | Branch (160:7): [True: 0, False: 1.83k] ------------------ 161| 0| goto out; 162| 1.83k| process(); 163| | 164| 1.83k| sshbuf_reset(iqueue); 165| 1.83k| sshbuf_reset(oqueue); 166| | 167| 1.83k| uint8_t hdr[4] = { 168| 1.83k| (uint8_t)((size >> 24) & 0xff), 169| 1.83k| (uint8_t)((size >> 16) & 0xff), 170| 1.83k| (uint8_t)((size >> 8) & 0xff), 171| 1.83k| (uint8_t)(size & 0xff), 172| 1.83k| }; 173| 1.83k| if (sshbuf_put(iqueue, hdr, 4) != 0 || ------------------ | Branch (173:7): [True: 0, False: 1.83k] ------------------ 174| 1.83k| sshbuf_put(iqueue, data, size) != 0) ------------------ | Branch (174:7): [True: 0, False: 1.83k] ------------------ 175| 0| goto out; 176| 1.83k| process(); 177| 1.83k| out: 178| 1.16k| cleanup_handles(); 179| 1.16k| sshbuf_free(iqueue); 180| 1.16k| sshbuf_free(oqueue); 181| 1.16k| free(client_addr); 182| 1.16k| iqueue = oqueue = NULL; 183| 1.16k| client_addr = NULL; 184| 1.16k| in_fuzz_server = 0; 185| 1.16k| fuzz_arena_release(); 186| 1.16k| return; 187| 1.83k| } 188| 0| cleanup_handles(); 189| 0| in_fuzz_server = 0; 190| 0| fuzz_arena_cleanup(); 191| 0| iqueue = oqueue = NULL; 192| | client_addr = NULL; 193| 0|} sftp_server_msg_fuzz_helper.c:reset_module_globals: 105| 1.83k|{ 106| 1.83k| pw = &fuzz_pw; 107| 1.83k| client_addr = NULL; 108| 1.83k| version = 0; 109| 1.83k| init_done = 0; 110| 1.83k| readonly = 0; 111| 1.83k| request_allowlist = NULL; 112| 1.83k| request_denylist = NULL; 113| 1.83k| handles = NULL; 114| 1.83k| num_handles = 0; 115| 1.83k| first_unused_handle = -1; 116| 1.83k| iqueue = NULL; 117| | oqueue = NULL; 118| 1.83k|} sftp_server_msg_fuzz_helper.c:cleanup_handles: 86| 1.83k|{ 87| 1.83k| u_int i; 88| 1.83k| if (handles == NULL) ------------------ | Branch (88:6): [True: 1.83k, False: 4] ------------------ 89| 1.83k| return; 90| 8| for (i = 0; i < num_handles; i++) { ------------------ | Branch (90:14): [True: 4, False: 4] ------------------ 91| 4| if (handles[i].use == HANDLE_FILE && handles[i].fd >= 0) ------------------ | Branch (91:7): [True: 1, False: 3] | Branch (91:40): [True: 1, False: 0] ------------------ 92| 1| close(handles[i].fd); 93| 3| else if (handles[i].use == HANDLE_DIR && handles[i].dirp != NULL) ------------------ | Branch (93:12): [True: 3, False: 0] | Branch (93:44): [True: 3, False: 0] ------------------ 94| 3| closedir(handles[i].dirp); 95| 4| free(handles[i].name); 96| 4| } 97| 4| free(handles); 98| | handles = NULL; 99| 4| num_handles = 0; 100| 4| first_unused_handle = -1; 101| 4|} attrib_clear: 54| 461|{ 55| 461| a->flags = 0; 56| 461| a->size = 0; 57| 461| a->uid = 0; 58| 461| a->gid = 0; 59| 461| a->perm = 0; 60| 461| a->atime = 0; 61| 461| a->mtime = 0; 62| 461|} stat_to_attrib: 67| 2|{ 68| 2| attrib_clear(a); 69| 2| a->flags = 0; 70| 2| a->flags |= SSH2_FILEXFER_ATTR_SIZE; ------------------ | | 68| 2|#define SSH2_FILEXFER_ATTR_SIZE 0x00000001 ------------------ 71| 2| a->size = st->st_size; 72| 2| a->flags |= SSH2_FILEXFER_ATTR_UIDGID; ------------------ | | 69| 2|#define SSH2_FILEXFER_ATTR_UIDGID 0x00000002 ------------------ 73| 2| a->uid = st->st_uid; 74| 2| a->gid = st->st_gid; 75| 2| a->flags |= SSH2_FILEXFER_ATTR_PERMISSIONS; ------------------ | | 70| 2|#define SSH2_FILEXFER_ATTR_PERMISSIONS 0x00000004 ------------------ 76| 2| a->perm = st->st_mode; 77| 2| a->flags |= SSH2_FILEXFER_ATTR_ACMODTIME; ------------------ | | 71| 2|#define SSH2_FILEXFER_ATTR_ACMODTIME 0x00000008 ------------------ 78| 2| a->atime = st->st_atime; 79| | a->mtime = st->st_mtime; 80| 2|} decode_attrib: 105| 339|{ 106| 339| int r; 107| | 108| 339| attrib_clear(a); 109| 339| if ((r = sshbuf_get_u32(b, &a->flags)) != 0) ------------------ | Branch (109:6): [True: 67, False: 272] ------------------ 110| 67| return r; 111| 272| if (a->flags & SSH2_FILEXFER_ATTR_SIZE) { ------------------ | | 68| 272|#define SSH2_FILEXFER_ATTR_SIZE 0x00000001 ------------------ | Branch (111:6): [True: 31, False: 241] ------------------ 112| 31| if ((r = sshbuf_get_u64(b, &a->size)) != 0) ------------------ | Branch (112:7): [True: 2, False: 29] ------------------ 113| 2| return r; 114| 31| } 115| 270| if (a->flags & SSH2_FILEXFER_ATTR_UIDGID) { ------------------ | | 69| 270|#define SSH2_FILEXFER_ATTR_UIDGID 0x00000002 ------------------ | Branch (115:6): [True: 27, False: 243] ------------------ 116| 27| if ((r = sshbuf_get_u32(b, &a->uid)) != 0 || ------------------ | Branch (116:7): [True: 1, False: 26] ------------------ 117| 26| (r = sshbuf_get_u32(b, &a->gid)) != 0) ------------------ | Branch (117:7): [True: 1, False: 25] ------------------ 118| 2| return r; 119| 27| } 120| 268| if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) { ------------------ | | 70| 268|#define SSH2_FILEXFER_ATTR_PERMISSIONS 0x00000004 ------------------ | Branch (120:6): [True: 26, False: 242] ------------------ 121| 26| if ((r = sshbuf_get_u32(b, &a->perm)) != 0) ------------------ | Branch (121:7): [True: 1, False: 25] ------------------ 122| 1| return r; 123| 26| } 124| 267| if (a->flags & SSH2_FILEXFER_ATTR_ACMODTIME) { ------------------ | | 71| 267|#define SSH2_FILEXFER_ATTR_ACMODTIME 0x00000008 ------------------ | Branch (124:6): [True: 27, False: 240] ------------------ 125| 27| if ((r = sshbuf_get_u32(b, &a->atime)) != 0 || ------------------ | Branch (125:7): [True: 2, False: 25] ------------------ 126| 25| (r = sshbuf_get_u32(b, &a->mtime)) != 0) ------------------ | Branch (126:7): [True: 1, False: 24] ------------------ 127| 3| return r; 128| 27| } 129| | /* vendor-specific extensions */ 130| 264| if (a->flags & SSH2_FILEXFER_ATTR_EXTENDED) { ------------------ | | 72| 264|#define SSH2_FILEXFER_ATTR_EXTENDED 0x80000000 ------------------ | Branch (130:6): [True: 191, False: 73] ------------------ 131| 191| char *type; 132| 191| u_char *data; 133| 191| size_t dlen; 134| 191| u_int i, count; 135| | 136| 191| if ((r = sshbuf_get_u32(b, &count)) != 0) ------------------ | Branch (136:7): [True: 35, False: 156] ------------------ 137| 35| return r; 138| 156| if (count > 0x100000) ------------------ | Branch (138:7): [True: 29, False: 127] ------------------ 139| 29| return SSH_ERR_INVALID_FORMAT; ------------------ | | 28| 29|#define SSH_ERR_INVALID_FORMAT -4 ------------------ 140| 5.34k| for (i = 0; i < count; i++) { ------------------ | Branch (140:15): [True: 5.34k, False: 4] ------------------ 141| 5.34k| if ((r = sshbuf_get_cstring(b, &type, NULL)) != 0 || ------------------ | Branch (141:8): [True: 86, False: 5.25k] ------------------ 142| 5.25k| (r = sshbuf_get_string(b, &data, &dlen)) != 0) ------------------ | Branch (142:8): [True: 37, False: 5.21k] ------------------ 143| 123| return r; 144| 5.21k| debug3("Got file attribute \"%.100s\" len %zu", ------------------ | | 109| 5.21k|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 145| 5.21k| type, dlen); 146| 5.21k| free(type); 147| 5.21k| free(data); 148| 5.21k| } 149| 127| } 150| 77| return 0; 151| 264|} encode_attrib: 156| 122|{ 157| 122| int r; 158| | 159| 122| if ((r = sshbuf_put_u32(b, a->flags)) != 0) ------------------ | Branch (159:6): [True: 0, False: 122] ------------------ 160| 0| return r; 161| 122| if (a->flags & SSH2_FILEXFER_ATTR_SIZE) { ------------------ | | 68| 122|#define SSH2_FILEXFER_ATTR_SIZE 0x00000001 ------------------ | Branch (161:6): [True: 2, False: 120] ------------------ 162| 2| if ((r = sshbuf_put_u64(b, a->size)) != 0) ------------------ | Branch (162:7): [True: 0, False: 2] ------------------ 163| 0| return r; 164| 2| } 165| 122| if (a->flags & SSH2_FILEXFER_ATTR_UIDGID) { ------------------ | | 69| 122|#define SSH2_FILEXFER_ATTR_UIDGID 0x00000002 ------------------ | Branch (165:6): [True: 2, False: 120] ------------------ 166| 2| if ((r = sshbuf_put_u32(b, a->uid)) != 0 || ------------------ | Branch (166:7): [True: 0, False: 2] ------------------ 167| 2| (r = sshbuf_put_u32(b, a->gid)) != 0) ------------------ | Branch (167:7): [True: 0, False: 2] ------------------ 168| 0| return r; 169| 2| } 170| 122| if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) { ------------------ | | 70| 122|#define SSH2_FILEXFER_ATTR_PERMISSIONS 0x00000004 ------------------ | Branch (170:6): [True: 2, False: 120] ------------------ 171| 2| if ((r = sshbuf_put_u32(b, a->perm)) != 0) ------------------ | Branch (171:7): [True: 0, False: 2] ------------------ 172| 0| return r; 173| 2| } 174| 122| if (a->flags & SSH2_FILEXFER_ATTR_ACMODTIME) { ------------------ | | 71| 122|#define SSH2_FILEXFER_ATTR_ACMODTIME 0x00000008 ------------------ | Branch (174:6): [True: 2, False: 120] ------------------ 175| 2| if ((r = sshbuf_put_u32(b, a->atime)) != 0 || ------------------ | Branch (175:7): [True: 0, False: 2] ------------------ 176| 2| (r = sshbuf_put_u32(b, a->mtime)) != 0) ------------------ | Branch (176:7): [True: 0, False: 2] ------------------ 177| 0| return r; 178| 2| } 179| 122| return 0; 180| 122|} sftp_realpath: 59| 197|{ 60| 197| struct stat sb; 61| 197| char *p, *q, *s; 62| 197| size_t left_len, resolved_len; 63| 197| unsigned symlinks; 64| 197| int serrno, slen, mem_allocated; 65| 197| char left[PATH_MAX], next_token[PATH_MAX], symlink[PATH_MAX]; 66| | 67| 197| if (path[0] == '\0') { ------------------ | Branch (67:6): [True: 0, False: 197] ------------------ 68| 0| errno = ENOENT; 69| 0| return (NULL); 70| 0| } 71| | 72| 197| serrno = errno; 73| | 74| 197| if (resolved == NULL) { ------------------ | Branch (74:6): [True: 0, False: 197] ------------------ 75| 0| resolved = malloc(PATH_MAX); 76| 0| if (resolved == NULL) ------------------ | Branch (76:7): [True: 0, False: 0] ------------------ 77| 0| return (NULL); 78| 0| mem_allocated = 1; 79| 0| } else 80| 197| mem_allocated = 0; 81| | 82| 197| symlinks = 0; 83| 197| if (path[0] == '/') { ------------------ | Branch (83:6): [True: 122, False: 75] ------------------ 84| 122| resolved[0] = '/'; 85| 122| resolved[1] = '\0'; 86| 122| if (path[1] == '\0') ------------------ | Branch (86:7): [True: 2, False: 120] ------------------ 87| 2| return (resolved); 88| 120| resolved_len = 1; 89| 120| left_len = strlcpy(left, path + 1, sizeof(left)); 90| 120| } else { 91| 75| if (getcwd(resolved, PATH_MAX) == NULL) { ------------------ | Branch (91:7): [True: 0, False: 75] ------------------ 92| 0| if (mem_allocated) ------------------ | Branch (92:8): [True: 0, False: 0] ------------------ 93| 0| free(resolved); 94| 0| else 95| 0| strlcpy(resolved, ".", PATH_MAX); 96| 0| return (NULL); 97| 0| } 98| 75| resolved_len = strlen(resolved); 99| 75| left_len = strlcpy(left, path, sizeof(left)); 100| 75| } 101| 195| if (left_len >= sizeof(left) || resolved_len >= PATH_MAX) { ------------------ | Branch (101:6): [True: 1, False: 194] | Branch (101:34): [True: 0, False: 194] ------------------ 102| 1| errno = ENAMETOOLONG; 103| 1| goto err; 104| 1| } 105| | 106| | /* 107| | * Iterate over path components in `left'. 108| | */ 109| 34.1k| while (left_len != 0) { ------------------ | Branch (109:9): [True: 34.1k, False: 34] ------------------ 110| | /* 111| | * Extract the next path component and adjust `left' 112| | * and its length. 113| | */ 114| 34.1k| p = strchr(left, '/'); 115| 34.1k| s = p ? p : left + left_len; ------------------ | Branch (115:7): [True: 33.9k, False: 133] ------------------ 116| 34.1k| if (s - left >= (ptrdiff_t)sizeof(next_token)) { ------------------ | Branch (116:7): [True: 0, False: 34.1k] ------------------ 117| 0| errno = ENAMETOOLONG; 118| 0| goto err; 119| 0| } 120| 34.1k| memcpy(next_token, left, s - left); 121| 34.1k| next_token[s - left] = '\0'; 122| 34.1k| left_len -= s - left; 123| 34.1k| if (p != NULL) ------------------ | Branch (123:7): [True: 33.9k, False: 133] ------------------ 124| 33.9k| memmove(left, s + 1, left_len + 1); 125| 34.1k| if (resolved[resolved_len - 1] != '/') { ------------------ | Branch (125:7): [True: 861, False: 33.2k] ------------------ 126| 861| if (resolved_len + 1 >= PATH_MAX) { ------------------ | Branch (126:8): [True: 0, False: 861] ------------------ 127| 0| errno = ENAMETOOLONG; 128| 0| goto err; 129| 0| } 130| 861| resolved[resolved_len++] = '/'; 131| 861| resolved[resolved_len] = '\0'; 132| 861| } 133| 34.1k| if (next_token[0] == '\0') ------------------ | Branch (133:7): [True: 30.4k, False: 3.63k] ------------------ 134| 30.4k| continue; 135| 3.63k| else if (strcmp(next_token, ".") == 0) ------------------ | Branch (135:12): [True: 1.55k, False: 2.08k] ------------------ 136| 1.55k| continue; 137| 2.08k| else if (strcmp(next_token, "..") == 0) { ------------------ | Branch (137:12): [True: 866, False: 1.21k] ------------------ 138| | /* 139| | * Strip the last path component except when we have 140| | * single "/" 141| | */ 142| 866| if (resolved_len > 1) { ------------------ | Branch (142:8): [True: 588, False: 278] ------------------ 143| 588| resolved[resolved_len - 1] = '\0'; 144| 588| q = strrchr(resolved, '/') + 1; 145| 588| *q = '\0'; 146| 588| resolved_len = q - resolved; 147| 588| } 148| 866| continue; 149| 866| } 150| | 151| | /* 152| | * Append the next path component and lstat() it. If 153| | * lstat() fails we still can return successfully if 154| | * there are no more path components left. 155| | */ 156| 1.21k| resolved_len = strlcat(resolved, next_token, PATH_MAX); 157| 1.21k| if (resolved_len >= PATH_MAX) { ------------------ | Branch (157:7): [True: 8, False: 1.20k] ------------------ 158| 8| errno = ENAMETOOLONG; 159| 8| goto err; 160| 8| } 161| 1.20k| if (lstat(resolved, &sb) != 0) { ------------------ | Branch (161:7): [True: 151, False: 1.05k] ------------------ 162| 151| if (errno == ENOENT && p == NULL) { ------------------ | Branch (162:8): [True: 122, False: 29] | Branch (162:27): [True: 81, False: 41] ------------------ 163| 81| errno = serrno; 164| 81| return (resolved); 165| 81| } 166| 70| goto err; 167| 151| } 168| 1.05k| if (S_ISLNK(sb.st_mode)) { ------------------ | Branch (168:7): [True: 265, False: 793] ------------------ 169| 265| if (symlinks++ > SYMLOOP_MAX) { ------------------ | | 43| 265|# define SYMLOOP_MAX 32 ------------------ | Branch (169:8): [True: 1, False: 264] ------------------ 170| 1| errno = ELOOP; 171| 1| goto err; 172| 1| } 173| 264| slen = readlink(resolved, symlink, sizeof(symlink) - 1); 174| 264| if (slen < 0) ------------------ | Branch (174:8): [True: 0, False: 264] ------------------ 175| 0| goto err; 176| 264| symlink[slen] = '\0'; 177| 264| if (symlink[0] == '/') { ------------------ | Branch (177:8): [True: 38, False: 226] ------------------ 178| 38| resolved[1] = 0; 179| 38| resolved_len = 1; 180| 226| } else if (resolved_len > 1) { ------------------ | Branch (180:15): [True: 226, False: 0] ------------------ 181| | /* Strip the last path component. */ 182| 226| resolved[resolved_len - 1] = '\0'; 183| 226| q = strrchr(resolved, '/') + 1; 184| 226| *q = '\0'; 185| 226| resolved_len = q - resolved; 186| 226| } 187| | 188| | /* 189| | * If there are any path components left, then 190| | * append them to symlink. The result is placed 191| | * in `left'. 192| | */ 193| 264| if (p != NULL) { ------------------ | Branch (193:8): [True: 261, False: 3] ------------------ 194| 261| if (symlink[slen - 1] != '/') { ------------------ | Branch (194:9): [True: 261, False: 0] ------------------ 195| 261| if (slen + 1 >= ------------------ | Branch (195:10): [True: 0, False: 261] ------------------ 196| 261| (ptrdiff_t)sizeof(symlink)) { 197| 0| errno = ENAMETOOLONG; 198| 0| goto err; 199| 0| } 200| 261| symlink[slen] = '/'; 201| 261| symlink[slen + 1] = 0; 202| 261| } 203| 261| left_len = strlcat(symlink, left, sizeof(symlink)); 204| 261| if (left_len >= sizeof(symlink)) { ------------------ | Branch (204:9): [True: 0, False: 261] ------------------ 205| 0| errno = ENAMETOOLONG; 206| 0| goto err; 207| 0| } 208| 261| } 209| 264| left_len = strlcpy(left, symlink, sizeof(left)); 210| 264| } 211| 1.05k| } 212| | 213| | /* 214| | * Remove trailing slash except when the resolved pathname 215| | * is a single "/". 216| | */ 217| 34| if (resolved_len > 1 && resolved[resolved_len - 1] == '/') ------------------ | Branch (217:6): [True: 20, False: 14] | Branch (217:26): [True: 14, False: 6] ------------------ 218| 14| resolved[resolved_len - 1] = '\0'; 219| 34| return (resolved); 220| | 221| 80|err: 222| 80| if (mem_allocated) ------------------ | Branch (222:6): [True: 0, False: 80] ------------------ 223| 0| free(resolved); 224| | return (NULL); 225| 194|} sftp_server_msg_fuzz_helper.c:handle_log_close: 470| 9|{ 471| 9| if (handle_is_ok(handle, HANDLE_FILE)) { ------------------ | Branch (471:6): [True: 0, False: 9] ------------------ 472| 0| logit("%s%sclose \"%s\" bytes read %llu written %llu", ------------------ | | 113| 0|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) | | ------------------ | | | Branch (113:86): [True: 0, False: 0] | | | Branch (113:86): [True: 0, False: 0] | | ------------------ ------------------ 473| 0| emsg == NULL ? "" : emsg, emsg == NULL ? "" : " ", 474| 0| handle_to_name(handle), 475| 0| (unsigned long long)handle_bytes_read(handle), 476| 0| (unsigned long long)handle_bytes_write(handle)); 477| 9| } else { 478| | logit("%s%sclosedir \"%s\"", ------------------ | | 113| 36|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) | | ------------------ | | | Branch (113:86): [True: 9, False: 0] | | | Branch (113:86): [True: 9, False: 0] | | ------------------ ------------------ 479| 9| emsg == NULL ? "" : emsg, emsg == NULL ? "" : " ", 480| 9| handle_to_name(handle)); 481| 9| } 482| 9|} sftp_server_msg_fuzz_helper.c:handle_is_ok: 357| 964|{ 358| 964| return i >= 0 && (u_int)i < num_handles && handles[i].use == type; ------------------ | Branch (358:9): [True: 136, False: 828] | Branch (358:19): [True: 0, False: 136] | Branch (358:45): [True: 0, False: 0] ------------------ 359| 964|} sftp_server_msg_fuzz_helper.c:handle_to_name: 388| 241|{ 389| 241| if (handle_is_ok(handle, HANDLE_DIR)|| ------------------ | Branch (389:6): [True: 0, False: 241] ------------------ 390| 241| handle_is_ok(handle, HANDLE_FILE)) ------------------ | Branch (390:6): [True: 0, False: 241] ------------------ 391| 0| return handles[handle].name; 392| 241| return NULL; 393| 241|} sftp_server_msg_fuzz_helper.c:process_open: 735| 102|{ 736| 102| uint32_t pflags; 737| 102| Attrib a; 738| 102| char *name; 739| 102| int r, handle, fd, flags, mode, status = SSH2_FX_FAILURE; ------------------ | | 91| 102|#define SSH2_FX_FAILURE 4 ------------------ 740| | 741| 102| if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 || ------------------ | Branch (741:6): [True: 11, False: 91] ------------------ 742| 91| (r = sshbuf_get_u32(iqueue, &pflags)) != 0 || /* portable flags */ ------------------ | Branch (742:6): [True: 1, False: 90] ------------------ 743| 90| (r = decode_attrib(iqueue, &a)) != 0) ------------------ | Branch (743:6): [True: 73, False: 17] ------------------ 744| 85| fatal_fr(r, "parse"); ------------------ | | 146| 85|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 745| | 746| 17| debug3("request %u: open flags %d", id, pflags); ------------------ | | 109| 17|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 747| 17| flags = flags_from_portable(pflags); 748| 17| mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a.perm : 0666; ------------------ | | 70| 17|#define SSH2_FILEXFER_ATTR_PERMISSIONS 0x00000004 ------------------ | Branch (748:9): [True: 3, False: 14] ------------------ 749| 17| logit("open \"%s\" flags %s mode 0%o", ------------------ | | 113| 17|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 750| 17| name, string_from_portable(pflags), mode); 751| 17| if (readonly && ------------------ | Branch (751:6): [True: 0, False: 17] ------------------ 752| 0| ((flags & O_ACCMODE) != O_RDONLY || ------------------ | Branch (752:7): [True: 0, False: 0] ------------------ 753| 0| (flags & (O_CREAT|O_TRUNC)) != 0)) { ------------------ | Branch (753:6): [True: 0, False: 0] ------------------ 754| 0| verbose("Refusing open request in read-only mode"); ------------------ | | 112| 0|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 755| 0| status = SSH2_FX_PERMISSION_DENIED; ------------------ | | 90| 0|#define SSH2_FX_PERMISSION_DENIED 3 ------------------ 756| 17| } else { 757| 17| fd = open(name, flags, mode); 758| 17| if (fd == -1) { ------------------ | Branch (758:7): [True: 16, False: 1] ------------------ 759| 16| status = errno_to_portable(errno); 760| 16| } else { 761| 1| handle = handle_new(HANDLE_FILE, name, fd, flags, NULL); 762| 1| if (handle < 0) { ------------------ | Branch (762:8): [True: 0, False: 1] ------------------ 763| 0| close(fd); 764| 1| } else { 765| 1| send_handle(id, handle); 766| 1| status = SSH2_FX_OK; ------------------ | | 87| 1|#define SSH2_FX_OK 0 ------------------ 767| 1| } 768| 1| } 769| 17| } 770| 17| if (status != SSH2_FX_OK) ------------------ | | 87| 17|#define SSH2_FX_OK 0 ------------------ | Branch (770:6): [True: 16, False: 1] ------------------ 771| 16| send_status(id, status); 772| 17| free(name); 773| 17|} sftp_server_msg_fuzz_helper.c:flags_from_portable: 248| 17|{ 249| 17| int flags = 0; 250| | 251| 17| if ((pflags & SSH2_FXF_READ) && ------------------ | | 75| 17|#define SSH2_FXF_READ 0x00000001 ------------------ | Branch (251:6): [True: 3, False: 14] ------------------ 252| 3| (pflags & SSH2_FXF_WRITE)) { ------------------ | | 76| 3|#define SSH2_FXF_WRITE 0x00000002 ------------------ | Branch (252:6): [True: 2, False: 1] ------------------ 253| 2| flags = O_RDWR; 254| 15| } else if (pflags & SSH2_FXF_READ) { ------------------ | | 75| 15|#define SSH2_FXF_READ 0x00000001 ------------------ | Branch (254:13): [True: 1, False: 14] ------------------ 255| 1| flags = O_RDONLY; 256| 14| } else if (pflags & SSH2_FXF_WRITE) { ------------------ | | 76| 14|#define SSH2_FXF_WRITE 0x00000002 ------------------ | Branch (256:13): [True: 5, False: 9] ------------------ 257| 5| flags = O_WRONLY; 258| 5| } 259| 17| if (pflags & SSH2_FXF_APPEND) ------------------ | | 77| 17|#define SSH2_FXF_APPEND 0x00000004 ------------------ | Branch (259:6): [True: 7, False: 10] ------------------ 260| 7| flags |= O_APPEND; 261| 17| if (pflags & SSH2_FXF_CREAT) ------------------ | | 78| 17|#define SSH2_FXF_CREAT 0x00000008 ------------------ | Branch (261:6): [True: 10, False: 7] ------------------ 262| 10| flags |= O_CREAT; 263| 17| if (pflags & SSH2_FXF_TRUNC) ------------------ | | 79| 17|#define SSH2_FXF_TRUNC 0x00000010 ------------------ | Branch (263:6): [True: 11, False: 6] ------------------ 264| 11| flags |= O_TRUNC; 265| 17| if (pflags & SSH2_FXF_EXCL) ------------------ | | 80| 17|#define SSH2_FXF_EXCL 0x00000020 ------------------ | Branch (265:6): [True: 10, False: 7] ------------------ 266| 10| flags |= O_EXCL; 267| 17| return flags; 268| 17|} sftp_server_msg_fuzz_helper.c:string_from_portable: 272| 17|{ 273| 17| static char ret[128]; 274| | 275| 17| *ret = '\0'; 276| | 277| 17|#define PAPPEND(str) { \ 278| 17| if (*ret != '\0') \ 279| 17| strlcat(ret, ",", sizeof(ret)); \ 280| 17| strlcat(ret, str, sizeof(ret)); \ 281| 17| } 282| | 283| 17| if (pflags & SSH2_FXF_READ) ------------------ | | 75| 17|#define SSH2_FXF_READ 0x00000001 ------------------ | Branch (283:6): [True: 3, False: 14] ------------------ 284| 3| PAPPEND("READ") ------------------ | | 277| 3|#define PAPPEND(str) { \ | | 278| 3| if (*ret != '\0') \ | | ------------------ | | | Branch (278:7): [True: 0, False: 3] | | ------------------ | | 279| 3| strlcat(ret, ",", sizeof(ret)); \ | | 280| 3| strlcat(ret, str, sizeof(ret)); \ | | 281| 3| } ------------------ 285| 17| if (pflags & SSH2_FXF_WRITE) ------------------ | | 76| 17|#define SSH2_FXF_WRITE 0x00000002 ------------------ | Branch (285:6): [True: 7, False: 10] ------------------ 286| 7| PAPPEND("WRITE") ------------------ | | 277| 7|#define PAPPEND(str) { \ | | 278| 7| if (*ret != '\0') \ | | ------------------ | | | Branch (278:7): [True: 2, False: 5] | | ------------------ | | 279| 7| strlcat(ret, ",", sizeof(ret)); \ | | 280| 7| strlcat(ret, str, sizeof(ret)); \ | | 281| 7| } ------------------ 287| 17| if (pflags & SSH2_FXF_APPEND) ------------------ | | 77| 17|#define SSH2_FXF_APPEND 0x00000004 ------------------ | Branch (287:6): [True: 7, False: 10] ------------------ 288| 7| PAPPEND("APPEND") ------------------ | | 277| 7|#define PAPPEND(str) { \ | | 278| 7| if (*ret != '\0') \ | | ------------------ | | | Branch (278:7): [True: 4, False: 3] | | ------------------ | | 279| 7| strlcat(ret, ",", sizeof(ret)); \ | | 280| 7| strlcat(ret, str, sizeof(ret)); \ | | 281| 7| } ------------------ 289| 17| if (pflags & SSH2_FXF_CREAT) ------------------ | | 78| 17|#define SSH2_FXF_CREAT 0x00000008 ------------------ | Branch (289:6): [True: 10, False: 7] ------------------ 290| 10| PAPPEND("CREATE") ------------------ | | 277| 10|#define PAPPEND(str) { \ | | 278| 10| if (*ret != '\0') \ | | ------------------ | | | Branch (278:7): [True: 7, False: 3] | | ------------------ | | 279| 10| strlcat(ret, ",", sizeof(ret)); \ | | 280| 10| strlcat(ret, str, sizeof(ret)); \ | | 281| 10| } ------------------ 291| 17| if (pflags & SSH2_FXF_TRUNC) ------------------ | | 79| 17|#define SSH2_FXF_TRUNC 0x00000010 ------------------ | Branch (291:6): [True: 11, False: 6] ------------------ 292| 11| PAPPEND("TRUNCATE") ------------------ | | 277| 11|#define PAPPEND(str) { \ | | 278| 11| if (*ret != '\0') \ | | ------------------ | | | Branch (278:7): [True: 9, False: 2] | | ------------------ | | 279| 11| strlcat(ret, ",", sizeof(ret)); \ | | 280| 11| strlcat(ret, str, sizeof(ret)); \ | | 281| 11| } ------------------ 293| 17| if (pflags & SSH2_FXF_EXCL) ------------------ | | 80| 17|#define SSH2_FXF_EXCL 0x00000020 ------------------ | Branch (293:6): [True: 10, False: 7] ------------------ 294| 10| PAPPEND("EXCL") ------------------ | | 277| 10|#define PAPPEND(str) { \ | | 278| 10| if (*ret != '\0') \ | | ------------------ | | | Branch (278:7): [True: 9, False: 1] | | ------------------ | | 279| 10| strlcat(ret, ",", sizeof(ret)); \ | | 280| 10| strlcat(ret, str, sizeof(ret)); \ | | 281| 10| } ------------------ 295| | 296| 17| return ret; 297| 17|} sftp_server_msg_fuzz_helper.c:errno_to_portable: 214| 440|{ 215| 440| int ret = 0; 216| | 217| 440| switch (unixerrno) { 218| 0| case 0: ------------------ | Branch (218:2): [True: 0, False: 440] ------------------ 219| 0| ret = SSH2_FX_OK; ------------------ | | 87| 0|#define SSH2_FX_OK 0 ------------------ 220| 0| break; 221| 251| case ENOENT: ------------------ | Branch (221:2): [True: 251, False: 189] ------------------ 222| 265| case ENOTDIR: ------------------ | Branch (222:2): [True: 14, False: 426] ------------------ 223| 364| case EBADF: ------------------ | Branch (223:2): [True: 99, False: 341] ------------------ 224| 365| case ELOOP: ------------------ | Branch (224:2): [True: 1, False: 439] ------------------ 225| 365| ret = SSH2_FX_NO_SUCH_FILE; ------------------ | | 89| 365|#define SSH2_FX_NO_SUCH_FILE 2 ------------------ 226| 365| break; 227| 0| case EPERM: ------------------ | Branch (227:2): [True: 0, False: 440] ------------------ 228| 0| case EACCES: ------------------ | Branch (228:2): [True: 0, False: 440] ------------------ 229| 0| case EFAULT: ------------------ | Branch (229:2): [True: 0, False: 440] ------------------ 230| 0| ret = SSH2_FX_PERMISSION_DENIED; ------------------ | | 90| 0|#define SSH2_FX_PERMISSION_DENIED 3 ------------------ 231| 0| break; 232| 56| case ENAMETOOLONG: ------------------ | Branch (232:2): [True: 56, False: 384] ------------------ 233| 64| case EINVAL: ------------------ | Branch (233:2): [True: 8, False: 432] ------------------ 234| 64| ret = SSH2_FX_BAD_MESSAGE; ------------------ | | 92| 64|#define SSH2_FX_BAD_MESSAGE 5 ------------------ 235| 64| break; 236| 0| case ENOSYS: ------------------ | Branch (236:2): [True: 0, False: 440] ------------------ 237| 0| ret = SSH2_FX_OP_UNSUPPORTED; ------------------ | | 95| 0|#define SSH2_FX_OP_UNSUPPORTED 8 ------------------ 238| 0| break; 239| 11| default: ------------------ | Branch (239:2): [True: 11, False: 429] ------------------ 240| 11| ret = SSH2_FX_FAILURE; ------------------ | | 91| 11|#define SSH2_FX_FAILURE 4 ------------------ 241| 11| break; 242| 440| } 243| 440| return ret; 244| 440|} sftp_server_msg_fuzz_helper.c:handle_new: 331| 4|{ 332| 4| int i; 333| | 334| 4| if (first_unused_handle == -1) { ------------------ | Branch (334:6): [True: 4, False: 0] ------------------ 335| 4| if (num_handles + 1 <= num_handles) ------------------ | Branch (335:7): [True: 0, False: 4] ------------------ 336| 0| return -1; 337| 4| num_handles++; 338| 4| handles = xreallocarray(handles, num_handles, sizeof(Handle)); 339| 4| handle_unused(num_handles - 1); 340| 4| } 341| | 342| 4| i = first_unused_handle; 343| 4| first_unused_handle = handles[i].next_unused; 344| | 345| 4| handles[i].use = use; 346| 4| handles[i].dirp = dirp; 347| 4| handles[i].fd = fd; 348| 4| handles[i].flags = flags; 349| 4| handles[i].name = xstrdup(name); 350| 4| handles[i].bytes_read = handles[i].bytes_write = 0; 351| | 352| 4| return i; 353| 4|} sftp_server_msg_fuzz_helper.c:handle_unused: 323| 4|{ 324| 4| handles[i].use = HANDLE_UNUSED; 325| 4| handles[i].next_unused = first_unused_handle; 326| 4| first_unused_handle = i; 327| 4|} sftp_server_msg_fuzz_helper.c:send_handle: 597| 4|{ 598| 4| u_char *string; 599| 4| int hlen; 600| | 601| 4| handle_to_string(handle, &string, &hlen); 602| 4| debug("request %u: sent handle %d", id, handle); ------------------ | | 111| 4|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 603| 4| send_data_or_handle(SSH2_FXP_HANDLE, id, string, hlen); ------------------ | | 59| 4|#define SSH2_FXP_HANDLE 102 ------------------ 604| 4| free(string); 605| 4|} sftp_server_msg_fuzz_helper.c:handle_to_string: 363| 4|{ 364| 4| if (stringp == NULL || hlenp == NULL) ------------------ | Branch (364:6): [True: 0, False: 4] | Branch (364:25): [True: 0, False: 4] ------------------ 365| 0| return -1; 366| 4| *stringp = xmalloc(sizeof(int32_t)); 367| 4| put_u32(*stringp, handle); 368| 4| *hlenp = sizeof(int32_t); 369| 4| return 0; 370| 4|} sftp_server_msg_fuzz_helper.c:send_data_or_handle: 574| 4|{ 575| 4| struct sshbuf *msg; 576| 4| int r; 577| | 578| 4| if ((msg = sshbuf_new()) == NULL) ------------------ | Branch (578:6): [True: 0, False: 4] ------------------ 579| 0| fatal_f("sshbuf_new failed"); ------------------ | | 126| 0|#define fatal_f(...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 580| 4| if ((r = sshbuf_put_u8(msg, type)) != 0 || ------------------ | Branch (580:6): [True: 0, False: 4] ------------------ 581| 4| (r = sshbuf_put_u32(msg, id)) != 0 || ------------------ | Branch (581:6): [True: 0, False: 4] ------------------ 582| 4| (r = sshbuf_put_string(msg, data, dlen)) != 0) ------------------ | Branch (582:6): [True: 0, False: 4] ------------------ 583| 0| fatal_fr(r, "compose"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 584| 4| send_msg(msg); 585| 4| sshbuf_free(msg); 586| 4|} sftp_server_msg_fuzz_helper.c:send_msg: 514| 2.95k|{ 515| 2.95k| int r; 516| | 517| 2.95k| if ((r = sshbuf_put_stringb(oqueue, m)) != 0) ------------------ | Branch (517:6): [True: 0, False: 2.95k] ------------------ 518| 0| fatal_fr(r, "enqueue"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 519| 2.95k| sshbuf_reset(m); 520| 2.95k|} sftp_server_msg_fuzz_helper.c:send_status: 568| 718|{ 569| | send_status_errmsg(id, status, NULL); 570| 718|} sftp_server_msg_fuzz_helper.c:send_status_errmsg: 542| 866|{ 543| 866| struct sshbuf *msg; 544| 866| int r; 545| | 546| 866| debug3("request %u: sent status %u", id, status); ------------------ | | 109| 866|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 547| 866| if (log_level > SYSLOG_LEVEL_VERBOSE || ------------------ | Branch (547:6): [True: 0, False: 866] ------------------ 548| 866| (status != SSH2_FX_OK && status != SSH2_FX_EOF)) ------------------ | | 87| 1.73k|#define SSH2_FX_OK 0 ------------------ (status != SSH2_FX_OK && status != SSH2_FX_EOF)) ------------------ | | 88| 844|#define SSH2_FX_EOF 1 ------------------ | Branch (548:7): [True: 844, False: 22] | Branch (548:31): [True: 844, False: 0] ------------------ 549| 844| logit("sent status %s", status_to_message(status)); ------------------ | | 113| 844|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 550| 866| if ((msg = sshbuf_new()) == NULL) ------------------ | Branch (550:6): [True: 0, False: 866] ------------------ 551| 0| fatal_f("sshbuf_new failed"); ------------------ | | 126| 0|#define fatal_f(...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 552| 866| if ((r = sshbuf_put_u8(msg, SSH2_FXP_STATUS)) != 0 || ------------------ | | 58| 866|#define SSH2_FXP_STATUS 101 ------------------ | Branch (552:6): [True: 0, False: 866] ------------------ 553| 866| (r = sshbuf_put_u32(msg, id)) != 0 || ------------------ | Branch (553:6): [True: 0, False: 866] ------------------ 554| 866| (r = sshbuf_put_u32(msg, status)) != 0) ------------------ | Branch (554:6): [True: 0, False: 866] ------------------ 555| 0| fatal_fr(r, "compose"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 556| 866| if (version >= 3) { ------------------ | Branch (556:6): [True: 866, False: 0] ------------------ 557| 866| if ((r = sshbuf_put_cstring(msg, errmsg == NULL ? ------------------ | Branch (557:7): [True: 0, False: 866] | Branch (557:36): [True: 718, False: 148] ------------------ 558| 718| status_to_message(status) : errmsg)) != 0 || 559| 866| (r = sshbuf_put_cstring(msg, "")) != 0) ------------------ | Branch (559:7): [True: 0, False: 866] ------------------ 560| 0| fatal_fr(r, "compose message"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 561| 866| } 562| 866| send_msg(msg); 563| 866| sshbuf_free(msg); 564| 866|} sftp_server_msg_fuzz_helper.c:status_to_message: 524| 1.56k|{ 525| 1.56k| static const char * const status_messages[] = { 526| 1.56k| "Success", /* SSH_FX_OK */ 527| 1.56k| "End of file", /* SSH_FX_EOF */ 528| 1.56k| "No such file", /* SSH_FX_NO_SUCH_FILE */ 529| 1.56k| "Permission denied", /* SSH_FX_PERMISSION_DENIED */ 530| 1.56k| "Failure", /* SSH_FX_FAILURE */ 531| 1.56k| "Bad message", /* SSH_FX_BAD_MESSAGE */ 532| 1.56k| "No connection", /* SSH_FX_NO_CONNECTION */ 533| 1.56k| "Connection lost", /* SSH_FX_CONNECTION_LOST */ 534| 1.56k| "Operation unsupported", /* SSH_FX_OP_UNSUPPORTED */ 535| 1.56k| "Unknown error" /* Others */ 536| 1.56k| }; 537| 1.56k| return (status_messages[MINIMUM(status,SSH2_FX_MAX)]); ------------------ | | 268| 1.56k|#define MINIMUM(a, b) (((a) < (b)) ? (a) : (b)) | | ------------------ | | | Branch (268:24): [True: 990, False: 572] | | ------------------ ------------------ 538| 1.56k|} sftp_server_msg_fuzz_helper.c:process_close: 777| 20|{ 778| 20| int r, handle, ret, status = SSH2_FX_FAILURE; ------------------ | | 91| 20|#define SSH2_FX_FAILURE 4 ------------------ 779| | 780| 20| if ((r = get_handle(iqueue, &handle)) != 0) ------------------ | Branch (780:6): [True: 11, False: 9] ------------------ 781| 11| fatal_fr(r, "parse"); ------------------ | | 146| 11|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 782| | 783| 9| debug3("request %u: close handle %u", id, handle); ------------------ | | 109| 9|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 784| 9| handle_log_close(handle, NULL); 785| 9| ret = handle_close(handle); 786| 9| status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK; ------------------ | | 87| 9|#define SSH2_FX_OK 0 ------------------ | Branch (786:11): [True: 9, False: 0] ------------------ 787| 9| send_status(id, status); 788| 9|} sftp_server_msg_fuzz_helper.c:get_handle: 496| 516|{ 497| 516| u_char *handle; 498| 516| int r; 499| 516| size_t hlen; 500| | 501| 516| *hp = -1; 502| 516| if ((r = sshbuf_get_string(queue, &handle, &hlen)) != 0) ------------------ | Branch (502:6): [True: 77, False: 439] ------------------ 503| 77| return r; 504| 439| if (hlen < 256) ------------------ | Branch (504:6): [True: 425, False: 14] ------------------ 505| 425| *hp = handle_from_string(handle, hlen); 506| 439| free(handle); 507| 439| return 0; 508| 516|} sftp_server_msg_fuzz_helper.c:handle_from_string: 374| 425|{ 375| 425| int val; 376| | 377| 425| if (hlen != sizeof(int32_t)) ------------------ | Branch (377:6): [True: 315, False: 110] ------------------ 378| 315| return -1; 379| 110| val = get_u32(handle); 380| 110| if (handle_is_ok(val, HANDLE_FILE) || ------------------ | Branch (380:6): [True: 0, False: 110] ------------------ 381| 110| handle_is_ok(val, HANDLE_DIR)) ------------------ | Branch (381:6): [True: 0, False: 110] ------------------ 382| 0| return val; 383| 110| return -1; 384| 110|} sftp_server_msg_fuzz_helper.c:handle_close: 451| 9|{ 452| 9| int ret = -1; 453| | 454| 9| if (handle_is_ok(handle, HANDLE_FILE)) { ------------------ | Branch (454:6): [True: 0, False: 9] ------------------ 455| 0| ret = close(handles[handle].fd); 456| 0| free(handles[handle].name); 457| 0| handle_unused(handle); 458| 9| } else if (handle_is_ok(handle, HANDLE_DIR)) { ------------------ | Branch (458:13): [True: 0, False: 9] ------------------ 459| 0| ret = closedir(handles[handle].dirp); 460| 0| free(handles[handle].name); 461| 0| handle_unused(handle); 462| 9| } else { 463| 9| errno = ENOENT; 464| 9| } 465| 9| return ret; 466| 9|} sftp_server_msg_fuzz_helper.c:process_read: 792| 27|{ 793| 27| static u_char *buf; 794| 27| static size_t buflen; 795| 27| uint32_t len; 796| 27| int r, handle, fd, ret, status = SSH2_FX_FAILURE; ------------------ | | 91| 27|#define SSH2_FX_FAILURE 4 ------------------ 797| 27| uint64_t off; 798| | 799| 27| if ((r = get_handle(iqueue, &handle)) != 0 || ------------------ | Branch (799:6): [True: 6, False: 21] ------------------ 800| 21| (r = sshbuf_get_u64(iqueue, &off)) != 0 || ------------------ | Branch (800:6): [True: 14, False: 7] ------------------ 801| 7| (r = sshbuf_get_u32(iqueue, &len)) != 0) ------------------ | Branch (801:6): [True: 1, False: 6] ------------------ 802| 21| fatal_fr(r, "parse"); ------------------ | | 146| 21|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 803| | 804| 6| debug("request %u: read \"%s\" (handle %d) off %llu len %u", ------------------ | | 111| 6|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 805| 6| id, handle_to_name(handle), handle, (unsigned long long)off, len); 806| 6| if ((fd = handle_to_fd(handle)) == -1) ------------------ | Branch (806:6): [True: 6, False: 0] ------------------ 807| 6| goto out; 808| 0| if (len > SFTP_MAX_READ_LENGTH) { ------------------ | | 55| 0|#define SFTP_MAX_READ_LENGTH (SFTP_MAX_MSG_LENGTH - 1024) | | ------------------ | | | | 29| 0|#define SFTP_MAX_MSG_LENGTH (256 * 1024) | | ------------------ ------------------ | Branch (808:6): [True: 0, False: 0] ------------------ 809| 0| debug2("read change len %u to %u", len, SFTP_MAX_READ_LENGTH); ------------------ | | 110| 0|#define debug2(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG2, NULL, __VA_ARGS__) ------------------ 810| 0| len = SFTP_MAX_READ_LENGTH; ------------------ | | 55| 0|#define SFTP_MAX_READ_LENGTH (SFTP_MAX_MSG_LENGTH - 1024) | | ------------------ | | | | 29| 0|#define SFTP_MAX_MSG_LENGTH (256 * 1024) | | ------------------ ------------------ 811| 0| } 812| 0| if (len > buflen) { ------------------ | Branch (812:6): [True: 0, False: 0] ------------------ 813| 0| debug3_f("allocate %zu => %u", buflen, len); ------------------ | | 120| 0|#define debug3_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 814| 0| if ((buf = realloc(buf, len)) == NULL) ------------------ | Branch (814:7): [True: 0, False: 0] ------------------ 815| 0| fatal_f("realloc failed"); ------------------ | | 126| 0|#define fatal_f(...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 816| 0| buflen = len; 817| 0| } 818| 0| if (lseek(fd, off, SEEK_SET) == -1) { ------------------ | Branch (818:6): [True: 0, False: 0] ------------------ 819| 0| status = errno_to_portable(errno); 820| 0| error_f("seek \"%.100s\": %s", handle_to_name(handle), ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 821| 0| strerror(errno)); 822| 0| goto out; 823| 0| } 824| 0| if (len == 0) { ------------------ | Branch (824:6): [True: 0, False: 0] ------------------ 825| | /* weird, but not strictly disallowed */ 826| 0| ret = 0; 827| 0| } else if ((ret = read(fd, buf, len)) == -1) { ------------------ | Branch (827:13): [True: 0, False: 0] ------------------ 828| 0| status = errno_to_portable(errno); 829| 0| error_f("read \"%.100s\": %s", handle_to_name(handle), ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 830| 0| strerror(errno)); 831| 0| goto out; 832| 0| } else if (ret == 0) { ------------------ | Branch (832:13): [True: 0, False: 0] ------------------ 833| 0| status = SSH2_FX_EOF; ------------------ | | 88| 0|#define SSH2_FX_EOF 1 ------------------ 834| 0| goto out; 835| 0| } 836| 0| send_data(id, buf, ret); 837| 0| handle_update_read(handle, ret); 838| | /* success */ 839| 0| status = SSH2_FX_OK; ------------------ | | 87| 0|#define SSH2_FX_OK 0 ------------------ 840| 6| out: 841| 6| if (status != SSH2_FX_OK) ------------------ | | 87| 6|#define SSH2_FX_OK 0 ------------------ | Branch (841:6): [True: 6, False: 0] ------------------ 842| 6| send_status(id, status); 843| 6|} sftp_server_msg_fuzz_helper.c:handle_to_fd: 405| 226|{ 406| 226| if (handle_is_ok(handle, HANDLE_FILE)) ------------------ | Branch (406:6): [True: 0, False: 226] ------------------ 407| 0| return handles[handle].fd; 408| 226| return -1; 409| 226|} sftp_server_msg_fuzz_helper.c:process_write: 847| 24|{ 848| 24| uint64_t off; 849| 24| size_t len; 850| 24| int r, handle, fd, ret, status; 851| 24| u_char *data; 852| | 853| 24| if ((r = get_handle(iqueue, &handle)) != 0 || ------------------ | Branch (853:6): [True: 7, False: 17] ------------------ 854| 17| (r = sshbuf_get_u64(iqueue, &off)) != 0 || ------------------ | Branch (854:6): [True: 12, False: 5] ------------------ 855| 5| (r = sshbuf_get_string(iqueue, &data, &len)) != 0) ------------------ | Branch (855:6): [True: 2, False: 3] ------------------ 856| 21| fatal_fr(r, "parse"); ------------------ | | 146| 21|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 857| | 858| 3| debug("request %u: write \"%s\" (handle %d) off %llu len %zu", ------------------ | | 111| 3|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 859| 3| id, handle_to_name(handle), handle, (unsigned long long)off, len); 860| 3| fd = handle_to_fd(handle); 861| | 862| 3| if (fd < 0) ------------------ | Branch (862:6): [True: 3, False: 0] ------------------ 863| 3| status = SSH2_FX_FAILURE; ------------------ | | 91| 3|#define SSH2_FX_FAILURE 4 ------------------ 864| 0| else { 865| 0| if (!(handle_to_flags(handle) & O_APPEND) && ------------------ | Branch (865:7): [True: 0, False: 0] ------------------ 866| 0| lseek(fd, off, SEEK_SET) == -1) { ------------------ | Branch (866:7): [True: 0, False: 0] ------------------ 867| 0| status = errno_to_portable(errno); 868| 0| error_f("seek \"%.100s\": %s", handle_to_name(handle), ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 869| 0| strerror(errno)); 870| 0| } else { 871| |/* XXX ATOMICIO ? */ 872| 0| ret = write(fd, data, len); 873| 0| if (ret == -1) { ------------------ | Branch (873:8): [True: 0, False: 0] ------------------ 874| 0| status = errno_to_portable(errno); 875| 0| error_f("write \"%.100s\": %s", ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 876| 0| handle_to_name(handle), strerror(errno)); 877| 0| } else if ((size_t)ret == len) { ------------------ | Branch (877:15): [True: 0, False: 0] ------------------ 878| 0| status = SSH2_FX_OK; ------------------ | | 87| 0|#define SSH2_FX_OK 0 ------------------ 879| 0| handle_update_write(handle, ret); 880| 0| } else { 881| 0| debug2_f("nothing at all written"); ------------------ | | 121| 0|#define debug2_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG2, NULL, __VA_ARGS__) ------------------ 882| 0| status = SSH2_FX_FAILURE; ------------------ | | 91| 0|#define SSH2_FX_FAILURE 4 ------------------ 883| 0| } 884| 0| } 885| 0| } 886| 3| send_status(id, status); 887| 3| free(data); 888| 3|} sftp_server_msg_fuzz_helper.c:process_lstat: 924| 10|{ 925| 10| process_do_stat(id, 1); 926| 10|} sftp_server_msg_fuzz_helper.c:process_do_stat: 892| 17|{ 893| 17| Attrib a; 894| 17| struct stat st; 895| 17| char *name; 896| 17| int r, status = SSH2_FX_FAILURE; ------------------ | | 91| 17|#define SSH2_FX_FAILURE 4 ------------------ 897| | 898| 17| if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0) ------------------ | Branch (898:6): [True: 10, False: 7] ------------------ 899| 10| fatal_fr(r, "parse"); ------------------ | | 146| 10|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 900| | 901| 7| debug3("request %u: %sstat", id, do_lstat ? "l" : ""); ------------------ | | 109| 14|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) | | ------------------ | | | Branch (109:89): [True: 4, False: 3] | | ------------------ ------------------ 902| 7| verbose("%sstat name \"%s\"", do_lstat ? "l" : "", name); ------------------ | | 112| 14|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) | | ------------------ | | | Branch (112:91): [True: 4, False: 3] | | ------------------ ------------------ 903| 7| r = do_lstat ? lstat(name, &st) : stat(name, &st); ------------------ | Branch (903:6): [True: 4, False: 3] ------------------ 904| 7| if (r == -1) { ------------------ | Branch (904:6): [True: 5, False: 2] ------------------ 905| 5| status = errno_to_portable(errno); 906| 5| } else { 907| 2| stat_to_attrib(&st, &a); 908| 2| send_attrib(id, &a); 909| 2| status = SSH2_FX_OK; ------------------ | | 87| 2|#define SSH2_FX_OK 0 ------------------ 910| 2| } 911| 7| if (status != SSH2_FX_OK) ------------------ | | 87| 7|#define SSH2_FX_OK 0 ------------------ | Branch (911:6): [True: 5, False: 2] ------------------ 912| 5| send_status(id, status); 913| 7| free(name); 914| 7|} sftp_server_msg_fuzz_helper.c:send_attrib: 632| 2|{ 633| 2| struct sshbuf *msg; 634| 2| int r; 635| | 636| 2| debug("request %u: sent attrib have 0x%x", id, a->flags); ------------------ | | 111| 2|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 637| 2| if ((msg = sshbuf_new()) == NULL) ------------------ | Branch (637:6): [True: 0, False: 2] ------------------ 638| 0| fatal_f("sshbuf_new failed"); ------------------ | | 126| 0|#define fatal_f(...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 639| 2| if ((r = sshbuf_put_u8(msg, SSH2_FXP_ATTRS)) != 0 || ------------------ | | 62| 2|#define SSH2_FXP_ATTRS 105 ------------------ | Branch (639:6): [True: 0, False: 2] ------------------ 640| 2| (r = sshbuf_put_u32(msg, id)) != 0 || ------------------ | Branch (640:6): [True: 0, False: 2] ------------------ 641| 2| (r = encode_attrib(msg, a)) != 0) ------------------ | Branch (641:6): [True: 0, False: 2] ------------------ 642| 0| fatal_fr(r, "compose"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 643| 2| send_msg(msg); 644| 2| sshbuf_free(msg); 645| 2|} sftp_server_msg_fuzz_helper.c:process_fstat: 930| 15|{ 931| 15| Attrib a; 932| 15| struct stat st; 933| 15| int fd, r, handle, status = SSH2_FX_FAILURE; ------------------ | | 91| 15|#define SSH2_FX_FAILURE 4 ------------------ 934| | 935| 15| if ((r = get_handle(iqueue, &handle)) != 0) ------------------ | Branch (935:6): [True: 10, False: 5] ------------------ 936| 10| fatal_fr(r, "parse"); ------------------ | | 146| 10|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 937| 5| debug("request %u: fstat \"%s\" (handle %u)", ------------------ | | 111| 5|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 938| 5| id, handle_to_name(handle), handle); 939| 5| fd = handle_to_fd(handle); 940| 5| if (fd >= 0) { ------------------ | Branch (940:6): [True: 0, False: 5] ------------------ 941| 0| r = fstat(fd, &st); 942| 0| if (r == -1) { ------------------ | Branch (942:7): [True: 0, False: 0] ------------------ 943| 0| status = errno_to_portable(errno); 944| 0| } else { 945| 0| stat_to_attrib(&st, &a); 946| 0| send_attrib(id, &a); 947| 0| status = SSH2_FX_OK; ------------------ | | 87| 0|#define SSH2_FX_OK 0 ------------------ 948| 0| } 949| 0| } 950| 5| if (status != SSH2_FX_OK) ------------------ | | 87| 5|#define SSH2_FX_OK 0 ------------------ | Branch (950:6): [True: 5, False: 0] ------------------ 951| 5| send_status(id, status); 952| 5|} sftp_server_msg_fuzz_helper.c:process_setstat: 980| 48|{ 981| 48| Attrib a; 982| 48| char *name; 983| 48| int r, status = SSH2_FX_OK; ------------------ | | 87| 48|#define SSH2_FX_OK 0 ------------------ 984| | 985| 48| if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 || ------------------ | Branch (985:6): [True: 10, False: 38] ------------------ 986| 38| (r = decode_attrib(iqueue, &a)) != 0) ------------------ | Branch (986:6): [True: 13, False: 25] ------------------ 987| 23| fatal_fr(r, "parse"); ------------------ | | 146| 23|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 988| | 989| 25| debug("request %u: setstat name \"%s\"", id, name); ------------------ | | 111| 25|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 990| 25| if (a.flags & SSH2_FILEXFER_ATTR_SIZE) { ------------------ | | 68| 25|#define SSH2_FILEXFER_ATTR_SIZE 0x00000001 ------------------ | Branch (990:6): [True: 11, False: 14] ------------------ 991| 11| logit("set \"%s\" size %llu", ------------------ | | 113| 11|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 992| 11| name, (unsigned long long)a.size); 993| 11| r = truncate(name, a.size); 994| 11| if (r == -1) ------------------ | Branch (994:7): [True: 11, False: 0] ------------------ 995| 11| status = errno_to_portable(errno); 996| 11| } 997| 25| if (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) { ------------------ | | 70| 25|#define SSH2_FILEXFER_ATTR_PERMISSIONS 0x00000004 ------------------ | Branch (997:6): [True: 10, False: 15] ------------------ 998| 10| logit("set \"%s\" mode %04o", name, a.perm); ------------------ | | 113| 10|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 999| 10| r = chmod(name, a.perm & 07777); 1000| 10| if (r == -1) ------------------ | Branch (1000:7): [True: 6, False: 4] ------------------ 1001| 6| status = errno_to_portable(errno); 1002| 10| } 1003| 25| if (a.flags & SSH2_FILEXFER_ATTR_ACMODTIME) { ------------------ | | 71| 25|#define SSH2_FILEXFER_ATTR_ACMODTIME 0x00000008 ------------------ | Branch (1003:6): [True: 8, False: 17] ------------------ 1004| 8| char buf[64]; 1005| 8| time_t t = a.mtime; 1006| | 1007| 8| strftime(buf, sizeof(buf), "%Y%m%d-%H:%M:%S", 1008| 8| localtime(&t)); 1009| 8| logit("set \"%s\" modtime %s", name, buf); ------------------ | | 113| 8|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1010| 8| r = utimes(name, attrib_to_tv(&a)); 1011| 8| if (r == -1) ------------------ | Branch (1011:7): [True: 4, False: 4] ------------------ 1012| 4| status = errno_to_portable(errno); 1013| 8| } 1014| 25| if (a.flags & SSH2_FILEXFER_ATTR_UIDGID) { ------------------ | | 69| 25|#define SSH2_FILEXFER_ATTR_UIDGID 0x00000002 ------------------ | Branch (1014:6): [True: 8, False: 17] ------------------ 1015| 8| logit("set \"%s\" owner %lu group %lu", name, ------------------ | | 113| 8|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1016| 8| (u_long)a.uid, (u_long)a.gid); 1017| 8| r = chown(name, a.uid, a.gid); 1018| 8| if (r == -1) ------------------ | Branch (1018:7): [True: 5, False: 3] ------------------ 1019| 5| status = errno_to_portable(errno); 1020| 8| } 1021| 25| send_status(id, status); 1022| 25| free(name); 1023| 25|} sftp_server_msg_fuzz_helper.c:attrib_to_tv: 956| 8|{ 957| 8| static struct timeval tv[2]; 958| | 959| 8| tv[0].tv_sec = a->atime; 960| 8| tv[0].tv_usec = 0; 961| 8| tv[1].tv_sec = a->mtime; 962| 8| tv[1].tv_usec = 0; 963| 8| return tv; 964| 8|} sftp_server_msg_fuzz_helper.c:process_fsetstat: 1027| 187|{ 1028| 187| Attrib a; 1029| 187| int handle, fd, r; 1030| 187| int status = SSH2_FX_OK; ------------------ | | 87| 187|#define SSH2_FX_OK 0 ------------------ 1031| | 1032| 187| if ((r = get_handle(iqueue, &handle)) != 0 || ------------------ | Branch (1032:6): [True: 26, False: 161] ------------------ 1033| 161| (r = decode_attrib(iqueue, &a)) != 0) ------------------ | Branch (1033:6): [True: 149, False: 12] ------------------ 1034| 175| fatal_fr(r, "parse"); ------------------ | | 146| 175|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1035| | 1036| 12| debug("request %u: fsetstat handle %d", id, handle); ------------------ | | 111| 12|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 1037| 12| fd = handle_to_fd(handle); 1038| 12| if (fd < 0) ------------------ | Branch (1038:6): [True: 12, False: 0] ------------------ 1039| 12| status = SSH2_FX_FAILURE; ------------------ | | 91| 12|#define SSH2_FX_FAILURE 4 ------------------ 1040| 0| else { 1041| 0| char *name = handle_to_name(handle); 1042| | 1043| 0| if (a.flags & SSH2_FILEXFER_ATTR_SIZE) { ------------------ | | 68| 0|#define SSH2_FILEXFER_ATTR_SIZE 0x00000001 ------------------ | Branch (1043:7): [True: 0, False: 0] ------------------ 1044| 0| logit("set \"%s\" size %llu", ------------------ | | 113| 0|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1045| 0| name, (unsigned long long)a.size); 1046| 0| r = ftruncate(fd, a.size); 1047| 0| if (r == -1) ------------------ | Branch (1047:8): [True: 0, False: 0] ------------------ 1048| 0| status = errno_to_portable(errno); 1049| 0| } 1050| 0| if (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) { ------------------ | | 70| 0|#define SSH2_FILEXFER_ATTR_PERMISSIONS 0x00000004 ------------------ | Branch (1050:7): [True: 0, False: 0] ------------------ 1051| 0| logit("set \"%s\" mode %04o", name, a.perm); ------------------ | | 113| 0|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1052| 0|#ifdef HAVE_FCHMOD 1053| 0| r = fchmod(fd, a.perm & 07777); 1054| |#else 1055| | r = chmod(name, a.perm & 07777); 1056| |#endif 1057| 0| if (r == -1) ------------------ | Branch (1057:8): [True: 0, False: 0] ------------------ 1058| 0| status = errno_to_portable(errno); 1059| 0| } 1060| 0| if (a.flags & SSH2_FILEXFER_ATTR_ACMODTIME) { ------------------ | | 71| 0|#define SSH2_FILEXFER_ATTR_ACMODTIME 0x00000008 ------------------ | Branch (1060:7): [True: 0, False: 0] ------------------ 1061| 0| char buf[64]; 1062| 0| time_t t = a.mtime; 1063| | 1064| 0| strftime(buf, sizeof(buf), "%Y%m%d-%H:%M:%S", 1065| 0| localtime(&t)); 1066| 0| logit("set \"%s\" modtime %s", name, buf); ------------------ | | 113| 0|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1067| 0|#ifdef HAVE_FUTIMES 1068| 0| r = futimes(fd, attrib_to_tv(&a)); 1069| |#else 1070| | r = utimes(name, attrib_to_tv(&a)); 1071| |#endif 1072| 0| if (r == -1) ------------------ | Branch (1072:8): [True: 0, False: 0] ------------------ 1073| 0| status = errno_to_portable(errno); 1074| 0| } 1075| 0| if (a.flags & SSH2_FILEXFER_ATTR_UIDGID) { ------------------ | | 69| 0|#define SSH2_FILEXFER_ATTR_UIDGID 0x00000002 ------------------ | Branch (1075:7): [True: 0, False: 0] ------------------ 1076| 0| logit("set \"%s\" owner %lu group %lu", name, ------------------ | | 113| 0|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1077| 0| (u_long)a.uid, (u_long)a.gid); 1078| 0|#ifdef HAVE_FCHOWN 1079| 0| r = fchown(fd, a.uid, a.gid); 1080| |#else 1081| | r = chown(name, a.uid, a.gid); 1082| |#endif 1083| 0| if (r == -1) ------------------ | Branch (1083:8): [True: 0, False: 0] ------------------ 1084| 0| status = errno_to_portable(errno); 1085| 0| } 1086| 0| } 1087| 12| send_status(id, status); 1088| 12|} sftp_server_msg_fuzz_helper.c:process_opendir: 1092| 12|{ 1093| 12| DIR *dirp = NULL; 1094| 12| char *path; 1095| 12| int r, handle, status = SSH2_FX_FAILURE; ------------------ | | 91| 12|#define SSH2_FX_FAILURE 4 ------------------ 1096| | 1097| 12| if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0) ------------------ | Branch (1097:6): [True: 4, False: 8] ------------------ 1098| 4| fatal_fr(r, "parse"); ------------------ | | 146| 4|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1099| | 1100| 8| debug3("request %u: opendir", id); ------------------ | | 109| 8|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1101| 8| logit("opendir \"%s\"", path); ------------------ | | 113| 8|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1102| 8| dirp = opendir(path); 1103| 8| if (dirp == NULL) { ------------------ | Branch (1103:6): [True: 5, False: 3] ------------------ 1104| 5| status = errno_to_portable(errno); 1105| 5| } else { 1106| 3| handle = handle_new(HANDLE_DIR, path, 0, 0, dirp); 1107| 3| if (handle < 0) { ------------------ | Branch (1107:7): [True: 0, False: 3] ------------------ 1108| 0| closedir(dirp); 1109| 3| } else { 1110| 3| send_handle(id, handle); 1111| 3| status = SSH2_FX_OK; ------------------ | | 87| 3|#define SSH2_FX_OK 0 ------------------ 1112| 3| } 1113| | 1114| 3| } 1115| 8| if (status != SSH2_FX_OK) ------------------ | | 87| 8|#define SSH2_FX_OK 0 ------------------ | Branch (1115:6): [True: 5, False: 3] ------------------ 1116| 5| send_status(id, status); 1117| 8| free(path); 1118| 8|} sftp_server_msg_fuzz_helper.c:process_readdir: 1122| 16|{ 1123| 16| DIR *dirp; 1124| 16| struct dirent *dp; 1125| 16| char *path; 1126| 16| int r, handle; 1127| | 1128| 16| if ((r = get_handle(iqueue, &handle)) != 0) ------------------ | Branch (1128:6): [True: 7, False: 9] ------------------ 1129| 7| fatal_fr(r, "parse"); ------------------ | | 146| 7|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1130| | 1131| 9| debug("request %u: readdir \"%s\" (handle %d)", id, ------------------ | | 111| 9|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 1132| 9| handle_to_name(handle), handle); 1133| 9| dirp = handle_to_dir(handle); 1134| 9| path = handle_to_name(handle); 1135| 9| if (dirp == NULL || path == NULL) { ------------------ | Branch (1135:6): [True: 9, False: 0] | Branch (1135:22): [True: 0, False: 0] ------------------ 1136| 9| send_status(id, SSH2_FX_FAILURE); ------------------ | | 91| 9|#define SSH2_FX_FAILURE 4 ------------------ 1137| 9| } else { 1138| 0| struct stat st; 1139| 0| char *pathname; 1140| 0| Stat *stats; 1141| 0| int nstats = 10, count = 0, i; 1142| | 1143| 0| stats = xcalloc(nstats, sizeof(Stat)); 1144| 0| while ((dp = readdir(dirp)) != NULL) { ------------------ | Branch (1144:10): [True: 0, False: 0] ------------------ 1145| 0| if (count >= nstats) { ------------------ | Branch (1145:8): [True: 0, False: 0] ------------------ 1146| 0| nstats *= 2; 1147| 0| stats = xreallocarray(stats, nstats, sizeof(Stat)); 1148| 0| } 1149| 0| xasprintf(&pathname, "%s%s%s", path, 1150| 0| strcmp(path, "/") ? "/" : "", dp->d_name); ------------------ | Branch (1150:8): [True: 0, False: 0] ------------------ 1151| 0| r = lstat(pathname, &st); 1152| 0| free(pathname); 1153| 0| if (r == -1) ------------------ | Branch (1153:8): [True: 0, False: 0] ------------------ 1154| 0| continue; 1155| 0| stat_to_attrib(&st, &(stats[count].attrib)); 1156| 0| stats[count].name = xstrdup(dp->d_name); 1157| 0| stats[count].long_name = ls_file(dp->d_name, &st, 1158| 0| 0, 0, NULL, NULL); 1159| 0| count++; 1160| | /* send up to 100 entries in one message */ 1161| | /* XXX check packet size instead */ 1162| 0| if (count == 100) ------------------ | Branch (1162:8): [True: 0, False: 0] ------------------ 1163| 0| break; 1164| 0| } 1165| 0| if (count > 0) { ------------------ | Branch (1165:7): [True: 0, False: 0] ------------------ 1166| 0| send_names(id, count, stats); 1167| 0| for (i = 0; i < count; i++) { ------------------ | Branch (1167:16): [True: 0, False: 0] ------------------ 1168| 0| free(stats[i].name); 1169| 0| free(stats[i].long_name); 1170| 0| } 1171| 0| } else { 1172| 0| send_status(id, SSH2_FX_EOF); ------------------ | | 88| 0|#define SSH2_FX_EOF 1 ------------------ 1173| 0| } 1174| 0| free(stats); 1175| 0| } 1176| 9|} sftp_server_msg_fuzz_helper.c:handle_to_dir: 397| 9|{ 398| 9| if (handle_is_ok(handle, HANDLE_DIR)) ------------------ | Branch (398:6): [True: 0, False: 9] ------------------ 399| 0| return handles[handle].dirp; 400| 9| return NULL; 401| 9|} sftp_server_msg_fuzz_helper.c:send_names: 609| 120|{ 610| 120| struct sshbuf *msg; 611| 120| int i, r; 612| | 613| 120| if ((msg = sshbuf_new()) == NULL) ------------------ | Branch (613:6): [True: 0, False: 120] ------------------ 614| 0| fatal_f("sshbuf_new failed"); ------------------ | | 126| 0|#define fatal_f(...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 615| 120| if ((r = sshbuf_put_u8(msg, SSH2_FXP_NAME)) != 0 || ------------------ | | 61| 120|#define SSH2_FXP_NAME 104 ------------------ | Branch (615:6): [True: 0, False: 120] ------------------ 616| 120| (r = sshbuf_put_u32(msg, id)) != 0 || ------------------ | Branch (616:6): [True: 0, False: 120] ------------------ 617| 120| (r = sshbuf_put_u32(msg, count)) != 0) ------------------ | Branch (617:6): [True: 0, False: 120] ------------------ 618| 0| fatal_fr(r, "compose"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 619| 120| debug("request %u: sent names count %d", id, count); ------------------ | | 111| 120|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 620| 240| for (i = 0; i < count; i++) { ------------------ | Branch (620:14): [True: 120, False: 120] ------------------ 621| 120| if ((r = sshbuf_put_cstring(msg, stats[i].name)) != 0 || ------------------ | Branch (621:7): [True: 0, False: 120] ------------------ 622| 120| (r = sshbuf_put_cstring(msg, stats[i].long_name)) != 0 || ------------------ | Branch (622:7): [True: 0, False: 120] ------------------ 623| 120| (r = encode_attrib(msg, &stats[i].attrib)) != 0) ------------------ | Branch (623:7): [True: 0, False: 120] ------------------ 624| 0| fatal_fr(r, "compose filenames/attrib"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 625| 120| } 626| 120| send_msg(msg); 627| 120| sshbuf_free(msg); 628| 120|} sftp_server_msg_fuzz_helper.c:process_remove: 1180| 11|{ 1181| 11| char *name; 1182| 11| int r, status = SSH2_FX_FAILURE; ------------------ | | 91| 11|#define SSH2_FX_FAILURE 4 ------------------ 1183| | 1184| 11| if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0) ------------------ | Branch (1184:6): [True: 3, False: 8] ------------------ 1185| 3| fatal_fr(r, "parse"); ------------------ | | 146| 3|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1186| | 1187| 8| debug3("request %u: remove", id); ------------------ | | 109| 8|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1188| 8| logit("remove name \"%s\"", name); ------------------ | | 113| 8|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1189| 8| r = unlink(name); 1190| 8| status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; ------------------ | | 87| 8|#define SSH2_FX_OK 0 ------------------ | Branch (1190:11): [True: 8, False: 0] ------------------ 1191| 8| send_status(id, status); 1192| 8| free(name); 1193| 8|} sftp_server_msg_fuzz_helper.c:process_mkdir: 1197| 46|{ 1198| 46| Attrib a; 1199| 46| char *name; 1200| 46| int r, mode, status = SSH2_FX_FAILURE; ------------------ | | 91| 46|#define SSH2_FX_FAILURE 4 ------------------ 1201| | 1202| 46| if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 || ------------------ | Branch (1202:6): [True: 10, False: 36] ------------------ 1203| 36| (r = decode_attrib(iqueue, &a)) != 0) ------------------ | Branch (1203:6): [True: 25, False: 11] ------------------ 1204| 35| fatal_fr(r, "parse"); ------------------ | | 146| 35|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1205| | 1206| 11| mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? ------------------ | | 70| 11|#define SSH2_FILEXFER_ATTR_PERMISSIONS 0x00000004 ------------------ | Branch (1206:9): [True: 1, False: 10] ------------------ 1207| 10| a.perm & 07777 : 0777; 1208| 11| debug3("request %u: mkdir", id); ------------------ | | 109| 11|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1209| 11| logit("mkdir name \"%s\" mode 0%o", name, mode); ------------------ | | 113| 11|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1210| 11| r = mkdir(name, mode); 1211| 11| status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; ------------------ | | 87| 14|#define SSH2_FX_OK 0 ------------------ | Branch (1211:11): [True: 8, False: 3] ------------------ 1212| 11| send_status(id, status); 1213| 11| free(name); 1214| 11|} sftp_server_msg_fuzz_helper.c:process_rmdir: 1218| 10|{ 1219| 10| char *name; 1220| 10| int r, status; 1221| | 1222| 10| if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0) ------------------ | Branch (1222:6): [True: 3, False: 7] ------------------ 1223| 3| fatal_fr(r, "parse"); ------------------ | | 146| 3|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1224| | 1225| 7| debug3("request %u: rmdir", id); ------------------ | | 109| 7|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1226| 7| logit("rmdir name \"%s\"", name); ------------------ | | 113| 7|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1227| 7| r = rmdir(name); 1228| 7| status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; ------------------ | | 87| 7|#define SSH2_FX_OK 0 ------------------ | Branch (1228:11): [True: 7, False: 0] ------------------ 1229| 7| send_status(id, status); 1230| 7| free(name); 1231| 7|} sftp_server_msg_fuzz_helper.c:process_realpath: 1235| 152|{ 1236| 152| char resolvedname[PATH_MAX]; 1237| 152| char *path; 1238| 152| int r; 1239| | 1240| 152| if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0) ------------------ | Branch (1240:6): [True: 7, False: 145] ------------------ 1241| 7| fatal_fr(r, "parse"); ------------------ | | 146| 7|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1242| | 1243| 145| if (path[0] == '\0') { ------------------ | Branch (1243:6): [True: 2, False: 143] ------------------ 1244| 2| free(path); 1245| 2| path = xstrdup("."); 1246| 2| } 1247| 145| debug3("request %u: realpath", id); ------------------ | | 109| 145|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1248| 145| verbose("realpath \"%s\"", path); ------------------ | | 112| 145|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 1249| 145| if (sftp_realpath(path, resolvedname) == NULL) { ------------------ | Branch (1249:6): [True: 59, False: 86] ------------------ 1250| 59| send_status(id, errno_to_portable(errno)); 1251| 86| } else { 1252| 86| Stat s; 1253| 86| attrib_clear(&s.attrib); 1254| 86| s.name = s.long_name = resolvedname; 1255| 86| send_names(id, 1, &s); 1256| 86| } 1257| 145| free(path); 1258| 145|} sftp_server_msg_fuzz_helper.c:process_stat: 918| 7|{ 919| 7| process_do_stat(id, 0); 920| 7|} sftp_server_msg_fuzz_helper.c:process_rename: 1262| 17|{ 1263| 17| char *oldpath, *newpath; 1264| 17| int r, status; 1265| 17| struct stat sb; 1266| | 1267| 17| if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 || ------------------ | Branch (1267:6): [True: 6, False: 11] ------------------ 1268| 11| (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0) ------------------ | Branch (1268:6): [True: 2, False: 9] ------------------ 1269| 8| fatal_fr(r, "parse"); ------------------ | | 146| 8|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1270| | 1271| 9| debug3("request %u: rename", id); ------------------ | | 109| 9|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1272| 9| logit("rename old \"%s\" new \"%s\"", oldpath, newpath); ------------------ | | 113| 9|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1273| 9| status = SSH2_FX_FAILURE; ------------------ | | 91| 9|#define SSH2_FX_FAILURE 4 ------------------ 1274| 9| if (lstat(oldpath, &sb) == -1) ------------------ | Branch (1274:6): [True: 2, False: 7] ------------------ 1275| 2| status = errno_to_portable(errno); 1276| 7| else if (S_ISREG(sb.st_mode)) { ------------------ | Branch (1276:11): [True: 0, False: 7] ------------------ 1277| | /* Race-free rename of regular files */ 1278| 0| if (link(oldpath, newpath) == -1) { ------------------ | Branch (1278:7): [True: 0, False: 0] ------------------ 1279| 0| if (errno == EOPNOTSUPP || errno == ENOSYS ------------------ | Branch (1279:8): [True: 0, False: 0] | Branch (1279:31): [True: 0, False: 0] ------------------ 1280| 0|#ifdef EXDEV 1281| 0| || errno == EXDEV ------------------ | Branch (1281:11): [True: 0, False: 0] ------------------ 1282| 0|#endif 1283| 0|#ifdef LINK_OPNOTSUPP_ERRNO 1284| 0| || errno == LINK_OPNOTSUPP_ERRNO ------------------ | | 1774| 0|#define LINK_OPNOTSUPP_ERRNO EPERM ------------------ | Branch (1284:11): [True: 0, False: 0] ------------------ 1285| 0|#endif 1286| 0| ) { 1287| 0| struct stat st; 1288| | 1289| | /* 1290| | * fs doesn't support links, so fall back to 1291| | * stat+rename. This is racy. 1292| | */ 1293| 0| if (stat(newpath, &st) == -1) { ------------------ | Branch (1293:9): [True: 0, False: 0] ------------------ 1294| 0| if (rename(oldpath, newpath) == -1) ------------------ | Branch (1294:10): [True: 0, False: 0] ------------------ 1295| 0| status = 1296| 0| errno_to_portable(errno); 1297| 0| else 1298| 0| status = SSH2_FX_OK; ------------------ | | 87| 0|#define SSH2_FX_OK 0 ------------------ 1299| 0| } 1300| 0| } else { 1301| 0| status = errno_to_portable(errno); 1302| 0| } 1303| 0| } else if (unlink(oldpath) == -1) { ------------------ | Branch (1303:14): [True: 0, False: 0] ------------------ 1304| 0| status = errno_to_portable(errno); 1305| | /* clean spare link */ 1306| 0| unlink(newpath); 1307| 0| } else 1308| 0| status = SSH2_FX_OK; ------------------ | | 87| 0|#define SSH2_FX_OK 0 ------------------ 1309| 7| } else if (stat(newpath, &sb) == -1) { ------------------ | Branch (1309:13): [True: 5, False: 2] ------------------ 1310| 5| if (rename(oldpath, newpath) == -1) ------------------ | Branch (1310:7): [True: 4, False: 1] ------------------ 1311| 4| status = errno_to_portable(errno); 1312| 1| else 1313| 1| status = SSH2_FX_OK; ------------------ | | 87| 1|#define SSH2_FX_OK 0 ------------------ 1314| 5| } 1315| 9| send_status(id, status); 1316| 9| free(oldpath); 1317| 9| free(newpath); 1318| 9|} sftp_server_msg_fuzz_helper.c:process_readlink: 1322| 8|{ 1323| 8| int r, len; 1324| 8| char buf[PATH_MAX]; 1325| 8| char *path; 1326| | 1327| 8| if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0) ------------------ | Branch (1327:6): [True: 2, False: 6] ------------------ 1328| 2| fatal_fr(r, "parse"); ------------------ | | 146| 2|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1329| | 1330| 6| debug3("request %u: readlink", id); ------------------ | | 109| 6|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1331| 6| verbose("readlink \"%s\"", path); ------------------ | | 112| 6|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 1332| 6| if ((len = readlink(path, buf, sizeof(buf) - 1)) == -1) ------------------ | Branch (1332:6): [True: 5, False: 1] ------------------ 1333| 5| send_status(id, errno_to_portable(errno)); 1334| 1| else { 1335| 1| Stat s; 1336| | 1337| 1| buf[len] = '\0'; 1338| 1| attrib_clear(&s.attrib); 1339| 1| s.name = s.long_name = buf; 1340| 1| send_names(id, 1, &s); 1341| 1| } 1342| 6| free(path); 1343| 6|} sftp_server_msg_fuzz_helper.c:process_symlink: 1347| 11|{ 1348| 11| char *oldpath, *newpath; 1349| 11| int r, status; 1350| | 1351| 11| if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 || ------------------ | Branch (1351:6): [True: 3, False: 8] ------------------ 1352| 8| (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0) ------------------ | Branch (1352:6): [True: 2, False: 6] ------------------ 1353| 5| fatal_fr(r, "parse"); ------------------ | | 146| 5|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1354| | 1355| 6| debug3("request %u: symlink", id); ------------------ | | 109| 6|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1356| 6| logit("symlink old \"%s\" new \"%s\"", oldpath, newpath); ------------------ | | 113| 6|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1357| | /* this will fail if 'newpath' exists */ 1358| 6| r = symlink(oldpath, newpath); 1359| 6| status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; ------------------ | | 87| 8|#define SSH2_FX_OK 0 ------------------ | Branch (1359:11): [True: 4, False: 2] ------------------ 1360| 6| send_status(id, status); 1361| 6| free(oldpath); 1362| 6| free(newpath); 1363| 6|} sftp_server_msg_fuzz_helper.c:process_extended_posix_rename: 1367| 6|{ 1368| 6| char *oldpath, *newpath; 1369| 6| int r, status; 1370| | 1371| 6| if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 || ------------------ | Branch (1371:6): [True: 2, False: 4] ------------------ 1372| 4| (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0) ------------------ | Branch (1372:6): [True: 2, False: 2] ------------------ 1373| 4| fatal_fr(r, "parse"); ------------------ | | 146| 4|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1374| | 1375| 2| debug3("request %u: posix-rename", id); ------------------ | | 109| 2|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1376| 2| logit("posix-rename old \"%s\" new \"%s\"", oldpath, newpath); ------------------ | | 113| 2|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1377| 2| r = rename(oldpath, newpath); 1378| 2| status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; ------------------ | | 87| 2|#define SSH2_FX_OK 0 ------------------ | Branch (1378:11): [True: 2, False: 0] ------------------ 1379| 2| send_status(id, status); 1380| 2| free(oldpath); 1381| 2| free(newpath); 1382| 2|} sftp_server_msg_fuzz_helper.c:process_extended_statvfs: 1386| 7|{ 1387| 7| char *path; 1388| 7| struct statvfs st; 1389| 7| int r; 1390| | 1391| 7| if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0) ------------------ | Branch (1391:6): [True: 3, False: 4] ------------------ 1392| 3| fatal_fr(r, "parse"); ------------------ | | 146| 3|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1393| 4| debug3("request %u: statvfs", id); ------------------ | | 109| 4|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1394| 4| logit("statvfs \"%s\"", path); ------------------ | | 113| 4|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1395| | 1396| 4| if (statvfs(path, &st) != 0) ------------------ | Branch (1396:6): [True: 3, False: 1] ------------------ 1397| 3| send_status(id, errno_to_portable(errno)); 1398| 1| else 1399| 1| send_statvfs(id, &st); 1400| 4| free(path); 1401| 4|} sftp_server_msg_fuzz_helper.c:send_statvfs: 649| 1|{ 650| 1| struct sshbuf *msg; 651| 1| uint64_t flag; 652| 1| int r; 653| | 654| 1| flag = (st->f_flag & ST_RDONLY) ? SSH2_FXE_STATVFS_ST_RDONLY : 0; ------------------ | | 83| 0|#define SSH2_FXE_STATVFS_ST_RDONLY 0x00000001 ------------------ | Branch (654:9): [True: 0, False: 1] ------------------ 655| 1| flag |= (st->f_flag & ST_NOSUID) ? SSH2_FXE_STATVFS_ST_NOSUID : 0; ------------------ | | 84| 0|#define SSH2_FXE_STATVFS_ST_NOSUID 0x00000002 ------------------ | Branch (655:10): [True: 0, False: 1] ------------------ 656| | 657| 1| if ((msg = sshbuf_new()) == NULL) ------------------ | Branch (657:6): [True: 0, False: 1] ------------------ 658| 0| fatal_f("sshbuf_new failed"); ------------------ | | 126| 0|#define fatal_f(...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 659| 1| if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED_REPLY)) != 0 || ------------------ | | 65| 1|#define SSH2_FXP_EXTENDED_REPLY 201 ------------------ | Branch (659:6): [True: 0, False: 1] ------------------ 660| 1| (r = sshbuf_put_u32(msg, id)) != 0 || ------------------ | Branch (660:6): [True: 0, False: 1] ------------------ 661| 1| (r = sshbuf_put_u64(msg, st->f_bsize)) != 0 || ------------------ | Branch (661:6): [True: 0, False: 1] ------------------ 662| 1| (r = sshbuf_put_u64(msg, st->f_frsize)) != 0 || ------------------ | Branch (662:6): [True: 0, False: 1] ------------------ 663| 1| (r = sshbuf_put_u64(msg, st->f_blocks)) != 0 || ------------------ | Branch (663:6): [True: 0, False: 1] ------------------ 664| 1| (r = sshbuf_put_u64(msg, st->f_bfree)) != 0 || ------------------ | Branch (664:6): [True: 0, False: 1] ------------------ 665| 1| (r = sshbuf_put_u64(msg, st->f_bavail)) != 0 || ------------------ | Branch (665:6): [True: 0, False: 1] ------------------ 666| 1| (r = sshbuf_put_u64(msg, st->f_files)) != 0 || ------------------ | Branch (666:6): [True: 0, False: 1] ------------------ 667| 1| (r = sshbuf_put_u64(msg, st->f_ffree)) != 0 || ------------------ | Branch (667:6): [True: 0, False: 1] ------------------ 668| 1| (r = sshbuf_put_u64(msg, st->f_favail)) != 0 || ------------------ | Branch (668:6): [True: 0, False: 1] ------------------ 669| 1| (r = sshbuf_put_u64(msg, FSID_TO_ULONG(st->f_fsid))) != 0 || ------------------ | | 807| 1|# define FSID_TO_ULONG(f) ((f)) ------------------ | Branch (669:6): [True: 0, False: 1] ------------------ 670| 1| (r = sshbuf_put_u64(msg, flag)) != 0 || ------------------ | Branch (670:6): [True: 0, False: 1] ------------------ 671| 1| (r = sshbuf_put_u64(msg, st->f_namemax)) != 0) ------------------ | Branch (671:6): [True: 0, False: 1] ------------------ 672| 0| fatal_fr(r, "compose"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 673| 1| send_msg(msg); 674| 1| sshbuf_free(msg); 675| 1|} sftp_server_msg_fuzz_helper.c:process_extended_fstatvfs: 1405| 3|{ 1406| 3| int r, handle, fd; 1407| 3| struct statvfs st; 1408| | 1409| 3| if ((r = get_handle(iqueue, &handle)) != 0) ------------------ | Branch (1409:6): [True: 2, False: 1] ------------------ 1410| 2| fatal_fr(r, "parse"); ------------------ | | 146| 2|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1411| 1| debug("request %u: fstatvfs \"%s\" (handle %u)", ------------------ | | 111| 1|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 1412| 1| id, handle_to_name(handle), handle); 1413| 1| if ((fd = handle_to_fd(handle)) < 0) { ------------------ | Branch (1413:6): [True: 1, False: 0] ------------------ 1414| 1| send_status(id, SSH2_FX_FAILURE); ------------------ | | 91| 1|#define SSH2_FX_FAILURE 4 ------------------ 1415| 1| return; 1416| 1| } 1417| 0| if (fstatvfs(fd, &st) != 0) ------------------ | Branch (1417:6): [True: 0, False: 0] ------------------ 1418| 0| send_status(id, errno_to_portable(errno)); 1419| 0| else 1420| 0| send_statvfs(id, &st); 1421| 0|} sftp_server_msg_fuzz_helper.c:process_extended_hardlink: 1425| 6|{ 1426| 6| char *oldpath, *newpath; 1427| 6| int r, status; 1428| | 1429| 6| if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 || ------------------ | Branch (1429:6): [True: 2, False: 4] ------------------ 1430| 4| (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0) ------------------ | Branch (1430:6): [True: 2, False: 2] ------------------ 1431| 4| fatal_fr(r, "parse"); ------------------ | | 146| 4|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1432| | 1433| 2| debug3("request %u: hardlink", id); ------------------ | | 109| 2|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1434| 2| logit("hardlink old \"%s\" new \"%s\"", oldpath, newpath); ------------------ | | 113| 2|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1435| 2| r = link(oldpath, newpath); 1436| 2| status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; ------------------ | | 87| 2|#define SSH2_FX_OK 0 ------------------ | Branch (1436:11): [True: 2, False: 0] ------------------ 1437| 2| send_status(id, status); 1438| 2| free(oldpath); 1439| 2| free(newpath); 1440| 2|} sftp_server_msg_fuzz_helper.c:process_extended_fsync: 1444| 3|{ 1445| 3| int handle, fd, r, status = SSH2_FX_OP_UNSUPPORTED; ------------------ | | 95| 3|#define SSH2_FX_OP_UNSUPPORTED 8 ------------------ 1446| | 1447| 3| if ((r = get_handle(iqueue, &handle)) != 0) ------------------ | Branch (1447:6): [True: 2, False: 1] ------------------ 1448| 2| fatal_fr(r, "parse"); ------------------ | | 146| 2|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1449| 1| debug3("request %u: fsync (handle %u)", id, handle); ------------------ | | 109| 1|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1450| 1| verbose("fsync \"%s\"", handle_to_name(handle)); ------------------ | | 112| 1|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 1451| 1| if ((fd = handle_to_fd(handle)) < 0) ------------------ | Branch (1451:6): [True: 1, False: 0] ------------------ 1452| 1| status = SSH2_FX_NO_SUCH_FILE; ------------------ | | 89| 1|#define SSH2_FX_NO_SUCH_FILE 2 ------------------ 1453| 0| else if (handle_is_ok(handle, HANDLE_FILE)) { ------------------ | Branch (1453:11): [True: 0, False: 0] ------------------ 1454| 0| r = fsync(fd); 1455| 0| status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; ------------------ | | 87| 0|#define SSH2_FX_OK 0 ------------------ | Branch (1455:12): [True: 0, False: 0] ------------------ 1456| 0| } 1457| 1| send_status(id, status); 1458| 1|} sftp_server_msg_fuzz_helper.c:process_extended_lsetstat: 1462| 16|{ 1463| 16| Attrib a; 1464| 16| char *name; 1465| 16| int r, status = SSH2_FX_OK; ------------------ | | 87| 16|#define SSH2_FX_OK 0 ------------------ 1466| | 1467| 16| if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 || ------------------ | Branch (1467:6): [True: 2, False: 14] ------------------ 1468| 14| (r = decode_attrib(iqueue, &a)) != 0) ------------------ | Branch (1468:6): [True: 2, False: 12] ------------------ 1469| 4| fatal_fr(r, "parse"); ------------------ | | 146| 4|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1470| | 1471| 12| debug("request %u: lsetstat name \"%s\"", id, name); ------------------ | | 111| 12|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 1472| 12| if (a.flags & SSH2_FILEXFER_ATTR_SIZE) { ------------------ | | 68| 12|#define SSH2_FILEXFER_ATTR_SIZE 0x00000001 ------------------ | Branch (1472:6): [True: 1, False: 11] ------------------ 1473| | /* nonsensical for links */ 1474| 1| status = SSH2_FX_BAD_MESSAGE; ------------------ | | 92| 1|#define SSH2_FX_BAD_MESSAGE 5 ------------------ 1475| 1| goto out; 1476| 1| } 1477| 11| if (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) { ------------------ | | 70| 11|#define SSH2_FILEXFER_ATTR_PERMISSIONS 0x00000004 ------------------ | Branch (1477:6): [True: 2, False: 9] ------------------ 1478| 2| logit("set \"%s\" mode %04o", name, a.perm); ------------------ | | 113| 2|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1479| 2| r = fchmodat(AT_FDCWD, name, 1480| 2| a.perm & 07777, AT_SYMLINK_NOFOLLOW); 1481| 2| if (r == -1) ------------------ | Branch (1481:7): [True: 2, False: 0] ------------------ 1482| 2| status = errno_to_portable(errno); 1483| 2| } 1484| 11| if (a.flags & SSH2_FILEXFER_ATTR_ACMODTIME) { ------------------ | | 71| 11|#define SSH2_FILEXFER_ATTR_ACMODTIME 0x00000008 ------------------ | Branch (1484:6): [True: 4, False: 7] ------------------ 1485| 4| char buf[64]; 1486| 4| time_t t = a.mtime; 1487| | 1488| 4| strftime(buf, sizeof(buf), "%Y%m%d-%H:%M:%S", 1489| 4| localtime(&t)); 1490| 4| logit("set \"%s\" modtime %s", name, buf); ------------------ | | 113| 4|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1491| 4| r = utimensat(AT_FDCWD, name, 1492| 4| attrib_to_ts(&a), AT_SYMLINK_NOFOLLOW); 1493| 4| if (r == -1) ------------------ | Branch (1493:7): [True: 2, False: 2] ------------------ 1494| 2| status = errno_to_portable(errno); 1495| 4| } 1496| 11| if (a.flags & SSH2_FILEXFER_ATTR_UIDGID) { ------------------ | | 69| 11|#define SSH2_FILEXFER_ATTR_UIDGID 0x00000002 ------------------ | Branch (1496:6): [True: 5, False: 6] ------------------ 1497| 5| logit("set \"%s\" owner %lu group %lu", name, ------------------ | | 113| 5|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1498| 5| (u_long)a.uid, (u_long)a.gid); 1499| 5| r = fchownat(AT_FDCWD, name, a.uid, a.gid, 1500| 5| AT_SYMLINK_NOFOLLOW); 1501| 5| if (r == -1) ------------------ | Branch (1501:7): [True: 3, False: 2] ------------------ 1502| 3| status = errno_to_portable(errno); 1503| 5| } 1504| 12| out: 1505| 12| send_status(id, status); 1506| 12| free(name); 1507| 12|} sftp_server_msg_fuzz_helper.c:attrib_to_ts: 968| 4|{ 969| 4| static struct timespec ts[2]; 970| | 971| 4| ts[0].tv_sec = a->atime; 972| 4| ts[0].tv_nsec = 0; 973| 4| ts[1].tv_sec = a->mtime; 974| 4| ts[1].tv_nsec = 0; 975| 4| return ts; 976| 4|} sftp_server_msg_fuzz_helper.c:process_extended_limits: 1511| 1|{ 1512| 1| struct sshbuf *msg; 1513| 1| int r; 1514| 1| uint64_t nfiles = 0; 1515| 1|#if defined(HAVE_GETRLIMIT) && defined(RLIMIT_NOFILE) 1516| 1| struct rlimit rlim; 1517| 1|#endif 1518| | 1519| 1| debug("request %u: limits", id); ------------------ | | 111| 1|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 1520| | 1521| 1|#if defined(HAVE_GETRLIMIT) && defined(RLIMIT_NOFILE) 1522| 1| if (getrlimit(RLIMIT_NOFILE, &rlim) != -1 && rlim.rlim_cur > 5) ------------------ | Branch (1522:6): [True: 1, False: 0] | Branch (1522:47): [True: 1, False: 0] ------------------ 1523| 1| nfiles = rlim.rlim_cur - 5; /* stdio(3) + syslog + spare */ 1524| 1|#endif 1525| | 1526| 1| if ((msg = sshbuf_new()) == NULL) ------------------ | Branch (1526:6): [True: 0, False: 1] ------------------ 1527| 0| fatal_f("sshbuf_new failed"); ------------------ | | 126| 0|#define fatal_f(...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 1528| 1| if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED_REPLY)) != 0 || ------------------ | | 65| 1|#define SSH2_FXP_EXTENDED_REPLY 201 ------------------ | Branch (1528:6): [True: 0, False: 1] ------------------ 1529| 1| (r = sshbuf_put_u32(msg, id)) != 0 || ------------------ | Branch (1529:6): [True: 0, False: 1] ------------------ 1530| | /* max-packet-length */ 1531| 1| (r = sshbuf_put_u64(msg, SFTP_MAX_MSG_LENGTH)) != 0 || ------------------ | | 29| 1|#define SFTP_MAX_MSG_LENGTH (256 * 1024) ------------------ | Branch (1531:6): [True: 0, False: 1] ------------------ 1532| | /* max-read-length */ 1533| 1| (r = sshbuf_put_u64(msg, SFTP_MAX_READ_LENGTH)) != 0 || ------------------ | | 55| 1|#define SFTP_MAX_READ_LENGTH (SFTP_MAX_MSG_LENGTH - 1024) | | ------------------ | | | | 29| 1|#define SFTP_MAX_MSG_LENGTH (256 * 1024) | | ------------------ ------------------ | Branch (1533:6): [True: 0, False: 1] ------------------ 1534| | /* max-write-length */ 1535| 1| (r = sshbuf_put_u64(msg, SFTP_MAX_MSG_LENGTH - 1024)) != 0 || ------------------ | | 29| 1|#define SFTP_MAX_MSG_LENGTH (256 * 1024) ------------------ | Branch (1535:6): [True: 0, False: 1] ------------------ 1536| | /* max-open-handles */ 1537| 1| (r = sshbuf_put_u64(msg, nfiles)) != 0) ------------------ | Branch (1537:6): [True: 0, False: 1] ------------------ 1538| 0| fatal_fr(r, "compose"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1539| 1| send_msg(msg); 1540| 1| sshbuf_free(msg); 1541| 1|} sftp_server_msg_fuzz_helper.c:process_extended_expand: 1545| 204|{ 1546| 204| char cwd[PATH_MAX], resolvedname[PATH_MAX]; 1547| 204| char *path, *npath; 1548| 204| int r; 1549| 204| Stat s; 1550| | 1551| 204| if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0) ------------------ | Branch (1551:6): [True: 4, False: 200] ------------------ 1552| 4| fatal_fr(r, "parse"); ------------------ | | 146| 4|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1553| 200| if (getcwd(cwd, sizeof(cwd)) == NULL) { ------------------ | Branch (1553:6): [True: 0, False: 200] ------------------ 1554| 0| send_status(id, errno_to_portable(errno)); 1555| 0| goto out; 1556| 0| } 1557| | 1558| 200| debug3("request %u: expand, original \"%s\"", id, path); ------------------ | | 109| 200|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1559| 200| if (path[0] == '\0') { ------------------ | Branch (1559:6): [True: 1, False: 199] ------------------ 1560| | /* empty path */ 1561| 1| free(path); 1562| 1| path = xstrdup("."); 1563| 199| } else if (*path == '~') { ------------------ | Branch (1563:13): [True: 168, False: 31] ------------------ 1564| | /* ~ expand path */ 1565| | /* Special-case for "~" and "~/" to respect homedir flag */ 1566| 168| if (strcmp(path, "~") == 0) { ------------------ | Branch (1566:7): [True: 1, False: 167] ------------------ 1567| 1| free(path); 1568| 1| path = xstrdup(cwd); 1569| 167| } else if (strncmp(path, "~/", 2) == 0) { ------------------ | Branch (1569:14): [True: 5, False: 162] ------------------ 1570| 5| npath = xstrdup(path + 2); 1571| 5| free(path); 1572| 5| xasprintf(&path, "%s/%s", cwd, npath); 1573| 5| free(npath); 1574| 162| } else { 1575| | /* ~user expansions */ 1576| 162| if (tilde_expand(path, pw->pw_uid, &npath) != 0) { ------------------ | Branch (1576:8): [True: 148, False: 14] ------------------ 1577| 148| send_status_errmsg(id, 1578| 148| errno_to_portable(ENOENT), "no such user"); 1579| 148| goto out; 1580| 148| } 1581| 14| free(path); 1582| 14| path = npath; 1583| 14| } 1584| 168| } else if (*path != '/') { ------------------ | Branch (1584:13): [True: 25, False: 6] ------------------ 1585| | /* relative path */ 1586| 25| xasprintf(&npath, "%s/%s", cwd, path); 1587| 25| free(path); 1588| 25| path = npath; 1589| 25| } 1590| 52| verbose("expand \"%s\"", path); ------------------ | | 112| 52|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 1591| 52| if (sftp_realpath(path, resolvedname) == NULL) { ------------------ | Branch (1591:6): [True: 21, False: 31] ------------------ 1592| 21| send_status(id, errno_to_portable(errno)); 1593| 21| goto out; 1594| 21| } 1595| 31| attrib_clear(&s.attrib); 1596| 31| s.name = s.long_name = resolvedname; 1597| 31| send_names(id, 1, &s); 1598| 200| out: 1599| 200| free(path); 1600| 200|} sftp_server_msg_fuzz_helper.c:process_extended_copy_data: 1604| 113|{ 1605| 113| u_char buf[64*1024]; 1606| 113| int read_handle, read_fd, write_handle, write_fd; 1607| 113| uint64_t len, read_off, read_len, write_off; 1608| 113| int r, copy_until_eof, status = SSH2_FX_OP_UNSUPPORTED; ------------------ | | 95| 113|#define SSH2_FX_OP_UNSUPPORTED 8 ------------------ 1609| 113| size_t ret; 1610| 113| struct stat st_read, st_write; 1611| | 1612| 113| if ((r = get_handle(iqueue, &read_handle)) != 0 || ------------------ | Branch (1612:6): [True: 3, False: 110] ------------------ 1613| 110| (r = sshbuf_get_u64(iqueue, &read_off)) != 0 || ------------------ | Branch (1613:6): [True: 1, False: 109] ------------------ 1614| 109| (r = sshbuf_get_u64(iqueue, &read_len)) != 0 || ------------------ | Branch (1614:6): [True: 1, False: 108] ------------------ 1615| 108| (r = get_handle(iqueue, &write_handle)) != 0 || ------------------ | Branch (1615:6): [True: 3, False: 105] ------------------ 1616| 105| (r = sshbuf_get_u64(iqueue, &write_off)) != 0) ------------------ | Branch (1616:6): [True: 6, False: 99] ------------------ 1617| 14| fatal_fr(r, "buffer error"); ------------------ | | 146| 14|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1618| | 1619| 99| debug("request %u: copy-data from \"%s\" (handle %d) off %llu len %llu " ------------------ | | 111| 99|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 1620| 99| "to \"%s\" (handle %d) off %llu", 1621| 99| id, handle_to_name(read_handle), read_handle, 1622| 99| (unsigned long long)read_off, (unsigned long long)read_len, 1623| 99| handle_to_name(write_handle), write_handle, 1624| 99| (unsigned long long)write_off); 1625| | 1626| | /* For read length of 0, we read until EOF. */ 1627| 99| if (read_len == 0) { ------------------ | Branch (1627:6): [True: 3, False: 96] ------------------ 1628| 3| read_len = (uint64_t)-1 - read_off; 1629| 3| copy_until_eof = 1; 1630| 3| } else 1631| 96| copy_until_eof = 0; 1632| | 1633| | /* Disallow reading & writing to the same handle, path or inode */ 1634| 99| read_fd = handle_to_fd(read_handle); 1635| 99| write_fd = handle_to_fd(write_handle); 1636| 99| if (read_fd < 0 || write_fd < 0) { ------------------ | Branch (1636:6): [True: 99, False: 0] | Branch (1636:21): [True: 0, False: 0] ------------------ 1637| 99| error_f("bad read or write fd"); ------------------ | | 125| 99|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1638| 99| status = errno_to_portable(EBADF); 1639| 99| goto out; 1640| 99| } 1641| 0| if (fstat(read_fd, &st_read) != 0) { ------------------ | Branch (1641:6): [True: 0, False: 0] ------------------ 1642| 0| status = errno_to_portable(errno); 1643| 0| error_f("fstat read_fd failed: %s", strerror(errno)); ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1644| 0| goto out; 1645| 0| } 1646| 0| if (fstat(write_fd, &st_write) != 0) { ------------------ | Branch (1646:6): [True: 0, False: 0] ------------------ 1647| 0| status = errno_to_portable(errno); 1648| 0| error_f("fstat write_fd failed: %s", strerror(errno)); ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1649| 0| goto out; 1650| 0| } 1651| 0| if (read_handle == write_handle || ------------------ | Branch (1651:6): [True: 0, False: 0] ------------------ 1652| 0| !strcmp(handle_to_name(read_handle), handle_to_name(write_handle)) || ------------------ | Branch (1652:6): [True: 0, False: 0] ------------------ 1653| 0| (st_read.st_dev != 0 && st_read.st_ino != 0 && ------------------ | Branch (1653:7): [True: 0, False: 0] | Branch (1653:30): [True: 0, False: 0] ------------------ 1654| 0| st_read.st_dev == st_write.st_dev && ------------------ | Branch (1654:6): [True: 0, False: 0] ------------------ 1655| 0| st_read.st_ino == st_write.st_ino)) { ------------------ | Branch (1655:6): [True: 0, False: 0] ------------------ 1656| 0| error_f("refusing to read/write same file: " ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1657| 0| "read \"%s\" dev %lu ino %lu, write \"%s\" dev %lu ino %lu", 1658| 0| handle_to_name(read_handle), 1659| 0| (u_long)st_read.st_dev, (u_long)st_read.st_ino, 1660| 0| handle_to_name(write_handle), 1661| 0| (u_long)st_write.st_dev, (u_long)st_write.st_ino); 1662| 0| status = SSH2_FX_FAILURE; ------------------ | | 91| 0|#define SSH2_FX_FAILURE 4 ------------------ 1663| 0| goto out; 1664| 0| } 1665| | 1666| 0| if (lseek(read_fd, read_off, SEEK_SET) < 0) { ------------------ | Branch (1666:6): [True: 0, False: 0] ------------------ 1667| 0| status = errno_to_portable(errno); 1668| 0| error_f("read_seek failed"); ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1669| 0| goto out; 1670| 0| } 1671| | 1672| 0| if ((handle_to_flags(write_handle) & O_APPEND) == 0 && ------------------ | Branch (1672:6): [True: 0, False: 0] ------------------ 1673| 0| lseek(write_fd, write_off, SEEK_SET) < 0) { ------------------ | Branch (1673:6): [True: 0, False: 0] ------------------ 1674| 0| status = errno_to_portable(errno); 1675| 0| error_f("write_seek failed"); ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1676| 0| goto out; 1677| 0| } 1678| | 1679| | /* Process the request in chunks. */ 1680| 0| while (read_len > 0 || copy_until_eof) { ------------------ | Branch (1680:9): [True: 0, False: 0] | Branch (1680:25): [True: 0, False: 0] ------------------ 1681| 0| len = MINIMUM(sizeof(buf), read_len); ------------------ | | 268| 0|#define MINIMUM(a, b) (((a) < (b)) ? (a) : (b)) | | ------------------ | | | Branch (268:24): [True: 0, False: 0] | | ------------------ ------------------ 1682| 0| read_len -= len; 1683| | 1684| 0| ret = atomicio(read, read_fd, buf, len); 1685| 0| if (ret == 0 && errno == EPIPE) { ------------------ | Branch (1685:7): [True: 0, False: 0] | Branch (1685:19): [True: 0, False: 0] ------------------ 1686| 0| status = copy_until_eof ? SSH2_FX_OK : SSH2_FX_EOF; ------------------ | | 87| 0|#define SSH2_FX_OK 0 ------------------ status = copy_until_eof ? SSH2_FX_OK : SSH2_FX_EOF; ------------------ | | 88| 0|#define SSH2_FX_EOF 1 ------------------ | Branch (1686:13): [True: 0, False: 0] ------------------ 1687| 0| break; 1688| 0| } else if (ret == 0) { ------------------ | Branch (1688:14): [True: 0, False: 0] ------------------ 1689| 0| status = errno_to_portable(errno); 1690| 0| error_f("read failed: %s", strerror(errno)); ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1691| 0| break; 1692| 0| } 1693| 0| len = ret; 1694| 0| handle_update_read(read_handle, len); 1695| | 1696| 0| ret = atomicio(vwrite, write_fd, buf, len); ------------------ | | 42| 0|#define vwrite (ssize_t (*)(int, void *, size_t))write ------------------ 1697| 0| if (ret != len) { ------------------ | Branch (1697:7): [True: 0, False: 0] ------------------ 1698| 0| status = errno_to_portable(errno); 1699| 0| error("%s: write failed: %llu != %llu: %s", __func__, ------------------ | | 114| 0|#define error(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1700| 0| (unsigned long long)ret, (unsigned long long)len, 1701| 0| strerror(errno)); 1702| 0| break; 1703| 0| } 1704| 0| handle_update_write(write_handle, len); 1705| 0| } 1706| | 1707| 0| if (read_len == 0) ------------------ | Branch (1707:6): [True: 0, False: 0] ------------------ 1708| 0| status = SSH2_FX_OK; ------------------ | | 87| 0|#define SSH2_FX_OK 0 ------------------ 1709| | 1710| 99| out: 1711| 99| send_status(id, status); 1712| 99|} sftp_server_msg_fuzz_helper.c:process_extended_home_directory: 1716| 95|{ 1717| 95| char *username; 1718| 95| struct passwd *user_pw; 1719| 95| int r; 1720| 95| Stat s; 1721| | 1722| 95| if ((r = sshbuf_get_cstring(iqueue, &username, NULL)) != 0) ------------------ | Branch (1722:6): [True: 2, False: 93] ------------------ 1723| 2| fatal_fr(r, "parse"); ------------------ | | 146| 2|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1724| | 1725| 93| debug3("request %u: home-directory \"%s\"", id, username); ------------------ | | 109| 93|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1726| 93| if (username[0] == '\0') { ------------------ | Branch (1726:6): [True: 1, False: 92] ------------------ 1727| 1| user_pw = pw; 1728| 92| } else if ((user_pw = getpwnam(username)) == NULL) { ------------------ | Branch (1728:13): [True: 91, False: 1] ------------------ 1729| 91| send_status(id, SSH2_FX_FAILURE); ------------------ | | 91| 91|#define SSH2_FX_FAILURE 4 ------------------ 1730| 91| goto out; 1731| 91| } 1732| | 1733| 2| verbose("home-directory \"%s\"", user_pw->pw_dir); ------------------ | | 112| 2|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 1734| 2| attrib_clear(&s.attrib); 1735| 2| s.name = s.long_name = user_pw->pw_dir; 1736| 2| send_names(id, 1, &s); 1737| 93| out: 1738| 93| free(username); 1739| 93|} sftp_server_msg_fuzz_helper.c:process_extended_get_users_groups_by_id: 1743| 296|{ 1744| 296| struct passwd *user_pw; 1745| 296| struct group *gr; 1746| 296| struct sshbuf *uids, *gids, *usernames, *groupnames, *msg; 1747| 296| int r; 1748| 296| u_int n, nusers = 0, ngroups = 0; 1749| 296| const char *name; 1750| | 1751| 296| if ((usernames = sshbuf_new()) == NULL || ------------------ | Branch (1751:6): [True: 0, False: 296] ------------------ 1752| 296| (groupnames = sshbuf_new()) == NULL || ------------------ | Branch (1752:6): [True: 0, False: 296] ------------------ 1753| 296| (msg = sshbuf_new()) == NULL) ------------------ | Branch (1753:6): [True: 0, False: 296] ------------------ 1754| 0| fatal_f("sshbuf_new failed"); ------------------ | | 126| 0|#define fatal_f(...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 1755| 296| if ((r = sshbuf_froms(iqueue, &uids)) != 0 || ------------------ | Branch (1755:6): [True: 39, False: 257] ------------------ 1756| 257| (r = sshbuf_froms(iqueue, &gids)) != 0) ------------------ | Branch (1756:6): [True: 51, False: 206] ------------------ 1757| 90| fatal_fr(r, "parse"); ------------------ | | 146| 90|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1758| 206| debug_f("uids len = %zu, gids len = %zu", ------------------ | | 122| 206|#define debug_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 1759| 206| sshbuf_len(uids), sshbuf_len(gids)); 1760| 163k| while (sshbuf_len(uids) != 0) { ------------------ | Branch (1760:9): [True: 163k, False: 162] ------------------ 1761| 163k| if ((r = sshbuf_get_u32(uids, &n)) != 0) ------------------ | Branch (1761:7): [True: 44, False: 163k] ------------------ 1762| 44| fatal_fr(r, "parse inner uid"); ------------------ | | 146| 44|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1763| 163k| user_pw = getpwuid((uid_t)n); 1764| 163k| name = user_pw == NULL ? "" : user_pw->pw_name; ------------------ | Branch (1764:10): [True: 82.7k, False: 81.0k] ------------------ 1765| 163k| debug3_f("uid %u => \"%s\"", n, name); ------------------ | | 120| 163k|#define debug3_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1766| 163k| if ((r = sshbuf_put_cstring(usernames, name)) != 0) ------------------ | Branch (1766:7): [True: 0, False: 163k] ------------------ 1767| 0| fatal_fr(r, "assemble uid reply"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1768| 163k| nusers++; 1769| 163k| } 1770| 168k| while (sshbuf_len(gids) != 0) { ------------------ | Branch (1770:9): [True: 168k, False: 121] ------------------ 1771| 168k| if ((r = sshbuf_get_u32(gids, &n)) != 0) ------------------ | Branch (1771:7): [True: 41, False: 168k] ------------------ 1772| 41| fatal_fr(r, "parse inner gid"); ------------------ | | 146| 41|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1773| 168k| gr = getgrgid((gid_t)n); 1774| 168k| name = gr == NULL ? "" : gr->gr_name; ------------------ | Branch (1774:10): [True: 98.6k, False: 69.9k] ------------------ 1775| 168k| debug3_f("gid %u => \"%s\"", n, name); ------------------ | | 120| 168k|#define debug3_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1776| 168k| if ((r = sshbuf_put_cstring(groupnames, name)) != 0) ------------------ | Branch (1776:7): [True: 0, False: 168k] ------------------ 1777| 0| fatal_fr(r, "assemble gid reply"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1778| 168k| ngroups++; 1779| 168k| } 1780| 121| verbose("users-groups-by-id: %u users, %u groups", nusers, ngroups); ------------------ | | 112| 121|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 1781| | 1782| 121| if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED_REPLY)) != 0 || ------------------ | | 65| 121|#define SSH2_FXP_EXTENDED_REPLY 201 ------------------ | Branch (1782:6): [True: 0, False: 121] ------------------ 1783| 121| (r = sshbuf_put_u32(msg, id)) != 0 || ------------------ | Branch (1783:6): [True: 0, False: 121] ------------------ 1784| 121| (r = sshbuf_put_stringb(msg, usernames)) != 0 || ------------------ | Branch (1784:6): [True: 0, False: 121] ------------------ 1785| 121| (r = sshbuf_put_stringb(msg, groupnames)) != 0) ------------------ | Branch (1785:6): [True: 0, False: 121] ------------------ 1786| 0| fatal_fr(r, "compose"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1787| 121| send_msg(msg); 1788| | 1789| 121| sshbuf_free(uids); 1790| 121| sshbuf_free(gids); 1791| 121| sshbuf_free(usernames); 1792| 121| sshbuf_free(groupnames); 1793| 121| sshbuf_free(msg); 1794| 121|} sftp_server_msg_fuzz_helper.c:process: 1821| 3.66k|{ 1822| 3.66k| u_int msg_len; 1823| 3.66k| u_int buf_len; 1824| 3.66k| u_int consumed; 1825| 3.66k| u_char type; 1826| 3.66k| const u_char *cp; 1827| 3.66k| int i, r; 1828| 3.66k| uint32_t id; 1829| | 1830| 3.66k| buf_len = sshbuf_len(iqueue); 1831| 3.66k| if (buf_len < 5) ------------------ | Branch (1831:6): [True: 0, False: 3.66k] ------------------ 1832| 0| return; /* Incomplete message. */ 1833| 3.66k| cp = sshbuf_ptr(iqueue); 1834| 3.66k| msg_len = get_u32(cp); 1835| 3.66k| if (msg_len > SFTP_MAX_MSG_LENGTH) { ------------------ | | 29| 3.66k|#define SFTP_MAX_MSG_LENGTH (256 * 1024) ------------------ | Branch (1835:6): [True: 0, False: 3.66k] ------------------ 1836| 0| error("bad message from %s local user %s", ------------------ | | 114| 0|#define error(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1837| 0| client_addr, pw->pw_name); 1838| 0| sftp_server_cleanup_exit(11); ------------------ | | 66| 0|#define sftp_server_cleanup_exit __orig_sftp_server_cleanup_exit ------------------ 1839| 0| } 1840| 3.66k| if (buf_len < msg_len + 4) ------------------ | Branch (1840:6): [True: 0, False: 3.66k] ------------------ 1841| 0| return; 1842| 3.66k| if ((r = sshbuf_consume(iqueue, 4)) != 0) ------------------ | Branch (1842:6): [True: 0, False: 3.66k] ------------------ 1843| 0| fatal_fr(r, "consume"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1844| 3.66k| buf_len -= 4; 1845| 3.66k| if ((r = sshbuf_get_u8(iqueue, &type)) != 0) ------------------ | Branch (1845:6): [True: 0, False: 3.66k] ------------------ 1846| 0| fatal_fr(r, "parse type"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1847| | 1848| 3.66k| switch (type) { 1849| 1.84k| case SSH2_FXP_INIT: ------------------ | | 35| 1.84k|#define SSH2_FXP_INIT 1 ------------------ | Branch (1849:2): [True: 1.84k, False: 1.82k] ------------------ 1850| 1.84k| process_init(); 1851| 1.84k| init_done = 1; 1852| 1.84k| break; 1853| 1.05k| case SSH2_FXP_EXTENDED: ------------------ | | 64| 1.05k|#define SSH2_FXP_EXTENDED 200 ------------------ | Branch (1853:2): [True: 1.05k, False: 2.61k] ------------------ 1854| 1.05k| if (!init_done) ------------------ | Branch (1854:7): [True: 0, False: 1.05k] ------------------ 1855| 0| fatal("Received extended request before init"); ------------------ | | 115| 0|#define fatal(...) sshfatal(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 1856| 1.05k| if ((r = sshbuf_get_u32(iqueue, &id)) != 0) ------------------ | Branch (1856:7): [True: 1, False: 1.05k] ------------------ 1857| 1| fatal_fr(r, "parse extended ID"); ------------------ | | 146| 1|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1858| 1.05k| process_extended(id); 1859| 1.05k| break; 1860| 770| default: ------------------ | Branch (1860:2): [True: 770, False: 2.89k] ------------------ 1861| 770| if (!init_done) ------------------ | Branch (1861:7): [True: 0, False: 770] ------------------ 1862| 0| fatal("Received %u request before init", type); ------------------ | | 115| 0|#define fatal(...) sshfatal(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 1863| 770| if ((r = sshbuf_get_u32(iqueue, &id)) != 0) ------------------ | Branch (1863:7): [True: 3, False: 767] ------------------ 1864| 3| fatal_fr(r, "parse ID"); ------------------ | | 146| 3|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1865| 7.03k| for (i = 0; handlers[i].handler != NULL; i++) { ------------------ | Branch (1865:15): [True: 6.99k, False: 44] ------------------ 1866| 6.99k| if (type == handlers[i].type) { ------------------ | Branch (1866:8): [True: 723, False: 6.27k] ------------------ 1867| 723| if (!request_permitted(&handlers[i])) { ------------------ | Branch (1867:9): [True: 0, False: 723] ------------------ 1868| 0| send_status(id, 1869| 0| SSH2_FX_PERMISSION_DENIED); ------------------ | | 90| 0|#define SSH2_FX_PERMISSION_DENIED 3 ------------------ 1870| 723| } else { 1871| 723| handlers[i].handler(id); 1872| 723| } 1873| 723| break; 1874| 723| } 1875| 6.99k| } 1876| 767| if (handlers[i].handler == NULL) ------------------ | Branch (1876:7): [True: 44, False: 723] ------------------ 1877| 44| error("Unknown message %u", type); ------------------ | | 114| 44|#define error(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1878| 3.66k| } 1879| | /* discard the remaining bytes from the current packet */ 1880| 3.00k| if (buf_len < sshbuf_len(iqueue)) { ------------------ | Branch (1880:6): [True: 0, False: 3.00k] ------------------ 1881| 0| error("iqueue grew unexpectedly"); ------------------ | | 114| 0|#define error(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1882| 0| sftp_server_cleanup_exit(255); ------------------ | | 66| 0|#define sftp_server_cleanup_exit __orig_sftp_server_cleanup_exit ------------------ 1883| 0| } 1884| 3.00k| consumed = buf_len - sshbuf_len(iqueue); 1885| 3.00k| if (msg_len < consumed) { ------------------ | Branch (1885:6): [True: 0, False: 3.00k] ------------------ 1886| 0| error("msg_len %u < consumed %u", msg_len, consumed); ------------------ | | 114| 0|#define error(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1887| 0| sftp_server_cleanup_exit(255); ------------------ | | 66| 0|#define sftp_server_cleanup_exit __orig_sftp_server_cleanup_exit ------------------ 1888| 0| } 1889| 3.00k| if (msg_len > consumed && ------------------ | Branch (1889:6): [True: 559, False: 2.44k] ------------------ 1890| 559| (r = sshbuf_consume(iqueue, msg_len - consumed)) != 0) ------------------ | Branch (1890:6): [True: 0, False: 559] ------------------ 1891| 0| fatal_fr(r, "consume"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1892| 3.00k|} sftp_server_msg_fuzz_helper.c:process_init: 703| 1.84k|{ 704| 1.84k| struct sshbuf *msg; 705| 1.84k| int r; 706| | 707| 1.84k| if ((r = sshbuf_get_u32(iqueue, &version)) != 0) ------------------ | Branch (707:6): [True: 2, False: 1.84k] ------------------ 708| 2| fatal_fr(r, "parse"); ------------------ | | 146| 2|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 709| 1.84k| verbose("received client version %u", version); ------------------ | | 112| 1.84k|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 710| 1.84k| if ((msg = sshbuf_new()) == NULL) ------------------ | Branch (710:6): [True: 0, False: 1.84k] ------------------ 711| 0| fatal_f("sshbuf_new failed"); ------------------ | | 126| 0|#define fatal_f(...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 712| 1.84k| if ((r = sshbuf_put_u8(msg, SSH2_FXP_VERSION)) != 0 || ------------------ | | 57| 1.84k|#define SSH2_FXP_VERSION 2 ------------------ | Branch (712:6): [True: 0, False: 1.84k] ------------------ 713| 1.84k| (r = sshbuf_put_u32(msg, SSH2_FILEXFER_VERSION)) != 0) ------------------ | | 32| 1.84k|#define SSH2_FILEXFER_VERSION 3 ------------------ | Branch (713:6): [True: 0, False: 1.84k] ------------------ 714| 0| fatal_fr(r, "compose"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 715| | 716| | /* extension advertisements */ 717| 1.84k| compose_extension(msg, "posix-rename@openssh.com", "1"); 718| 1.84k| compose_extension(msg, "statvfs@openssh.com", "2"); 719| 1.84k| compose_extension(msg, "fstatvfs@openssh.com", "2"); 720| 1.84k| compose_extension(msg, "hardlink@openssh.com", "1"); 721| 1.84k| compose_extension(msg, "fsync@openssh.com", "1"); 722| 1.84k| compose_extension(msg, "lsetstat@openssh.com", "1"); 723| 1.84k| compose_extension(msg, "limits@openssh.com", "1"); 724| 1.84k| compose_extension(msg, "expand-path@openssh.com", "1"); 725| 1.84k| compose_extension(msg, "copy-data", "1"); 726| 1.84k| compose_extension(msg, "home-directory", "1"); 727| 1.84k| compose_extension(msg, "users-groups-by-id@openssh.com", "1"); 728| | 729| 1.84k| send_msg(msg); 730| 1.84k| sshbuf_free(msg); 731| 1.84k|} sftp_server_msg_fuzz_helper.c:compose_extension: 683| 20.2k|{ 684| 20.2k| int r; 685| 20.2k| const struct sftp_handler *exthnd; 686| | 687| 20.2k| if ((exthnd = extended_handler_byname(name)) == NULL) ------------------ | Branch (687:6): [True: 0, False: 20.2k] ------------------ 688| 0| fatal_f("internal error: no handler for %s", name); ------------------ | | 126| 0|#define fatal_f(...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 689| 20.2k| if (!request_permitted(exthnd)) { ------------------ | Branch (689:6): [True: 0, False: 20.2k] ------------------ 690| 0| debug2_f("refusing to advertise disallowed extension %s", name); ------------------ | | 121| 0|#define debug2_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG2, NULL, __VA_ARGS__) ------------------ 691| 0| return 0; 692| 0| } 693| 20.2k| if ((r = sshbuf_put_cstring(msg, name)) != 0 || ------------------ | Branch (693:6): [True: 0, False: 20.2k] ------------------ 694| 20.2k| (r = sshbuf_put_cstring(msg, ver)) != 0) ------------------ | Branch (694:6): [True: 0, False: 20.2k] ------------------ 695| 0| fatal_fr(r, "compose %s", name); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 696| 20.2k| return 0; 697| 20.2k|} sftp_server_msg_fuzz_helper.c:extended_handler_byname: 174| 21.2k|{ 175| 21.2k| int i; 176| | 177| 131k| for (i = 0; extended_handlers[i].handler != NULL; i++) { ------------------ | Branch (177:14): [True: 131k, False: 286] ------------------ 178| 131k| if (strcmp(name, extended_handlers[i].ext_name) == 0) ------------------ | Branch (178:7): [True: 21.0k, False: 110k] ------------------ 179| 21.0k| return &extended_handlers[i]; 180| 131k| } 181| 286| return NULL; 182| 21.2k|} sftp_server_msg_fuzz_helper.c:process_extended: 1798| 1.05k|{ 1799| 1.05k| char *request; 1800| 1.05k| int r; 1801| 1.05k| const struct sftp_handler *exthand; 1802| | 1803| 1.05k| if ((r = sshbuf_get_cstring(iqueue, &request, NULL)) != 0) ------------------ | Branch (1803:6): [True: 18, False: 1.03k] ------------------ 1804| 18| fatal_fr(r, "parse"); ------------------ | | 146| 18|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1805| 1.03k| if ((exthand = extended_handler_byname(request)) == NULL) { ------------------ | Branch (1805:6): [True: 286, False: 750] ------------------ 1806| 286| error("Unknown extended request \"%.100s\"", request); ------------------ | | 114| 286|#define error(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1807| 286| send_status(id, SSH2_FX_OP_UNSUPPORTED); /* MUST */ ------------------ | | 95| 286|#define SSH2_FX_OP_UNSUPPORTED 8 ------------------ 1808| 750| } else { 1809| 750| if (!request_permitted(exthand)) ------------------ | Branch (1809:7): [True: 0, False: 750] ------------------ 1810| 0| send_status(id, SSH2_FX_PERMISSION_DENIED); ------------------ | | 90| 0|#define SSH2_FX_PERMISSION_DENIED 3 ------------------ 1811| 750| else 1812| 750| exthand->handler(id); 1813| 750| } 1814| 1.03k| free(request); 1815| 1.03k|} sftp_server_msg_fuzz_helper.c:request_permitted: 186| 21.7k|{ 187| 21.7k| char *result; 188| | 189| 21.7k| if (readonly && h->does_write) { ------------------ | Branch (189:6): [True: 0, False: 21.7k] | Branch (189:18): [True: 0, False: 0] ------------------ 190| 0| verbose("Refusing %s request in read-only mode", h->name); ------------------ | | 112| 0|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 191| 0| return 0; 192| 0| } 193| 21.7k| if (request_denylist != NULL && ------------------ | Branch (193:6): [True: 0, False: 21.7k] ------------------ 194| 0| ((result = match_list(h->name, request_denylist, NULL))) != NULL) { ------------------ | Branch (194:6): [True: 0, False: 0] ------------------ 195| 0| free(result); 196| 0| verbose("Refusing denylisted %s request", h->name); ------------------ | | 112| 0|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 197| 0| return 0; 198| 0| } 199| 21.7k| if (request_allowlist != NULL && ------------------ | Branch (199:6): [True: 0, False: 21.7k] ------------------ 200| 0| ((result = match_list(h->name, request_allowlist, NULL))) != NULL) { ------------------ | Branch (200:6): [True: 0, False: 0] ------------------ 201| 0| free(result); 202| 0| debug2("Permitting allowlisted %s request", h->name); ------------------ | | 110| 0|#define debug2(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG2, NULL, __VA_ARGS__) ------------------ 203| 0| return 1; 204| 0| } 205| 21.7k| if (request_allowlist != NULL) { ------------------ | Branch (205:6): [True: 0, False: 21.7k] ------------------ 206| 0| verbose("Refusing non-allowlisted %s request", h->name); ------------------ | | 112| 0|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 207| 0| return 0; 208| 0| } 209| 21.7k| return 1; 210| 21.7k|} sshbuf_get_u64: 47| 393|{ 48| 393| const u_char *p = sshbuf_ptr(buf); 49| 393| int r; 50| | 51| 393| if ((r = sshbuf_consume(buf, 8)) < 0) ------------------ | Branch (51:6): [True: 36, False: 357] ------------------ 52| 36| return r; 53| 357| if (valp != NULL) ------------------ | Branch (53:6): [True: 357, False: 0] ------------------ 54| 357| *valp = PEEK_U64(p); ------------------ | | 342| 357| (((uint64_t)(((const u_char *)(p))[0]) << 56) | \ | | 343| 357| ((uint64_t)(((const u_char *)(p))[1]) << 48) | \ | | 344| 357| ((uint64_t)(((const u_char *)(p))[2]) << 40) | \ | | 345| 357| ((uint64_t)(((const u_char *)(p))[3]) << 32) | \ | | 346| 357| ((uint64_t)(((const u_char *)(p))[4]) << 24) | \ | | 347| 357| ((uint64_t)(((const u_char *)(p))[5]) << 16) | \ | | 348| 357| ((uint64_t)(((const u_char *)(p))[6]) << 8) | \ | | 349| 357| (uint64_t)(((const u_char *)(p))[7])) ------------------ 55| 357| return 0; 56| 393|} sshbuf_get_u32: 60| 336k|{ 61| 336k| const u_char *p = sshbuf_ptr(buf); 62| 336k| int r; 63| | 64| 336k| if ((r = sshbuf_consume(buf, 4)) < 0) ------------------ | Branch (64:6): [True: 201, False: 336k] ------------------ 65| 201| return r; 66| 336k| if (valp != NULL) ------------------ | Branch (66:6): [True: 336k, False: 0] ------------------ 67| 336k| *valp = PEEK_U32(p); ------------------ | | 351| 336k| (((uint32_t)(((const u_char *)(p))[0]) << 24) | \ | | 352| 336k| ((uint32_t)(((const u_char *)(p))[1]) << 16) | \ | | 353| 336k| ((uint32_t)(((const u_char *)(p))[2]) << 8) | \ | | 354| 336k| (uint32_t)(((const u_char *)(p))[3])) ------------------ 68| 336k| return 0; 69| 336k|} sshbuf_get_u8: 86| 3.66k|{ 87| 3.66k| const u_char *p = sshbuf_ptr(buf); 88| 3.66k| int r; 89| | 90| 3.66k| if ((r = sshbuf_consume(buf, 1)) < 0) ------------------ | Branch (90:6): [True: 0, False: 3.66k] ------------------ 91| 0| return r; 92| 3.66k| if (valp != NULL) ------------------ | Branch (92:6): [True: 3.66k, False: 0] ------------------ 93| 3.66k| *valp = (uint8_t)*p; 94| 3.66k| return 0; 95| 3.66k|} sshbuf_get_string: 186| 5.77k|{ 187| 5.77k| const u_char *val; 188| 5.77k| size_t len; 189| 5.77k| int r; 190| | 191| 5.77k| if (valp != NULL) ------------------ | Branch (191:6): [True: 5.77k, False: 0] ------------------ 192| 5.77k| *valp = NULL; 193| 5.77k| if (lenp != NULL) ------------------ | Branch (193:6): [True: 5.77k, False: 0] ------------------ 194| 5.77k| *lenp = 0; 195| 5.77k| if ((r = sshbuf_get_string_direct(buf, &val, &len)) < 0) ------------------ | Branch (195:6): [True: 116, False: 5.66k] ------------------ 196| 116| return r; 197| 5.66k| if (valp != NULL) { ------------------ | Branch (197:6): [True: 5.66k, False: 0] ------------------ 198| 5.66k| if ((*valp = malloc(len + 1)) == NULL) { ------------------ | Branch (198:7): [True: 0, False: 5.66k] ------------------ 199| 0| SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL")); 200| 0| return SSH_ERR_ALLOC_FAIL; ------------------ | | 26| 0|#define SSH_ERR_ALLOC_FAIL -2 ------------------ 201| 0| } 202| 5.66k| if (len != 0) ------------------ | Branch (202:7): [True: 338, False: 5.32k] ------------------ 203| 338| memcpy(*valp, val, len); 204| 5.66k| (*valp)[len] = '\0'; 205| 5.66k| } 206| 5.66k| if (lenp != NULL) ------------------ | Branch (206:6): [True: 5.66k, False: 0] ------------------ 207| 5.66k| *lenp = len; 208| 5.66k| return 0; 209| 5.66k|} sshbuf_get_string_direct: 213| 12.7k|{ 214| 12.7k| size_t len; 215| 12.7k| const u_char *p; 216| 12.7k| int r; 217| | 218| 12.7k| if (valp != NULL) ------------------ | Branch (218:6): [True: 5.77k, False: 6.99k] ------------------ 219| 5.77k| *valp = NULL; 220| 12.7k| if (lenp != NULL) ------------------ | Branch (220:6): [True: 5.77k, False: 6.99k] ------------------ 221| 5.77k| *lenp = 0; 222| 12.7k| if ((r = sshbuf_peek_string_direct(buf, &p, &len)) < 0) ------------------ | Branch (222:6): [True: 116, False: 12.6k] ------------------ 223| 116| return r; 224| 12.6k| if (valp != NULL) ------------------ | Branch (224:6): [True: 5.66k, False: 6.99k] ------------------ 225| 5.66k| *valp = p; 226| 12.6k| if (lenp != NULL) ------------------ | Branch (226:6): [True: 5.66k, False: 6.99k] ------------------ 227| 5.66k| *lenp = len; 228| 12.6k| if (sshbuf_consume(buf, len + 4) != 0) { ------------------ | Branch (228:6): [True: 0, False: 12.6k] ------------------ 229| | /* Shouldn't happen */ 230| 0| SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR")); 231| 0| SSHBUF_ABORT(); 232| 0| return SSH_ERR_INTERNAL_ERROR; ------------------ | | 25| 0|#define SSH_ERR_INTERNAL_ERROR -1 ------------------ 233| 0| } 234| 12.6k| return 0; 235| 12.6k|} sshbuf_peek_string_direct: 240| 20.5k|{ 241| 20.5k| uint32_t len; 242| 20.5k| const u_char *p = sshbuf_ptr(buf); 243| | 244| 20.5k| if (valp != NULL) ------------------ | Branch (244:6): [True: 20.5k, False: 0] ------------------ 245| 20.5k| *valp = NULL; 246| 20.5k| if (lenp != NULL) ------------------ | Branch (246:6): [True: 20.5k, False: 0] ------------------ 247| 20.5k| *lenp = 0; 248| 20.5k| if (sshbuf_len(buf) < 4) { ------------------ | Branch (248:6): [True: 126, False: 20.3k] ------------------ 249| 126| SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE")); 250| 126| return SSH_ERR_MESSAGE_INCOMPLETE; ------------------ | | 27| 126|#define SSH_ERR_MESSAGE_INCOMPLETE -3 ------------------ 251| 126| } 252| 20.3k| len = PEEK_U32(p); ------------------ | | 351| 20.3k| (((uint32_t)(((const u_char *)(p))[0]) << 24) | \ | | 352| 20.3k| ((uint32_t)(((const u_char *)(p))[1]) << 16) | \ | | 353| 20.3k| ((uint32_t)(((const u_char *)(p))[2]) << 8) | \ | | 354| 20.3k| (uint32_t)(((const u_char *)(p))[3])) ------------------ 253| 20.3k| if (len > SSHBUF_SIZE_MAX - 4) { ------------------ | | 39| 20.3k|#define SSHBUF_SIZE_MAX 0x8000000 /* Hard maximum size */ ------------------ | Branch (253:6): [True: 99, False: 20.2k] ------------------ 254| 99| SSHBUF_DBG(("SSH_ERR_STRING_TOO_LARGE")); 255| 99| return SSH_ERR_STRING_TOO_LARGE; ------------------ | | 30| 99|#define SSH_ERR_STRING_TOO_LARGE -6 ------------------ 256| 99| } 257| 20.2k| if (sshbuf_len(buf) - 4 < len) { ------------------ | Branch (257:6): [True: 162, False: 20.1k] ------------------ 258| 162| SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE")); 259| 162| return SSH_ERR_MESSAGE_INCOMPLETE; ------------------ | | 27| 162|#define SSH_ERR_MESSAGE_INCOMPLETE -3 ------------------ 260| 162| } 261| 20.1k| if (valp != NULL) ------------------ | Branch (261:6): [True: 20.1k, False: 0] ------------------ 262| 20.1k| *valp = p + 4; 263| 20.1k| if (lenp != NULL) ------------------ | Branch (263:6): [True: 20.1k, False: 0] ------------------ 264| 20.1k| *lenp = len; 265| 20.1k| return 0; 266| 20.2k|} sshbuf_get_cstring: 270| 7.19k|{ 271| 7.19k| size_t len; 272| 7.19k| const u_char *p, *z; 273| 7.19k| int r; 274| | 275| 7.19k| if (valp != NULL) ------------------ | Branch (275:6): [True: 7.19k, False: 0] ------------------ 276| 7.19k| *valp = NULL; 277| 7.19k| if (lenp != NULL) ------------------ | Branch (277:6): [True: 0, False: 7.19k] ------------------ 278| 0| *lenp = 0; 279| 7.19k| if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0) ------------------ | Branch (279:6): [True: 181, False: 7.01k] ------------------ 280| 181| return r; 281| | /* Allow a \0 only at the end of the string */ 282| 7.01k| if (len > 0 && ------------------ | Branch (282:6): [True: 1.86k, False: 5.14k] ------------------ 283| 1.86k| (z = memchr(p , '\0', len)) != NULL && z < p + len - 1) { ------------------ | Branch (283:6): [True: 476, False: 1.38k] | Branch (283:45): [True: 15, False: 461] ------------------ 284| 15| SSHBUF_DBG(("SSH_ERR_INVALID_FORMAT")); 285| 15| return SSH_ERR_INVALID_FORMAT; ------------------ | | 28| 15|#define SSH_ERR_INVALID_FORMAT -4 ------------------ 286| 15| } 287| 6.99k| if ((r = sshbuf_skip_string(buf)) != 0) ------------------ | | 232| 6.99k|#define sshbuf_skip_string(buf) sshbuf_get_string_direct(buf, NULL, NULL) ------------------ | Branch (287:6): [True: 0, False: 6.99k] ------------------ 288| 0| return -1; 289| 6.99k| if (valp != NULL) { ------------------ | Branch (289:6): [True: 6.99k, False: 0] ------------------ 290| 6.99k| if ((*valp = malloc(len + 1)) == NULL) { ------------------ | Branch (290:7): [True: 0, False: 6.99k] ------------------ 291| 0| SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL")); 292| 0| return SSH_ERR_ALLOC_FAIL; ------------------ | | 26| 0|#define SSH_ERR_ALLOC_FAIL -2 ------------------ 293| 0| } 294| 6.99k| if (len != 0) ------------------ | Branch (294:7): [True: 1.84k, False: 5.14k] ------------------ 295| 1.84k| memcpy(*valp, p, len); 296| 6.99k| (*valp)[len] = '\0'; 297| 6.99k| } 298| 6.99k| if (lenp != NULL) ------------------ | Branch (298:6): [True: 0, False: 6.99k] ------------------ 299| 0| *lenp = (size_t)len; 300| 6.99k| return 0; 301| 6.99k|} sshbuf_put: 325| 5.50k|{ 326| 5.50k| u_char *p; 327| 5.50k| int r; 328| | 329| 5.50k| if ((r = sshbuf_reserve(buf, len, &p)) < 0) ------------------ | Branch (329:6): [True: 0, False: 5.50k] ------------------ 330| 0| return r; 331| 5.50k| if (len != 0) ------------------ | Branch (331:6): [True: 5.50k, False: 0] ------------------ 332| 5.50k| memcpy(p, v, len); 333| 5.50k| return 0; 334| 5.50k|} sshbuf_put_u64: 391| 17|{ 392| 17| u_char *p; 393| 17| int r; 394| | 395| 17| if ((r = sshbuf_reserve(buf, 8, &p)) < 0) ------------------ | Branch (395:6): [True: 0, False: 17] ------------------ 396| 0| return r; 397| 17| POKE_U64(p, val); ------------------ | | 360| 17| do { \ | | 361| 17| const uint64_t __v = (v); \ | | 362| 17| ((u_char *)(p))[0] = (__v >> 56) & 0xff; \ | | 363| 17| ((u_char *)(p))[1] = (__v >> 48) & 0xff; \ | | 364| 17| ((u_char *)(p))[2] = (__v >> 40) & 0xff; \ | | 365| 17| ((u_char *)(p))[3] = (__v >> 32) & 0xff; \ | | 366| 17| ((u_char *)(p))[4] = (__v >> 24) & 0xff; \ | | 367| 17| ((u_char *)(p))[5] = (__v >> 16) & 0xff; \ | | 368| 17| ((u_char *)(p))[6] = (__v >> 8) & 0xff; \ | | 369| 17| ((u_char *)(p))[7] = __v & 0xff; \ | | 370| 17| } while (0) | | ------------------ | | | Branch (370:11): [Folded, False: 17] | | ------------------ ------------------ 398| 17| return 0; 399| 17|} sshbuf_put_u32: 403| 4.07k|{ 404| 4.07k| u_char *p; 405| 4.07k| int r; 406| | 407| 4.07k| if ((r = sshbuf_reserve(buf, 4, &p)) < 0) ------------------ | Branch (407:6): [True: 0, False: 4.07k] ------------------ 408| 0| return r; 409| 4.07k| POKE_U32(p, val); ------------------ | | 372| 4.07k| do { \ | | 373| 4.07k| const uint32_t __v = (v); \ | | 374| 4.07k| ((u_char *)(p))[0] = (__v >> 24) & 0xff; \ | | 375| 4.07k| ((u_char *)(p))[1] = (__v >> 16) & 0xff; \ | | 376| 4.07k| ((u_char *)(p))[2] = (__v >> 8) & 0xff; \ | | 377| 4.07k| ((u_char *)(p))[3] = __v & 0xff; \ | | 378| 4.07k| } while (0) | | ------------------ | | | Branch (378:11): [Folded, False: 4.07k] | | ------------------ ------------------ 410| 4.07k| return 0; 411| 4.07k|} sshbuf_put_u8: 427| 2.95k|{ 428| 2.95k| u_char *p; 429| 2.95k| int r; 430| | 431| 2.95k| if ((r = sshbuf_reserve(buf, 1, &p)) < 0) ------------------ | Branch (431:6): [True: 0, False: 2.95k] ------------------ 432| 0| return r; 433| 2.95k| p[0] = val; 434| 2.95k| return 0; 435| 2.95k|} sshbuf_put_string: 513| 377k|{ 514| 377k| u_char *d; 515| 377k| int r; 516| | 517| 377k| if (len > SSHBUF_SIZE_MAX - 4) { ------------------ | | 39| 377k|#define SSHBUF_SIZE_MAX 0x8000000 /* Hard maximum size */ ------------------ | Branch (517:6): [True: 0, False: 377k] ------------------ 518| 0| SSHBUF_DBG(("SSH_ERR_NO_BUFFER_SPACE")); 519| 0| return SSH_ERR_NO_BUFFER_SPACE; ------------------ | | 33| 0|#define SSH_ERR_NO_BUFFER_SPACE -9 ------------------ 520| 0| } 521| 377k| if ((r = sshbuf_reserve(buf, len + 4, &d)) < 0) ------------------ | Branch (521:6): [True: 0, False: 377k] ------------------ 522| 0| return r; 523| 377k| POKE_U32(d, len); ------------------ | | 372| 377k| do { \ | | 373| 377k| const uint32_t __v = (v); \ | | 374| 377k| ((u_char *)(p))[0] = (__v >> 24) & 0xff; \ | | 375| 377k| ((u_char *)(p))[1] = (__v >> 16) & 0xff; \ | | 376| 377k| ((u_char *)(p))[2] = (__v >> 8) & 0xff; \ | | 377| 377k| ((u_char *)(p))[3] = __v & 0xff; \ | | 378| 377k| } while (0) | | ------------------ | | | Branch (378:11): [Folded, False: 377k] | | ------------------ ------------------ 524| 377k| if (len != 0) ------------------ | Branch (524:6): [True: 195k, False: 182k] ------------------ 525| 195k| memcpy(d + 4, v, len); 526| 377k| return 0; 527| 377k|} sshbuf_put_cstring: 531| 374k|{ 532| 374k| return sshbuf_put_string(buf, v, v == NULL ? 0 : strlen(v)); ------------------ | Branch (532:35): [True: 0, False: 374k] ------------------ 533| 374k|} sshbuf_put_stringb: 537| 3.19k|{ 538| 3.19k| if (v == NULL) ------------------ | Branch (538:6): [True: 0, False: 3.19k] ------------------ 539| 0| return sshbuf_put_string(buf, NULL, 0); 540| | 541| 3.19k| return sshbuf_put_string(buf, sshbuf_ptr(v), sshbuf_len(v)); 542| 3.19k|} sshbuf_froms: 546| 553|{ 547| 553| const u_char *p; 548| 553| size_t len; 549| 553| struct sshbuf *ret; 550| 553| int r; 551| | 552| 553| if (buf == NULL || bufp == NULL) ------------------ | Branch (552:6): [True: 0, False: 553] | Branch (552:21): [True: 0, False: 553] ------------------ 553| 0| return SSH_ERR_INVALID_ARGUMENT; ------------------ | | 34| 0|#define SSH_ERR_INVALID_ARGUMENT -10 ------------------ 554| 553| *bufp = NULL; 555| 553| if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0) ------------------ | Branch (555:6): [True: 90, False: 463] ------------------ 556| 90| return r; 557| 463| if ((ret = sshbuf_from(p, len)) == NULL) ------------------ | Branch (557:6): [True: 0, False: 463] ------------------ 558| 0| return SSH_ERR_ALLOC_FAIL; ------------------ | | 26| 0|#define SSH_ERR_ALLOC_FAIL -2 ------------------ 559| 463| if ((r = sshbuf_consume(buf, len + 4)) != 0 || /* Shouldn't happen */ ------------------ | Branch (559:6): [True: 0, False: 463] ------------------ 560| 463| (r = sshbuf_set_parent(ret, buf)) != 0) { ------------------ | Branch (560:6): [True: 0, False: 463] ------------------ 561| 0| sshbuf_free(ret); 562| 0| return r; 563| 0| } 564| 463| *bufp = ret; 565| 463| return 0; 566| 463|} sshbuf_new: 94| 7.39k|{ 95| 7.39k| struct sshbuf *ret; 96| | 97| 7.39k| if ((ret = calloc(1, sizeof(*ret))) == NULL) ------------------ | Branch (97:6): [True: 0, False: 7.39k] ------------------ 98| 0| return NULL; 99| 7.39k| ret->alloc = SSHBUF_SIZE_INIT; ------------------ | | 409| 7.39k|# define SSHBUF_SIZE_INIT 256 /* Initial allocation */ ------------------ 100| 7.39k| ret->max_size = SSHBUF_SIZE_MAX; ------------------ | | 39| 7.39k|#define SSHBUF_SIZE_MAX 0x8000000 /* Hard maximum size */ ------------------ 101| 7.39k| ret->readonly = 0; 102| 7.39k| ret->refcount = 1; 103| 7.39k| ret->parent = NULL; 104| 7.39k| if ((ret->cd = ret->d = calloc(1, ret->alloc)) == NULL) { ------------------ | Branch (104:6): [True: 0, False: 7.39k] ------------------ 105| 0| free(ret); 106| 0| return NULL; 107| 0| } 108| 7.39k| return ret; 109| 7.39k|} sshbuf_from: 113| 463|{ 114| 463| struct sshbuf *ret; 115| | 116| 463| if (blob == NULL || len > SSHBUF_SIZE_MAX || ------------------ | | 39| 926|#define SSHBUF_SIZE_MAX 0x8000000 /* Hard maximum size */ ------------------ | Branch (116:6): [True: 0, False: 463] | Branch (116:22): [True: 0, False: 463] ------------------ 117| 463| (ret = calloc(1, sizeof(*ret))) == NULL) ------------------ | Branch (117:6): [True: 0, False: 463] ------------------ 118| 0| return NULL; 119| 463| ret->alloc = ret->size = ret->max_size = len; 120| 463| ret->readonly = 1; 121| 463| ret->refcount = 1; 122| 463| ret->parent = NULL; 123| 463| ret->cd = blob; 124| | ret->d = NULL; 125| 463| return ret; 126| 463|} sshbuf_set_parent: 130| 463|{ 131| 463| int r; 132| | 133| 463| if ((r = sshbuf_check_sanity(child)) != 0 || ------------------ | Branch (133:6): [True: 0, False: 463] ------------------ 134| 463| (r = sshbuf_check_sanity(parent)) != 0) ------------------ | Branch (134:6): [True: 0, False: 463] ------------------ 135| 0| return r; 136| 463| if ((child->parent != NULL && child->parent != parent) || ------------------ | Branch (136:7): [True: 0, False: 463] | Branch (136:32): [True: 0, False: 0] ------------------ 137| 463| child == parent) ------------------ | Branch (137:6): [True: 0, False: 463] ------------------ 138| 0| return SSH_ERR_INTERNAL_ERROR; ------------------ | | 25| 0|#define SSH_ERR_INTERNAL_ERROR -1 ------------------ 139| 463| child->parent = parent; 140| 463| child->parent->refcount++; 141| 463| return 0; 142| 463|} sshbuf_free: 162| 11.5k|{ 163| 11.5k| if (buf == NULL) ------------------ | Branch (163:6): [True: 5.53k, False: 6.01k] ------------------ 164| 5.53k| return; 165| | /* 166| | * The following will leak on insane buffers, but this is the safest 167| | * course of action - an invalid pointer or already-freed pointer may 168| | * have been passed to us and continuing to scribble over memory would 169| | * be bad. 170| | */ 171| 6.01k| if (sshbuf_check_sanity(buf) != 0) ------------------ | Branch (171:6): [True: 0, False: 6.01k] ------------------ 172| 0| return; 173| | 174| | /* 175| | * If we are a parent with still-extant children, then don't free just 176| | * yet. The last child's call to sshbuf_free should decrement our 177| | * refcount to 0 and trigger the actual free. 178| | */ 179| 6.01k| buf->refcount--; 180| 6.01k| if (buf->refcount > 0) ------------------ | Branch (180:6): [True: 242, False: 5.77k] ------------------ 181| 242| return; 182| | 183| | /* 184| | * If we are a child, then free our parent to decrement its reference 185| | * count and possibly free it. 186| | */ 187| 5.77k| sshbuf_free(buf->parent); 188| 5.77k| buf->parent = NULL; 189| | 190| 5.77k| if (!buf->readonly) ------------------ | Branch (190:6): [True: 5.53k, False: 242] ------------------ 191| 5.53k| freezero(buf->d, buf->alloc); 192| 5.77k| freezero(buf, sizeof(*buf)); 193| 5.77k|} sshbuf_reset: 197| 6.62k|{ 198| 6.62k| u_char *d; 199| | 200| 6.62k| if (buf->readonly || buf->refcount > 1) { ------------------ | Branch (200:6): [True: 0, False: 6.62k] | Branch (200:23): [True: 0, False: 6.62k] ------------------ 201| | /* Nonsensical. Just make buffer appear empty */ 202| 0| buf->off = buf->size; 203| 0| return; 204| 0| } 205| 6.62k| if (sshbuf_check_sanity(buf) != 0) ------------------ | Branch (205:6): [True: 0, False: 6.62k] ------------------ 206| 0| return; 207| 6.62k| buf->off = buf->size = 0; 208| 6.62k| if (buf->alloc != SSHBUF_SIZE_INIT) { ------------------ | | 409| 6.62k|# define SSHBUF_SIZE_INIT 256 /* Initial allocation */ ------------------ | Branch (208:6): [True: 3.77k, False: 2.84k] ------------------ 209| 3.77k| if ((d = recallocarray(buf->d, buf->alloc, SSHBUF_SIZE_INIT, ------------------ | | 409| 3.77k|# define SSHBUF_SIZE_INIT 256 /* Initial allocation */ ------------------ | Branch (209:7): [True: 3.77k, False: 0] ------------------ 210| 3.77k| 1)) != NULL) { 211| 3.77k| buf->cd = buf->d = d; 212| 3.77k| buf->alloc = SSHBUF_SIZE_INIT; ------------------ | | 409| 3.77k|# define SSHBUF_SIZE_INIT 256 /* Initial allocation */ ------------------ 213| 3.77k| } 214| 3.77k| } 215| 6.62k| explicit_bzero(buf->d, buf->alloc); 216| 6.62k|} sshbuf_len: 282| 744k|{ 283| 744k| if (sshbuf_check_sanity(buf) != 0) ------------------ | Branch (283:6): [True: 0, False: 744k] ------------------ 284| 0| return 0; 285| 744k| return buf->size - buf->off; 286| 744k|} sshbuf_ptr: 298| 368k|{ 299| 368k| if (sshbuf_check_sanity(buf) != 0) ------------------ | Branch (299:6): [True: 0, False: 368k] ------------------ 300| 0| return NULL; 301| 368k| return buf->cd + buf->off; 302| 368k|} sshbuf_check_reserve: 314| 402k|{ 315| 402k| int r; 316| | 317| 402k| if ((r = sshbuf_check_sanity(buf)) != 0) ------------------ | Branch (317:6): [True: 0, False: 402k] ------------------ 318| 0| return r; 319| 402k| if (buf->readonly || buf->refcount > 1) ------------------ | Branch (319:6): [True: 0, False: 402k] | Branch (319:23): [True: 0, False: 402k] ------------------ 320| 0| return SSH_ERR_BUFFER_READ_ONLY; ------------------ | | 73| 0|#define SSH_ERR_BUFFER_READ_ONLY -49 ------------------ 321| 402k| SSHBUF_TELL("check"); 322| | /* Check that len is reasonable and that max_size + available < len */ 323| 402k| if (len > buf->max_size || buf->max_size - len < buf->size - buf->off) ------------------ | Branch (323:6): [True: 0, False: 402k] | Branch (323:29): [True: 0, False: 402k] ------------------ 324| 0| return SSH_ERR_NO_BUFFER_SPACE; ------------------ | | 33| 0|#define SSH_ERR_NO_BUFFER_SPACE -9 ------------------ 325| 402k| return 0; 326| 402k|} sshbuf_allocate: 330| 390k|{ 331| 390k| size_t rlen, need; 332| 390k| u_char *dp; 333| 390k| int r; 334| | 335| 390k| SSHBUF_DBG(("allocate buf = %p len = %zu", buf, len)); 336| 390k| if ((r = sshbuf_check_reserve(buf, len)) != 0) ------------------ | Branch (336:6): [True: 0, False: 390k] ------------------ 337| 0| return r; 338| | /* 339| | * If the requested allocation appended would push us past max_size 340| | * then pack the buffer, zeroing buf->off. 341| | */ 342| 390k| sshbuf_maybe_pack(buf, buf->size + len > buf->max_size); 343| 390k| SSHBUF_TELL("allocate"); 344| 390k| if (len + buf->size <= buf->alloc) ------------------ | Branch (344:6): [True: 378k, False: 11.9k] ------------------ 345| 378k| return 0; /* already have it. */ 346| | 347| | /* 348| | * Prefer to alloc in SSHBUF_SIZE_INC units, but 349| | * allocate less if doing so would overflow max_size. 350| | */ 351| 11.9k| need = len + buf->size - buf->alloc; 352| 11.9k| rlen = ROUNDUP(buf->alloc + need, SSHBUF_SIZE_INC); ------------------ | | 270| 11.9k|#define ROUNDUP(x, y) ((((x)+((y)-1))/(y))*(y)) ------------------ 353| 11.9k| SSHBUF_DBG(("need %zu initial rlen %zu", need, rlen)); 354| 11.9k| if (rlen > buf->max_size) ------------------ | Branch (354:6): [True: 0, False: 11.9k] ------------------ 355| 0| rlen = buf->alloc + need; 356| 11.9k| SSHBUF_DBG(("adjusted rlen %zu", rlen)); 357| 11.9k| if ((dp = recallocarray(buf->d, buf->alloc, rlen, 1)) == NULL) { ------------------ | Branch (357:6): [True: 0, False: 11.9k] ------------------ 358| 0| SSHBUF_DBG(("realloc fail")); 359| 0| return SSH_ERR_ALLOC_FAIL; ------------------ | | 26| 0|#define SSH_ERR_ALLOC_FAIL -2 ------------------ 360| 0| } 361| 11.9k| buf->alloc = rlen; 362| 11.9k| buf->cd = buf->d = dp; 363| 11.9k| if ((r = sshbuf_check_reserve(buf, len)) < 0) { ------------------ | Branch (363:6): [True: 0, False: 11.9k] ------------------ 364| | /* shouldn't fail */ 365| 0| return r; 366| 0| } 367| 11.9k| SSHBUF_TELL("done"); 368| 11.9k| return 0; 369| 11.9k|} sshbuf_reserve: 373| 390k|{ 374| 390k| u_char *dp; 375| 390k| int r; 376| | 377| 390k| if (dpp != NULL) ------------------ | Branch (377:6): [True: 390k, False: 0] ------------------ 378| 390k| *dpp = NULL; 379| | 380| 390k| SSHBUF_DBG(("reserve buf = %p len = %zu", buf, len)); 381| 390k| if ((r = sshbuf_allocate(buf, len)) != 0) ------------------ | Branch (381:6): [True: 0, False: 390k] ------------------ 382| 0| return r; 383| | 384| 390k| dp = buf->d + buf->size; 385| 390k| buf->size += len; 386| 390k| if (dpp != NULL) ------------------ | Branch (386:6): [True: 390k, False: 0] ------------------ 387| 390k| *dpp = dp; 388| 390k| return 0; 389| 390k|} sshbuf_consume: 393| 358k|{ 394| 358k| int r; 395| | 396| 358k| SSHBUF_DBG(("len = %zu", len)); 397| 358k| if ((r = sshbuf_check_sanity(buf)) != 0) ------------------ | Branch (397:6): [True: 0, False: 358k] ------------------ 398| 0| return r; 399| 358k| if (len == 0) ------------------ | Branch (399:6): [True: 0, False: 358k] ------------------ 400| 0| return 0; 401| 358k| if (len > sshbuf_len(buf)) ------------------ | Branch (401:6): [True: 237, False: 357k] ------------------ 402| 237| return SSH_ERR_MESSAGE_INCOMPLETE; ------------------ | | 27| 237|#define SSH_ERR_MESSAGE_INCOMPLETE -3 ------------------ 403| 357k| buf->off += len; 404| | /* deal with empty buffer */ 405| 357k| if (buf->off == buf->size) ------------------ | Branch (405:6): [True: 3.45k, False: 354k] ------------------ 406| 3.45k| buf->off = buf->size = 0; 407| 357k| SSHBUF_TELL("done"); 408| 357k| return 0; 409| 358k|} sshbuf.c:sshbuf_check_sanity: 56| 1.88M|{ 57| 1.88M| SSHBUF_TELL("sanity"); 58| 1.88M| if (__predict_false(buf == NULL || ------------------ | | 986| 36.4M|# define __predict_false(exp) __builtin_expect(((exp) != 0), 0) | | ------------------ | | | Branch (986:35): [True: 0, False: 1.88M] | | | Branch (986:54): [True: 556k, False: 1.33M] | | | Branch (986:54): [True: 0, False: 556k] | | | Branch (986:54): [True: 0, False: 1.88M] | | | Branch (986:54): [True: 0, False: 1.88M] | | | Branch (986:54): [True: 0, False: 1.88M] | | | Branch (986:54): [True: 0, False: 1.88M] | | | Branch (986:54): [True: 0, False: 1.88M] | | | Branch (986:54): [True: 0, False: 1.88M] | | | Branch (986:54): [True: 0, False: 1.88M] | | | Branch (986:54): [True: 0, False: 1.88M] | | | Branch (986:54): [True: 0, False: 1.88M] | | ------------------ ------------------ 59| 1.88M| (!buf->readonly && buf->d != buf->cd) || 60| 1.88M| buf->parent == buf || 61| 1.88M| buf->refcount < 1 || buf->refcount > SSHBUF_REFS_MAX || 62| 1.88M| buf->cd == NULL || 63| 1.88M| buf->max_size > SSHBUF_SIZE_MAX || 64| 1.88M| buf->alloc > buf->max_size || 65| 1.88M| buf->size > buf->alloc || 66| 1.88M| buf->off > buf->size)) { 67| | /* Do not try to recover from corrupted buffer internals */ 68| 0| SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR")); 69| 0| ssh_signal(SIGSEGV, SIG_DFL); 70| 0| raise(SIGSEGV); 71| 0| return SSH_ERR_INTERNAL_ERROR; ------------------ | | 25| 0|#define SSH_ERR_INTERNAL_ERROR -1 ------------------ 72| 0| } 73| 1.88M| return 0; 74| 1.88M|} sshbuf.c:sshbuf_maybe_pack: 78| 390k|{ 79| 390k| SSHBUF_DBG(("force %d", force)); 80| 390k| SSHBUF_TELL("pre-pack"); 81| 390k| if (buf->off == 0 || buf->readonly || buf->refcount > 1) ------------------ | Branch (81:6): [True: 390k, False: 0] | Branch (81:23): [True: 0, False: 0] | Branch (81:40): [True: 0, False: 0] ------------------ 82| 390k| return; 83| 0| if (force || ------------------ | Branch (83:6): [True: 0, False: 0] ------------------ 84| 0| (buf->off >= SSHBUF_PACK_MIN && buf->off >= buf->size / 2)) { ------------------ | | 411| 0|# define SSHBUF_PACK_MIN 8192 /* Minimum packable offset */ ------------------ | Branch (84:7): [True: 0, False: 0] | Branch (84:38): [True: 0, False: 0] ------------------ 85| 0| memmove(buf->d, buf->d + buf->off, buf->size - buf->off); 86| 0| buf->size -= buf->off; 87| 0| buf->off = 0; 88| 0| SSHBUF_TELL("packed"); 89| 0| } 90| 0|} ssh_err: 24| 668|{ 25| 668| const char *msg = NULL; 26| | 27| 668| switch (n) { 28| 0| case SSH_ERR_SUCCESS: ------------------ | | 24| 0|#define SSH_ERR_SUCCESS 0 ------------------ | Branch (28:2): [True: 0, False: 668] ------------------ 29| 0| return "success"; 30| 0| case SSH_ERR_INTERNAL_ERROR: ------------------ | | 25| 0|#define SSH_ERR_INTERNAL_ERROR -1 ------------------ | Branch (30:2): [True: 0, False: 668] ------------------ 31| 0| return "unexpected internal error"; 32| 0| case SSH_ERR_ALLOC_FAIL: ------------------ | | 26| 0|#define SSH_ERR_ALLOC_FAIL -2 ------------------ | Branch (32:2): [True: 0, False: 668] ------------------ 33| 0| return "memory allocation failed"; 34| 525| case SSH_ERR_MESSAGE_INCOMPLETE: ------------------ | | 27| 525|#define SSH_ERR_MESSAGE_INCOMPLETE -3 ------------------ | Branch (34:2): [True: 525, False: 143] ------------------ 35| 525| return "incomplete message"; 36| 44| case SSH_ERR_INVALID_FORMAT: ------------------ | | 28| 44|#define SSH_ERR_INVALID_FORMAT -4 ------------------ | Branch (36:2): [True: 44, False: 624] ------------------ 37| 44| return "invalid format"; 38| 0| case SSH_ERR_BIGNUM_IS_NEGATIVE: ------------------ | | 29| 0|#define SSH_ERR_BIGNUM_IS_NEGATIVE -5 ------------------ | Branch (38:2): [True: 0, False: 668] ------------------ 39| 0| return "bignum is negative"; 40| 99| case SSH_ERR_STRING_TOO_LARGE: ------------------ | | 30| 99|#define SSH_ERR_STRING_TOO_LARGE -6 ------------------ | Branch (40:2): [True: 99, False: 569] ------------------ 41| 99| return "string is too large"; 42| 0| case SSH_ERR_BIGNUM_TOO_LARGE: ------------------ | | 31| 0|#define SSH_ERR_BIGNUM_TOO_LARGE -7 ------------------ | Branch (42:2): [True: 0, False: 668] ------------------ 43| 0| return "bignum is too large"; 44| 0| case SSH_ERR_ECPOINT_TOO_LARGE: ------------------ | | 32| 0|#define SSH_ERR_ECPOINT_TOO_LARGE -8 ------------------ | Branch (44:2): [True: 0, False: 668] ------------------ 45| 0| return "elliptic curve point is too large"; 46| 0| case SSH_ERR_NO_BUFFER_SPACE: ------------------ | | 33| 0|#define SSH_ERR_NO_BUFFER_SPACE -9 ------------------ | Branch (46:2): [True: 0, False: 668] ------------------ 47| 0| return "insufficient buffer space"; 48| 0| case SSH_ERR_INVALID_ARGUMENT: ------------------ | | 34| 0|#define SSH_ERR_INVALID_ARGUMENT -10 ------------------ | Branch (48:2): [True: 0, False: 668] ------------------ 49| 0| return "invalid argument"; 50| 0| case SSH_ERR_KEY_BITS_MISMATCH: ------------------ | | 35| 0|#define SSH_ERR_KEY_BITS_MISMATCH -11 ------------------ | Branch (50:2): [True: 0, False: 668] ------------------ 51| 0| return "key bits do not match"; 52| 0| case SSH_ERR_EC_CURVE_INVALID: ------------------ | | 36| 0|#define SSH_ERR_EC_CURVE_INVALID -12 ------------------ | Branch (52:2): [True: 0, False: 668] ------------------ 53| 0| return "invalid elliptic curve"; 54| 0| case SSH_ERR_KEY_TYPE_MISMATCH: ------------------ | | 37| 0|#define SSH_ERR_KEY_TYPE_MISMATCH -13 ------------------ | Branch (54:2): [True: 0, False: 668] ------------------ 55| 0| return "key type does not match"; 56| 0| case SSH_ERR_KEY_TYPE_UNKNOWN: ------------------ | | 38| 0|#define SSH_ERR_KEY_TYPE_UNKNOWN -14 /* XXX UNSUPPORTED? */ ------------------ | Branch (56:2): [True: 0, False: 668] ------------------ 57| 0| return "unknown or unsupported key type"; 58| 0| case SSH_ERR_EC_CURVE_MISMATCH: ------------------ | | 39| 0|#define SSH_ERR_EC_CURVE_MISMATCH -15 ------------------ | Branch (58:2): [True: 0, False: 668] ------------------ 59| 0| return "elliptic curve does not match"; 60| 0| case SSH_ERR_EXPECTED_CERT: ------------------ | | 40| 0|#define SSH_ERR_EXPECTED_CERT -16 ------------------ | Branch (60:2): [True: 0, False: 668] ------------------ 61| 0| return "plain key provided where certificate required"; 62| 0| case SSH_ERR_KEY_LACKS_CERTBLOB: ------------------ | | 41| 0|#define SSH_ERR_KEY_LACKS_CERTBLOB -17 ------------------ | Branch (62:2): [True: 0, False: 668] ------------------ 63| 0| return "key lacks certificate data"; 64| 0| case SSH_ERR_KEY_CERT_UNKNOWN_TYPE: ------------------ | | 42| 0|#define SSH_ERR_KEY_CERT_UNKNOWN_TYPE -18 ------------------ | Branch (64:2): [True: 0, False: 668] ------------------ 65| 0| return "unknown/unsupported certificate type"; 66| 0| case SSH_ERR_KEY_CERT_INVALID_SIGN_KEY: ------------------ | | 43| 0|#define SSH_ERR_KEY_CERT_INVALID_SIGN_KEY -19 ------------------ | Branch (66:2): [True: 0, False: 668] ------------------ 67| 0| return "invalid certificate signing key"; 68| 0| case SSH_ERR_KEY_INVALID_EC_VALUE: ------------------ | | 44| 0|#define SSH_ERR_KEY_INVALID_EC_VALUE -20 ------------------ | Branch (68:2): [True: 0, False: 668] ------------------ 69| 0| return "invalid elliptic curve value"; 70| 0| case SSH_ERR_SIGNATURE_INVALID: ------------------ | | 45| 0|#define SSH_ERR_SIGNATURE_INVALID -21 ------------------ | Branch (70:2): [True: 0, False: 668] ------------------ 71| 0| return "incorrect signature"; 72| 0| case SSH_ERR_LIBCRYPTO_ERROR: ------------------ | | 46| 0|#define SSH_ERR_LIBCRYPTO_ERROR -22 ------------------ | Branch (72:2): [True: 0, False: 668] ------------------ 73| 0| msg = ssherr_libcrypto(); 74| 0| return msg != NULL ? msg : "error in libcrypto"; ------------------ | Branch (74:10): [True: 0, False: 0] ------------------ 75| 0| case SSH_ERR_INTERNAL_CRYPTO_ERROR: ------------------ | | 86| 0|#define SSH_ERR_INTERNAL_CRYPTO_ERROR -62 ------------------ | Branch (75:2): [True: 0, False: 668] ------------------ 76| 0| return "cryptographic operation failed"; 77| 0| case SSH_ERR_UNEXPECTED_TRAILING_DATA: ------------------ | | 47| 0|#define SSH_ERR_UNEXPECTED_TRAILING_DATA -23 ------------------ | Branch (77:2): [True: 0, False: 668] ------------------ 78| 0| return "unexpected bytes remain after decoding"; 79| 0| case SSH_ERR_SYSTEM_ERROR: ------------------ | | 48| 0|#define SSH_ERR_SYSTEM_ERROR -24 ------------------ | Branch (79:2): [True: 0, False: 668] ------------------ 80| 0| return strerror(errno); 81| 0| case SSH_ERR_KEY_CERT_INVALID: ------------------ | | 49| 0|#define SSH_ERR_KEY_CERT_INVALID -25 ------------------ | Branch (81:2): [True: 0, False: 668] ------------------ 82| 0| return "invalid certificate"; 83| 0| case SSH_ERR_AGENT_COMMUNICATION: ------------------ | | 50| 0|#define SSH_ERR_AGENT_COMMUNICATION -26 ------------------ | Branch (83:2): [True: 0, False: 668] ------------------ 84| 0| return "communication with agent failed"; 85| 0| case SSH_ERR_AGENT_FAILURE: ------------------ | | 51| 0|#define SSH_ERR_AGENT_FAILURE -27 ------------------ | Branch (85:2): [True: 0, False: 668] ------------------ 86| 0| return "agent refused operation"; 87| 0| case SSH_ERR_DH_GEX_OUT_OF_RANGE: ------------------ | | 52| 0|#define SSH_ERR_DH_GEX_OUT_OF_RANGE -28 ------------------ | Branch (87:2): [True: 0, False: 668] ------------------ 88| 0| return "DH GEX group out of range"; 89| 0| case SSH_ERR_DISCONNECTED: ------------------ | | 53| 0|#define SSH_ERR_DISCONNECTED -29 ------------------ | Branch (89:2): [True: 0, False: 668] ------------------ 90| 0| return "disconnected"; 91| 0| case SSH_ERR_MAC_INVALID: ------------------ | | 54| 0|#define SSH_ERR_MAC_INVALID -30 ------------------ | Branch (91:2): [True: 0, False: 668] ------------------ 92| 0| return "message authentication code incorrect"; 93| 0| case SSH_ERR_NO_CIPHER_ALG_MATCH: ------------------ | | 55| 0|#define SSH_ERR_NO_CIPHER_ALG_MATCH -31 ------------------ | Branch (93:2): [True: 0, False: 668] ------------------ 94| 0| return "no matching cipher found"; 95| 0| case SSH_ERR_NO_MAC_ALG_MATCH: ------------------ | | 56| 0|#define SSH_ERR_NO_MAC_ALG_MATCH -32 ------------------ | Branch (95:2): [True: 0, False: 668] ------------------ 96| 0| return "no matching MAC found"; 97| 0| case SSH_ERR_NO_COMPRESS_ALG_MATCH: ------------------ | | 57| 0|#define SSH_ERR_NO_COMPRESS_ALG_MATCH -33 ------------------ | Branch (97:2): [True: 0, False: 668] ------------------ 98| 0| return "no matching compression method found"; 99| 0| case SSH_ERR_NO_KEX_ALG_MATCH: ------------------ | | 58| 0|#define SSH_ERR_NO_KEX_ALG_MATCH -34 ------------------ | Branch (99:2): [True: 0, False: 668] ------------------ 100| 0| return "no matching key exchange method found"; 101| 0| case SSH_ERR_NO_HOSTKEY_ALG_MATCH: ------------------ | | 59| 0|#define SSH_ERR_NO_HOSTKEY_ALG_MATCH -35 ------------------ | Branch (101:2): [True: 0, False: 668] ------------------ 102| 0| return "no matching host key type found"; 103| 0| case SSH_ERR_PROTOCOL_MISMATCH: ------------------ | | 61| 0|#define SSH_ERR_PROTOCOL_MISMATCH -37 ------------------ | Branch (103:2): [True: 0, False: 668] ------------------ 104| 0| return "protocol version mismatch"; 105| 0| case SSH_ERR_NO_PROTOCOL_VERSION: ------------------ | | 62| 0|#define SSH_ERR_NO_PROTOCOL_VERSION -38 ------------------ | Branch (105:2): [True: 0, False: 668] ------------------ 106| 0| return "could not read protocol version"; 107| 0| case SSH_ERR_NO_HOSTKEY_LOADED: ------------------ | | 60| 0|#define SSH_ERR_NO_HOSTKEY_LOADED -36 ------------------ | Branch (107:2): [True: 0, False: 668] ------------------ 108| 0| return "could not load host key"; 109| 0| case SSH_ERR_NEED_REKEY: ------------------ | | 63| 0|#define SSH_ERR_NEED_REKEY -39 ------------------ | Branch (109:2): [True: 0, False: 668] ------------------ 110| 0| return "rekeying not supported by peer"; 111| 0| case SSH_ERR_PASSPHRASE_TOO_SHORT: ------------------ | | 64| 0|#define SSH_ERR_PASSPHRASE_TOO_SHORT -40 ------------------ | Branch (111:2): [True: 0, False: 668] ------------------ 112| 0| return "passphrase is too short (minimum five characters)"; 113| 0| case SSH_ERR_FILE_CHANGED: ------------------ | | 65| 0|#define SSH_ERR_FILE_CHANGED -41 ------------------ | Branch (113:2): [True: 0, False: 668] ------------------ 114| 0| return "file changed while reading"; 115| 0| case SSH_ERR_KEY_UNKNOWN_CIPHER: ------------------ | | 66| 0|#define SSH_ERR_KEY_UNKNOWN_CIPHER -42 ------------------ | Branch (115:2): [True: 0, False: 668] ------------------ 116| 0| return "key encrypted using unsupported cipher"; 117| 0| case SSH_ERR_KEY_WRONG_PASSPHRASE: ------------------ | | 67| 0|#define SSH_ERR_KEY_WRONG_PASSPHRASE -43 ------------------ | Branch (117:2): [True: 0, False: 668] ------------------ 118| 0| return "incorrect passphrase supplied to decrypt private key"; 119| 0| case SSH_ERR_KEY_BAD_PERMISSIONS: ------------------ | | 68| 0|#define SSH_ERR_KEY_BAD_PERMISSIONS -44 ------------------ | Branch (119:2): [True: 0, False: 668] ------------------ 120| 0| return "bad permissions"; 121| 0| case SSH_ERR_KEY_CERT_MISMATCH: ------------------ | | 69| 0|#define SSH_ERR_KEY_CERT_MISMATCH -45 ------------------ | Branch (121:2): [True: 0, False: 668] ------------------ 122| 0| return "certificate does not match key"; 123| 0| case SSH_ERR_KEY_NOT_FOUND: ------------------ | | 70| 0|#define SSH_ERR_KEY_NOT_FOUND -46 ------------------ | Branch (123:2): [True: 0, False: 668] ------------------ 124| 0| return "key not found"; 125| 0| case SSH_ERR_AGENT_NOT_PRESENT: ------------------ | | 71| 0|#define SSH_ERR_AGENT_NOT_PRESENT -47 ------------------ | Branch (125:2): [True: 0, False: 668] ------------------ 126| 0| return "agent not present"; 127| 0| case SSH_ERR_AGENT_NO_IDENTITIES: ------------------ | | 72| 0|#define SSH_ERR_AGENT_NO_IDENTITIES -48 ------------------ | Branch (127:2): [True: 0, False: 668] ------------------ 128| 0| return "agent contains no identities"; 129| 0| case SSH_ERR_BUFFER_READ_ONLY: ------------------ | | 73| 0|#define SSH_ERR_BUFFER_READ_ONLY -49 ------------------ | Branch (129:2): [True: 0, False: 668] ------------------ 130| 0| return "internal error: buffer is read-only"; 131| 0| case SSH_ERR_KRL_BAD_MAGIC: ------------------ | | 74| 0|#define SSH_ERR_KRL_BAD_MAGIC -50 ------------------ | Branch (131:2): [True: 0, False: 668] ------------------ 132| 0| return "KRL file has invalid magic number"; 133| 0| case SSH_ERR_KEY_REVOKED: ------------------ | | 75| 0|#define SSH_ERR_KEY_REVOKED -51 ------------------ | Branch (133:2): [True: 0, False: 668] ------------------ 134| 0| return "Key is revoked"; 135| 0| case SSH_ERR_CONN_CLOSED: ------------------ | | 76| 0|#define SSH_ERR_CONN_CLOSED -52 ------------------ | Branch (135:2): [True: 0, False: 668] ------------------ 136| 0| return "Connection closed"; 137| 0| case SSH_ERR_CONN_TIMEOUT: ------------------ | | 77| 0|#define SSH_ERR_CONN_TIMEOUT -53 ------------------ | Branch (137:2): [True: 0, False: 668] ------------------ 138| 0| return "Connection timed out"; 139| 0| case SSH_ERR_CONN_CORRUPT: ------------------ | | 78| 0|#define SSH_ERR_CONN_CORRUPT -54 ------------------ | Branch (139:2): [True: 0, False: 668] ------------------ 140| 0| return "Connection corrupted"; 141| 0| case SSH_ERR_PROTOCOL_ERROR: ------------------ | | 79| 0|#define SSH_ERR_PROTOCOL_ERROR -55 ------------------ | Branch (141:2): [True: 0, False: 668] ------------------ 142| 0| return "Protocol error"; 143| 0| case SSH_ERR_KEY_LENGTH: ------------------ | | 80| 0|#define SSH_ERR_KEY_LENGTH -56 ------------------ | Branch (143:2): [True: 0, False: 668] ------------------ 144| 0| return "Invalid key length"; 145| 0| case SSH_ERR_NUMBER_TOO_LARGE: ------------------ | | 81| 0|#define SSH_ERR_NUMBER_TOO_LARGE -57 ------------------ | Branch (145:2): [True: 0, False: 668] ------------------ 146| 0| return "number is too large"; 147| 0| case SSH_ERR_KEY_ALG_UNSUPPORTED: ------------------ | | 87| 0|#define SSH_ERR_KEY_ALG_UNSUPPORTED -63 ------------------ | Branch (147:2): [True: 0, False: 668] ------------------ 148| 0| return "key algorithm not supported"; 149| 0| case SSH_ERR_SIGN_ALG_UNSUPPORTED: ------------------ | | 82| 0|#define SSH_ERR_SIGN_ALG_UNSUPPORTED -58 ------------------ | Branch (149:2): [True: 0, False: 668] ------------------ 150| 0| return "signature algorithm not supported"; 151| 0| case SSH_ERR_FEATURE_UNSUPPORTED: ------------------ | | 83| 0|#define SSH_ERR_FEATURE_UNSUPPORTED -59 ------------------ | Branch (151:2): [True: 0, False: 668] ------------------ 152| 0| return "requested feature not supported"; 153| 0| case SSH_ERR_DEVICE_NOT_FOUND: ------------------ | | 84| 0|#define SSH_ERR_DEVICE_NOT_FOUND -60 ------------------ | Branch (153:2): [True: 0, False: 668] ------------------ 154| 0| return "device not found"; 155| 0| default: ------------------ | Branch (155:2): [True: 0, False: 668] ------------------ 156| 0| return "unknown error"; 157| 668| } 158| 668|} xmalloc: 33| 179|{ 34| 179| void *ptr; 35| | 36| 179| if (size == 0) ------------------ | Branch (36:6): [True: 0, False: 179] ------------------ 37| 0| fatal("xmalloc: zero size"); ------------------ | | 115| 0|#define fatal(...) sshfatal(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 38| 179| ptr = malloc(size); 39| 179| if (ptr == NULL) ------------------ | Branch (39:6): [True: 0, False: 179] ------------------ 40| 0| fatal("xmalloc: out of memory (allocating %zu bytes)", size); ------------------ | | 115| 0|#define fatal(...) sshfatal(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 41| 179| return ptr; 42| 179|} xreallocarray: 62| 4|{ 63| 4| void *new_ptr; 64| | 65| 4| new_ptr = reallocarray(ptr, nmemb, size); 66| 4| if (new_ptr == NULL) ------------------ | Branch (66:6): [True: 0, False: 4] ------------------ 67| 0| fatal("xreallocarray: out of memory (%zu elements of %zu bytes)", ------------------ | | 115| 0|#define fatal(...) sshfatal(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 68| 4| nmemb, size); 69| 4| return new_ptr; 70| 4|} xstrdup: 86| 175|{ 87| 175| size_t len; 88| 175| char *cp; 89| | 90| 175| len = strlen(str) + 1; 91| 175| cp = xmalloc(len); 92| 175| return memcpy(cp, str, len); 93| 175|} xvasprintf: 97| 44|{ 98| 44| int i; 99| | 100| 44| i = vasprintf(ret, fmt, ap); 101| 44| if (i < 0 || *ret == NULL) ------------------ | Branch (101:6): [True: 0, False: 44] | Branch (101:15): [True: 0, False: 44] ------------------ 102| 0| fatal("xvasprintf: could not allocate memory"); ------------------ | | 115| 0|#define fatal(...) sshfatal(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 103| 44| return i; 104| 44|} xasprintf: 108| 44|{ 109| 44| va_list ap; 110| 44| int i; 111| | 112| 44| va_start(ap, fmt); 113| 44| i = xvasprintf(ret, fmt, ap); 114| | va_end(ap); 115| 44| return i; 116| 44|}