sshfatal: 39| 653|{ 40| 653| va_list args; 41| | 42| 653| va_start(args, fmt); 43| 653| sshlogv(file, func, line, showfunc, level, suffix, fmt, args); 44| | va_end(args); 45| 653| cleanup_exit(255); 46| 653|} log_init: 196| 1|{ 197| |#if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT) 198| | struct syslog_data sdata = SYSLOG_DATA_INIT; 199| |#endif 200| | 201| 1| argv0 = av0; 202| | 203| 1| if (log_change_level(level) != 0) { ------------------ | Branch (203:6): [True: 0, False: 1] ------------------ 204| 0| fprintf(stderr, "Unrecognized internal syslog level code %d\n", 205| 0| (int) level); 206| 0| exit(1); 207| 0| } 208| | 209| 1| log_handler = NULL; 210| 1| log_handler_ctx = NULL; 211| | 212| 1| log_on_stderr = on_stderr; 213| 1| if (on_stderr) ------------------ | Branch (213:6): [True: 0, False: 1] ------------------ 214| 0| return; 215| | 216| 1| switch (facility) { 217| 0| case SYSLOG_FACILITY_DAEMON: ------------------ | Branch (217:2): [True: 0, False: 1] ------------------ 218| 0| log_facility = LOG_DAEMON; 219| 0| break; 220| 0| case SYSLOG_FACILITY_USER: ------------------ | Branch (220:2): [True: 0, False: 1] ------------------ 221| 0| log_facility = LOG_USER; 222| 0| break; 223| 1| case SYSLOG_FACILITY_AUTH: ------------------ | Branch (223:2): [True: 1, False: 0] ------------------ 224| 1| log_facility = LOG_AUTH; 225| 1| break; 226| 0|#ifdef LOG_AUTHPRIV 227| 0| case SYSLOG_FACILITY_AUTHPRIV: ------------------ | Branch (227:2): [True: 0, False: 1] ------------------ 228| 0| log_facility = LOG_AUTHPRIV; 229| 0| break; 230| 0|#endif 231| 0| case SYSLOG_FACILITY_LOCAL0: ------------------ | Branch (231:2): [True: 0, False: 1] ------------------ 232| 0| log_facility = LOG_LOCAL0; 233| 0| break; 234| 0| case SYSLOG_FACILITY_LOCAL1: ------------------ | Branch (234:2): [True: 0, False: 1] ------------------ 235| 0| log_facility = LOG_LOCAL1; 236| 0| break; 237| 0| case SYSLOG_FACILITY_LOCAL2: ------------------ | Branch (237:2): [True: 0, False: 1] ------------------ 238| 0| log_facility = LOG_LOCAL2; 239| 0| break; 240| 0| case SYSLOG_FACILITY_LOCAL3: ------------------ | Branch (240:2): [True: 0, False: 1] ------------------ 241| 0| log_facility = LOG_LOCAL3; 242| 0| break; 243| 0| case SYSLOG_FACILITY_LOCAL4: ------------------ | Branch (243:2): [True: 0, False: 1] ------------------ 244| 0| log_facility = LOG_LOCAL4; 245| 0| break; 246| 0| case SYSLOG_FACILITY_LOCAL5: ------------------ | Branch (246:2): [True: 0, False: 1] ------------------ 247| 0| log_facility = LOG_LOCAL5; 248| 0| break; 249| 0| case SYSLOG_FACILITY_LOCAL6: ------------------ | Branch (249:2): [True: 0, False: 1] ------------------ 250| 0| log_facility = LOG_LOCAL6; 251| 0| break; 252| 0| case SYSLOG_FACILITY_LOCAL7: ------------------ | Branch (252:2): [True: 0, False: 1] ------------------ 253| 0| log_facility = LOG_LOCAL7; 254| 0| break; 255| 0| default: ------------------ | Branch (255:2): [True: 0, False: 1] ------------------ 256| 0| fprintf(stderr, 257| 0| "Unrecognized internal syslog facility code %d\n", 258| 0| (int) facility); 259| 0| exit(1); 260| 1| } 261| | 262| | /* 263| | * If an external library (eg libwrap) attempts to use syslog 264| | * immediately after reexec, syslog may be pointing to the wrong 265| | * facility, so we force an open/close of syslog here. 266| | */ 267| |#if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT) 268| | openlog_r(argv0 ? argv0 : __progname, LOG_PID, log_facility, &sdata); 269| | closelog_r(&sdata); 270| |#else 271| 1| openlog(argv0 ? argv0 : __progname, LOG_PID, log_facility); ------------------ | Branch (271:10): [True: 1, False: 0] ------------------ 272| 1| closelog(); 273| 1|#endif 274| 1|} log_change_level: 278| 1|{ 279| | /* no-op if log_init has not been called */ 280| 1| if (argv0 == NULL) ------------------ | Branch (280:6): [True: 0, False: 1] ------------------ 281| 0| return 0; 282| | 283| 1| switch (new_log_level) { 284| 0| case SYSLOG_LEVEL_QUIET: ------------------ | Branch (284:2): [True: 0, False: 1] ------------------ 285| 0| case SYSLOG_LEVEL_FATAL: ------------------ | Branch (285:2): [True: 0, False: 1] ------------------ 286| 1| case SYSLOG_LEVEL_ERROR: ------------------ | Branch (286:2): [True: 1, False: 0] ------------------ 287| 1| case SYSLOG_LEVEL_INFO: ------------------ | Branch (287:2): [True: 0, False: 1] ------------------ 288| 1| case SYSLOG_LEVEL_VERBOSE: ------------------ | Branch (288:2): [True: 0, False: 1] ------------------ 289| 1| case SYSLOG_LEVEL_DEBUG1: ------------------ | Branch (289:2): [True: 0, False: 1] ------------------ 290| 1| case SYSLOG_LEVEL_DEBUG2: ------------------ | Branch (290:2): [True: 0, False: 1] ------------------ 291| 1| case SYSLOG_LEVEL_DEBUG3: ------------------ | Branch (291:2): [True: 0, False: 1] ------------------ 292| 1| log_level = new_log_level; 293| 1| return 0; 294| 0| default: ------------------ | Branch (294:2): [True: 0, False: 1] ------------------ 295| 0| return -1; 296| 1| } 297| 1|} sshlog: 430| 322k|{ 431| 322k| va_list args; 432| | 433| 322k| va_start(args, fmt); 434| 322k| sshlogv(file, func, line, showfunc, level, suffix, fmt, args); 435| | va_end(args); 436| 322k|} sshlogv: 454| 323k|{ 455| 323k| char tag[128], fmt2[MSGBUFSIZ + 128]; 456| 323k| int forced = 0; 457| 323k| const char *cp; 458| 323k| size_t i; 459| | 460| | /* short circuit processing early if we're not going to log anything */ 461| 323k| if (nlog_verbose == 0 && level > log_level) ------------------ | Branch (461:6): [True: 323k, False: 0] | Branch (461:27): [True: 322k, False: 1.21k] ------------------ 462| 322k| return; 463| | 464| 1.21k| snprintf(tag, sizeof(tag), "%.48s:%.48s():%d (bin=%s, pid=%ld)", 465| 1.21k| (cp = strrchr(file, '/')) == NULL ? file : cp + 1, func, line, ------------------ | Branch (465:6): [True: 137, False: 1.07k] ------------------ 466| 1.21k| argv0 == NULL ? "UNKNOWN" : argv0, (long)getpid()); ------------------ | Branch (466:6): [True: 0, False: 1.21k] ------------------ 467| 1.21k| for (i = 0; i < nlog_verbose; i++) { ------------------ | Branch (467:14): [True: 0, False: 1.21k] ------------------ 468| 0| if (match_pattern_list(tag, log_verbose[i], 0) == 1) { ------------------ | Branch (468:7): [True: 0, False: 0] ------------------ 469| 0| forced = 1; 470| 0| break; 471| 0| } 472| 0| } 473| | 474| 1.21k| if (forced) ------------------ | Branch (474:6): [True: 0, False: 1.21k] ------------------ 475| 0| snprintf(fmt2, sizeof(fmt2), "%s: %s", tag, fmt); 476| 1.21k| else if (showfunc) ------------------ | Branch (476:11): [True: 883, False: 328] ------------------ 477| 883| snprintf(fmt2, sizeof(fmt2), "%s: %s", func, fmt); 478| 328| else 479| 328| strlcpy(fmt2, fmt, sizeof(fmt2)); 480| | 481| 1.21k| do_log(level, forced, suffix, fmt2, args); 482| 1.21k|} log.c:do_log: 339| 1.21k|{ 340| |#if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT) 341| | struct syslog_data sdata = SYSLOG_DATA_INIT; 342| |#endif 343| 1.21k| char msgbuf[MSGBUFSIZ]; 344| 1.21k| char fmtbuf[MSGBUFSIZ]; 345| 1.21k| char *txt = NULL; 346| 1.21k| int pri = LOG_INFO; 347| 1.21k| int saved_errno = errno; 348| 1.21k| log_handler_fn *tmp_handler; 349| 1.21k| const char *progname = argv0 != NULL ? argv0 : __progname; ------------------ | Branch (349:25): [True: 1.21k, False: 0] ------------------ 350| | 351| 1.21k| if (!force && level > log_level) ------------------ | Branch (351:6): [True: 1.21k, False: 0] | Branch (351:16): [True: 0, False: 1.21k] ------------------ 352| 0| return; 353| | 354| 1.21k| switch (level) { 355| 653| case SYSLOG_LEVEL_FATAL: ------------------ | Branch (355:2): [True: 653, False: 558] ------------------ 356| 653| if (!log_on_stderr) ------------------ | Branch (356:7): [True: 653, False: 0] ------------------ 357| 653| txt = "fatal"; 358| 653| pri = LOG_CRIT; 359| 653| break; 360| 558| case SYSLOG_LEVEL_ERROR: ------------------ | Branch (360:2): [True: 558, False: 653] ------------------ 361| 558| if (!log_on_stderr) ------------------ | Branch (361:7): [True: 558, False: 0] ------------------ 362| 558| txt = "error"; 363| 558| pri = LOG_ERR; 364| 558| break; 365| 0| case SYSLOG_LEVEL_INFO: ------------------ | Branch (365:2): [True: 0, False: 1.21k] ------------------ 366| 0| pri = LOG_INFO; 367| 0| break; 368| 0| case SYSLOG_LEVEL_VERBOSE: ------------------ | Branch (368:2): [True: 0, False: 1.21k] ------------------ 369| 0| pri = LOG_INFO; 370| 0| break; 371| 0| case SYSLOG_LEVEL_DEBUG1: ------------------ | Branch (371:2): [True: 0, False: 1.21k] ------------------ 372| 0| txt = "debug1"; 373| 0| pri = LOG_DEBUG; 374| 0| break; 375| 0| case SYSLOG_LEVEL_DEBUG2: ------------------ | Branch (375:2): [True: 0, False: 1.21k] ------------------ 376| 0| txt = "debug2"; 377| 0| pri = LOG_DEBUG; 378| 0| break; 379| 0| case SYSLOG_LEVEL_DEBUG3: ------------------ | Branch (379:2): [True: 0, False: 1.21k] ------------------ 380| 0| txt = "debug3"; 381| 0| pri = LOG_DEBUG; 382| 0| break; 383| 0| default: ------------------ | Branch (383:2): [True: 0, False: 1.21k] ------------------ 384| 0| txt = "internal error"; 385| 0| pri = LOG_ERR; 386| 0| break; 387| 1.21k| } 388| 1.21k| if (txt != NULL && log_handler == NULL) { ------------------ | Branch (388:6): [True: 1.21k, False: 0] | Branch (388:21): [True: 1.21k, False: 0] ------------------ 389| 1.21k| snprintf(fmtbuf, sizeof(fmtbuf), "%s: %s", txt, fmt); 390| 1.21k| vsnprintf(msgbuf, sizeof(msgbuf), fmtbuf, args); 391| 1.21k| } else { 392| 0| vsnprintf(msgbuf, sizeof(msgbuf), fmt, args); 393| 0| } 394| 1.21k| if (suffix != NULL) { ------------------ | Branch (394:6): [True: 653, False: 558] ------------------ 395| 653| snprintf(fmtbuf, sizeof(fmtbuf), "%s: %s", msgbuf, suffix); 396| 653| strlcpy(msgbuf, fmtbuf, sizeof(msgbuf)); 397| 653| } 398| 1.21k| strnvis(fmtbuf, msgbuf, sizeof(fmtbuf), 399| 1.21k| log_on_stderr ? LOG_STDERR_VIS : LOG_SYSLOG_VIS); ------------------ | | 69| 0|#define LOG_STDERR_VIS (VIS_SAFE|VIS_OCTAL) | | ------------------ | | | | 60| 0|#define VIS_SAFE 0x20 /* only encode "unsafe" characters */ | | ------------------ | | #define LOG_STDERR_VIS (VIS_SAFE|VIS_OCTAL) | | ------------------ | | | | 49| 0|#define VIS_OCTAL 0x01 /* use octal \ddd format */ | | ------------------ ------------------ log_on_stderr ? LOG_STDERR_VIS : LOG_SYSLOG_VIS); ------------------ | | 68| 1.21k|#define LOG_SYSLOG_VIS (VIS_CSTYLE|VIS_NL|VIS_TAB|VIS_OCTAL) | | ------------------ | | | | 50| 1.21k|#define VIS_CSTYLE 0x02 /* use \[nrft0..] where appropriate */ | | ------------------ | | #define LOG_SYSLOG_VIS (VIS_CSTYLE|VIS_NL|VIS_TAB|VIS_OCTAL) | | ------------------ | | | | 58| 1.21k|#define VIS_NL 0x10 /* also encode newline */ | | ------------------ | | #define LOG_SYSLOG_VIS (VIS_CSTYLE|VIS_NL|VIS_TAB|VIS_OCTAL) | | ------------------ | | | | 57| 1.21k|#define VIS_TAB 0x08 /* also encode tab */ | | ------------------ | | #define LOG_SYSLOG_VIS (VIS_CSTYLE|VIS_NL|VIS_TAB|VIS_OCTAL) | | ------------------ | | | | 49| 1.21k|#define VIS_OCTAL 0x01 /* use octal \ddd format */ | | ------------------ ------------------ | Branch (399:6): [True: 0, False: 1.21k] ------------------ 400| 1.21k| if (log_handler != NULL) { ------------------ | Branch (400:6): [True: 0, False: 1.21k] ------------------ 401| | /* Avoid recursion */ 402| 0| tmp_handler = log_handler; 403| 0| log_handler = NULL; 404| | /* Note: this sends the raw (i.e. no strnvis) log message */ 405| 0| tmp_handler(level, force, msgbuf, log_handler_ctx); 406| 0| log_handler = tmp_handler; 407| 1.21k| } else if (log_on_stderr) { ------------------ | Branch (407:13): [True: 0, False: 1.21k] ------------------ 408| 0| snprintf(msgbuf, sizeof msgbuf, "%s%s%.*s\r\n", 409| 0| (log_on_stderr > 1) ? progname : "", ------------------ | Branch (409:7): [True: 0, False: 0] ------------------ 410| 0| (log_on_stderr > 1) ? ": " : "", ------------------ | Branch (410:7): [True: 0, False: 0] ------------------ 411| 0| (int)sizeof msgbuf - 3, fmtbuf); 412| 0| (void)write(log_stderr_fd, msgbuf, strlen(msgbuf)); 413| 1.21k| } else { 414| |#if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT) 415| | openlog_r(progname, LOG_PID, log_facility, &sdata); 416| | syslog_r(pri, &sdata, "%.500s", fmtbuf); 417| | closelog_r(&sdata); 418| |#else 419| 1.21k| openlog(progname, LOG_PID, log_facility); 420| 1.21k| syslog(pri, "%.500s", fmtbuf); 421| 1.21k| closelog(); 422| 1.21k|#endif 423| 1.21k| } 424| | errno = saved_errno; 425| 1.21k|} tilde_expand: 1277| 149|{ 1278| 149| char *ocopy = NULL, *copy, *s = NULL; 1279| 149| const char *path = NULL, *user = NULL; 1280| 149| struct passwd *pw; 1281| 149| size_t len; 1282| 149| int ret = -1, r, slash; 1283| | 1284| 149| *retp = NULL; 1285| 149| if (*filename != '~') { ------------------ | Branch (1285:6): [True: 0, False: 149] ------------------ 1286| 0| *retp = xstrdup(filename); 1287| 0| return 0; 1288| 0| } 1289| 149| ocopy = copy = xstrdup(filename + 1); 1290| | 1291| 149| if (*copy == '\0') /* ~ */ ------------------ | Branch (1291:6): [True: 0, False: 149] ------------------ 1292| 0| path = NULL; 1293| 149| else if (*copy == '/') { ------------------ | Branch (1293:11): [True: 0, False: 149] ------------------ 1294| 0| copy += strspn(copy, "/"); 1295| 0| if (*copy == '\0') ------------------ | Branch (1295:7): [True: 0, False: 0] ------------------ 1296| 0| path = NULL; /* ~/ */ 1297| 0| else 1298| 0| path = copy; /* ~/path */ 1299| 149| } else { 1300| 149| user = copy; 1301| 149| if ((path = strchr(copy, '/')) != NULL) { ------------------ | Branch (1301:7): [True: 17, False: 132] ------------------ 1302| 17| copy[path - copy] = '\0'; 1303| 17| path++; 1304| 17| path += strspn(path, "/"); 1305| 17| if (*path == '\0') /* ~user/ */ ------------------ | Branch (1305:8): [True: 1, False: 16] ------------------ 1306| 1| path = NULL; 1307| | /* else ~user/path */ 1308| 17| } 1309| | /* else ~user */ 1310| 149| } 1311| 149| if (user != NULL) { ------------------ | Branch (1311:6): [True: 149, False: 0] ------------------ 1312| 149| if ((pw = getpwnam(user)) == NULL) { ------------------ | Branch (1312:7): [True: 137, False: 12] ------------------ 1313| 137| error_f("No such user %s", user); ------------------ | | 125| 137|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1314| 137| goto out; 1315| 137| } 1316| 149| } else if ((pw = getpwuid(uid)) == NULL) { ------------------ | Branch (1316:13): [True: 0, False: 0] ------------------ 1317| 0| error_f("No such uid %ld", (long)uid); ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1318| 0| goto out; 1319| 0| } 1320| | 1321| | /* Make sure directory has a trailing '/' */ 1322| 12| slash = (len = strlen(pw->pw_dir)) == 0 || pw->pw_dir[len - 1] != '/'; ------------------ | Branch (1322:10): [True: 0, False: 12] | Branch (1322:45): [True: 12, False: 0] ------------------ 1323| | 1324| 12| if ((r = xasprintf(&s, "%s%s%s", pw->pw_dir, ------------------ | Branch (1324:6): [True: 0, False: 12] ------------------ 1325| 12| slash ? "/" : "", path != NULL ? path : "")) <= 0) { ------------------ | Branch (1325:6): [True: 12, False: 0] | Branch (1325:24): [True: 7, False: 5] ------------------ 1326| 0| error_f("xasprintf failed"); ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1327| 0| goto out; 1328| 0| } 1329| 12| if (r >= PATH_MAX) { ------------------ | Branch (1329:6): [True: 0, False: 12] ------------------ 1330| 0| error_f("Path too long"); ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1331| 0| goto out; 1332| 0| } 1333| | /* success */ 1334| 12| ret = 0; 1335| 12| *retp = s; 1336| 12| s = NULL; 1337| 149| out: 1338| 149| free(s); 1339| 149| free(ocopy); 1340| 149| return ret; 1341| 12|} get_u32: 1696| 3.73k|{ 1697| 3.73k| const u_char *p = (const u_char *)vp; 1698| 3.73k| uint32_t v; 1699| | 1700| 3.73k| v = (uint32_t)p[0] << 24; 1701| 3.73k| v |= (uint32_t)p[1] << 16; 1702| 3.73k| v |= (uint32_t)p[2] << 8; 1703| 3.73k| v |= (uint32_t)p[3]; 1704| | 1705| 3.73k| return (v); 1706| 3.73k|} put_u32: 1751| 5|{ 1752| 5| u_char *p = (u_char *)vp; 1753| | 1754| 5| p[0] = (u_char)(v >> 24) & 0xff; 1755| 5| p[1] = (u_char)(v >> 16) & 0xff; 1756| 5| p[2] = (u_char)(v >> 8) & 0xff; 1757| 5| p[3] = (u_char)v & 0xff; 1758| 5|} freezero: 26| 11.3k|{ 27| 11.3k| if (ptr == NULL) ------------------ | Branch (27:6): [True: 0, False: 11.3k] ------------------ 28| 0| return; 29| 11.3k| explicit_bzero(ptr, sz); 30| 11.3k| free(ptr); 31| 11.3k|} recallocarray: 37| 15.3k|{ 38| 15.3k| size_t oldsize, newsize; 39| 15.3k| void *newptr; 40| | 41| 15.3k| if (ptr == NULL) ------------------ | Branch (41:6): [True: 0, False: 15.3k] ------------------ 42| 0| return calloc(newnmemb, size); 43| | 44| 15.3k| if ((newnmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) && ------------------ | | 33| 30.7k|#define MUL_NO_OVERFLOW ((size_t)1 << (sizeof(size_t) * 4)) ------------------ if ((newnmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) && ------------------ | | 33| 15.3k|#define MUL_NO_OVERFLOW ((size_t)1 << (sizeof(size_t) * 4)) ------------------ | Branch (44:7): [True: 0, False: 15.3k] | Branch (44:38): [True: 0, False: 15.3k] ------------------ 45| 15.3k| newnmemb > 0 && SIZE_MAX / newnmemb < size) { ------------------ | Branch (45:6): [True: 0, False: 0] | Branch (45:22): [True: 0, False: 0] ------------------ 46| 0| errno = ENOMEM; 47| 0| return NULL; 48| 0| } 49| 15.3k| newsize = newnmemb * size; 50| | 51| 15.3k| if ((oldnmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) && ------------------ | | 33| 30.7k|#define MUL_NO_OVERFLOW ((size_t)1 << (sizeof(size_t) * 4)) ------------------ if ((oldnmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) && ------------------ | | 33| 15.3k|#define MUL_NO_OVERFLOW ((size_t)1 << (sizeof(size_t) * 4)) ------------------ | Branch (51:7): [True: 0, False: 15.3k] | Branch (51:38): [True: 0, False: 15.3k] ------------------ 52| 15.3k| oldnmemb > 0 && SIZE_MAX / oldnmemb < size) { ------------------ | Branch (52:6): [True: 0, False: 0] | Branch (52:22): [True: 0, False: 0] ------------------ 53| 0| errno = EINVAL; 54| 0| return NULL; 55| 0| } 56| 15.3k| oldsize = oldnmemb * size; 57| | 58| | /* 59| | * Don't bother too much if we're shrinking just a bit, 60| | * we do not shrink for series of small steps, oh well. 61| | */ 62| 15.3k| if (newsize <= oldsize) { ------------------ | Branch (62:6): [True: 3.75k, False: 11.6k] ------------------ 63| 3.75k| size_t d = oldsize - newsize; 64| | 65| 3.75k| if (d < oldsize / 2 && d < (size_t)getpagesize()) { ------------------ | Branch (65:7): [True: 0, False: 3.75k] | Branch (65:26): [True: 0, False: 0] ------------------ 66| 0| memset((char *)ptr + newsize, 0, d); 67| 0| return ptr; 68| 0| } 69| 3.75k| } 70| | 71| 15.3k| newptr = malloc(newsize); 72| 15.3k| if (newptr == NULL) ------------------ | Branch (72:6): [True: 0, False: 15.3k] ------------------ 73| 0| return NULL; 74| | 75| 15.3k| if (newsize > oldsize) { ------------------ | Branch (75:6): [True: 11.6k, False: 3.75k] ------------------ 76| 11.6k| memcpy(newptr, ptr, oldsize); 77| 11.6k| memset((char *)newptr + oldsize, 0, newsize - oldsize); 78| 11.6k| } else 79| 3.75k| memcpy(newptr, ptr, newsize); 80| | 81| 15.3k| explicit_bzero(ptr, oldsize); 82| 15.3k| free(ptr); 83| | 84| 15.3k| return newptr; 85| 15.3k|} strlcat: 36| 1.76k|{ 37| 1.76k| char *d = dst; 38| 1.76k| const char *s = src; 39| 1.76k| size_t n = siz; 40| 1.76k| size_t dlen; 41| | 42| | /* Find the end of dst and adjust bytes left but don't go past end */ 43| 14.4k| while (n-- != 0 && *d != '\0') ------------------ | Branch (43:9): [True: 14.4k, False: 0] | Branch (43:21): [True: 12.6k, False: 1.76k] ------------------ 44| 12.6k| d++; 45| 1.76k| dlen = d - dst; 46| 1.76k| n = siz - dlen; 47| | 48| 1.76k| if (n == 0) ------------------ | Branch (48:6): [True: 0, False: 1.76k] ------------------ 49| 0| return(dlen + strlen(s)); 50| 327k| while (*s != '\0') { ------------------ | Branch (50:9): [True: 325k, False: 1.76k] ------------------ 51| 325k| if (n != 1) { ------------------ | Branch (51:7): [True: 325k, False: 68] ------------------ 52| 325k| *d++ = *s; 53| 325k| n--; 54| 325k| } 55| 325k| s++; 56| 325k| } 57| 1.76k| *d = '\0'; 58| | 59| 1.76k| return(dlen + (s - src)); /* count does not include NUL */ 60| 1.76k|} strlcpy: 34| 1.49k|{ 35| 1.49k| char *d = dst; 36| 1.49k| const char *s = src; 37| 1.49k| size_t n = siz; 38| | 39| | /* Copy as many bytes as will fit */ 40| 1.49k| if (n != 0) { ------------------ | Branch (40:6): [True: 1.49k, False: 0] ------------------ 41| 424k| while (--n != 0) { ------------------ | Branch (41:10): [True: 424k, False: 3] ------------------ 42| 424k| if ((*d++ = *s++) == '\0') ------------------ | Branch (42:8): [True: 1.49k, False: 422k] ------------------ 43| 1.49k| break; 44| 424k| } 45| 1.49k| } 46| | 47| | /* Not enough room in dst, add NUL and traverse rest of src */ 48| 1.49k| if (n == 0) { ------------------ | Branch (48:6): [True: 3, False: 1.49k] ------------------ 49| 3| if (siz != 0) ------------------ | Branch (49:7): [True: 3, False: 0] ------------------ 50| 3| *d = '\0'; /* NUL-terminate dst */ 51| 6| while (*s++) ------------------ | Branch (51:10): [True: 3, False: 3] ------------------ 52| 3| ; 53| 3| } 54| | 55| 1.49k| return(s - src - 1); /* count does not include NUL */ 56| 1.49k|} vis: 63| 30.0k|{ 64| 30.0k| if (isvisible(c, flag)) { ------------------ | | 47| 30.0k| (((c) == '\\' || (flag & VIS_ALL) == 0) && \ | | ------------------ | | | | 62| 29.7k|#define VIS_ALL 0x400 /* encode all characters */ | | ------------------ | | | Branch (47:4): [True: 277, False: 29.7k] | | | Branch (47:19): [True: 29.7k, False: 0] | | ------------------ | | 48| 30.0k| (((u_int)(c) <= UCHAR_MAX && isascii((u_char)(c)) && \ | | ------------------ | | | Branch (48:4): [True: 11.5k, False: 18.5k] | | ------------------ | | 49| 30.0k| (((c) != '*' && (c) != '?' && (c) != '[' && (c) != '#') || \ | | ------------------ | | | Branch (49:4): [True: 11.2k, False: 219] | | | Branch (49:18): [True: 11.0k, False: 198] | | | Branch (49:32): [True: 10.8k, False: 209] | | | Branch (49:46): [True: 10.5k, False: 275] | | ------------------ | | 50| 11.5k| (flag & VIS_GLOB) == 0) && isgraph((u_char)(c))) || \ | | ------------------ | | | | 68| 901|#define VIS_GLOB 0x100 /* encode glob(3) magics and '#' */ | | ------------------ | | | Branch (50:3): [True: 901, False: 0] | | ------------------ | | 51| 30.0k| ((flag & VIS_SP) == 0 && (c) == ' ') || \ | | ------------------ | | | | 56| 27.9k|#define VIS_SP 0x04 /* also encode space */ | | ------------------ | | | Branch (51:3): [True: 27.9k, False: 0] | | | Branch (51:27): [True: 214, False: 27.7k] | | ------------------ | | 52| 30.0k| ((flag & VIS_TAB) == 0 && (c) == '\t') || \ | | ------------------ | | | | 57| 27.7k|#define VIS_TAB 0x08 /* also encode tab */ | | ------------------ | | | Branch (52:3): [True: 0, False: 27.7k] | | | Branch (52:28): [True: 0, False: 0] | | ------------------ | | 53| 30.0k| ((flag & VIS_NL) == 0 && (c) == '\n') || \ | | ------------------ | | | | 58| 27.7k|#define VIS_NL 0x10 /* also encode newline */ | | ------------------ | | | Branch (53:3): [True: 0, False: 27.7k] | | | Branch (53:27): [True: 0, False: 0] | | ------------------ | | 54| 30.0k| ((flag & VIS_SAFE) && ((c) == '\b' || \ | | ------------------ | | | | 60| 27.7k|#define VIS_SAFE 0x20 /* only encode "unsafe" characters */ | | ------------------ | | | Branch (54:3): [True: 0, False: 27.7k] | | | Branch (54:25): [True: 0, False: 0] | | ------------------ | | 55| 0| (c) == '\007' || (c) == '\r' || \ | | ------------------ | | | Branch (55:3): [True: 0, False: 0] | | | Branch (55:20): [True: 0, False: 0] | | ------------------ | | 56| 0| isgraph((u_char)(c)))))) ------------------ | Branch (64:6): [True: 11.5k, False: 0] | Branch (64:6): [True: 2.03k, False: 9.46k] | Branch (64:6): [True: 0, False: 0] ------------------ 65| 2.25k| if ((c == '"' && (flag & VIS_DQ) != 0) || ------------------ | | 61| 271|#define VIS_DQ 0x200 /* backslash-escape double quotes */ ------------------ | Branch (65:8): [True: 271, False: 1.98k] | Branch (65:20): [True: 0, False: 271] ------------------ 66| 2.25k| (c == '\\' && (flag & VIS_NOSLASH) == 0)) ------------------ | | 67| 277|#define VIS_NOSLASH 0x40 /* inhibit printing '\' */ ------------------ | Branch (66:8): [True: 277, False: 1.97k] | Branch (66:21): [True: 277, False: 0] ------------------ 67| 277| *dst++ = '\\'; 68| 2.25k| *dst++ = c; 69| 2.25k| *dst = '\0'; 70| 2.25k| return (dst); 71| 2.25k| } 72| | 73| 27.7k| if (flag & VIS_CSTYLE) { ------------------ | | 50| 27.7k|#define VIS_CSTYLE 0x02 /* use \[nrft0..] where appropriate */ ------------------ | Branch (73:6): [True: 27.7k, False: 0] ------------------ 74| 27.7k| switch(c) { ------------------ | Branch (74:10): [True: 6.23k, False: 21.5k] ------------------ 75| 338| case '\n': ------------------ | Branch (75:3): [True: 338, False: 27.4k] ------------------ 76| 338| *dst++ = '\\'; 77| 338| *dst++ = 'n'; 78| 338| goto done; 79| 304| case '\r': ------------------ | Branch (79:3): [True: 304, False: 27.4k] ------------------ 80| 304| *dst++ = '\\'; 81| 304| *dst++ = 'r'; 82| 304| goto done; 83| 718| case '\b': ------------------ | Branch (83:3): [True: 718, False: 27.0k] ------------------ 84| 718| *dst++ = '\\'; 85| 718| *dst++ = 'b'; 86| 718| goto done; 87| 3.85k| case '\a': ------------------ | Branch (87:3): [True: 3.85k, False: 23.9k] ------------------ 88| 3.85k| *dst++ = '\\'; 89| 3.85k| *dst++ = 'a'; 90| 3.85k| goto done; 91| 222| case '\v': ------------------ | Branch (91:3): [True: 222, False: 27.5k] ------------------ 92| 222| *dst++ = '\\'; 93| 222| *dst++ = 'v'; 94| 222| goto done; 95| 466| case '\t': ------------------ | Branch (95:3): [True: 466, False: 27.3k] ------------------ 96| 466| *dst++ = '\\'; 97| 466| *dst++ = 't'; 98| 466| goto done; 99| 328| case '\f': ------------------ | Branch (99:3): [True: 328, False: 27.4k] ------------------ 100| 328| *dst++ = '\\'; 101| 328| *dst++ = 'f'; 102| 328| goto done; 103| 0| case ' ': ------------------ | Branch (103:3): [True: 0, False: 27.7k] ------------------ 104| 0| *dst++ = '\\'; 105| 0| *dst++ = 's'; 106| 0| goto done; 107| 0| case '\0': ------------------ | Branch (107:3): [True: 0, False: 27.7k] ------------------ 108| 0| *dst++ = '\\'; 109| 0| *dst++ = '0'; 110| 0| if (isoctal(nextc)) { ------------------ | | 45| 0|#define isoctal(c) (((u_char)(c)) >= '0' && ((u_char)(c)) <= '7') | | ------------------ | | | Branch (45:21): [True: 0, False: 0] | | | Branch (45:45): [True: 0, False: 0] | | ------------------ ------------------ 111| 0| *dst++ = '0'; 112| 0| *dst++ = '0'; 113| 0| } 114| 0| goto done; 115| 27.7k| } 116| 27.7k| } 117| 21.5k| if (((c & 0177) == ' ') || (flag & VIS_OCTAL) || ------------------ | | 49| 20.5k|#define VIS_OCTAL 0x01 /* use octal \ddd format */ ------------------ | Branch (117:6): [True: 1.01k, False: 20.5k] | Branch (117:29): [True: 20.5k, False: 0] ------------------ 118| 21.5k| ((flag & VIS_GLOB) && (c == '*' || c == '?' || c == '[' || c == '#'))) { ------------------ | | 68| 0|#define VIS_GLOB 0x100 /* encode glob(3) magics and '#' */ ------------------ | Branch (118:7): [True: 0, False: 0] | Branch (118:29): [True: 0, False: 0] | Branch (118:41): [True: 0, False: 0] | Branch (118:53): [True: 0, False: 0] | Branch (118:65): [True: 0, False: 0] ------------------ 119| 21.5k| *dst++ = '\\'; 120| 21.5k| *dst++ = ((u_char)c >> 6 & 07) + '0'; 121| 21.5k| *dst++ = ((u_char)c >> 3 & 07) + '0'; 122| 21.5k| *dst++ = ((u_char)c & 07) + '0'; 123| 21.5k| goto done; 124| 21.5k| } 125| 0| if ((flag & VIS_NOSLASH) == 0) ------------------ | | 67| 0|#define VIS_NOSLASH 0x40 /* inhibit printing '\' */ ------------------ | Branch (125:6): [True: 0, False: 0] ------------------ 126| 0| *dst++ = '\\'; 127| 0| if (c & 0200) { ------------------ | Branch (127:6): [True: 0, False: 0] ------------------ 128| 0| c &= 0177; 129| 0| *dst++ = 'M'; 130| 0| } 131| 0| if (iscntrl((u_char)c)) { ------------------ | Branch (131:6): [True: 0, False: 0] ------------------ 132| 0| *dst++ = '^'; 133| 0| if (c == 0177) ------------------ | Branch (133:7): [True: 0, False: 0] ------------------ 134| 0| *dst++ = '?'; 135| 0| else 136| 0| *dst++ = c + '@'; 137| 0| } else { 138| 0| *dst++ = '-'; 139| 0| *dst++ = c; 140| 0| } 141| 27.7k|done: 142| 27.7k| *dst = '\0'; 143| 27.7k| return (dst); 144| 0|} strnvis: 175| 1.21k|{ 176| 1.21k| char *start, *end; 177| 1.21k| char tbuf[5]; 178| 1.21k| int c, i; 179| | 180| 1.21k| i = 0; 181| 95.5k| for (start = dst, end = start + siz - 1; (c = *src) && dst < end; ) { ------------------ | Branch (181:43): [True: 94.4k, False: 1.13k] | Branch (181:57): [True: 94.4k, False: 35] ------------------ 182| 94.4k| if (isvisible(c, flag)) { ------------------ | | 47| 94.4k| (((c) == '\\' || (flag & VIS_ALL) == 0) && \ | | ------------------ | | | | 62| 93.7k|#define VIS_ALL 0x400 /* encode all characters */ | | ------------------ | | | Branch (47:4): [True: 647, False: 93.7k] | | | Branch (47:19): [True: 93.7k, False: 0] | | ------------------ | | 48| 94.4k| (((u_int)(c) <= UCHAR_MAX && isascii((u_char)(c)) && \ | | ------------------ | | | Branch (48:4): [True: 77.2k, False: 17.1k] | | ------------------ | | 49| 94.4k| (((c) != '*' && (c) != '?' && (c) != '[' && (c) != '#') || \ | | ------------------ | | | Branch (49:4): [True: 76.9k, False: 338] | | | Branch (49:18): [True: 76.5k, False: 312] | | | Branch (49:32): [True: 76.2k, False: 303] | | | Branch (49:46): [True: 75.9k, False: 346] | | ------------------ | | 50| 77.2k| (flag & VIS_GLOB) == 0) && isgraph((u_char)(c))) || \ | | ------------------ | | | | 68| 1.29k|#define VIS_GLOB 0x100 /* encode glob(3) magics and '#' */ | | ------------------ | | | Branch (50:3): [True: 1.29k, False: 0] | | ------------------ | | 51| 94.4k| ((flag & VIS_SP) == 0 && (c) == ' ') || \ | | ------------------ | | | | 56| 31.2k|#define VIS_SP 0x04 /* also encode space */ | | ------------------ | | | Branch (51:3): [True: 31.2k, False: 0] | | | Branch (51:27): [True: 6.49k, False: 24.7k] | | ------------------ | | 52| 94.4k| ((flag & VIS_TAB) == 0 && (c) == '\t') || \ | | ------------------ | | | | 57| 24.7k|#define VIS_TAB 0x08 /* also encode tab */ | | ------------------ | | | Branch (52:3): [True: 0, False: 24.7k] | | | Branch (52:28): [True: 0, False: 0] | | ------------------ | | 53| 94.4k| ((flag & VIS_NL) == 0 && (c) == '\n') || \ | | ------------------ | | | | 58| 24.7k|#define VIS_NL 0x10 /* also encode newline */ | | ------------------ | | | Branch (53:3): [True: 0, False: 24.7k] | | | Branch (53:27): [True: 0, False: 0] | | ------------------ | | 54| 94.4k| ((flag & VIS_SAFE) && ((c) == '\b' || \ | | ------------------ | | | | 60| 24.7k|#define VIS_SAFE 0x20 /* only encode "unsafe" characters */ | | ------------------ | | | Branch (54:3): [True: 0, False: 24.7k] | | | Branch (54:25): [True: 0, False: 0] | | ------------------ | | 55| 0| (c) == '\007' || (c) == '\r' || \ | | ------------------ | | | Branch (55:3): [True: 0, False: 0] | | | Branch (55:20): [True: 0, False: 0] | | ------------------ | | 56| 0| isgraph((u_char)(c)))))) ------------------ | Branch (182:7): [True: 77.2k, False: 0] | Branch (182:7): [True: 63.2k, False: 14.0k] | Branch (182:7): [True: 0, False: 0] ------------------ 183| 69.7k| if ((c == '"' && (flag & VIS_DQ) != 0) || ------------------ | | 61| 1.82k|#define VIS_DQ 0x200 /* backslash-escape double quotes */ ------------------ | Branch (183:9): [True: 1.82k, False: 67.8k] | Branch (183:21): [True: 0, False: 1.82k] ------------------ 184| 69.7k| (c == '\\' && (flag & VIS_NOSLASH) == 0)) { ------------------ | | 67| 647|#define VIS_NOSLASH 0x40 /* inhibit printing '\' */ ------------------ | Branch (184:9): [True: 647, False: 69.0k] | Branch (184:22): [True: 647, False: 0] ------------------ 185| | /* need space for the extra '\\' */ 186| 647| if (dst + 1 >= end) { ------------------ | Branch (186:9): [True: 2, False: 645] ------------------ 187| 2| i = 2; 188| 2| break; 189| 2| } 190| 645| *dst++ = '\\'; 191| 645| } 192| 69.7k| i = 1; 193| 69.7k| *dst++ = c; 194| 69.7k| src++; 195| 69.7k| } else { 196| 24.7k| i = vis(tbuf, c, flag, *++src) - tbuf; 197| 24.7k| if (dst + i <= end) { ------------------ | Branch (197:8): [True: 24.6k, False: 36] ------------------ 198| 24.6k| memcpy(dst, tbuf, i); 199| 24.6k| dst += i; 200| 24.6k| } else { 201| 36| src--; 202| 36| break; 203| 36| } 204| 24.7k| } 205| 94.4k| } 206| 1.21k| if (siz > 0) ------------------ | Branch (206:6): [True: 1.21k, False: 0] ------------------ 207| 1.21k| *dst = '\0'; 208| 1.21k| if (dst + i > end) { ------------------ | Branch (208:6): [True: 74, False: 1.13k] ------------------ 209| | /* adjust return value for truncation */ 210| 5.38k| while ((c = *src)) ------------------ | Branch (210:10): [True: 5.30k, False: 74] ------------------ 211| 5.30k| dst += vis(tbuf, c, flag, *++src) - tbuf; 212| 74| } 213| 1.21k| return (dst - start); 214| 1.21k|} __wrap_malloc: 83| 51.7k|{ 84| 51.7k| void *p = __real_malloc(size); 85| 51.7k| arena_track(p); 86| 51.7k| return p; 87| 51.7k|} __wrap_calloc: 91| 15.2k|{ 92| 15.2k| void *p = __real_calloc(nmemb, size); 93| 15.2k| arena_track(p); 94| 15.2k| return p; 95| 15.2k|} __wrap_free: 108| 91.6k|{ 109| 91.6k| arena_untrack(ptr); 110| 91.6k| __real_free(ptr); 111| 91.6k|} __wrap_strdup: 115| 1.82k|{ 116| 1.82k| size_t len; 117| 1.82k| char *p; 118| 1.82k| if (s == NULL) ------------------ | Branch (118:6): [True: 0, False: 1.82k] ------------------ 119| 0| return NULL; 120| 1.82k| len = strlen(s) + 1; 121| 1.82k| p = (char *)__real_malloc(len); 122| 1.82k| if (p == NULL) ------------------ | Branch (122:6): [True: 0, False: 1.82k] ------------------ 123| 0| return NULL; 124| 1.82k| memcpy(p, s, len); 125| 1.82k| arena_track(p); 126| 1.82k| return p; 127| 1.82k|} fuzz_arena_begin: 131| 1.82k|{ 132| 1.82k| tracking = 1; 133| 1.82k|} fuzz_arena_release: 137| 1.17k|{ 138| 1.17k| struct arena_node *n; 139| 1.17k| tracking = 0; 140| 1.17k| while (arena_head != NULL) { ------------------ | Branch (140:9): [True: 0, False: 1.17k] ------------------ 141| 0| n = arena_head; 142| 0| arena_head = n->next; 143| 0| __real_free(n); 144| 0| } 145| 1.17k|} fuzz_arena_cleanup: 149| 653|{ 150| 653| struct arena_node *n; 151| 653| tracking = 0; 152| 5.57k| while (arena_head != NULL) { ------------------ | Branch (152:9): [True: 4.92k, False: 653] ------------------ 153| 4.92k| n = arena_head; 154| 4.92k| arena_head = n->next; 155| 4.92k| __real_free(n->ptr); 156| 4.92k| __real_free(n); 157| 4.92k| } 158| 653|} fuzz_arena.c:arena_track: 53| 68.8k|{ 54| 68.8k| struct arena_node *n; 55| 68.8k| if (!tracking || p == NULL) ------------------ | Branch (55:6): [True: 22.1k, False: 46.6k] | Branch (55:19): [True: 0, False: 46.6k] ------------------ 56| 22.1k| return; 57| 46.6k| n = (struct arena_node *)__real_malloc(sizeof(*n)); 58| 46.6k| if (n == NULL) ------------------ | Branch (58:6): [True: 0, False: 46.6k] ------------------ 59| 0| return; 60| 46.6k| n->ptr = p; 61| 46.6k| n->next = arena_head; 62| 46.6k| arena_head = n; 63| 46.6k|} fuzz_arena.c:arena_untrack: 67| 91.6k|{ 68| 91.6k| struct arena_node **pp; 69| 91.6k| if (p == NULL) ------------------ | Branch (69:6): [True: 29.5k, False: 62.0k] ------------------ 70| 29.5k| return; 71| 100k| for (pp = &arena_head; *pp != NULL; pp = &(*pp)->next) { ------------------ | Branch (71:25): [True: 80.5k, False: 20.3k] ------------------ 72| 80.5k| if ((*pp)->ptr == p) { ------------------ | Branch (72:7): [True: 41.7k, False: 38.7k] ------------------ 73| 41.7k| struct arena_node *n = *pp; 74| 41.7k| *pp = n->next; 75| 41.7k| __real_free(n); 76| 41.7k| return; 77| 41.7k| } 78| 80.5k| } 79| 62.0k|} LLVMFuzzerTestOneInput: 20| 1.83k|{ 21| 1.83k| fuzz_server_one(data, size); 22| 1.83k| return 0; 23| 1.83k|} cleanup_exit: 60| 653|{ 61| 653| if (in_fuzz_server) ------------------ | Branch (61:6): [True: 653, False: 0] ------------------ 62| 653| longjmp(fuzz_server_env, code ? code : 1); ------------------ | Branch (62:28): [True: 653, False: 0] ------------------ 63| 0| _exit(code); 64| 653|} fuzz_server_one: 122| 1.83k|{ 123| 1.83k| if (!log_initialized) { ------------------ | Branch (123:6): [True: 1, False: 1.83k] ------------------ 124| 1| log_initialized = 1; 125| 1| log_init("sftp_server_msg_fuzz", SYSLOG_LEVEL_ERROR, 126| 1| SYSLOG_FACILITY_AUTH, 0); 127| | 128| | /* Confine filesystem syscalls (process_open/mkdir/symlink) to a fresh tmpdir. */ 129| 1| char tmpdir[] = "/tmp/sftp_fuzz_XXXXXX"; 130| 1| if (mkdtemp(tmpdir) != NULL && chdir(tmpdir) != 0) ------------------ | Branch (130:7): [True: 1, False: 0] | Branch (130:34): [True: 0, False: 1] ------------------ 131| 0| _exit(1); 132| | 133| 1| memset(&fuzz_pw, 0, sizeof(fuzz_pw)); 134| 1| fuzz_pw.pw_name = (char *)"fuzz"; 135| 1| fuzz_pw.pw_uid = getuid(); 136| 1| fuzz_pw.pw_gid = getgid(); 137| 1| fuzz_pw.pw_dir = (char *)"/tmp"; 138| 1| fuzz_pw.pw_shell = (char *)"/bin/sh"; 139| 1| } 140| | 141| 1.83k| if (size == 0 || size > 65000) ------------------ | Branch (141:6): [True: 0, False: 1.83k] | Branch (141:19): [True: 11, False: 1.82k] ------------------ 142| 11| return; 143| | 144| 1.82k| reset_module_globals(); 145| | 146| 1.82k| fuzz_arena_begin(); 147| 1.82k| in_fuzz_server = 1; 148| 1.82k| if (setjmp(fuzz_server_env) == 0) { ------------------ | Branch (148:6): [True: 1.82k, False: 0] ------------------ 149| 1.82k| client_addr = strdup("127.0.0.1"); 150| 1.82k| iqueue = sshbuf_new(); 151| 1.82k| oqueue = sshbuf_new(); 152| 1.82k| if (iqueue == NULL || oqueue == NULL) ------------------ | Branch (152:7): [True: 0, False: 1.82k] | Branch (152:25): [True: 0, False: 1.82k] ------------------ 153| 0| goto out; 154| | 155| 1.82k| const uint8_t init_msg[] = { 156| 1.82k| 0x00, 0x00, 0x00, 0x05, 157| 1.82k| SSH2_FXP_INIT, ------------------ | | 35| 1.82k|#define SSH2_FXP_INIT 1 ------------------ 158| 1.82k| 0x00, 0x00, 0x00, 0x03, 159| 1.82k| }; 160| 1.82k| if (sshbuf_put(iqueue, init_msg, sizeof(init_msg)) != 0) ------------------ | Branch (160:7): [True: 0, False: 1.82k] ------------------ 161| 0| goto out; 162| 1.82k| process(); 163| | 164| 1.82k| sshbuf_reset(iqueue); 165| 1.82k| sshbuf_reset(oqueue); 166| | 167| 1.82k| uint8_t hdr[4] = { 168| 1.82k| (uint8_t)((size >> 24) & 0xff), 169| 1.82k| (uint8_t)((size >> 16) & 0xff), 170| 1.82k| (uint8_t)((size >> 8) & 0xff), 171| 1.82k| (uint8_t)(size & 0xff), 172| 1.82k| }; 173| 1.82k| if (sshbuf_put(iqueue, hdr, 4) != 0 || ------------------ | Branch (173:7): [True: 0, False: 1.82k] ------------------ 174| 1.82k| sshbuf_put(iqueue, data, size) != 0) ------------------ | Branch (174:7): [True: 0, False: 1.82k] ------------------ 175| 0| goto out; 176| 1.82k| process(); 177| 1.82k| out: 178| 1.17k| cleanup_handles(); 179| 1.17k| sshbuf_free(iqueue); 180| 1.17k| sshbuf_free(oqueue); 181| 1.17k| free(client_addr); 182| 1.17k| iqueue = oqueue = NULL; 183| 1.17k| client_addr = NULL; 184| 1.17k| in_fuzz_server = 0; 185| 1.17k| fuzz_arena_release(); 186| 1.17k| return; 187| 1.82k| } 188| 0| cleanup_handles(); 189| 0| in_fuzz_server = 0; 190| 0| fuzz_arena_cleanup(); 191| 0| iqueue = oqueue = NULL; 192| | client_addr = NULL; 193| 0|} sftp_server_msg_fuzz_helper.c:reset_module_globals: 105| 1.82k|{ 106| 1.82k| pw = &fuzz_pw; 107| 1.82k| client_addr = NULL; 108| 1.82k| version = 0; 109| 1.82k| init_done = 0; 110| 1.82k| readonly = 0; 111| 1.82k| request_allowlist = NULL; 112| 1.82k| request_denylist = NULL; 113| 1.82k| handles = NULL; 114| 1.82k| num_handles = 0; 115| 1.82k| first_unused_handle = -1; 116| 1.82k| iqueue = NULL; 117| | oqueue = NULL; 118| 1.82k|} sftp_server_msg_fuzz_helper.c:cleanup_handles: 86| 1.82k|{ 87| 1.82k| u_int i; 88| 1.82k| if (handles == NULL) ------------------ | Branch (88:6): [True: 1.81k, False: 5] ------------------ 89| 1.81k| return; 90| 10| for (i = 0; i < num_handles; i++) { ------------------ | Branch (90:14): [True: 5, False: 5] ------------------ 91| 5| if (handles[i].use == HANDLE_FILE && handles[i].fd >= 0) ------------------ | Branch (91:7): [True: 1, False: 4] | Branch (91:40): [True: 1, False: 0] ------------------ 92| 1| close(handles[i].fd); 93| 4| else if (handles[i].use == HANDLE_DIR && handles[i].dirp != NULL) ------------------ | Branch (93:12): [True: 4, False: 0] | Branch (93:44): [True: 4, False: 0] ------------------ 94| 4| closedir(handles[i].dirp); 95| 5| free(handles[i].name); 96| 5| } 97| 5| free(handles); 98| | handles = NULL; 99| 5| num_handles = 0; 100| 5| first_unused_handle = -1; 101| 5|} attrib_clear: 54| 466|{ 55| 466| a->flags = 0; 56| 466| a->size = 0; 57| 466| a->uid = 0; 58| 466| a->gid = 0; 59| 466| a->perm = 0; 60| 466| a->atime = 0; 61| 466| a->mtime = 0; 62| 466|} stat_to_attrib: 67| 2|{ 68| 2| attrib_clear(a); 69| 2| a->flags = 0; 70| 2| a->flags |= SSH2_FILEXFER_ATTR_SIZE; ------------------ | | 68| 2|#define SSH2_FILEXFER_ATTR_SIZE 0x00000001 ------------------ 71| 2| a->size = st->st_size; 72| 2| a->flags |= SSH2_FILEXFER_ATTR_UIDGID; ------------------ | | 69| 2|#define SSH2_FILEXFER_ATTR_UIDGID 0x00000002 ------------------ 73| 2| a->uid = st->st_uid; 74| 2| a->gid = st->st_gid; 75| 2| a->flags |= SSH2_FILEXFER_ATTR_PERMISSIONS; ------------------ | | 70| 2|#define SSH2_FILEXFER_ATTR_PERMISSIONS 0x00000004 ------------------ 76| 2| a->perm = st->st_mode; 77| 2| a->flags |= SSH2_FILEXFER_ATTR_ACMODTIME; ------------------ | | 71| 2|#define SSH2_FILEXFER_ATTR_ACMODTIME 0x00000008 ------------------ 78| 2| a->atime = st->st_atime; 79| | a->mtime = st->st_mtime; 80| 2|} decode_attrib: 105| 340|{ 106| 340| int r; 107| | 108| 340| attrib_clear(a); 109| 340| if ((r = sshbuf_get_u32(b, &a->flags)) != 0) ------------------ | Branch (109:6): [True: 65, False: 275] ------------------ 110| 65| return r; 111| 275| if (a->flags & SSH2_FILEXFER_ATTR_SIZE) { ------------------ | | 68| 275|#define SSH2_FILEXFER_ATTR_SIZE 0x00000001 ------------------ | Branch (111:6): [True: 26, False: 249] ------------------ 112| 26| if ((r = sshbuf_get_u64(b, &a->size)) != 0) ------------------ | Branch (112:7): [True: 2, False: 24] ------------------ 113| 2| return r; 114| 26| } 115| 273| if (a->flags & SSH2_FILEXFER_ATTR_UIDGID) { ------------------ | | 69| 273|#define SSH2_FILEXFER_ATTR_UIDGID 0x00000002 ------------------ | Branch (115:6): [True: 24, False: 249] ------------------ 116| 24| if ((r = sshbuf_get_u32(b, &a->uid)) != 0 || ------------------ | Branch (116:7): [True: 1, False: 23] ------------------ 117| 23| (r = sshbuf_get_u32(b, &a->gid)) != 0) ------------------ | Branch (117:7): [True: 1, False: 22] ------------------ 118| 2| return r; 119| 24| } 120| 271| if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) { ------------------ | | 70| 271|#define SSH2_FILEXFER_ATTR_PERMISSIONS 0x00000004 ------------------ | Branch (120:6): [True: 28, False: 243] ------------------ 121| 28| if ((r = sshbuf_get_u32(b, &a->perm)) != 0) ------------------ | Branch (121:7): [True: 1, False: 27] ------------------ 122| 1| return r; 123| 28| } 124| 270| if (a->flags & SSH2_FILEXFER_ATTR_ACMODTIME) { ------------------ | | 71| 270|#define SSH2_FILEXFER_ATTR_ACMODTIME 0x00000008 ------------------ | Branch (124:6): [True: 22, False: 248] ------------------ 125| 22| if ((r = sshbuf_get_u32(b, &a->atime)) != 0 || ------------------ | Branch (125:7): [True: 3, False: 19] ------------------ 126| 19| (r = sshbuf_get_u32(b, &a->mtime)) != 0) ------------------ | Branch (126:7): [True: 2, False: 17] ------------------ 127| 5| return r; 128| 22| } 129| | /* vendor-specific extensions */ 130| 265| if (a->flags & SSH2_FILEXFER_ATTR_EXTENDED) { ------------------ | | 72| 265|#define SSH2_FILEXFER_ATTR_EXTENDED 0x80000000 ------------------ | Branch (130:6): [True: 191, False: 74] ------------------ 131| 191| char *type; 132| 191| u_char *data; 133| 191| size_t dlen; 134| 191| u_int i, count; 135| | 136| 191| if ((r = sshbuf_get_u32(b, &count)) != 0) ------------------ | Branch (136:7): [True: 31, False: 160] ------------------ 137| 31| return r; 138| 160| if (count > 0x100000) ------------------ | Branch (138:7): [True: 23, False: 137] ------------------ 139| 23| return SSH_ERR_INVALID_FORMAT; ------------------ | | 28| 23|#define SSH_ERR_INVALID_FORMAT -4 ------------------ 140| 6.06k| for (i = 0; i < count; i++) { ------------------ | Branch (140:15): [True: 6.05k, False: 5] ------------------ 141| 6.05k| if ((r = sshbuf_get_cstring(b, &type, NULL)) != 0 || ------------------ | Branch (141:8): [True: 89, False: 5.97k] ------------------ 142| 5.97k| (r = sshbuf_get_string(b, &data, &dlen)) != 0) ------------------ | Branch (142:8): [True: 43, False: 5.92k] ------------------ 143| 132| return r; 144| 5.92k| debug3("Got file attribute \"%.100s\" len %zu", ------------------ | | 109| 5.92k|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 145| 5.92k| type, dlen); 146| 5.92k| free(type); 147| 5.92k| free(data); 148| 5.92k| } 149| 137| } 150| 79| return 0; 151| 265|} encode_attrib: 156| 126|{ 157| 126| int r; 158| | 159| 126| if ((r = sshbuf_put_u32(b, a->flags)) != 0) ------------------ | Branch (159:6): [True: 0, False: 126] ------------------ 160| 0| return r; 161| 126| if (a->flags & SSH2_FILEXFER_ATTR_SIZE) { ------------------ | | 68| 126|#define SSH2_FILEXFER_ATTR_SIZE 0x00000001 ------------------ | Branch (161:6): [True: 2, False: 124] ------------------ 162| 2| if ((r = sshbuf_put_u64(b, a->size)) != 0) ------------------ | Branch (162:7): [True: 0, False: 2] ------------------ 163| 0| return r; 164| 2| } 165| 126| if (a->flags & SSH2_FILEXFER_ATTR_UIDGID) { ------------------ | | 69| 126|#define SSH2_FILEXFER_ATTR_UIDGID 0x00000002 ------------------ | Branch (165:6): [True: 2, False: 124] ------------------ 166| 2| if ((r = sshbuf_put_u32(b, a->uid)) != 0 || ------------------ | Branch (166:7): [True: 0, False: 2] ------------------ 167| 2| (r = sshbuf_put_u32(b, a->gid)) != 0) ------------------ | Branch (167:7): [True: 0, False: 2] ------------------ 168| 0| return r; 169| 2| } 170| 126| if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) { ------------------ | | 70| 126|#define SSH2_FILEXFER_ATTR_PERMISSIONS 0x00000004 ------------------ | Branch (170:6): [True: 2, False: 124] ------------------ 171| 2| if ((r = sshbuf_put_u32(b, a->perm)) != 0) ------------------ | Branch (171:7): [True: 0, False: 2] ------------------ 172| 0| return r; 173| 2| } 174| 126| if (a->flags & SSH2_FILEXFER_ATTR_ACMODTIME) { ------------------ | | 71| 126|#define SSH2_FILEXFER_ATTR_ACMODTIME 0x00000008 ------------------ | Branch (174:6): [True: 2, False: 124] ------------------ 175| 2| if ((r = sshbuf_put_u32(b, a->atime)) != 0 || ------------------ | Branch (175:7): [True: 0, False: 2] ------------------ 176| 2| (r = sshbuf_put_u32(b, a->mtime)) != 0) ------------------ | Branch (176:7): [True: 0, False: 2] ------------------ 177| 0| return r; 178| 2| } 179| 126| return 0; 180| 126|} sftp_realpath: 59| 202|{ 60| 202| struct stat sb; 61| 202| char *p, *q, *s; 62| 202| size_t left_len, resolved_len; 63| 202| unsigned symlinks; 64| 202| int serrno, slen, mem_allocated; 65| 202| char left[PATH_MAX], next_token[PATH_MAX], symlink[PATH_MAX]; 66| | 67| 202| if (path[0] == '\0') { ------------------ | Branch (67:6): [True: 0, False: 202] ------------------ 68| 0| errno = ENOENT; 69| 0| return (NULL); 70| 0| } 71| | 72| 202| serrno = errno; 73| | 74| 202| if (resolved == NULL) { ------------------ | Branch (74:6): [True: 0, False: 202] ------------------ 75| 0| resolved = malloc(PATH_MAX); 76| 0| if (resolved == NULL) ------------------ | Branch (76:7): [True: 0, False: 0] ------------------ 77| 0| return (NULL); 78| 0| mem_allocated = 1; 79| 0| } else 80| 202| mem_allocated = 0; 81| | 82| 202| symlinks = 0; 83| 202| if (path[0] == '/') { ------------------ | Branch (83:6): [True: 126, False: 76] ------------------ 84| 126| resolved[0] = '/'; 85| 126| resolved[1] = '\0'; 86| 126| if (path[1] == '\0') ------------------ | Branch (86:7): [True: 2, False: 124] ------------------ 87| 2| return (resolved); 88| 124| resolved_len = 1; 89| 124| left_len = strlcpy(left, path + 1, sizeof(left)); 90| 124| } else { 91| 76| if (getcwd(resolved, PATH_MAX) == NULL) { ------------------ | Branch (91:7): [True: 0, False: 76] ------------------ 92| 0| if (mem_allocated) ------------------ | Branch (92:8): [True: 0, False: 0] ------------------ 93| 0| free(resolved); 94| 0| else 95| 0| strlcpy(resolved, ".", PATH_MAX); 96| 0| return (NULL); 97| 0| } 98| 76| resolved_len = strlen(resolved); 99| 76| left_len = strlcpy(left, path, sizeof(left)); 100| 76| } 101| 200| if (left_len >= sizeof(left) || resolved_len >= PATH_MAX) { ------------------ | Branch (101:6): [True: 2, False: 198] | Branch (101:34): [True: 0, False: 198] ------------------ 102| 2| errno = ENAMETOOLONG; 103| 2| goto err; 104| 2| } 105| | 106| | /* 107| | * Iterate over path components in `left'. 108| | */ 109| 16.2k| while (left_len != 0) { ------------------ | Branch (109:9): [True: 16.2k, False: 30] ------------------ 110| | /* 111| | * Extract the next path component and adjust `left' 112| | * and its length. 113| | */ 114| 16.2k| p = strchr(left, '/'); 115| 16.2k| s = p ? p : left + left_len; ------------------ | Branch (115:7): [True: 16.1k, False: 141] ------------------ 116| 16.2k| if (s - left >= (ptrdiff_t)sizeof(next_token)) { ------------------ | Branch (116:7): [True: 0, False: 16.2k] ------------------ 117| 0| errno = ENAMETOOLONG; 118| 0| goto err; 119| 0| } 120| 16.2k| memcpy(next_token, left, s - left); 121| 16.2k| next_token[s - left] = '\0'; 122| 16.2k| left_len -= s - left; 123| 16.2k| if (p != NULL) ------------------ | Branch (123:7): [True: 16.1k, False: 141] ------------------ 124| 16.1k| memmove(left, s + 1, left_len + 1); 125| 16.2k| if (resolved[resolved_len - 1] != '/') { ------------------ | Branch (125:7): [True: 976, False: 15.2k] ------------------ 126| 976| if (resolved_len + 1 >= PATH_MAX) { ------------------ | Branch (126:8): [True: 0, False: 976] ------------------ 127| 0| errno = ENAMETOOLONG; 128| 0| goto err; 129| 0| } 130| 976| resolved[resolved_len++] = '/'; 131| 976| resolved[resolved_len] = '\0'; 132| 976| } 133| 16.2k| if (next_token[0] == '\0') ------------------ | Branch (133:7): [True: 13.2k, False: 2.96k] ------------------ 134| 13.2k| continue; 135| 2.96k| else if (strcmp(next_token, ".") == 0) ------------------ | Branch (135:12): [True: 903, False: 2.06k] ------------------ 136| 903| continue; 137| 2.06k| else if (strcmp(next_token, "..") == 0) { ------------------ | Branch (137:12): [True: 668, False: 1.39k] ------------------ 138| | /* 139| | * Strip the last path component except when we have 140| | * single "/" 141| | */ 142| 668| if (resolved_len > 1) { ------------------ | Branch (142:8): [True: 468, False: 200] ------------------ 143| 468| resolved[resolved_len - 1] = '\0'; 144| 468| q = strrchr(resolved, '/') + 1; 145| 468| *q = '\0'; 146| 468| resolved_len = q - resolved; 147| 468| } 148| 668| continue; 149| 668| } 150| | 151| | /* 152| | * Append the next path component and lstat() it. If 153| | * lstat() fails we still can return successfully if 154| | * there are no more path components left. 155| | */ 156| 1.39k| resolved_len = strlcat(resolved, next_token, PATH_MAX); 157| 1.39k| if (resolved_len >= PATH_MAX) { ------------------ | Branch (157:7): [True: 8, False: 1.38k] ------------------ 158| 8| errno = ENAMETOOLONG; 159| 8| goto err; 160| 8| } 161| 1.38k| if (lstat(resolved, &sb) != 0) { ------------------ | Branch (161:7): [True: 157, False: 1.22k] ------------------ 162| 157| if (errno == ENOENT && p == NULL) { ------------------ | Branch (162:8): [True: 122, False: 35] | Branch (162:27): [True: 88, False: 34] ------------------ 163| 88| errno = serrno; 164| 88| return (resolved); 165| 88| } 166| 69| goto err; 167| 157| } 168| 1.22k| if (S_ISLNK(sb.st_mode)) { ------------------ | Branch (168:7): [True: 318, False: 910] ------------------ 169| 318| if (symlinks++ > SYMLOOP_MAX) { ------------------ | | 43| 318|# define SYMLOOP_MAX 32 ------------------ | Branch (169:8): [True: 3, False: 315] ------------------ 170| 3| errno = ELOOP; 171| 3| goto err; 172| 3| } 173| 315| slen = readlink(resolved, symlink, sizeof(symlink) - 1); 174| 315| if (slen < 0) ------------------ | Branch (174:8): [True: 0, False: 315] ------------------ 175| 0| goto err; 176| 315| symlink[slen] = '\0'; 177| 315| if (symlink[0] == '/') { ------------------ | Branch (177:8): [True: 145, False: 170] ------------------ 178| 145| resolved[1] = 0; 179| 145| resolved_len = 1; 180| 170| } else if (resolved_len > 1) { ------------------ | Branch (180:15): [True: 170, False: 0] ------------------ 181| | /* Strip the last path component. */ 182| 170| resolved[resolved_len - 1] = '\0'; 183| 170| q = strrchr(resolved, '/') + 1; 184| 170| *q = '\0'; 185| 170| resolved_len = q - resolved; 186| 170| } 187| | 188| | /* 189| | * If there are any path components left, then 190| | * append them to symlink. The result is placed 191| | * in `left'. 192| | */ 193| 315| if (p != NULL) { ------------------ | Branch (193:8): [True: 311, False: 4] ------------------ 194| 311| if (symlink[slen - 1] != '/') { ------------------ | Branch (194:9): [True: 311, False: 0] ------------------ 195| 311| if (slen + 1 >= ------------------ | Branch (195:10): [True: 0, False: 311] ------------------ 196| 311| (ptrdiff_t)sizeof(symlink)) { 197| 0| errno = ENAMETOOLONG; 198| 0| goto err; 199| 0| } 200| 311| symlink[slen] = '/'; 201| 311| symlink[slen + 1] = 0; 202| 311| } 203| 311| left_len = strlcat(symlink, left, sizeof(symlink)); 204| 311| if (left_len >= sizeof(symlink)) { ------------------ | Branch (204:9): [True: 0, False: 311] ------------------ 205| 0| errno = ENAMETOOLONG; 206| 0| goto err; 207| 0| } 208| 311| } 209| 315| left_len = strlcpy(left, symlink, sizeof(left)); 210| 315| } 211| 1.22k| } 212| | 213| | /* 214| | * Remove trailing slash except when the resolved pathname 215| | * is a single "/". 216| | */ 217| 30| if (resolved_len > 1 && resolved[resolved_len - 1] == '/') ------------------ | Branch (217:6): [True: 20, False: 10] | Branch (217:26): [True: 12, False: 8] ------------------ 218| 12| resolved[resolved_len - 1] = '\0'; 219| 30| return (resolved); 220| | 221| 82|err: 222| 82| if (mem_allocated) ------------------ | Branch (222:6): [True: 0, False: 82] ------------------ 223| 0| free(resolved); 224| | return (NULL); 225| 198|} sftp_server_msg_fuzz_helper.c:handle_log_close: 470| 8|{ 471| 8| if (handle_is_ok(handle, HANDLE_FILE)) { ------------------ | Branch (471:6): [True: 0, False: 8] ------------------ 472| 0| logit("%s%sclose \"%s\" bytes read %llu written %llu", ------------------ | | 113| 0|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) | | ------------------ | | | Branch (113:86): [True: 0, False: 0] | | | Branch (113:86): [True: 0, False: 0] | | ------------------ ------------------ 473| 0| emsg == NULL ? "" : emsg, emsg == NULL ? "" : " ", 474| 0| handle_to_name(handle), 475| 0| (unsigned long long)handle_bytes_read(handle), 476| 0| (unsigned long long)handle_bytes_write(handle)); 477| 8| } else { 478| | logit("%s%sclosedir \"%s\"", ------------------ | | 113| 32|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) | | ------------------ | | | Branch (113:86): [True: 8, False: 0] | | | Branch (113:86): [True: 8, False: 0] | | ------------------ ------------------ 479| 8| emsg == NULL ? "" : emsg, emsg == NULL ? "" : " ", 480| 8| handle_to_name(handle)); 481| 8| } 482| 8|} sftp_server_msg_fuzz_helper.c:handle_is_ok: 357| 916|{ 358| 916| return i >= 0 && (u_int)i < num_handles && handles[i].use == type; ------------------ | Branch (358:9): [True: 118, False: 798] | Branch (358:19): [True: 0, False: 118] | Branch (358:45): [True: 0, False: 0] ------------------ 359| 916|} sftp_server_msg_fuzz_helper.c:handle_to_name: 388| 237|{ 389| 237| if (handle_is_ok(handle, HANDLE_DIR)|| ------------------ | Branch (389:6): [True: 0, False: 237] ------------------ 390| 237| handle_is_ok(handle, HANDLE_FILE)) ------------------ | Branch (390:6): [True: 0, False: 237] ------------------ 391| 0| return handles[handle].name; 392| 237| return NULL; 393| 237|} sftp_server_msg_fuzz_helper.c:process_open: 735| 72|{ 736| 72| uint32_t pflags; 737| 72| Attrib a; 738| 72| char *name; 739| 72| int r, handle, fd, flags, mode, status = SSH2_FX_FAILURE; ------------------ | | 91| 72|#define SSH2_FX_FAILURE 4 ------------------ 740| | 741| 72| if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 || ------------------ | Branch (741:6): [True: 8, False: 64] ------------------ 742| 64| (r = sshbuf_get_u32(iqueue, &pflags)) != 0 || /* portable flags */ ------------------ | Branch (742:6): [True: 1, False: 63] ------------------ 743| 63| (r = decode_attrib(iqueue, &a)) != 0) ------------------ | Branch (743:6): [True: 49, False: 14] ------------------ 744| 58| fatal_fr(r, "parse"); ------------------ | | 146| 58|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 745| | 746| 14| debug3("request %u: open flags %d", id, pflags); ------------------ | | 109| 14|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 747| 14| flags = flags_from_portable(pflags); 748| 14| mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a.perm : 0666; ------------------ | | 70| 14|#define SSH2_FILEXFER_ATTR_PERMISSIONS 0x00000004 ------------------ | Branch (748:9): [True: 3, False: 11] ------------------ 749| 14| logit("open \"%s\" flags %s mode 0%o", ------------------ | | 113| 14|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 750| 14| name, string_from_portable(pflags), mode); 751| 14| if (readonly && ------------------ | Branch (751:6): [True: 0, False: 14] ------------------ 752| 0| ((flags & O_ACCMODE) != O_RDONLY || ------------------ | Branch (752:7): [True: 0, False: 0] ------------------ 753| 0| (flags & (O_CREAT|O_TRUNC)) != 0)) { ------------------ | Branch (753:6): [True: 0, False: 0] ------------------ 754| 0| verbose("Refusing open request in read-only mode"); ------------------ | | 112| 0|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 755| 0| status = SSH2_FX_PERMISSION_DENIED; ------------------ | | 90| 0|#define SSH2_FX_PERMISSION_DENIED 3 ------------------ 756| 14| } else { 757| 14| fd = open(name, flags, mode); 758| 14| if (fd == -1) { ------------------ | Branch (758:7): [True: 13, False: 1] ------------------ 759| 13| status = errno_to_portable(errno); 760| 13| } else { 761| 1| handle = handle_new(HANDLE_FILE, name, fd, flags, NULL); 762| 1| if (handle < 0) { ------------------ | Branch (762:8): [True: 0, False: 1] ------------------ 763| 0| close(fd); 764| 1| } else { 765| 1| send_handle(id, handle); 766| 1| status = SSH2_FX_OK; ------------------ | | 87| 1|#define SSH2_FX_OK 0 ------------------ 767| 1| } 768| 1| } 769| 14| } 770| 14| if (status != SSH2_FX_OK) ------------------ | | 87| 14|#define SSH2_FX_OK 0 ------------------ | Branch (770:6): [True: 13, False: 1] ------------------ 771| 13| send_status(id, status); 772| 14| free(name); 773| 14|} sftp_server_msg_fuzz_helper.c:flags_from_portable: 248| 14|{ 249| 14| int flags = 0; 250| | 251| 14| if ((pflags & SSH2_FXF_READ) && ------------------ | | 75| 14|#define SSH2_FXF_READ 0x00000001 ------------------ | Branch (251:6): [True: 2, False: 12] ------------------ 252| 2| (pflags & SSH2_FXF_WRITE)) { ------------------ | | 76| 2|#define SSH2_FXF_WRITE 0x00000002 ------------------ | Branch (252:6): [True: 1, False: 1] ------------------ 253| 1| flags = O_RDWR; 254| 13| } else if (pflags & SSH2_FXF_READ) { ------------------ | | 75| 13|#define SSH2_FXF_READ 0x00000001 ------------------ | Branch (254:13): [True: 1, False: 12] ------------------ 255| 1| flags = O_RDONLY; 256| 12| } else if (pflags & SSH2_FXF_WRITE) { ------------------ | | 76| 12|#define SSH2_FXF_WRITE 0x00000002 ------------------ | Branch (256:13): [True: 4, False: 8] ------------------ 257| 4| flags = O_WRONLY; 258| 4| } 259| 14| if (pflags & SSH2_FXF_APPEND) ------------------ | | 77| 14|#define SSH2_FXF_APPEND 0x00000004 ------------------ | Branch (259:6): [True: 5, False: 9] ------------------ 260| 5| flags |= O_APPEND; 261| 14| if (pflags & SSH2_FXF_CREAT) ------------------ | | 78| 14|#define SSH2_FXF_CREAT 0x00000008 ------------------ | Branch (261:6): [True: 10, False: 4] ------------------ 262| 10| flags |= O_CREAT; 263| 14| if (pflags & SSH2_FXF_TRUNC) ------------------ | | 79| 14|#define SSH2_FXF_TRUNC 0x00000010 ------------------ | Branch (263:6): [True: 8, False: 6] ------------------ 264| 8| flags |= O_TRUNC; 265| 14| if (pflags & SSH2_FXF_EXCL) ------------------ | | 80| 14|#define SSH2_FXF_EXCL 0x00000020 ------------------ | Branch (265:6): [True: 8, False: 6] ------------------ 266| 8| flags |= O_EXCL; 267| 14| return flags; 268| 14|} sftp_server_msg_fuzz_helper.c:string_from_portable: 272| 14|{ 273| 14| static char ret[128]; 274| | 275| 14| *ret = '\0'; 276| | 277| 14|#define PAPPEND(str) { \ 278| 14| if (*ret != '\0') \ 279| 14| strlcat(ret, ",", sizeof(ret)); \ 280| 14| strlcat(ret, str, sizeof(ret)); \ 281| 14| } 282| | 283| 14| if (pflags & SSH2_FXF_READ) ------------------ | | 75| 14|#define SSH2_FXF_READ 0x00000001 ------------------ | Branch (283:6): [True: 2, False: 12] ------------------ 284| 2| PAPPEND("READ") ------------------ | | 277| 2|#define PAPPEND(str) { \ | | 278| 2| if (*ret != '\0') \ | | ------------------ | | | Branch (278:7): [True: 0, False: 2] | | ------------------ | | 279| 2| strlcat(ret, ",", sizeof(ret)); \ | | 280| 2| strlcat(ret, str, sizeof(ret)); \ | | 281| 2| } ------------------ 285| 14| if (pflags & SSH2_FXF_WRITE) ------------------ | | 76| 14|#define SSH2_FXF_WRITE 0x00000002 ------------------ | Branch (285:6): [True: 5, False: 9] ------------------ 286| 5| PAPPEND("WRITE") ------------------ | | 277| 5|#define PAPPEND(str) { \ | | 278| 5| if (*ret != '\0') \ | | ------------------ | | | Branch (278:7): [True: 1, False: 4] | | ------------------ | | 279| 5| strlcat(ret, ",", sizeof(ret)); \ | | 280| 5| strlcat(ret, str, sizeof(ret)); \ | | 281| 5| } ------------------ 287| 14| if (pflags & SSH2_FXF_APPEND) ------------------ | | 77| 14|#define SSH2_FXF_APPEND 0x00000004 ------------------ | Branch (287:6): [True: 5, False: 9] ------------------ 288| 5| PAPPEND("APPEND") ------------------ | | 277| 5|#define PAPPEND(str) { \ | | 278| 5| if (*ret != '\0') \ | | ------------------ | | | Branch (278:7): [True: 3, False: 2] | | ------------------ | | 279| 5| strlcat(ret, ",", sizeof(ret)); \ | | 280| 5| strlcat(ret, str, sizeof(ret)); \ | | 281| 5| } ------------------ 289| 14| if (pflags & SSH2_FXF_CREAT) ------------------ | | 78| 14|#define SSH2_FXF_CREAT 0x00000008 ------------------ | Branch (289:6): [True: 10, False: 4] ------------------ 290| 10| PAPPEND("CREATE") ------------------ | | 277| 10|#define PAPPEND(str) { \ | | 278| 10| if (*ret != '\0') \ | | ------------------ | | | Branch (278:7): [True: 7, False: 3] | | ------------------ | | 279| 10| strlcat(ret, ",", sizeof(ret)); \ | | 280| 10| strlcat(ret, str, sizeof(ret)); \ | | 281| 10| } ------------------ 291| 14| if (pflags & SSH2_FXF_TRUNC) ------------------ | | 79| 14|#define SSH2_FXF_TRUNC 0x00000010 ------------------ | Branch (291:6): [True: 8, False: 6] ------------------ 292| 8| PAPPEND("TRUNCATE") ------------------ | | 277| 8|#define PAPPEND(str) { \ | | 278| 8| if (*ret != '\0') \ | | ------------------ | | | Branch (278:7): [True: 7, False: 1] | | ------------------ | | 279| 8| strlcat(ret, ",", sizeof(ret)); \ | | 280| 8| strlcat(ret, str, sizeof(ret)); \ | | 281| 8| } ------------------ 293| 14| if (pflags & SSH2_FXF_EXCL) ------------------ | | 80| 14|#define SSH2_FXF_EXCL 0x00000020 ------------------ | Branch (293:6): [True: 8, False: 6] ------------------ 294| 8| PAPPEND("EXCL") ------------------ | | 277| 8|#define PAPPEND(str) { \ | | 278| 8| if (*ret != '\0') \ | | ------------------ | | | Branch (278:7): [True: 7, False: 1] | | ------------------ | | 279| 8| strlcat(ret, ",", sizeof(ret)); \ | | 280| 8| strlcat(ret, str, sizeof(ret)); \ | | 281| 8| } ------------------ 295| | 296| 14| return ret; 297| 14|} sftp_server_msg_fuzz_helper.c:errno_to_portable: 214| 428|{ 215| 428| int ret = 0; 216| | 217| 428| switch (unixerrno) { 218| 0| case 0: ------------------ | Branch (218:2): [True: 0, False: 428] ------------------ 219| 0| ret = SSH2_FX_OK; ------------------ | | 87| 0|#define SSH2_FX_OK 0 ------------------ 220| 0| break; 221| 231| case ENOENT: ------------------ | Branch (221:2): [True: 231, False: 197] ------------------ 222| 254| case ENOTDIR: ------------------ | Branch (222:2): [True: 23, False: 405] ------------------ 223| 347| case EBADF: ------------------ | Branch (223:2): [True: 93, False: 335] ------------------ 224| 350| case ELOOP: ------------------ | Branch (224:2): [True: 3, False: 425] ------------------ 225| 350| ret = SSH2_FX_NO_SUCH_FILE; ------------------ | | 89| 350|#define SSH2_FX_NO_SUCH_FILE 2 ------------------ 226| 350| break; 227| 0| case EPERM: ------------------ | Branch (227:2): [True: 0, False: 428] ------------------ 228| 0| case EACCES: ------------------ | Branch (228:2): [True: 0, False: 428] ------------------ 229| 0| case EFAULT: ------------------ | Branch (229:2): [True: 0, False: 428] ------------------ 230| 0| ret = SSH2_FX_PERMISSION_DENIED; ------------------ | | 90| 0|#define SSH2_FX_PERMISSION_DENIED 3 ------------------ 231| 0| break; 232| 59| case ENAMETOOLONG: ------------------ | Branch (232:2): [True: 59, False: 369] ------------------ 233| 66| case EINVAL: ------------------ | Branch (233:2): [True: 7, False: 421] ------------------ 234| 66| ret = SSH2_FX_BAD_MESSAGE; ------------------ | | 92| 66|#define SSH2_FX_BAD_MESSAGE 5 ------------------ 235| 66| break; 236| 0| case ENOSYS: ------------------ | Branch (236:2): [True: 0, False: 428] ------------------ 237| 0| ret = SSH2_FX_OP_UNSUPPORTED; ------------------ | | 95| 0|#define SSH2_FX_OP_UNSUPPORTED 8 ------------------ 238| 0| break; 239| 12| default: ------------------ | Branch (239:2): [True: 12, False: 416] ------------------ 240| 12| ret = SSH2_FX_FAILURE; ------------------ | | 91| 12|#define SSH2_FX_FAILURE 4 ------------------ 241| 12| break; 242| 428| } 243| 428| return ret; 244| 428|} sftp_server_msg_fuzz_helper.c:handle_new: 331| 5|{ 332| 5| int i; 333| | 334| 5| if (first_unused_handle == -1) { ------------------ | Branch (334:6): [True: 5, False: 0] ------------------ 335| 5| if (num_handles + 1 <= num_handles) ------------------ | Branch (335:7): [True: 0, False: 5] ------------------ 336| 0| return -1; 337| 5| num_handles++; 338| 5| handles = xreallocarray(handles, num_handles, sizeof(Handle)); 339| 5| handle_unused(num_handles - 1); 340| 5| } 341| | 342| 5| i = first_unused_handle; 343| 5| first_unused_handle = handles[i].next_unused; 344| | 345| 5| handles[i].use = use; 346| 5| handles[i].dirp = dirp; 347| 5| handles[i].fd = fd; 348| 5| handles[i].flags = flags; 349| 5| handles[i].name = xstrdup(name); 350| 5| handles[i].bytes_read = handles[i].bytes_write = 0; 351| | 352| 5| return i; 353| 5|} sftp_server_msg_fuzz_helper.c:handle_unused: 323| 5|{ 324| 5| handles[i].use = HANDLE_UNUSED; 325| 5| handles[i].next_unused = first_unused_handle; 326| 5| first_unused_handle = i; 327| 5|} sftp_server_msg_fuzz_helper.c:send_handle: 597| 5|{ 598| 5| u_char *string; 599| 5| int hlen; 600| | 601| 5| handle_to_string(handle, &string, &hlen); 602| 5| debug("request %u: sent handle %d", id, handle); ------------------ | | 111| 5|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 603| 5| send_data_or_handle(SSH2_FXP_HANDLE, id, string, hlen); ------------------ | | 59| 5|#define SSH2_FXP_HANDLE 102 ------------------ 604| 5| free(string); 605| 5|} sftp_server_msg_fuzz_helper.c:handle_to_string: 363| 5|{ 364| 5| if (stringp == NULL || hlenp == NULL) ------------------ | Branch (364:6): [True: 0, False: 5] | Branch (364:25): [True: 0, False: 5] ------------------ 365| 0| return -1; 366| 5| *stringp = xmalloc(sizeof(int32_t)); 367| 5| put_u32(*stringp, handle); 368| 5| *hlenp = sizeof(int32_t); 369| 5| return 0; 370| 5|} sftp_server_msg_fuzz_helper.c:send_data_or_handle: 574| 5|{ 575| 5| struct sshbuf *msg; 576| 5| int r; 577| | 578| 5| if ((msg = sshbuf_new()) == NULL) ------------------ | Branch (578:6): [True: 0, False: 5] ------------------ 579| 0| fatal_f("sshbuf_new failed"); ------------------ | | 126| 0|#define fatal_f(...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 580| 5| if ((r = sshbuf_put_u8(msg, type)) != 0 || ------------------ | Branch (580:6): [True: 0, False: 5] ------------------ 581| 5| (r = sshbuf_put_u32(msg, id)) != 0 || ------------------ | Branch (581:6): [True: 0, False: 5] ------------------ 582| 5| (r = sshbuf_put_string(msg, data, dlen)) != 0) ------------------ | Branch (582:6): [True: 0, False: 5] ------------------ 583| 0| fatal_fr(r, "compose"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 584| 5| send_msg(msg); 585| 5| sshbuf_free(msg); 586| 5|} sftp_server_msg_fuzz_helper.c:send_msg: 514| 2.95k|{ 515| 2.95k| int r; 516| | 517| 2.95k| if ((r = sshbuf_put_stringb(oqueue, m)) != 0) ------------------ | Branch (517:6): [True: 0, False: 2.95k] ------------------ 518| 0| fatal_fr(r, "enqueue"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 519| 2.95k| sshbuf_reset(m); 520| 2.95k|} sftp_server_msg_fuzz_helper.c:send_status: 568| 729|{ 569| | send_status_errmsg(id, status, NULL); 570| 729|} sftp_server_msg_fuzz_helper.c:send_status_errmsg: 542| 866|{ 543| 866| struct sshbuf *msg; 544| 866| int r; 545| | 546| 866| debug3("request %u: sent status %u", id, status); ------------------ | | 109| 866|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 547| 866| if (log_level > SYSLOG_LEVEL_VERBOSE || ------------------ | Branch (547:6): [True: 0, False: 866] ------------------ 548| 866| (status != SSH2_FX_OK && status != SSH2_FX_EOF)) ------------------ | | 87| 1.73k|#define SSH2_FX_OK 0 ------------------ (status != SSH2_FX_OK && status != SSH2_FX_EOF)) ------------------ | | 88| 843|#define SSH2_FX_EOF 1 ------------------ | Branch (548:7): [True: 843, False: 23] | Branch (548:31): [True: 843, False: 0] ------------------ 549| 843| logit("sent status %s", status_to_message(status)); ------------------ | | 113| 843|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 550| 866| if ((msg = sshbuf_new()) == NULL) ------------------ | Branch (550:6): [True: 0, False: 866] ------------------ 551| 0| fatal_f("sshbuf_new failed"); ------------------ | | 126| 0|#define fatal_f(...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 552| 866| if ((r = sshbuf_put_u8(msg, SSH2_FXP_STATUS)) != 0 || ------------------ | | 58| 866|#define SSH2_FXP_STATUS 101 ------------------ | Branch (552:6): [True: 0, False: 866] ------------------ 553| 866| (r = sshbuf_put_u32(msg, id)) != 0 || ------------------ | Branch (553:6): [True: 0, False: 866] ------------------ 554| 866| (r = sshbuf_put_u32(msg, status)) != 0) ------------------ | Branch (554:6): [True: 0, False: 866] ------------------ 555| 0| fatal_fr(r, "compose"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 556| 866| if (version >= 3) { ------------------ | Branch (556:6): [True: 866, False: 0] ------------------ 557| 866| if ((r = sshbuf_put_cstring(msg, errmsg == NULL ? ------------------ | Branch (557:7): [True: 0, False: 866] | Branch (557:36): [True: 729, False: 137] ------------------ 558| 729| status_to_message(status) : errmsg)) != 0 || 559| 866| (r = sshbuf_put_cstring(msg, "")) != 0) ------------------ | Branch (559:7): [True: 0, False: 866] ------------------ 560| 0| fatal_fr(r, "compose message"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 561| 866| } 562| 866| send_msg(msg); 563| 866| sshbuf_free(msg); 564| 866|} sftp_server_msg_fuzz_helper.c:status_to_message: 524| 1.57k|{ 525| 1.57k| static const char * const status_messages[] = { 526| 1.57k| "Success", /* SSH_FX_OK */ 527| 1.57k| "End of file", /* SSH_FX_EOF */ 528| 1.57k| "No such file", /* SSH_FX_NO_SUCH_FILE */ 529| 1.57k| "Permission denied", /* SSH_FX_PERMISSION_DENIED */ 530| 1.57k| "Failure", /* SSH_FX_FAILURE */ 531| 1.57k| "Bad message", /* SSH_FX_BAD_MESSAGE */ 532| 1.57k| "No connection", /* SSH_FX_NO_CONNECTION */ 533| 1.57k| "Connection lost", /* SSH_FX_CONNECTION_LOST */ 534| 1.57k| "Operation unsupported", /* SSH_FX_OP_UNSUPPORTED */ 535| 1.57k| "Unknown error" /* Others */ 536| 1.57k| }; 537| 1.57k| return (status_messages[MINIMUM(status,SSH2_FX_MAX)]); ------------------ | | 268| 1.57k|#define MINIMUM(a, b) (((a) < (b)) ? (a) : (b)) | | ------------------ | | | Branch (268:24): [True: 996, False: 576] | | ------------------ ------------------ 538| 1.57k|} sftp_server_msg_fuzz_helper.c:process_close: 777| 16|{ 778| 16| int r, handle, ret, status = SSH2_FX_FAILURE; ------------------ | | 91| 16|#define SSH2_FX_FAILURE 4 ------------------ 779| | 780| 16| if ((r = get_handle(iqueue, &handle)) != 0) ------------------ | Branch (780:6): [True: 8, False: 8] ------------------ 781| 8| fatal_fr(r, "parse"); ------------------ | | 146| 8|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 782| | 783| 8| debug3("request %u: close handle %u", id, handle); ------------------ | | 109| 8|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 784| 8| handle_log_close(handle, NULL); 785| 8| ret = handle_close(handle); 786| 8| status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK; ------------------ | | 87| 8|#define SSH2_FX_OK 0 ------------------ | Branch (786:11): [True: 8, False: 0] ------------------ 787| 8| send_status(id, status); 788| 8|} sftp_server_msg_fuzz_helper.c:get_handle: 496| 508|{ 497| 508| u_char *handle; 498| 508| int r; 499| 508| size_t hlen; 500| | 501| 508| *hp = -1; 502| 508| if ((r = sshbuf_get_string(queue, &handle, &hlen)) != 0) ------------------ | Branch (502:6): [True: 69, False: 439] ------------------ 503| 69| return r; 504| 439| if (hlen < 256) ------------------ | Branch (504:6): [True: 422, False: 17] ------------------ 505| 422| *hp = handle_from_string(handle, hlen); 506| 439| free(handle); 507| 439| return 0; 508| 508|} sftp_server_msg_fuzz_helper.c:handle_from_string: 374| 422|{ 375| 422| int val; 376| | 377| 422| if (hlen != sizeof(int32_t)) ------------------ | Branch (377:6): [True: 329, False: 93] ------------------ 378| 329| return -1; 379| 93| val = get_u32(handle); 380| 93| if (handle_is_ok(val, HANDLE_FILE) || ------------------ | Branch (380:6): [True: 0, False: 93] ------------------ 381| 93| handle_is_ok(val, HANDLE_DIR)) ------------------ | Branch (381:6): [True: 0, False: 93] ------------------ 382| 0| return val; 383| 93| return -1; 384| 93|} sftp_server_msg_fuzz_helper.c:handle_close: 451| 8|{ 452| 8| int ret = -1; 453| | 454| 8| if (handle_is_ok(handle, HANDLE_FILE)) { ------------------ | Branch (454:6): [True: 0, False: 8] ------------------ 455| 0| ret = close(handles[handle].fd); 456| 0| free(handles[handle].name); 457| 0| handle_unused(handle); 458| 8| } else if (handle_is_ok(handle, HANDLE_DIR)) { ------------------ | Branch (458:13): [True: 0, False: 8] ------------------ 459| 0| ret = closedir(handles[handle].dirp); 460| 0| free(handles[handle].name); 461| 0| handle_unused(handle); 462| 8| } else { 463| 8| errno = ENOENT; 464| 8| } 465| 8| return ret; 466| 8|} sftp_server_msg_fuzz_helper.c:process_read: 792| 24|{ 793| 24| static u_char *buf; 794| 24| static size_t buflen; 795| 24| uint32_t len; 796| 24| int r, handle, fd, ret, status = SSH2_FX_FAILURE; ------------------ | | 91| 24|#define SSH2_FX_FAILURE 4 ------------------ 797| 24| uint64_t off; 798| | 799| 24| if ((r = get_handle(iqueue, &handle)) != 0 || ------------------ | Branch (799:6): [True: 8, False: 16] ------------------ 800| 16| (r = sshbuf_get_u64(iqueue, &off)) != 0 || ------------------ | Branch (800:6): [True: 11, False: 5] ------------------ 801| 5| (r = sshbuf_get_u32(iqueue, &len)) != 0) ------------------ | Branch (801:6): [True: 1, False: 4] ------------------ 802| 20| fatal_fr(r, "parse"); ------------------ | | 146| 20|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 803| | 804| 4| debug("request %u: read \"%s\" (handle %d) off %llu len %u", ------------------ | | 111| 4|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 805| 4| id, handle_to_name(handle), handle, (unsigned long long)off, len); 806| 4| if ((fd = handle_to_fd(handle)) == -1) ------------------ | Branch (806:6): [True: 4, False: 0] ------------------ 807| 4| goto out; 808| 0| if (len > SFTP_MAX_READ_LENGTH) { ------------------ | | 55| 0|#define SFTP_MAX_READ_LENGTH (SFTP_MAX_MSG_LENGTH - 1024) | | ------------------ | | | | 29| 0|#define SFTP_MAX_MSG_LENGTH (256 * 1024) | | ------------------ ------------------ | Branch (808:6): [True: 0, False: 0] ------------------ 809| 0| debug2("read change len %u to %u", len, SFTP_MAX_READ_LENGTH); ------------------ | | 110| 0|#define debug2(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG2, NULL, __VA_ARGS__) ------------------ 810| 0| len = SFTP_MAX_READ_LENGTH; ------------------ | | 55| 0|#define SFTP_MAX_READ_LENGTH (SFTP_MAX_MSG_LENGTH - 1024) | | ------------------ | | | | 29| 0|#define SFTP_MAX_MSG_LENGTH (256 * 1024) | | ------------------ ------------------ 811| 0| } 812| 0| if (len > buflen) { ------------------ | Branch (812:6): [True: 0, False: 0] ------------------ 813| 0| debug3_f("allocate %zu => %u", buflen, len); ------------------ | | 120| 0|#define debug3_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 814| 0| if ((buf = realloc(buf, len)) == NULL) ------------------ | Branch (814:7): [True: 0, False: 0] ------------------ 815| 0| fatal_f("realloc failed"); ------------------ | | 126| 0|#define fatal_f(...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 816| 0| buflen = len; 817| 0| } 818| 0| if (lseek(fd, off, SEEK_SET) == -1) { ------------------ | Branch (818:6): [True: 0, False: 0] ------------------ 819| 0| status = errno_to_portable(errno); 820| 0| error_f("seek \"%.100s\": %s", handle_to_name(handle), ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 821| 0| strerror(errno)); 822| 0| goto out; 823| 0| } 824| 0| if (len == 0) { ------------------ | Branch (824:6): [True: 0, False: 0] ------------------ 825| | /* weird, but not strictly disallowed */ 826| 0| ret = 0; 827| 0| } else if ((ret = read(fd, buf, len)) == -1) { ------------------ | Branch (827:13): [True: 0, False: 0] ------------------ 828| 0| status = errno_to_portable(errno); 829| 0| error_f("read \"%.100s\": %s", handle_to_name(handle), ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 830| 0| strerror(errno)); 831| 0| goto out; 832| 0| } else if (ret == 0) { ------------------ | Branch (832:13): [True: 0, False: 0] ------------------ 833| 0| status = SSH2_FX_EOF; ------------------ | | 88| 0|#define SSH2_FX_EOF 1 ------------------ 834| 0| goto out; 835| 0| } 836| 0| send_data(id, buf, ret); 837| 0| handle_update_read(handle, ret); 838| | /* success */ 839| 0| status = SSH2_FX_OK; ------------------ | | 87| 0|#define SSH2_FX_OK 0 ------------------ 840| 4| out: 841| 4| if (status != SSH2_FX_OK) ------------------ | | 87| 4|#define SSH2_FX_OK 0 ------------------ | Branch (841:6): [True: 4, False: 0] ------------------ 842| 4| send_status(id, status); 843| 4|} sftp_server_msg_fuzz_helper.c:handle_to_fd: 405| 218|{ 406| 218| if (handle_is_ok(handle, HANDLE_FILE)) ------------------ | Branch (406:6): [True: 0, False: 218] ------------------ 407| 0| return handles[handle].fd; 408| 218| return -1; 409| 218|} sftp_server_msg_fuzz_helper.c:process_write: 847| 20|{ 848| 20| uint64_t off; 849| 20| size_t len; 850| 20| int r, handle, fd, ret, status; 851| 20| u_char *data; 852| | 853| 20| if ((r = get_handle(iqueue, &handle)) != 0 || ------------------ | Branch (853:6): [True: 4, False: 16] ------------------ 854| 16| (r = sshbuf_get_u64(iqueue, &off)) != 0 || ------------------ | Branch (854:6): [True: 10, False: 6] ------------------ 855| 6| (r = sshbuf_get_string(iqueue, &data, &len)) != 0) ------------------ | Branch (855:6): [True: 3, False: 3] ------------------ 856| 17| fatal_fr(r, "parse"); ------------------ | | 146| 17|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 857| | 858| 3| debug("request %u: write \"%s\" (handle %d) off %llu len %zu", ------------------ | | 111| 3|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 859| 3| id, handle_to_name(handle), handle, (unsigned long long)off, len); 860| 3| fd = handle_to_fd(handle); 861| | 862| 3| if (fd < 0) ------------------ | Branch (862:6): [True: 3, False: 0] ------------------ 863| 3| status = SSH2_FX_FAILURE; ------------------ | | 91| 3|#define SSH2_FX_FAILURE 4 ------------------ 864| 0| else { 865| 0| if (!(handle_to_flags(handle) & O_APPEND) && ------------------ | Branch (865:7): [True: 0, False: 0] ------------------ 866| 0| lseek(fd, off, SEEK_SET) == -1) { ------------------ | Branch (866:7): [True: 0, False: 0] ------------------ 867| 0| status = errno_to_portable(errno); 868| 0| error_f("seek \"%.100s\": %s", handle_to_name(handle), ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 869| 0| strerror(errno)); 870| 0| } else { 871| |/* XXX ATOMICIO ? */ 872| 0| ret = write(fd, data, len); 873| 0| if (ret == -1) { ------------------ | Branch (873:8): [True: 0, False: 0] ------------------ 874| 0| status = errno_to_portable(errno); 875| 0| error_f("write \"%.100s\": %s", ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 876| 0| handle_to_name(handle), strerror(errno)); 877| 0| } else if ((size_t)ret == len) { ------------------ | Branch (877:15): [True: 0, False: 0] ------------------ 878| 0| status = SSH2_FX_OK; ------------------ | | 87| 0|#define SSH2_FX_OK 0 ------------------ 879| 0| handle_update_write(handle, ret); 880| 0| } else { 881| 0| debug2_f("nothing at all written"); ------------------ | | 121| 0|#define debug2_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG2, NULL, __VA_ARGS__) ------------------ 882| 0| status = SSH2_FX_FAILURE; ------------------ | | 91| 0|#define SSH2_FX_FAILURE 4 ------------------ 883| 0| } 884| 0| } 885| 0| } 886| 3| send_status(id, status); 887| 3| free(data); 888| 3|} sftp_server_msg_fuzz_helper.c:process_lstat: 924| 8|{ 925| 8| process_do_stat(id, 1); 926| 8|} sftp_server_msg_fuzz_helper.c:process_do_stat: 892| 14|{ 893| 14| Attrib a; 894| 14| struct stat st; 895| 14| char *name; 896| 14| int r, status = SSH2_FX_FAILURE; ------------------ | | 91| 14|#define SSH2_FX_FAILURE 4 ------------------ 897| | 898| 14| if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0) ------------------ | Branch (898:6): [True: 7, False: 7] ------------------ 899| 7| fatal_fr(r, "parse"); ------------------ | | 146| 7|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 900| | 901| 7| debug3("request %u: %sstat", id, do_lstat ? "l" : ""); ------------------ | | 109| 14|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) | | ------------------ | | | Branch (109:89): [True: 4, False: 3] | | ------------------ ------------------ 902| 7| verbose("%sstat name \"%s\"", do_lstat ? "l" : "", name); ------------------ | | 112| 14|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) | | ------------------ | | | Branch (112:91): [True: 4, False: 3] | | ------------------ ------------------ 903| 7| r = do_lstat ? lstat(name, &st) : stat(name, &st); ------------------ | Branch (903:6): [True: 4, False: 3] ------------------ 904| 7| if (r == -1) { ------------------ | Branch (904:6): [True: 5, False: 2] ------------------ 905| 5| status = errno_to_portable(errno); 906| 5| } else { 907| 2| stat_to_attrib(&st, &a); 908| 2| send_attrib(id, &a); 909| 2| status = SSH2_FX_OK; ------------------ | | 87| 2|#define SSH2_FX_OK 0 ------------------ 910| 2| } 911| 7| if (status != SSH2_FX_OK) ------------------ | | 87| 7|#define SSH2_FX_OK 0 ------------------ | Branch (911:6): [True: 5, False: 2] ------------------ 912| 5| send_status(id, status); 913| 7| free(name); 914| 7|} sftp_server_msg_fuzz_helper.c:send_attrib: 632| 2|{ 633| 2| struct sshbuf *msg; 634| 2| int r; 635| | 636| 2| debug("request %u: sent attrib have 0x%x", id, a->flags); ------------------ | | 111| 2|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 637| 2| if ((msg = sshbuf_new()) == NULL) ------------------ | Branch (637:6): [True: 0, False: 2] ------------------ 638| 0| fatal_f("sshbuf_new failed"); ------------------ | | 126| 0|#define fatal_f(...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 639| 2| if ((r = sshbuf_put_u8(msg, SSH2_FXP_ATTRS)) != 0 || ------------------ | | 62| 2|#define SSH2_FXP_ATTRS 105 ------------------ | Branch (639:6): [True: 0, False: 2] ------------------ 640| 2| (r = sshbuf_put_u32(msg, id)) != 0 || ------------------ | Branch (640:6): [True: 0, False: 2] ------------------ 641| 2| (r = encode_attrib(msg, a)) != 0) ------------------ | Branch (641:6): [True: 0, False: 2] ------------------ 642| 0| fatal_fr(r, "compose"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 643| 2| send_msg(msg); 644| 2| sshbuf_free(msg); 645| 2|} sftp_server_msg_fuzz_helper.c:process_fstat: 930| 14|{ 931| 14| Attrib a; 932| 14| struct stat st; 933| 14| int fd, r, handle, status = SSH2_FX_FAILURE; ------------------ | | 91| 14|#define SSH2_FX_FAILURE 4 ------------------ 934| | 935| 14| if ((r = get_handle(iqueue, &handle)) != 0) ------------------ | Branch (935:6): [True: 8, False: 6] ------------------ 936| 8| fatal_fr(r, "parse"); ------------------ | | 146| 8|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 937| 6| debug("request %u: fstat \"%s\" (handle %u)", ------------------ | | 111| 6|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 938| 6| id, handle_to_name(handle), handle); 939| 6| fd = handle_to_fd(handle); 940| 6| if (fd >= 0) { ------------------ | Branch (940:6): [True: 0, False: 6] ------------------ 941| 0| r = fstat(fd, &st); 942| 0| if (r == -1) { ------------------ | Branch (942:7): [True: 0, False: 0] ------------------ 943| 0| status = errno_to_portable(errno); 944| 0| } else { 945| 0| stat_to_attrib(&st, &a); 946| 0| send_attrib(id, &a); 947| 0| status = SSH2_FX_OK; ------------------ | | 87| 0|#define SSH2_FX_OK 0 ------------------ 948| 0| } 949| 0| } 950| 6| if (status != SSH2_FX_OK) ------------------ | | 87| 6|#define SSH2_FX_OK 0 ------------------ | Branch (950:6): [True: 6, False: 0] ------------------ 951| 6| send_status(id, status); 952| 6|} sftp_server_msg_fuzz_helper.c:process_setstat: 980| 57|{ 981| 57| Attrib a; 982| 57| char *name; 983| 57| int r, status = SSH2_FX_OK; ------------------ | | 87| 57|#define SSH2_FX_OK 0 ------------------ 984| | 985| 57| if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 || ------------------ | Branch (985:6): [True: 10, False: 47] ------------------ 986| 47| (r = decode_attrib(iqueue, &a)) != 0) ------------------ | Branch (986:6): [True: 20, False: 27] ------------------ 987| 30| fatal_fr(r, "parse"); ------------------ | | 146| 30|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 988| | 989| 27| debug("request %u: setstat name \"%s\"", id, name); ------------------ | | 111| 27|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 990| 27| if (a.flags & SSH2_FILEXFER_ATTR_SIZE) { ------------------ | | 68| 27|#define SSH2_FILEXFER_ATTR_SIZE 0x00000001 ------------------ | Branch (990:6): [True: 10, False: 17] ------------------ 991| 10| logit("set \"%s\" size %llu", ------------------ | | 113| 10|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 992| 10| name, (unsigned long long)a.size); 993| 10| r = truncate(name, a.size); 994| 10| if (r == -1) ------------------ | Branch (994:7): [True: 10, False: 0] ------------------ 995| 10| status = errno_to_portable(errno); 996| 10| } 997| 27| if (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) { ------------------ | | 70| 27|#define SSH2_FILEXFER_ATTR_PERMISSIONS 0x00000004 ------------------ | Branch (997:6): [True: 12, False: 15] ------------------ 998| 12| logit("set \"%s\" mode %04o", name, a.perm); ------------------ | | 113| 12|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 999| 12| r = chmod(name, a.perm & 07777); 1000| 12| if (r == -1) ------------------ | Branch (1000:7): [True: 8, False: 4] ------------------ 1001| 8| status = errno_to_portable(errno); 1002| 12| } 1003| 27| if (a.flags & SSH2_FILEXFER_ATTR_ACMODTIME) { ------------------ | | 71| 27|#define SSH2_FILEXFER_ATTR_ACMODTIME 0x00000008 ------------------ | Branch (1003:6): [True: 6, False: 21] ------------------ 1004| 6| char buf[64]; 1005| 6| time_t t = a.mtime; 1006| | 1007| 6| strftime(buf, sizeof(buf), "%Y%m%d-%H:%M:%S", 1008| 6| localtime(&t)); 1009| 6| logit("set \"%s\" modtime %s", name, buf); ------------------ | | 113| 6|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1010| 6| r = utimes(name, attrib_to_tv(&a)); 1011| 6| if (r == -1) ------------------ | Branch (1011:7): [True: 4, False: 2] ------------------ 1012| 4| status = errno_to_portable(errno); 1013| 6| } 1014| 27| if (a.flags & SSH2_FILEXFER_ATTR_UIDGID) { ------------------ | | 69| 27|#define SSH2_FILEXFER_ATTR_UIDGID 0x00000002 ------------------ | Branch (1014:6): [True: 8, False: 19] ------------------ 1015| 8| logit("set \"%s\" owner %lu group %lu", name, ------------------ | | 113| 8|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1016| 8| (u_long)a.uid, (u_long)a.gid); 1017| 8| r = chown(name, a.uid, a.gid); 1018| 8| if (r == -1) ------------------ | Branch (1018:7): [True: 5, False: 3] ------------------ 1019| 5| status = errno_to_portable(errno); 1020| 8| } 1021| 27| send_status(id, status); 1022| 27| free(name); 1023| 27|} sftp_server_msg_fuzz_helper.c:attrib_to_tv: 956| 6|{ 957| 6| static struct timeval tv[2]; 958| | 959| 6| tv[0].tv_sec = a->atime; 960| 6| tv[0].tv_usec = 0; 961| 6| tv[1].tv_sec = a->mtime; 962| 6| tv[1].tv_usec = 0; 963| 6| return tv; 964| 6|} sftp_server_msg_fuzz_helper.c:process_fsetstat: 1027| 201|{ 1028| 201| Attrib a; 1029| 201| int handle, fd, r; 1030| 201| int status = SSH2_FX_OK; ------------------ | | 87| 201|#define SSH2_FX_OK 0 ------------------ 1031| | 1032| 201| if ((r = get_handle(iqueue, &handle)) != 0 || ------------------ | Branch (1032:6): [True: 26, False: 175] ------------------ 1033| 175| (r = decode_attrib(iqueue, &a)) != 0) ------------------ | Branch (1033:6): [True: 158, False: 17] ------------------ 1034| 184| fatal_fr(r, "parse"); ------------------ | | 146| 184|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1035| | 1036| 17| debug("request %u: fsetstat handle %d", id, handle); ------------------ | | 111| 17|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 1037| 17| fd = handle_to_fd(handle); 1038| 17| if (fd < 0) ------------------ | Branch (1038:6): [True: 17, False: 0] ------------------ 1039| 17| status = SSH2_FX_FAILURE; ------------------ | | 91| 17|#define SSH2_FX_FAILURE 4 ------------------ 1040| 0| else { 1041| 0| char *name = handle_to_name(handle); 1042| | 1043| 0| if (a.flags & SSH2_FILEXFER_ATTR_SIZE) { ------------------ | | 68| 0|#define SSH2_FILEXFER_ATTR_SIZE 0x00000001 ------------------ | Branch (1043:7): [True: 0, False: 0] ------------------ 1044| 0| logit("set \"%s\" size %llu", ------------------ | | 113| 0|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1045| 0| name, (unsigned long long)a.size); 1046| 0| r = ftruncate(fd, a.size); 1047| 0| if (r == -1) ------------------ | Branch (1047:8): [True: 0, False: 0] ------------------ 1048| 0| status = errno_to_portable(errno); 1049| 0| } 1050| 0| if (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) { ------------------ | | 70| 0|#define SSH2_FILEXFER_ATTR_PERMISSIONS 0x00000004 ------------------ | Branch (1050:7): [True: 0, False: 0] ------------------ 1051| 0| logit("set \"%s\" mode %04o", name, a.perm); ------------------ | | 113| 0|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1052| 0|#ifdef HAVE_FCHMOD 1053| 0| r = fchmod(fd, a.perm & 07777); 1054| |#else 1055| | r = chmod(name, a.perm & 07777); 1056| |#endif 1057| 0| if (r == -1) ------------------ | Branch (1057:8): [True: 0, False: 0] ------------------ 1058| 0| status = errno_to_portable(errno); 1059| 0| } 1060| 0| if (a.flags & SSH2_FILEXFER_ATTR_ACMODTIME) { ------------------ | | 71| 0|#define SSH2_FILEXFER_ATTR_ACMODTIME 0x00000008 ------------------ | Branch (1060:7): [True: 0, False: 0] ------------------ 1061| 0| char buf[64]; 1062| 0| time_t t = a.mtime; 1063| | 1064| 0| strftime(buf, sizeof(buf), "%Y%m%d-%H:%M:%S", 1065| 0| localtime(&t)); 1066| 0| logit("set \"%s\" modtime %s", name, buf); ------------------ | | 113| 0|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1067| 0|#ifdef HAVE_FUTIMES 1068| 0| r = futimes(fd, attrib_to_tv(&a)); 1069| |#else 1070| | r = utimes(name, attrib_to_tv(&a)); 1071| |#endif 1072| 0| if (r == -1) ------------------ | Branch (1072:8): [True: 0, False: 0] ------------------ 1073| 0| status = errno_to_portable(errno); 1074| 0| } 1075| 0| if (a.flags & SSH2_FILEXFER_ATTR_UIDGID) { ------------------ | | 69| 0|#define SSH2_FILEXFER_ATTR_UIDGID 0x00000002 ------------------ | Branch (1075:7): [True: 0, False: 0] ------------------ 1076| 0| logit("set \"%s\" owner %lu group %lu", name, ------------------ | | 113| 0|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1077| 0| (u_long)a.uid, (u_long)a.gid); 1078| 0|#ifdef HAVE_FCHOWN 1079| 0| r = fchown(fd, a.uid, a.gid); 1080| |#else 1081| | r = chown(name, a.uid, a.gid); 1082| |#endif 1083| 0| if (r == -1) ------------------ | Branch (1083:8): [True: 0, False: 0] ------------------ 1084| 0| status = errno_to_portable(errno); 1085| 0| } 1086| 0| } 1087| 17| send_status(id, status); 1088| 17|} sftp_server_msg_fuzz_helper.c:process_opendir: 1092| 13|{ 1093| 13| DIR *dirp = NULL; 1094| 13| char *path; 1095| 13| int r, handle, status = SSH2_FX_FAILURE; ------------------ | | 91| 13|#define SSH2_FX_FAILURE 4 ------------------ 1096| | 1097| 13| if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0) ------------------ | Branch (1097:6): [True: 4, False: 9] ------------------ 1098| 4| fatal_fr(r, "parse"); ------------------ | | 146| 4|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1099| | 1100| 9| debug3("request %u: opendir", id); ------------------ | | 109| 9|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1101| 9| logit("opendir \"%s\"", path); ------------------ | | 113| 9|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1102| 9| dirp = opendir(path); 1103| 9| if (dirp == NULL) { ------------------ | Branch (1103:6): [True: 5, False: 4] ------------------ 1104| 5| status = errno_to_portable(errno); 1105| 5| } else { 1106| 4| handle = handle_new(HANDLE_DIR, path, 0, 0, dirp); 1107| 4| if (handle < 0) { ------------------ | Branch (1107:7): [True: 0, False: 4] ------------------ 1108| 0| closedir(dirp); 1109| 4| } else { 1110| 4| send_handle(id, handle); 1111| 4| status = SSH2_FX_OK; ------------------ | | 87| 4|#define SSH2_FX_OK 0 ------------------ 1112| 4| } 1113| | 1114| 4| } 1115| 9| if (status != SSH2_FX_OK) ------------------ | | 87| 9|#define SSH2_FX_OK 0 ------------------ | Branch (1115:6): [True: 5, False: 4] ------------------ 1116| 5| send_status(id, status); 1117| 9| free(path); 1118| 9|} sftp_server_msg_fuzz_helper.c:process_readdir: 1122| 21|{ 1123| 21| DIR *dirp; 1124| 21| struct dirent *dp; 1125| 21| char *path; 1126| 21| int r, handle; 1127| | 1128| 21| if ((r = get_handle(iqueue, &handle)) != 0) ------------------ | Branch (1128:6): [True: 7, False: 14] ------------------ 1129| 7| fatal_fr(r, "parse"); ------------------ | | 146| 7|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1130| | 1131| 14| debug("request %u: readdir \"%s\" (handle %d)", id, ------------------ | | 111| 14|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 1132| 14| handle_to_name(handle), handle); 1133| 14| dirp = handle_to_dir(handle); 1134| 14| path = handle_to_name(handle); 1135| 14| if (dirp == NULL || path == NULL) { ------------------ | Branch (1135:6): [True: 14, False: 0] | Branch (1135:22): [True: 0, False: 0] ------------------ 1136| 14| send_status(id, SSH2_FX_FAILURE); ------------------ | | 91| 14|#define SSH2_FX_FAILURE 4 ------------------ 1137| 14| } else { 1138| 0| struct stat st; 1139| 0| char *pathname; 1140| 0| Stat *stats; 1141| 0| int nstats = 10, count = 0, i; 1142| | 1143| 0| stats = xcalloc(nstats, sizeof(Stat)); 1144| 0| while ((dp = readdir(dirp)) != NULL) { ------------------ | Branch (1144:10): [True: 0, False: 0] ------------------ 1145| 0| if (count >= nstats) { ------------------ | Branch (1145:8): [True: 0, False: 0] ------------------ 1146| 0| nstats *= 2; 1147| 0| stats = xreallocarray(stats, nstats, sizeof(Stat)); 1148| 0| } 1149| 0| xasprintf(&pathname, "%s%s%s", path, 1150| 0| strcmp(path, "/") ? "/" : "", dp->d_name); ------------------ | Branch (1150:8): [True: 0, False: 0] ------------------ 1151| 0| r = lstat(pathname, &st); 1152| 0| free(pathname); 1153| 0| if (r == -1) ------------------ | Branch (1153:8): [True: 0, False: 0] ------------------ 1154| 0| continue; 1155| 0| stat_to_attrib(&st, &(stats[count].attrib)); 1156| 0| stats[count].name = xstrdup(dp->d_name); 1157| 0| stats[count].long_name = ls_file(dp->d_name, &st, 1158| 0| 0, 0, NULL, NULL); 1159| 0| count++; 1160| | /* send up to 100 entries in one message */ 1161| | /* XXX check packet size instead */ 1162| 0| if (count == 100) ------------------ | Branch (1162:8): [True: 0, False: 0] ------------------ 1163| 0| break; 1164| 0| } 1165| 0| if (count > 0) { ------------------ | Branch (1165:7): [True: 0, False: 0] ------------------ 1166| 0| send_names(id, count, stats); 1167| 0| for (i = 0; i < count; i++) { ------------------ | Branch (1167:16): [True: 0, False: 0] ------------------ 1168| 0| free(stats[i].name); 1169| 0| free(stats[i].long_name); 1170| 0| } 1171| 0| } else { 1172| 0| send_status(id, SSH2_FX_EOF); ------------------ | | 88| 0|#define SSH2_FX_EOF 1 ------------------ 1173| 0| } 1174| 0| free(stats); 1175| 0| } 1176| 14|} sftp_server_msg_fuzz_helper.c:handle_to_dir: 397| 14|{ 398| 14| if (handle_is_ok(handle, HANDLE_DIR)) ------------------ | Branch (398:6): [True: 0, False: 14] ------------------ 399| 0| return handles[handle].dirp; 400| 14| return NULL; 401| 14|} sftp_server_msg_fuzz_helper.c:send_names: 609| 124|{ 610| 124| struct sshbuf *msg; 611| 124| int i, r; 612| | 613| 124| if ((msg = sshbuf_new()) == NULL) ------------------ | Branch (613:6): [True: 0, False: 124] ------------------ 614| 0| fatal_f("sshbuf_new failed"); ------------------ | | 126| 0|#define fatal_f(...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 615| 124| if ((r = sshbuf_put_u8(msg, SSH2_FXP_NAME)) != 0 || ------------------ | | 61| 124|#define SSH2_FXP_NAME 104 ------------------ | Branch (615:6): [True: 0, False: 124] ------------------ 616| 124| (r = sshbuf_put_u32(msg, id)) != 0 || ------------------ | Branch (616:6): [True: 0, False: 124] ------------------ 617| 124| (r = sshbuf_put_u32(msg, count)) != 0) ------------------ | Branch (617:6): [True: 0, False: 124] ------------------ 618| 0| fatal_fr(r, "compose"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 619| 124| debug("request %u: sent names count %d", id, count); ------------------ | | 111| 124|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 620| 248| for (i = 0; i < count; i++) { ------------------ | Branch (620:14): [True: 124, False: 124] ------------------ 621| 124| if ((r = sshbuf_put_cstring(msg, stats[i].name)) != 0 || ------------------ | Branch (621:7): [True: 0, False: 124] ------------------ 622| 124| (r = sshbuf_put_cstring(msg, stats[i].long_name)) != 0 || ------------------ | Branch (622:7): [True: 0, False: 124] ------------------ 623| 124| (r = encode_attrib(msg, &stats[i].attrib)) != 0) ------------------ | Branch (623:7): [True: 0, False: 124] ------------------ 624| 0| fatal_fr(r, "compose filenames/attrib"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 625| 124| } 626| 124| send_msg(msg); 627| 124| sshbuf_free(msg); 628| 124|} sftp_server_msg_fuzz_helper.c:process_remove: 1180| 19|{ 1181| 19| char *name; 1182| 19| int r, status = SSH2_FX_FAILURE; ------------------ | | 91| 19|#define SSH2_FX_FAILURE 4 ------------------ 1183| | 1184| 19| if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0) ------------------ | Branch (1184:6): [True: 8, False: 11] ------------------ 1185| 8| fatal_fr(r, "parse"); ------------------ | | 146| 8|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1186| | 1187| 11| debug3("request %u: remove", id); ------------------ | | 109| 11|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1188| 11| logit("remove name \"%s\"", name); ------------------ | | 113| 11|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1189| 11| r = unlink(name); 1190| 11| status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; ------------------ | | 87| 11|#define SSH2_FX_OK 0 ------------------ | Branch (1190:11): [True: 11, False: 0] ------------------ 1191| 11| send_status(id, status); 1192| 11| free(name); 1193| 11|} sftp_server_msg_fuzz_helper.c:process_mkdir: 1197| 49|{ 1198| 49| Attrib a; 1199| 49| char *name; 1200| 49| int r, mode, status = SSH2_FX_FAILURE; ------------------ | | 91| 49|#define SSH2_FX_FAILURE 4 ------------------ 1201| | 1202| 49| if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 || ------------------ | Branch (1202:6): [True: 8, False: 41] ------------------ 1203| 41| (r = decode_attrib(iqueue, &a)) != 0) ------------------ | Branch (1203:6): [True: 32, False: 9] ------------------ 1204| 40| fatal_fr(r, "parse"); ------------------ | | 146| 40|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1205| | 1206| 9| mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? ------------------ | | 70| 9|#define SSH2_FILEXFER_ATTR_PERMISSIONS 0x00000004 ------------------ | Branch (1206:9): [True: 2, False: 7] ------------------ 1207| 7| a.perm & 07777 : 0777; 1208| 9| debug3("request %u: mkdir", id); ------------------ | | 109| 9|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1209| 9| logit("mkdir name \"%s\" mode 0%o", name, mode); ------------------ | | 113| 9|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1210| 9| r = mkdir(name, mode); 1211| 9| status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; ------------------ | | 87| 11|#define SSH2_FX_OK 0 ------------------ | Branch (1211:11): [True: 7, False: 2] ------------------ 1212| 9| send_status(id, status); 1213| 9| free(name); 1214| 9|} sftp_server_msg_fuzz_helper.c:process_rmdir: 1218| 11|{ 1219| 11| char *name; 1220| 11| int r, status; 1221| | 1222| 11| if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0) ------------------ | Branch (1222:6): [True: 3, False: 8] ------------------ 1223| 3| fatal_fr(r, "parse"); ------------------ | | 146| 3|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1224| | 1225| 8| debug3("request %u: rmdir", id); ------------------ | | 109| 8|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1226| 8| logit("rmdir name \"%s\"", name); ------------------ | | 113| 8|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1227| 8| r = rmdir(name); 1228| 8| status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; ------------------ | | 87| 8|#define SSH2_FX_OK 0 ------------------ | Branch (1228:11): [True: 8, False: 0] ------------------ 1229| 8| send_status(id, status); 1230| 8| free(name); 1231| 8|} sftp_server_msg_fuzz_helper.c:process_realpath: 1235| 143|{ 1236| 143| char resolvedname[PATH_MAX]; 1237| 143| char *path; 1238| 143| int r; 1239| | 1240| 143| if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0) ------------------ | Branch (1240:6): [True: 9, False: 134] ------------------ 1241| 9| fatal_fr(r, "parse"); ------------------ | | 146| 9|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1242| | 1243| 134| if (path[0] == '\0') { ------------------ | Branch (1243:6): [True: 1, False: 133] ------------------ 1244| 1| free(path); 1245| 1| path = xstrdup("."); 1246| 1| } 1247| 134| debug3("request %u: realpath", id); ------------------ | | 109| 134|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1248| 134| verbose("realpath \"%s\"", path); ------------------ | | 112| 134|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 1249| 134| if (sftp_realpath(path, resolvedname) == NULL) { ------------------ | Branch (1249:6): [True: 51, False: 83] ------------------ 1250| 51| send_status(id, errno_to_portable(errno)); 1251| 83| } else { 1252| 83| Stat s; 1253| 83| attrib_clear(&s.attrib); 1254| 83| s.name = s.long_name = resolvedname; 1255| 83| send_names(id, 1, &s); 1256| 83| } 1257| 134| free(path); 1258| 134|} sftp_server_msg_fuzz_helper.c:process_stat: 918| 6|{ 919| 6| process_do_stat(id, 0); 920| 6|} sftp_server_msg_fuzz_helper.c:process_rename: 1262| 19|{ 1263| 19| char *oldpath, *newpath; 1264| 19| int r, status; 1265| 19| struct stat sb; 1266| | 1267| 19| if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 || ------------------ | Branch (1267:6): [True: 6, False: 13] ------------------ 1268| 13| (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0) ------------------ | Branch (1268:6): [True: 2, False: 11] ------------------ 1269| 8| fatal_fr(r, "parse"); ------------------ | | 146| 8|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1270| | 1271| 11| debug3("request %u: rename", id); ------------------ | | 109| 11|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1272| 11| logit("rename old \"%s\" new \"%s\"", oldpath, newpath); ------------------ | | 113| 11|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1273| 11| status = SSH2_FX_FAILURE; ------------------ | | 91| 11|#define SSH2_FX_FAILURE 4 ------------------ 1274| 11| if (lstat(oldpath, &sb) == -1) ------------------ | Branch (1274:6): [True: 4, False: 7] ------------------ 1275| 4| status = errno_to_portable(errno); 1276| 7| else if (S_ISREG(sb.st_mode)) { ------------------ | Branch (1276:11): [True: 0, False: 7] ------------------ 1277| | /* Race-free rename of regular files */ 1278| 0| if (link(oldpath, newpath) == -1) { ------------------ | Branch (1278:7): [True: 0, False: 0] ------------------ 1279| 0| if (errno == EOPNOTSUPP || errno == ENOSYS ------------------ | Branch (1279:8): [True: 0, False: 0] | Branch (1279:31): [True: 0, False: 0] ------------------ 1280| 0|#ifdef EXDEV 1281| 0| || errno == EXDEV ------------------ | Branch (1281:11): [True: 0, False: 0] ------------------ 1282| 0|#endif 1283| 0|#ifdef LINK_OPNOTSUPP_ERRNO 1284| 0| || errno == LINK_OPNOTSUPP_ERRNO ------------------ | | 1774| 0|#define LINK_OPNOTSUPP_ERRNO EPERM ------------------ | Branch (1284:11): [True: 0, False: 0] ------------------ 1285| 0|#endif 1286| 0| ) { 1287| 0| struct stat st; 1288| | 1289| | /* 1290| | * fs doesn't support links, so fall back to 1291| | * stat+rename. This is racy. 1292| | */ 1293| 0| if (stat(newpath, &st) == -1) { ------------------ | Branch (1293:9): [True: 0, False: 0] ------------------ 1294| 0| if (rename(oldpath, newpath) == -1) ------------------ | Branch (1294:10): [True: 0, False: 0] ------------------ 1295| 0| status = 1296| 0| errno_to_portable(errno); 1297| 0| else 1298| 0| status = SSH2_FX_OK; ------------------ | | 87| 0|#define SSH2_FX_OK 0 ------------------ 1299| 0| } 1300| 0| } else { 1301| 0| status = errno_to_portable(errno); 1302| 0| } 1303| 0| } else if (unlink(oldpath) == -1) { ------------------ | Branch (1303:14): [True: 0, False: 0] ------------------ 1304| 0| status = errno_to_portable(errno); 1305| | /* clean spare link */ 1306| 0| unlink(newpath); 1307| 0| } else 1308| 0| status = SSH2_FX_OK; ------------------ | | 87| 0|#define SSH2_FX_OK 0 ------------------ 1309| 7| } else if (stat(newpath, &sb) == -1) { ------------------ | Branch (1309:13): [True: 6, False: 1] ------------------ 1310| 6| if (rename(oldpath, newpath) == -1) ------------------ | Branch (1310:7): [True: 5, False: 1] ------------------ 1311| 5| status = errno_to_portable(errno); 1312| 1| else 1313| 1| status = SSH2_FX_OK; ------------------ | | 87| 1|#define SSH2_FX_OK 0 ------------------ 1314| 6| } 1315| 11| send_status(id, status); 1316| 11| free(oldpath); 1317| 11| free(newpath); 1318| 11|} sftp_server_msg_fuzz_helper.c:process_readlink: 1322| 9|{ 1323| 9| int r, len; 1324| 9| char buf[PATH_MAX]; 1325| 9| char *path; 1326| | 1327| 9| if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0) ------------------ | Branch (1327:6): [True: 3, False: 6] ------------------ 1328| 3| fatal_fr(r, "parse"); ------------------ | | 146| 3|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1329| | 1330| 6| debug3("request %u: readlink", id); ------------------ | | 109| 6|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1331| 6| verbose("readlink \"%s\"", path); ------------------ | | 112| 6|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 1332| 6| if ((len = readlink(path, buf, sizeof(buf) - 1)) == -1) ------------------ | Branch (1332:6): [True: 5, False: 1] ------------------ 1333| 5| send_status(id, errno_to_portable(errno)); 1334| 1| else { 1335| 1| Stat s; 1336| | 1337| 1| buf[len] = '\0'; 1338| 1| attrib_clear(&s.attrib); 1339| 1| s.name = s.long_name = buf; 1340| 1| send_names(id, 1, &s); 1341| 1| } 1342| 6| free(path); 1343| 6|} sftp_server_msg_fuzz_helper.c:process_symlink: 1347| 11|{ 1348| 11| char *oldpath, *newpath; 1349| 11| int r, status; 1350| | 1351| 11| if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 || ------------------ | Branch (1351:6): [True: 2, False: 9] ------------------ 1352| 9| (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0) ------------------ | Branch (1352:6): [True: 2, False: 7] ------------------ 1353| 4| fatal_fr(r, "parse"); ------------------ | | 146| 4|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1354| | 1355| 7| debug3("request %u: symlink", id); ------------------ | | 109| 7|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1356| 7| logit("symlink old \"%s\" new \"%s\"", oldpath, newpath); ------------------ | | 113| 7|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1357| | /* this will fail if 'newpath' exists */ 1358| 7| r = symlink(oldpath, newpath); 1359| 7| status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; ------------------ | | 87| 9|#define SSH2_FX_OK 0 ------------------ | Branch (1359:11): [True: 5, False: 2] ------------------ 1360| 7| send_status(id, status); 1361| 7| free(oldpath); 1362| 7| free(newpath); 1363| 7|} sftp_server_msg_fuzz_helper.c:process_extended_posix_rename: 1367| 6|{ 1368| 6| char *oldpath, *newpath; 1369| 6| int r, status; 1370| | 1371| 6| if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 || ------------------ | Branch (1371:6): [True: 2, False: 4] ------------------ 1372| 4| (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0) ------------------ | Branch (1372:6): [True: 2, False: 2] ------------------ 1373| 4| fatal_fr(r, "parse"); ------------------ | | 146| 4|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1374| | 1375| 2| debug3("request %u: posix-rename", id); ------------------ | | 109| 2|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1376| 2| logit("posix-rename old \"%s\" new \"%s\"", oldpath, newpath); ------------------ | | 113| 2|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1377| 2| r = rename(oldpath, newpath); 1378| 2| status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; ------------------ | | 87| 2|#define SSH2_FX_OK 0 ------------------ | Branch (1378:11): [True: 2, False: 0] ------------------ 1379| 2| send_status(id, status); 1380| 2| free(oldpath); 1381| 2| free(newpath); 1382| 2|} sftp_server_msg_fuzz_helper.c:process_extended_statvfs: 1386| 7|{ 1387| 7| char *path; 1388| 7| struct statvfs st; 1389| 7| int r; 1390| | 1391| 7| if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0) ------------------ | Branch (1391:6): [True: 3, False: 4] ------------------ 1392| 3| fatal_fr(r, "parse"); ------------------ | | 146| 3|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1393| 4| debug3("request %u: statvfs", id); ------------------ | | 109| 4|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1394| 4| logit("statvfs \"%s\"", path); ------------------ | | 113| 4|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1395| | 1396| 4| if (statvfs(path, &st) != 0) ------------------ | Branch (1396:6): [True: 3, False: 1] ------------------ 1397| 3| send_status(id, errno_to_portable(errno)); 1398| 1| else 1399| 1| send_statvfs(id, &st); 1400| 4| free(path); 1401| 4|} sftp_server_msg_fuzz_helper.c:send_statvfs: 649| 1|{ 650| 1| struct sshbuf *msg; 651| 1| uint64_t flag; 652| 1| int r; 653| | 654| 1| flag = (st->f_flag & ST_RDONLY) ? SSH2_FXE_STATVFS_ST_RDONLY : 0; ------------------ | | 83| 0|#define SSH2_FXE_STATVFS_ST_RDONLY 0x00000001 ------------------ | Branch (654:9): [True: 0, False: 1] ------------------ 655| 1| flag |= (st->f_flag & ST_NOSUID) ? SSH2_FXE_STATVFS_ST_NOSUID : 0; ------------------ | | 84| 0|#define SSH2_FXE_STATVFS_ST_NOSUID 0x00000002 ------------------ | Branch (655:10): [True: 0, False: 1] ------------------ 656| | 657| 1| if ((msg = sshbuf_new()) == NULL) ------------------ | Branch (657:6): [True: 0, False: 1] ------------------ 658| 0| fatal_f("sshbuf_new failed"); ------------------ | | 126| 0|#define fatal_f(...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 659| 1| if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED_REPLY)) != 0 || ------------------ | | 65| 1|#define SSH2_FXP_EXTENDED_REPLY 201 ------------------ | Branch (659:6): [True: 0, False: 1] ------------------ 660| 1| (r = sshbuf_put_u32(msg, id)) != 0 || ------------------ | Branch (660:6): [True: 0, False: 1] ------------------ 661| 1| (r = sshbuf_put_u64(msg, st->f_bsize)) != 0 || ------------------ | Branch (661:6): [True: 0, False: 1] ------------------ 662| 1| (r = sshbuf_put_u64(msg, st->f_frsize)) != 0 || ------------------ | Branch (662:6): [True: 0, False: 1] ------------------ 663| 1| (r = sshbuf_put_u64(msg, st->f_blocks)) != 0 || ------------------ | Branch (663:6): [True: 0, False: 1] ------------------ 664| 1| (r = sshbuf_put_u64(msg, st->f_bfree)) != 0 || ------------------ | Branch (664:6): [True: 0, False: 1] ------------------ 665| 1| (r = sshbuf_put_u64(msg, st->f_bavail)) != 0 || ------------------ | Branch (665:6): [True: 0, False: 1] ------------------ 666| 1| (r = sshbuf_put_u64(msg, st->f_files)) != 0 || ------------------ | Branch (666:6): [True: 0, False: 1] ------------------ 667| 1| (r = sshbuf_put_u64(msg, st->f_ffree)) != 0 || ------------------ | Branch (667:6): [True: 0, False: 1] ------------------ 668| 1| (r = sshbuf_put_u64(msg, st->f_favail)) != 0 || ------------------ | Branch (668:6): [True: 0, False: 1] ------------------ 669| 1| (r = sshbuf_put_u64(msg, FSID_TO_ULONG(st->f_fsid))) != 0 || ------------------ | | 807| 1|# define FSID_TO_ULONG(f) ((f)) ------------------ | Branch (669:6): [True: 0, False: 1] ------------------ 670| 1| (r = sshbuf_put_u64(msg, flag)) != 0 || ------------------ | Branch (670:6): [True: 0, False: 1] ------------------ 671| 1| (r = sshbuf_put_u64(msg, st->f_namemax)) != 0) ------------------ | Branch (671:6): [True: 0, False: 1] ------------------ 672| 0| fatal_fr(r, "compose"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 673| 1| send_msg(msg); 674| 1| sshbuf_free(msg); 675| 1|} sftp_server_msg_fuzz_helper.c:process_extended_fstatvfs: 1405| 3|{ 1406| 3| int r, handle, fd; 1407| 3| struct statvfs st; 1408| | 1409| 3| if ((r = get_handle(iqueue, &handle)) != 0) ------------------ | Branch (1409:6): [True: 2, False: 1] ------------------ 1410| 2| fatal_fr(r, "parse"); ------------------ | | 146| 2|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1411| 1| debug("request %u: fstatvfs \"%s\" (handle %u)", ------------------ | | 111| 1|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 1412| 1| id, handle_to_name(handle), handle); 1413| 1| if ((fd = handle_to_fd(handle)) < 0) { ------------------ | Branch (1413:6): [True: 1, False: 0] ------------------ 1414| 1| send_status(id, SSH2_FX_FAILURE); ------------------ | | 91| 1|#define SSH2_FX_FAILURE 4 ------------------ 1415| 1| return; 1416| 1| } 1417| 0| if (fstatvfs(fd, &st) != 0) ------------------ | Branch (1417:6): [True: 0, False: 0] ------------------ 1418| 0| send_status(id, errno_to_portable(errno)); 1419| 0| else 1420| 0| send_statvfs(id, &st); 1421| 0|} sftp_server_msg_fuzz_helper.c:process_extended_hardlink: 1425| 6|{ 1426| 6| char *oldpath, *newpath; 1427| 6| int r, status; 1428| | 1429| 6| if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 || ------------------ | Branch (1429:6): [True: 2, False: 4] ------------------ 1430| 4| (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0) ------------------ | Branch (1430:6): [True: 2, False: 2] ------------------ 1431| 4| fatal_fr(r, "parse"); ------------------ | | 146| 4|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1432| | 1433| 2| debug3("request %u: hardlink", id); ------------------ | | 109| 2|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1434| 2| logit("hardlink old \"%s\" new \"%s\"", oldpath, newpath); ------------------ | | 113| 2|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1435| 2| r = link(oldpath, newpath); 1436| 2| status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; ------------------ | | 87| 2|#define SSH2_FX_OK 0 ------------------ | Branch (1436:11): [True: 2, False: 0] ------------------ 1437| 2| send_status(id, status); 1438| 2| free(oldpath); 1439| 2| free(newpath); 1440| 2|} sftp_server_msg_fuzz_helper.c:process_extended_fsync: 1444| 3|{ 1445| 3| int handle, fd, r, status = SSH2_FX_OP_UNSUPPORTED; ------------------ | | 95| 3|#define SSH2_FX_OP_UNSUPPORTED 8 ------------------ 1446| | 1447| 3| if ((r = get_handle(iqueue, &handle)) != 0) ------------------ | Branch (1447:6): [True: 2, False: 1] ------------------ 1448| 2| fatal_fr(r, "parse"); ------------------ | | 146| 2|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1449| 1| debug3("request %u: fsync (handle %u)", id, handle); ------------------ | | 109| 1|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1450| 1| verbose("fsync \"%s\"", handle_to_name(handle)); ------------------ | | 112| 1|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 1451| 1| if ((fd = handle_to_fd(handle)) < 0) ------------------ | Branch (1451:6): [True: 1, False: 0] ------------------ 1452| 1| status = SSH2_FX_NO_SUCH_FILE; ------------------ | | 89| 1|#define SSH2_FX_NO_SUCH_FILE 2 ------------------ 1453| 0| else if (handle_is_ok(handle, HANDLE_FILE)) { ------------------ | Branch (1453:11): [True: 0, False: 0] ------------------ 1454| 0| r = fsync(fd); 1455| 0| status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; ------------------ | | 87| 0|#define SSH2_FX_OK 0 ------------------ | Branch (1455:12): [True: 0, False: 0] ------------------ 1456| 0| } 1457| 1| send_status(id, status); 1458| 1|} sftp_server_msg_fuzz_helper.c:process_extended_lsetstat: 1462| 16|{ 1463| 16| Attrib a; 1464| 16| char *name; 1465| 16| int r, status = SSH2_FX_OK; ------------------ | | 87| 16|#define SSH2_FX_OK 0 ------------------ 1466| | 1467| 16| if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 || ------------------ | Branch (1467:6): [True: 2, False: 14] ------------------ 1468| 14| (r = decode_attrib(iqueue, &a)) != 0) ------------------ | Branch (1468:6): [True: 2, False: 12] ------------------ 1469| 4| fatal_fr(r, "parse"); ------------------ | | 146| 4|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1470| | 1471| 12| debug("request %u: lsetstat name \"%s\"", id, name); ------------------ | | 111| 12|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 1472| 12| if (a.flags & SSH2_FILEXFER_ATTR_SIZE) { ------------------ | | 68| 12|#define SSH2_FILEXFER_ATTR_SIZE 0x00000001 ------------------ | Branch (1472:6): [True: 1, False: 11] ------------------ 1473| | /* nonsensical for links */ 1474| 1| status = SSH2_FX_BAD_MESSAGE; ------------------ | | 92| 1|#define SSH2_FX_BAD_MESSAGE 5 ------------------ 1475| 1| goto out; 1476| 1| } 1477| 11| if (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) { ------------------ | | 70| 11|#define SSH2_FILEXFER_ATTR_PERMISSIONS 0x00000004 ------------------ | Branch (1477:6): [True: 2, False: 9] ------------------ 1478| 2| logit("set \"%s\" mode %04o", name, a.perm); ------------------ | | 113| 2|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1479| 2| r = fchmodat(AT_FDCWD, name, 1480| 2| a.perm & 07777, AT_SYMLINK_NOFOLLOW); 1481| 2| if (r == -1) ------------------ | Branch (1481:7): [True: 2, False: 0] ------------------ 1482| 2| status = errno_to_portable(errno); 1483| 2| } 1484| 11| if (a.flags & SSH2_FILEXFER_ATTR_ACMODTIME) { ------------------ | | 71| 11|#define SSH2_FILEXFER_ATTR_ACMODTIME 0x00000008 ------------------ | Branch (1484:6): [True: 4, False: 7] ------------------ 1485| 4| char buf[64]; 1486| 4| time_t t = a.mtime; 1487| | 1488| 4| strftime(buf, sizeof(buf), "%Y%m%d-%H:%M:%S", 1489| 4| localtime(&t)); 1490| 4| logit("set \"%s\" modtime %s", name, buf); ------------------ | | 113| 4|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1491| 4| r = utimensat(AT_FDCWD, name, 1492| 4| attrib_to_ts(&a), AT_SYMLINK_NOFOLLOW); 1493| 4| if (r == -1) ------------------ | Branch (1493:7): [True: 2, False: 2] ------------------ 1494| 2| status = errno_to_portable(errno); 1495| 4| } 1496| 11| if (a.flags & SSH2_FILEXFER_ATTR_UIDGID) { ------------------ | | 69| 11|#define SSH2_FILEXFER_ATTR_UIDGID 0x00000002 ------------------ | Branch (1496:6): [True: 5, False: 6] ------------------ 1497| 5| logit("set \"%s\" owner %lu group %lu", name, ------------------ | | 113| 5|#define logit(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_INFO, NULL, __VA_ARGS__) ------------------ 1498| 5| (u_long)a.uid, (u_long)a.gid); 1499| 5| r = fchownat(AT_FDCWD, name, a.uid, a.gid, 1500| 5| AT_SYMLINK_NOFOLLOW); 1501| 5| if (r == -1) ------------------ | Branch (1501:7): [True: 2, False: 3] ------------------ 1502| 2| status = errno_to_portable(errno); 1503| 5| } 1504| 12| out: 1505| 12| send_status(id, status); 1506| 12| free(name); 1507| 12|} sftp_server_msg_fuzz_helper.c:attrib_to_ts: 968| 4|{ 969| 4| static struct timespec ts[2]; 970| | 971| 4| ts[0].tv_sec = a->atime; 972| 4| ts[0].tv_nsec = 0; 973| 4| ts[1].tv_sec = a->mtime; 974| 4| ts[1].tv_nsec = 0; 975| 4| return ts; 976| 4|} sftp_server_msg_fuzz_helper.c:process_extended_limits: 1511| 1|{ 1512| 1| struct sshbuf *msg; 1513| 1| int r; 1514| 1| uint64_t nfiles = 0; 1515| 1|#if defined(HAVE_GETRLIMIT) && defined(RLIMIT_NOFILE) 1516| 1| struct rlimit rlim; 1517| 1|#endif 1518| | 1519| 1| debug("request %u: limits", id); ------------------ | | 111| 1|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 1520| | 1521| 1|#if defined(HAVE_GETRLIMIT) && defined(RLIMIT_NOFILE) 1522| 1| if (getrlimit(RLIMIT_NOFILE, &rlim) != -1 && rlim.rlim_cur > 5) ------------------ | Branch (1522:6): [True: 1, False: 0] | Branch (1522:47): [True: 1, False: 0] ------------------ 1523| 1| nfiles = rlim.rlim_cur - 5; /* stdio(3) + syslog + spare */ 1524| 1|#endif 1525| | 1526| 1| if ((msg = sshbuf_new()) == NULL) ------------------ | Branch (1526:6): [True: 0, False: 1] ------------------ 1527| 0| fatal_f("sshbuf_new failed"); ------------------ | | 126| 0|#define fatal_f(...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 1528| 1| if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED_REPLY)) != 0 || ------------------ | | 65| 1|#define SSH2_FXP_EXTENDED_REPLY 201 ------------------ | Branch (1528:6): [True: 0, False: 1] ------------------ 1529| 1| (r = sshbuf_put_u32(msg, id)) != 0 || ------------------ | Branch (1529:6): [True: 0, False: 1] ------------------ 1530| | /* max-packet-length */ 1531| 1| (r = sshbuf_put_u64(msg, SFTP_MAX_MSG_LENGTH)) != 0 || ------------------ | | 29| 1|#define SFTP_MAX_MSG_LENGTH (256 * 1024) ------------------ | Branch (1531:6): [True: 0, False: 1] ------------------ 1532| | /* max-read-length */ 1533| 1| (r = sshbuf_put_u64(msg, SFTP_MAX_READ_LENGTH)) != 0 || ------------------ | | 55| 1|#define SFTP_MAX_READ_LENGTH (SFTP_MAX_MSG_LENGTH - 1024) | | ------------------ | | | | 29| 1|#define SFTP_MAX_MSG_LENGTH (256 * 1024) | | ------------------ ------------------ | Branch (1533:6): [True: 0, False: 1] ------------------ 1534| | /* max-write-length */ 1535| 1| (r = sshbuf_put_u64(msg, SFTP_MAX_MSG_LENGTH - 1024)) != 0 || ------------------ | | 29| 1|#define SFTP_MAX_MSG_LENGTH (256 * 1024) ------------------ | Branch (1535:6): [True: 0, False: 1] ------------------ 1536| | /* max-open-handles */ 1537| 1| (r = sshbuf_put_u64(msg, nfiles)) != 0) ------------------ | Branch (1537:6): [True: 0, False: 1] ------------------ 1538| 0| fatal_fr(r, "compose"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1539| 1| send_msg(msg); 1540| 1| sshbuf_free(msg); 1541| 1|} sftp_server_msg_fuzz_helper.c:process_extended_expand: 1545| 207|{ 1546| 207| char cwd[PATH_MAX], resolvedname[PATH_MAX]; 1547| 207| char *path, *npath; 1548| 207| int r; 1549| 207| Stat s; 1550| | 1551| 207| if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0) ------------------ | Branch (1551:6): [True: 2, False: 205] ------------------ 1552| 2| fatal_fr(r, "parse"); ------------------ | | 146| 2|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1553| 205| if (getcwd(cwd, sizeof(cwd)) == NULL) { ------------------ | Branch (1553:6): [True: 0, False: 205] ------------------ 1554| 0| send_status(id, errno_to_portable(errno)); 1555| 0| goto out; 1556| 0| } 1557| | 1558| 205| debug3("request %u: expand, original \"%s\"", id, path); ------------------ | | 109| 205|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1559| 205| if (path[0] == '\0') { ------------------ | Branch (1559:6): [True: 1, False: 204] ------------------ 1560| | /* empty path */ 1561| 1| free(path); 1562| 1| path = xstrdup("."); 1563| 204| } else if (*path == '~') { ------------------ | Branch (1563:13): [True: 155, False: 49] ------------------ 1564| | /* ~ expand path */ 1565| | /* Special-case for "~" and "~/" to respect homedir flag */ 1566| 155| if (strcmp(path, "~") == 0) { ------------------ | Branch (1566:7): [True: 1, False: 154] ------------------ 1567| 1| free(path); 1568| 1| path = xstrdup(cwd); 1569| 154| } else if (strncmp(path, "~/", 2) == 0) { ------------------ | Branch (1569:14): [True: 5, False: 149] ------------------ 1570| 5| npath = xstrdup(path + 2); 1571| 5| free(path); 1572| 5| xasprintf(&path, "%s/%s", cwd, npath); 1573| 5| free(npath); 1574| 149| } else { 1575| | /* ~user expansions */ 1576| 149| if (tilde_expand(path, pw->pw_uid, &npath) != 0) { ------------------ | Branch (1576:8): [True: 137, False: 12] ------------------ 1577| 137| send_status_errmsg(id, 1578| 137| errno_to_portable(ENOENT), "no such user"); 1579| 137| goto out; 1580| 137| } 1581| 12| free(path); 1582| 12| path = npath; 1583| 12| } 1584| 155| } else if (*path != '/') { ------------------ | Branch (1584:13): [True: 27, False: 22] ------------------ 1585| | /* relative path */ 1586| 27| xasprintf(&npath, "%s/%s", cwd, path); 1587| 27| free(path); 1588| 27| path = npath; 1589| 27| } 1590| 68| verbose("expand \"%s\"", path); ------------------ | | 112| 68|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 1591| 68| if (sftp_realpath(path, resolvedname) == NULL) { ------------------ | Branch (1591:6): [True: 31, False: 37] ------------------ 1592| 31| send_status(id, errno_to_portable(errno)); 1593| 31| goto out; 1594| 31| } 1595| 37| attrib_clear(&s.attrib); 1596| 37| s.name = s.long_name = resolvedname; 1597| 37| send_names(id, 1, &s); 1598| 205| out: 1599| 205| free(path); 1600| 205|} sftp_server_msg_fuzz_helper.c:process_extended_copy_data: 1604| 105|{ 1605| 105| u_char buf[64*1024]; 1606| 105| int read_handle, read_fd, write_handle, write_fd; 1607| 105| uint64_t len, read_off, read_len, write_off; 1608| 105| int r, copy_until_eof, status = SSH2_FX_OP_UNSUPPORTED; ------------------ | | 95| 105|#define SSH2_FX_OP_UNSUPPORTED 8 ------------------ 1609| 105| size_t ret; 1610| 105| struct stat st_read, st_write; 1611| | 1612| 105| if ((r = get_handle(iqueue, &read_handle)) != 0 || ------------------ | Branch (1612:6): [True: 2, False: 103] ------------------ 1613| 103| (r = sshbuf_get_u64(iqueue, &read_off)) != 0 || ------------------ | Branch (1613:6): [True: 1, False: 102] ------------------ 1614| 102| (r = sshbuf_get_u64(iqueue, &read_len)) != 0 || ------------------ | Branch (1614:6): [True: 1, False: 101] ------------------ 1615| 101| (r = get_handle(iqueue, &write_handle)) != 0 || ------------------ | Branch (1615:6): [True: 2, False: 99] ------------------ 1616| 99| (r = sshbuf_get_u64(iqueue, &write_off)) != 0) ------------------ | Branch (1616:6): [True: 6, False: 93] ------------------ 1617| 12| fatal_fr(r, "buffer error"); ------------------ | | 146| 12|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1618| | 1619| 93| debug("request %u: copy-data from \"%s\" (handle %d) off %llu len %llu " ------------------ | | 111| 93|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 1620| 93| "to \"%s\" (handle %d) off %llu", 1621| 93| id, handle_to_name(read_handle), read_handle, 1622| 93| (unsigned long long)read_off, (unsigned long long)read_len, 1623| 93| handle_to_name(write_handle), write_handle, 1624| 93| (unsigned long long)write_off); 1625| | 1626| | /* For read length of 0, we read until EOF. */ 1627| 93| if (read_len == 0) { ------------------ | Branch (1627:6): [True: 3, False: 90] ------------------ 1628| 3| read_len = (uint64_t)-1 - read_off; 1629| 3| copy_until_eof = 1; 1630| 3| } else 1631| 90| copy_until_eof = 0; 1632| | 1633| | /* Disallow reading & writing to the same handle, path or inode */ 1634| 93| read_fd = handle_to_fd(read_handle); 1635| 93| write_fd = handle_to_fd(write_handle); 1636| 93| if (read_fd < 0 || write_fd < 0) { ------------------ | Branch (1636:6): [True: 93, False: 0] | Branch (1636:21): [True: 0, False: 0] ------------------ 1637| 93| error_f("bad read or write fd"); ------------------ | | 125| 93|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1638| 93| status = errno_to_portable(EBADF); 1639| 93| goto out; 1640| 93| } 1641| 0| if (fstat(read_fd, &st_read) != 0) { ------------------ | Branch (1641:6): [True: 0, False: 0] ------------------ 1642| 0| status = errno_to_portable(errno); 1643| 0| error_f("fstat read_fd failed: %s", strerror(errno)); ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1644| 0| goto out; 1645| 0| } 1646| 0| if (fstat(write_fd, &st_write) != 0) { ------------------ | Branch (1646:6): [True: 0, False: 0] ------------------ 1647| 0| status = errno_to_portable(errno); 1648| 0| error_f("fstat write_fd failed: %s", strerror(errno)); ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1649| 0| goto out; 1650| 0| } 1651| 0| if (read_handle == write_handle || ------------------ | Branch (1651:6): [True: 0, False: 0] ------------------ 1652| 0| !strcmp(handle_to_name(read_handle), handle_to_name(write_handle)) || ------------------ | Branch (1652:6): [True: 0, False: 0] ------------------ 1653| 0| (st_read.st_dev != 0 && st_read.st_ino != 0 && ------------------ | Branch (1653:7): [True: 0, False: 0] | Branch (1653:30): [True: 0, False: 0] ------------------ 1654| 0| st_read.st_dev == st_write.st_dev && ------------------ | Branch (1654:6): [True: 0, False: 0] ------------------ 1655| 0| st_read.st_ino == st_write.st_ino)) { ------------------ | Branch (1655:6): [True: 0, False: 0] ------------------ 1656| 0| error_f("refusing to read/write same file: " ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1657| 0| "read \"%s\" dev %lu ino %lu, write \"%s\" dev %lu ino %lu", 1658| 0| handle_to_name(read_handle), 1659| 0| (u_long)st_read.st_dev, (u_long)st_read.st_ino, 1660| 0| handle_to_name(write_handle), 1661| 0| (u_long)st_write.st_dev, (u_long)st_write.st_ino); 1662| 0| status = SSH2_FX_FAILURE; ------------------ | | 91| 0|#define SSH2_FX_FAILURE 4 ------------------ 1663| 0| goto out; 1664| 0| } 1665| | 1666| 0| if (lseek(read_fd, read_off, SEEK_SET) < 0) { ------------------ | Branch (1666:6): [True: 0, False: 0] ------------------ 1667| 0| status = errno_to_portable(errno); 1668| 0| error_f("read_seek failed"); ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1669| 0| goto out; 1670| 0| } 1671| | 1672| 0| if ((handle_to_flags(write_handle) & O_APPEND) == 0 && ------------------ | Branch (1672:6): [True: 0, False: 0] ------------------ 1673| 0| lseek(write_fd, write_off, SEEK_SET) < 0) { ------------------ | Branch (1673:6): [True: 0, False: 0] ------------------ 1674| 0| status = errno_to_portable(errno); 1675| 0| error_f("write_seek failed"); ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1676| 0| goto out; 1677| 0| } 1678| | 1679| | /* Process the request in chunks. */ 1680| 0| while (read_len > 0 || copy_until_eof) { ------------------ | Branch (1680:9): [True: 0, False: 0] | Branch (1680:25): [True: 0, False: 0] ------------------ 1681| 0| len = MINIMUM(sizeof(buf), read_len); ------------------ | | 268| 0|#define MINIMUM(a, b) (((a) < (b)) ? (a) : (b)) | | ------------------ | | | Branch (268:24): [True: 0, False: 0] | | ------------------ ------------------ 1682| 0| read_len -= len; 1683| | 1684| 0| ret = atomicio(read, read_fd, buf, len); 1685| 0| if (ret == 0 && errno == EPIPE) { ------------------ | Branch (1685:7): [True: 0, False: 0] | Branch (1685:19): [True: 0, False: 0] ------------------ 1686| 0| status = copy_until_eof ? SSH2_FX_OK : SSH2_FX_EOF; ------------------ | | 87| 0|#define SSH2_FX_OK 0 ------------------ status = copy_until_eof ? SSH2_FX_OK : SSH2_FX_EOF; ------------------ | | 88| 0|#define SSH2_FX_EOF 1 ------------------ | Branch (1686:13): [True: 0, False: 0] ------------------ 1687| 0| break; 1688| 0| } else if (ret == 0) { ------------------ | Branch (1688:14): [True: 0, False: 0] ------------------ 1689| 0| status = errno_to_portable(errno); 1690| 0| error_f("read failed: %s", strerror(errno)); ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1691| 0| break; 1692| 0| } 1693| 0| len = ret; 1694| 0| handle_update_read(read_handle, len); 1695| | 1696| 0| ret = atomicio(vwrite, write_fd, buf, len); ------------------ | | 42| 0|#define vwrite (ssize_t (*)(int, void *, size_t))write ------------------ 1697| 0| if (ret != len) { ------------------ | Branch (1697:7): [True: 0, False: 0] ------------------ 1698| 0| status = errno_to_portable(errno); 1699| 0| error("%s: write failed: %llu != %llu: %s", __func__, ------------------ | | 114| 0|#define error(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1700| 0| (unsigned long long)ret, (unsigned long long)len, 1701| 0| strerror(errno)); 1702| 0| break; 1703| 0| } 1704| 0| handle_update_write(write_handle, len); 1705| 0| } 1706| | 1707| 0| if (read_len == 0) ------------------ | Branch (1707:6): [True: 0, False: 0] ------------------ 1708| 0| status = SSH2_FX_OK; ------------------ | | 87| 0|#define SSH2_FX_OK 0 ------------------ 1709| | 1710| 93| out: 1711| 93| send_status(id, status); 1712| 93|} sftp_server_msg_fuzz_helper.c:process_extended_home_directory: 1716| 97|{ 1717| 97| char *username; 1718| 97| struct passwd *user_pw; 1719| 97| int r; 1720| 97| Stat s; 1721| | 1722| 97| if ((r = sshbuf_get_cstring(iqueue, &username, NULL)) != 0) ------------------ | Branch (1722:6): [True: 2, False: 95] ------------------ 1723| 2| fatal_fr(r, "parse"); ------------------ | | 146| 2|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1724| | 1725| 95| debug3("request %u: home-directory \"%s\"", id, username); ------------------ | | 109| 95|#define debug3(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1726| 95| if (username[0] == '\0') { ------------------ | Branch (1726:6): [True: 2, False: 93] ------------------ 1727| 2| user_pw = pw; 1728| 93| } else if ((user_pw = getpwnam(username)) == NULL) { ------------------ | Branch (1728:13): [True: 92, False: 1] ------------------ 1729| 92| send_status(id, SSH2_FX_FAILURE); ------------------ | | 91| 92|#define SSH2_FX_FAILURE 4 ------------------ 1730| 92| goto out; 1731| 92| } 1732| | 1733| 3| verbose("home-directory \"%s\"", user_pw->pw_dir); ------------------ | | 112| 3|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 1734| 3| attrib_clear(&s.attrib); 1735| 3| s.name = s.long_name = user_pw->pw_dir; 1736| 3| send_names(id, 1, &s); 1737| 95| out: 1738| 95| free(username); 1739| 95|} sftp_server_msg_fuzz_helper.c:process_extended_get_users_groups_by_id: 1743| 303|{ 1744| 303| struct passwd *user_pw; 1745| 303| struct group *gr; 1746| 303| struct sshbuf *uids, *gids, *usernames, *groupnames, *msg; 1747| 303| int r; 1748| 303| u_int n, nusers = 0, ngroups = 0; 1749| 303| const char *name; 1750| | 1751| 303| if ((usernames = sshbuf_new()) == NULL || ------------------ | Branch (1751:6): [True: 0, False: 303] ------------------ 1752| 303| (groupnames = sshbuf_new()) == NULL || ------------------ | Branch (1752:6): [True: 0, False: 303] ------------------ 1753| 303| (msg = sshbuf_new()) == NULL) ------------------ | Branch (1753:6): [True: 0, False: 303] ------------------ 1754| 0| fatal_f("sshbuf_new failed"); ------------------ | | 126| 0|#define fatal_f(...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 1755| 303| if ((r = sshbuf_froms(iqueue, &uids)) != 0 || ------------------ | Branch (1755:6): [True: 47, False: 256] ------------------ 1756| 256| (r = sshbuf_froms(iqueue, &gids)) != 0) ------------------ | Branch (1756:6): [True: 56, False: 200] ------------------ 1757| 103| fatal_fr(r, "parse"); ------------------ | | 146| 103|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1758| 200| debug_f("uids len = %zu, gids len = %zu", ------------------ | | 122| 200|#define debug_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) ------------------ 1759| 200| sshbuf_len(uids), sshbuf_len(gids)); 1760| 121k| while (sshbuf_len(uids) != 0) { ------------------ | Branch (1760:9): [True: 121k, False: 161] ------------------ 1761| 121k| if ((r = sshbuf_get_u32(uids, &n)) != 0) ------------------ | Branch (1761:7): [True: 39, False: 121k] ------------------ 1762| 39| fatal_fr(r, "parse inner uid"); ------------------ | | 146| 39|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1763| 121k| user_pw = getpwuid((uid_t)n); 1764| 121k| name = user_pw == NULL ? "" : user_pw->pw_name; ------------------ | Branch (1764:10): [True: 54.3k, False: 66.7k] ------------------ 1765| 121k| debug3_f("uid %u => \"%s\"", n, name); ------------------ | | 120| 121k|#define debug3_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1766| 121k| if ((r = sshbuf_put_cstring(usernames, name)) != 0) ------------------ | Branch (1766:7): [True: 0, False: 121k] ------------------ 1767| 0| fatal_fr(r, "assemble uid reply"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1768| 121k| nusers++; 1769| 121k| } 1770| 190k| while (sshbuf_len(gids) != 0) { ------------------ | Branch (1770:9): [True: 190k, False: 123] ------------------ 1771| 190k| if ((r = sshbuf_get_u32(gids, &n)) != 0) ------------------ | Branch (1771:7): [True: 38, False: 190k] ------------------ 1772| 38| fatal_fr(r, "parse inner gid"); ------------------ | | 146| 38|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1773| 190k| gr = getgrgid((gid_t)n); 1774| 190k| name = gr == NULL ? "" : gr->gr_name; ------------------ | Branch (1774:10): [True: 102k, False: 88.2k] ------------------ 1775| 190k| debug3_f("gid %u => \"%s\"", n, name); ------------------ | | 120| 190k|#define debug3_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 1776| 190k| if ((r = sshbuf_put_cstring(groupnames, name)) != 0) ------------------ | Branch (1776:7): [True: 0, False: 190k] ------------------ 1777| 0| fatal_fr(r, "assemble gid reply"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1778| 190k| ngroups++; 1779| 190k| } 1780| 123| verbose("users-groups-by-id: %u users, %u groups", nusers, ngroups); ------------------ | | 112| 123|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 1781| | 1782| 123| if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED_REPLY)) != 0 || ------------------ | | 65| 123|#define SSH2_FXP_EXTENDED_REPLY 201 ------------------ | Branch (1782:6): [True: 0, False: 123] ------------------ 1783| 123| (r = sshbuf_put_u32(msg, id)) != 0 || ------------------ | Branch (1783:6): [True: 0, False: 123] ------------------ 1784| 123| (r = sshbuf_put_stringb(msg, usernames)) != 0 || ------------------ | Branch (1784:6): [True: 0, False: 123] ------------------ 1785| 123| (r = sshbuf_put_stringb(msg, groupnames)) != 0) ------------------ | Branch (1785:6): [True: 0, False: 123] ------------------ 1786| 0| fatal_fr(r, "compose"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1787| 123| send_msg(msg); 1788| | 1789| 123| sshbuf_free(uids); 1790| 123| sshbuf_free(gids); 1791| 123| sshbuf_free(usernames); 1792| 123| sshbuf_free(groupnames); 1793| 123| sshbuf_free(msg); 1794| 123|} sftp_server_msg_fuzz_helper.c:process: 1821| 3.64k|{ 1822| 3.64k| u_int msg_len; 1823| 3.64k| u_int buf_len; 1824| 3.64k| u_int consumed; 1825| 3.64k| u_char type; 1826| 3.64k| const u_char *cp; 1827| 3.64k| int i, r; 1828| 3.64k| uint32_t id; 1829| | 1830| 3.64k| buf_len = sshbuf_len(iqueue); 1831| 3.64k| if (buf_len < 5) ------------------ | Branch (1831:6): [True: 0, False: 3.64k] ------------------ 1832| 0| return; /* Incomplete message. */ 1833| 3.64k| cp = sshbuf_ptr(iqueue); 1834| 3.64k| msg_len = get_u32(cp); 1835| 3.64k| if (msg_len > SFTP_MAX_MSG_LENGTH) { ------------------ | | 29| 3.64k|#define SFTP_MAX_MSG_LENGTH (256 * 1024) ------------------ | Branch (1835:6): [True: 0, False: 3.64k] ------------------ 1836| 0| error("bad message from %s local user %s", ------------------ | | 114| 0|#define error(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1837| 0| client_addr, pw->pw_name); 1838| 0| sftp_server_cleanup_exit(11); ------------------ | | 66| 0|#define sftp_server_cleanup_exit __orig_sftp_server_cleanup_exit ------------------ 1839| 0| } 1840| 3.64k| if (buf_len < msg_len + 4) ------------------ | Branch (1840:6): [True: 0, False: 3.64k] ------------------ 1841| 0| return; 1842| 3.64k| if ((r = sshbuf_consume(iqueue, 4)) != 0) ------------------ | Branch (1842:6): [True: 0, False: 3.64k] ------------------ 1843| 0| fatal_fr(r, "consume"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1844| 3.64k| buf_len -= 4; 1845| 3.64k| if ((r = sshbuf_get_u8(iqueue, &type)) != 0) ------------------ | Branch (1845:6): [True: 0, False: 3.64k] ------------------ 1846| 0| fatal_fr(r, "parse type"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1847| | 1848| 3.64k| switch (type) { 1849| 1.83k| case SSH2_FXP_INIT: ------------------ | | 35| 1.83k|#define SSH2_FXP_INIT 1 ------------------ | Branch (1849:2): [True: 1.83k, False: 1.81k] ------------------ 1850| 1.83k| process_init(); 1851| 1.83k| init_done = 1; 1852| 1.83k| break; 1853| 1.05k| case SSH2_FXP_EXTENDED: ------------------ | | 64| 1.05k|#define SSH2_FXP_EXTENDED 200 ------------------ | Branch (1853:2): [True: 1.05k, False: 2.58k] ------------------ 1854| 1.05k| if (!init_done) ------------------ | Branch (1854:7): [True: 0, False: 1.05k] ------------------ 1855| 0| fatal("Received extended request before init"); ------------------ | | 115| 0|#define fatal(...) sshfatal(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 1856| 1.05k| if ((r = sshbuf_get_u32(iqueue, &id)) != 0) ------------------ | Branch (1856:7): [True: 2, False: 1.05k] ------------------ 1857| 2| fatal_fr(r, "parse extended ID"); ------------------ | | 146| 2|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1858| 1.05k| process_extended(id); 1859| 1.05k| break; 1860| 756| default: ------------------ | Branch (1860:2): [True: 756, False: 2.89k] ------------------ 1861| 756| if (!init_done) ------------------ | Branch (1861:7): [True: 0, False: 756] ------------------ 1862| 0| fatal("Received %u request before init", type); ------------------ | | 115| 0|#define fatal(...) sshfatal(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 1863| 756| if ((r = sshbuf_get_u32(iqueue, &id)) != 0) ------------------ | Branch (1863:7): [True: 3, False: 753] ------------------ 1864| 3| fatal_fr(r, "parse ID"); ------------------ | | 146| 3|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1865| 7.16k| for (i = 0; handlers[i].handler != NULL; i++) { ------------------ | Branch (1865:15): [True: 7.12k, False: 40] ------------------ 1866| 7.12k| if (type == handlers[i].type) { ------------------ | Branch (1866:8): [True: 713, False: 6.40k] ------------------ 1867| 713| if (!request_permitted(&handlers[i])) { ------------------ | Branch (1867:9): [True: 0, False: 713] ------------------ 1868| 0| send_status(id, 1869| 0| SSH2_FX_PERMISSION_DENIED); ------------------ | | 90| 0|#define SSH2_FX_PERMISSION_DENIED 3 ------------------ 1870| 713| } else { 1871| 713| handlers[i].handler(id); 1872| 713| } 1873| 713| break; 1874| 713| } 1875| 7.12k| } 1876| 753| if (handlers[i].handler == NULL) ------------------ | Branch (1876:7): [True: 40, False: 713] ------------------ 1877| 40| error("Unknown message %u", type); ------------------ | | 114| 40|#define error(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1878| 3.64k| } 1879| | /* discard the remaining bytes from the current packet */ 1880| 2.99k| if (buf_len < sshbuf_len(iqueue)) { ------------------ | Branch (1880:6): [True: 0, False: 2.99k] ------------------ 1881| 0| error("iqueue grew unexpectedly"); ------------------ | | 114| 0|#define error(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1882| 0| sftp_server_cleanup_exit(255); ------------------ | | 66| 0|#define sftp_server_cleanup_exit __orig_sftp_server_cleanup_exit ------------------ 1883| 0| } 1884| 2.99k| consumed = buf_len - sshbuf_len(iqueue); 1885| 2.99k| if (msg_len < consumed) { ------------------ | Branch (1885:6): [True: 0, False: 2.99k] ------------------ 1886| 0| error("msg_len %u < consumed %u", msg_len, consumed); ------------------ | | 114| 0|#define error(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1887| 0| sftp_server_cleanup_exit(255); ------------------ | | 66| 0|#define sftp_server_cleanup_exit __orig_sftp_server_cleanup_exit ------------------ 1888| 0| } 1889| 2.99k| if (msg_len > consumed && ------------------ | Branch (1889:6): [True: 381, False: 2.61k] ------------------ 1890| 381| (r = sshbuf_consume(iqueue, msg_len - consumed)) != 0) ------------------ | Branch (1890:6): [True: 0, False: 381] ------------------ 1891| 0| fatal_fr(r, "consume"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1892| 2.99k|} sftp_server_msg_fuzz_helper.c:process_init: 703| 1.83k|{ 704| 1.83k| struct sshbuf *msg; 705| 1.83k| int r; 706| | 707| 1.83k| if ((r = sshbuf_get_u32(iqueue, &version)) != 0) ------------------ | Branch (707:6): [True: 2, False: 1.83k] ------------------ 708| 2| fatal_fr(r, "parse"); ------------------ | | 146| 2|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 709| 1.83k| verbose("received client version %u", version); ------------------ | | 112| 1.83k|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 710| 1.83k| if ((msg = sshbuf_new()) == NULL) ------------------ | Branch (710:6): [True: 0, False: 1.83k] ------------------ 711| 0| fatal_f("sshbuf_new failed"); ------------------ | | 126| 0|#define fatal_f(...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 712| 1.83k| if ((r = sshbuf_put_u8(msg, SSH2_FXP_VERSION)) != 0 || ------------------ | | 57| 1.83k|#define SSH2_FXP_VERSION 2 ------------------ | Branch (712:6): [True: 0, False: 1.83k] ------------------ 713| 1.83k| (r = sshbuf_put_u32(msg, SSH2_FILEXFER_VERSION)) != 0) ------------------ | | 32| 1.83k|#define SSH2_FILEXFER_VERSION 3 ------------------ | Branch (713:6): [True: 0, False: 1.83k] ------------------ 714| 0| fatal_fr(r, "compose"); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 715| | 716| | /* extension advertisements */ 717| 1.83k| compose_extension(msg, "posix-rename@openssh.com", "1"); 718| 1.83k| compose_extension(msg, "statvfs@openssh.com", "2"); 719| 1.83k| compose_extension(msg, "fstatvfs@openssh.com", "2"); 720| 1.83k| compose_extension(msg, "hardlink@openssh.com", "1"); 721| 1.83k| compose_extension(msg, "fsync@openssh.com", "1"); 722| 1.83k| compose_extension(msg, "lsetstat@openssh.com", "1"); 723| 1.83k| compose_extension(msg, "limits@openssh.com", "1"); 724| 1.83k| compose_extension(msg, "expand-path@openssh.com", "1"); 725| 1.83k| compose_extension(msg, "copy-data", "1"); 726| 1.83k| compose_extension(msg, "home-directory", "1"); 727| 1.83k| compose_extension(msg, "users-groups-by-id@openssh.com", "1"); 728| | 729| 1.83k| send_msg(msg); 730| 1.83k| sshbuf_free(msg); 731| 1.83k|} sftp_server_msg_fuzz_helper.c:compose_extension: 683| 20.1k|{ 684| 20.1k| int r; 685| 20.1k| const struct sftp_handler *exthnd; 686| | 687| 20.1k| if ((exthnd = extended_handler_byname(name)) == NULL) ------------------ | Branch (687:6): [True: 0, False: 20.1k] ------------------ 688| 0| fatal_f("internal error: no handler for %s", name); ------------------ | | 126| 0|#define fatal_f(...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 689| 20.1k| if (!request_permitted(exthnd)) { ------------------ | Branch (689:6): [True: 0, False: 20.1k] ------------------ 690| 0| debug2_f("refusing to advertise disallowed extension %s", name); ------------------ | | 121| 0|#define debug2_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG2, NULL, __VA_ARGS__) ------------------ 691| 0| return 0; 692| 0| } 693| 20.1k| if ((r = sshbuf_put_cstring(msg, name)) != 0 || ------------------ | Branch (693:6): [True: 0, False: 20.1k] ------------------ 694| 20.1k| (r = sshbuf_put_cstring(msg, ver)) != 0) ------------------ | Branch (694:6): [True: 0, False: 20.1k] ------------------ 695| 0| fatal_fr(r, "compose %s", name); ------------------ | | 146| 0|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 696| 20.1k| return 0; 697| 20.1k|} sftp_server_msg_fuzz_helper.c:extended_handler_byname: 174| 21.1k|{ 175| 21.1k| int i; 176| | 177| 131k| for (i = 0; extended_handlers[i].handler != NULL; i++) { ------------------ | Branch (177:14): [True: 131k, False: 288] ------------------ 178| 131k| if (strcmp(name, extended_handlers[i].ext_name) == 0) ------------------ | Branch (178:7): [True: 20.8k, False: 110k] ------------------ 179| 20.8k| return &extended_handlers[i]; 180| 131k| } 181| 288| return NULL; 182| 21.1k|} sftp_server_msg_fuzz_helper.c:process_extended: 1798| 1.05k|{ 1799| 1.05k| char *request; 1800| 1.05k| int r; 1801| 1.05k| const struct sftp_handler *exthand; 1802| | 1803| 1.05k| if ((r = sshbuf_get_cstring(iqueue, &request, NULL)) != 0) ------------------ | Branch (1803:6): [True: 13, False: 1.04k] ------------------ 1804| 13| fatal_fr(r, "parse"); ------------------ | | 146| 13|#define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) ------------------ 1805| 1.04k| if ((exthand = extended_handler_byname(request)) == NULL) { ------------------ | Branch (1805:6): [True: 288, False: 754] ------------------ 1806| 288| error("Unknown extended request \"%.100s\"", request); ------------------ | | 114| 288|#define error(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1807| 288| send_status(id, SSH2_FX_OP_UNSUPPORTED); /* MUST */ ------------------ | | 95| 288|#define SSH2_FX_OP_UNSUPPORTED 8 ------------------ 1808| 754| } else { 1809| 754| if (!request_permitted(exthand)) ------------------ | Branch (1809:7): [True: 0, False: 754] ------------------ 1810| 0| send_status(id, SSH2_FX_PERMISSION_DENIED); ------------------ | | 90| 0|#define SSH2_FX_PERMISSION_DENIED 3 ------------------ 1811| 754| else 1812| 754| exthand->handler(id); 1813| 754| } 1814| 1.04k| free(request); 1815| 1.04k|} sftp_server_msg_fuzz_helper.c:request_permitted: 186| 21.6k|{ 187| 21.6k| char *result; 188| | 189| 21.6k| if (readonly && h->does_write) { ------------------ | Branch (189:6): [True: 0, False: 21.6k] | Branch (189:18): [True: 0, False: 0] ------------------ 190| 0| verbose("Refusing %s request in read-only mode", h->name); ------------------ | | 112| 0|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 191| 0| return 0; 192| 0| } 193| 21.6k| if (request_denylist != NULL && ------------------ | Branch (193:6): [True: 0, False: 21.6k] ------------------ 194| 0| ((result = match_list(h->name, request_denylist, NULL))) != NULL) { ------------------ | Branch (194:6): [True: 0, False: 0] ------------------ 195| 0| free(result); 196| 0| verbose("Refusing denylisted %s request", h->name); ------------------ | | 112| 0|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 197| 0| return 0; 198| 0| } 199| 21.6k| if (request_allowlist != NULL && ------------------ | Branch (199:6): [True: 0, False: 21.6k] ------------------ 200| 0| ((result = match_list(h->name, request_allowlist, NULL))) != NULL) { ------------------ | Branch (200:6): [True: 0, False: 0] ------------------ 201| 0| free(result); 202| 0| debug2("Permitting allowlisted %s request", h->name); ------------------ | | 110| 0|#define debug2(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG2, NULL, __VA_ARGS__) ------------------ 203| 0| return 1; 204| 0| } 205| 21.6k| if (request_allowlist != NULL) { ------------------ | Branch (205:6): [True: 0, False: 21.6k] ------------------ 206| 0| verbose("Refusing non-allowlisted %s request", h->name); ------------------ | | 112| 0|#define verbose(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_VERBOSE, NULL, __VA_ARGS__) ------------------ 207| 0| return 0; 208| 0| } 209| 21.6k| return 1; 210| 21.6k|} sshbuf_get_u64: 47| 362|{ 48| 362| const u_char *p = sshbuf_ptr(buf); 49| 362| int r; 50| | 51| 362| if ((r = sshbuf_consume(buf, 8)) < 0) ------------------ | Branch (51:6): [True: 31, False: 331] ------------------ 52| 31| return r; 53| 331| if (valp != NULL) ------------------ | Branch (53:6): [True: 331, False: 0] ------------------ 54| 331| *valp = PEEK_U64(p); ------------------ | | 342| 331| (((uint64_t)(((const u_char *)(p))[0]) << 56) | \ | | 343| 331| ((uint64_t)(((const u_char *)(p))[1]) << 48) | \ | | 344| 331| ((uint64_t)(((const u_char *)(p))[2]) << 40) | \ | | 345| 331| ((uint64_t)(((const u_char *)(p))[3]) << 32) | \ | | 346| 331| ((uint64_t)(((const u_char *)(p))[4]) << 24) | \ | | 347| 331| ((uint64_t)(((const u_char *)(p))[5]) << 16) | \ | | 348| 331| ((uint64_t)(((const u_char *)(p))[6]) << 8) | \ | | 349| 331| (uint64_t)(((const u_char *)(p))[7])) ------------------ 55| 331| return 0; 56| 362|} sshbuf_get_u32: 60| 315k|{ 61| 315k| const u_char *p = sshbuf_ptr(buf); 62| 315k| int r; 63| | 64| 315k| if ((r = sshbuf_consume(buf, 4)) < 0) ------------------ | Branch (64:6): [True: 190, False: 315k] ------------------ 65| 190| return r; 66| 315k| if (valp != NULL) ------------------ | Branch (66:6): [True: 315k, False: 0] ------------------ 67| 315k| *valp = PEEK_U32(p); ------------------ | | 351| 315k| (((uint32_t)(((const u_char *)(p))[0]) << 24) | \ | | 352| 315k| ((uint32_t)(((const u_char *)(p))[1]) << 16) | \ | | 353| 315k| ((uint32_t)(((const u_char *)(p))[2]) << 8) | \ | | 354| 315k| (uint32_t)(((const u_char *)(p))[3])) ------------------ 68| 315k| return 0; 69| 315k|} sshbuf_get_u8: 86| 3.64k|{ 87| 3.64k| const u_char *p = sshbuf_ptr(buf); 88| 3.64k| int r; 89| | 90| 3.64k| if ((r = sshbuf_consume(buf, 1)) < 0) ------------------ | Branch (90:6): [True: 0, False: 3.64k] ------------------ 91| 0| return r; 92| 3.64k| if (valp != NULL) ------------------ | Branch (92:6): [True: 3.64k, False: 0] ------------------ 93| 3.64k| *valp = (uint8_t)*p; 94| 3.64k| return 0; 95| 3.64k|} sshbuf_get_string: 186| 6.48k|{ 187| 6.48k| const u_char *val; 188| 6.48k| size_t len; 189| 6.48k| int r; 190| | 191| 6.48k| if (valp != NULL) ------------------ | Branch (191:6): [True: 6.48k, False: 0] ------------------ 192| 6.48k| *valp = NULL; 193| 6.48k| if (lenp != NULL) ------------------ | Branch (193:6): [True: 6.48k, False: 0] ------------------ 194| 6.48k| *lenp = 0; 195| 6.48k| if ((r = sshbuf_get_string_direct(buf, &val, &len)) < 0) ------------------ | Branch (195:6): [True: 115, False: 6.36k] ------------------ 196| 115| return r; 197| 6.36k| if (valp != NULL) { ------------------ | Branch (197:6): [True: 6.36k, False: 0] ------------------ 198| 6.36k| if ((*valp = malloc(len + 1)) == NULL) { ------------------ | Branch (198:7): [True: 0, False: 6.36k] ------------------ 199| 0| SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL")); 200| 0| return SSH_ERR_ALLOC_FAIL; ------------------ | | 26| 0|#define SSH_ERR_ALLOC_FAIL -2 ------------------ 201| 0| } 202| 6.36k| if (len != 0) ------------------ | Branch (202:7): [True: 686, False: 5.68k] ------------------ 203| 686| memcpy(*valp, val, len); 204| 6.36k| (*valp)[len] = '\0'; 205| 6.36k| } 206| 6.36k| if (lenp != NULL) ------------------ | Branch (206:6): [True: 6.36k, False: 0] ------------------ 207| 6.36k| *lenp = len; 208| 6.36k| return 0; 209| 6.36k|} sshbuf_get_string_direct: 213| 14.1k|{ 214| 14.1k| size_t len; 215| 14.1k| const u_char *p; 216| 14.1k| int r; 217| | 218| 14.1k| if (valp != NULL) ------------------ | Branch (218:6): [True: 6.48k, False: 7.70k] ------------------ 219| 6.48k| *valp = NULL; 220| 14.1k| if (lenp != NULL) ------------------ | Branch (220:6): [True: 6.48k, False: 7.70k] ------------------ 221| 6.48k| *lenp = 0; 222| 14.1k| if ((r = sshbuf_peek_string_direct(buf, &p, &len)) < 0) ------------------ | Branch (222:6): [True: 115, False: 14.0k] ------------------ 223| 115| return r; 224| 14.0k| if (valp != NULL) ------------------ | Branch (224:6): [True: 6.36k, False: 7.70k] ------------------ 225| 6.36k| *valp = p; 226| 14.0k| if (lenp != NULL) ------------------ | Branch (226:6): [True: 6.36k, False: 7.70k] ------------------ 227| 6.36k| *lenp = len; 228| 14.0k| if (sshbuf_consume(buf, len + 4) != 0) { ------------------ | Branch (228:6): [True: 0, False: 14.0k] ------------------ 229| | /* Shouldn't happen */ 230| 0| SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR")); 231| 0| SSHBUF_ABORT(); 232| 0| return SSH_ERR_INTERNAL_ERROR; ------------------ | | 25| 0|#define SSH_ERR_INTERNAL_ERROR -1 ------------------ 233| 0| } 234| 14.0k| return 0; 235| 14.0k|} sshbuf_peek_string_direct: 240| 22.6k|{ 241| 22.6k| uint32_t len; 242| 22.6k| const u_char *p = sshbuf_ptr(buf); 243| | 244| 22.6k| if (valp != NULL) ------------------ | Branch (244:6): [True: 22.6k, False: 0] ------------------ 245| 22.6k| *valp = NULL; 246| 22.6k| if (lenp != NULL) ------------------ | Branch (246:6): [True: 22.6k, False: 0] ------------------ 247| 22.6k| *lenp = 0; 248| 22.6k| if (sshbuf_len(buf) < 4) { ------------------ | Branch (248:6): [True: 141, False: 22.5k] ------------------ 249| 141| SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE")); 250| 141| return SSH_ERR_MESSAGE_INCOMPLETE; ------------------ | | 27| 141|#define SSH_ERR_MESSAGE_INCOMPLETE -3 ------------------ 251| 141| } 252| 22.5k| len = PEEK_U32(p); ------------------ | | 351| 22.5k| (((uint32_t)(((const u_char *)(p))[0]) << 24) | \ | | 352| 22.5k| ((uint32_t)(((const u_char *)(p))[1]) << 16) | \ | | 353| 22.5k| ((uint32_t)(((const u_char *)(p))[2]) << 8) | \ | | 354| 22.5k| (uint32_t)(((const u_char *)(p))[3])) ------------------ 253| 22.5k| if (len > SSHBUF_SIZE_MAX - 4) { ------------------ | | 39| 22.5k|#define SSHBUF_SIZE_MAX 0x8000000 /* Hard maximum size */ ------------------ | Branch (253:6): [True: 93, False: 22.4k] ------------------ 254| 93| SSHBUF_DBG(("SSH_ERR_STRING_TOO_LARGE")); 255| 93| return SSH_ERR_STRING_TOO_LARGE; ------------------ | | 30| 93|#define SSH_ERR_STRING_TOO_LARGE -6 ------------------ 256| 93| } 257| 22.4k| if (sshbuf_len(buf) - 4 < len) { ------------------ | Branch (257:6): [True: 162, False: 22.2k] ------------------ 258| 162| SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE")); 259| 162| return SSH_ERR_MESSAGE_INCOMPLETE; ------------------ | | 27| 162|#define SSH_ERR_MESSAGE_INCOMPLETE -3 ------------------ 260| 162| } 261| 22.2k| if (valp != NULL) ------------------ | Branch (261:6): [True: 22.2k, False: 0] ------------------ 262| 22.2k| *valp = p + 4; 263| 22.2k| if (lenp != NULL) ------------------ | Branch (263:6): [True: 22.2k, False: 0] ------------------ 264| 22.2k| *lenp = len; 265| 22.2k| return 0; 266| 22.4k|} sshbuf_get_cstring: 270| 7.90k|{ 271| 7.90k| size_t len; 272| 7.90k| const u_char *p, *z; 273| 7.90k| int r; 274| | 275| 7.90k| if (valp != NULL) ------------------ | Branch (275:6): [True: 7.90k, False: 0] ------------------ 276| 7.90k| *valp = NULL; 277| 7.90k| if (lenp != NULL) ------------------ | Branch (277:6): [True: 0, False: 7.90k] ------------------ 278| 0| *lenp = 0; 279| 7.90k| if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0) ------------------ | Branch (279:6): [True: 178, False: 7.72k] ------------------ 280| 178| return r; 281| | /* Allow a \0 only at the end of the string */ 282| 7.72k| if (len > 0 && ------------------ | Branch (282:6): [True: 2.28k, False: 5.43k] ------------------ 283| 2.28k| (z = memchr(p , '\0', len)) != NULL && z < p + len - 1) { ------------------ | Branch (283:6): [True: 528, False: 1.75k] | Branch (283:45): [True: 13, False: 515] ------------------ 284| 13| SSHBUF_DBG(("SSH_ERR_INVALID_FORMAT")); 285| 13| return SSH_ERR_INVALID_FORMAT; ------------------ | | 28| 13|#define SSH_ERR_INVALID_FORMAT -4 ------------------ 286| 13| } 287| 7.70k| if ((r = sshbuf_skip_string(buf)) != 0) ------------------ | | 232| 7.70k|#define sshbuf_skip_string(buf) sshbuf_get_string_direct(buf, NULL, NULL) ------------------ | Branch (287:6): [True: 0, False: 7.70k] ------------------ 288| 0| return -1; 289| 7.70k| if (valp != NULL) { ------------------ | Branch (289:6): [True: 7.70k, False: 0] ------------------ 290| 7.70k| if ((*valp = malloc(len + 1)) == NULL) { ------------------ | Branch (290:7): [True: 0, False: 7.70k] ------------------ 291| 0| SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL")); 292| 0| return SSH_ERR_ALLOC_FAIL; ------------------ | | 26| 0|#define SSH_ERR_ALLOC_FAIL -2 ------------------ 293| 0| } 294| 7.70k| if (len != 0) ------------------ | Branch (294:7): [True: 2.27k, False: 5.43k] ------------------ 295| 2.27k| memcpy(*valp, p, len); 296| 7.70k| (*valp)[len] = '\0'; 297| 7.70k| } 298| 7.70k| if (lenp != NULL) ------------------ | Branch (298:6): [True: 0, False: 7.70k] ------------------ 299| 0| *lenp = (size_t)len; 300| 7.70k| return 0; 301| 7.70k|} sshbuf_put: 325| 5.46k|{ 326| 5.46k| u_char *p; 327| 5.46k| int r; 328| | 329| 5.46k| if ((r = sshbuf_reserve(buf, len, &p)) < 0) ------------------ | Branch (329:6): [True: 0, False: 5.46k] ------------------ 330| 0| return r; 331| 5.46k| if (len != 0) ------------------ | Branch (331:6): [True: 5.46k, False: 0] ------------------ 332| 5.46k| memcpy(p, v, len); 333| 5.46k| return 0; 334| 5.46k|} sshbuf_put_u64: 391| 17|{ 392| 17| u_char *p; 393| 17| int r; 394| | 395| 17| if ((r = sshbuf_reserve(buf, 8, &p)) < 0) ------------------ | Branch (395:6): [True: 0, False: 17] ------------------ 396| 0| return r; 397| 17| POKE_U64(p, val); ------------------ | | 360| 17| do { \ | | 361| 17| const uint64_t __v = (v); \ | | 362| 17| ((u_char *)(p))[0] = (__v >> 56) & 0xff; \ | | 363| 17| ((u_char *)(p))[1] = (__v >> 48) & 0xff; \ | | 364| 17| ((u_char *)(p))[2] = (__v >> 40) & 0xff; \ | | 365| 17| ((u_char *)(p))[3] = (__v >> 32) & 0xff; \ | | 366| 17| ((u_char *)(p))[4] = (__v >> 24) & 0xff; \ | | 367| 17| ((u_char *)(p))[5] = (__v >> 16) & 0xff; \ | | 368| 17| ((u_char *)(p))[6] = (__v >> 8) & 0xff; \ | | 369| 17| ((u_char *)(p))[7] = __v & 0xff; \ | | 370| 17| } while (0) | | ------------------ | | | Branch (370:11): [Folded, False: 17] | | ------------------ ------------------ 398| 17| return 0; 399| 17|} sshbuf_put_u32: 403| 4.07k|{ 404| 4.07k| u_char *p; 405| 4.07k| int r; 406| | 407| 4.07k| if ((r = sshbuf_reserve(buf, 4, &p)) < 0) ------------------ | Branch (407:6): [True: 0, False: 4.07k] ------------------ 408| 0| return r; 409| 4.07k| POKE_U32(p, val); ------------------ | | 372| 4.07k| do { \ | | 373| 4.07k| const uint32_t __v = (v); \ | | 374| 4.07k| ((u_char *)(p))[0] = (__v >> 24) & 0xff; \ | | 375| 4.07k| ((u_char *)(p))[1] = (__v >> 16) & 0xff; \ | | 376| 4.07k| ((u_char *)(p))[2] = (__v >> 8) & 0xff; \ | | 377| 4.07k| ((u_char *)(p))[3] = __v & 0xff; \ | | 378| 4.07k| } while (0) | | ------------------ | | | Branch (378:11): [Folded, False: 4.07k] | | ------------------ ------------------ 410| 4.07k| return 0; 411| 4.07k|} sshbuf_put_u8: 427| 2.95k|{ 428| 2.95k| u_char *p; 429| 2.95k| int r; 430| | 431| 2.95k| if ((r = sshbuf_reserve(buf, 1, &p)) < 0) ------------------ | Branch (431:6): [True: 0, False: 2.95k] ------------------ 432| 0| return r; 433| 2.95k| p[0] = val; 434| 2.95k| return 0; 435| 2.95k|} sshbuf_put_string: 513| 356k|{ 514| 356k| u_char *d; 515| 356k| int r; 516| | 517| 356k| if (len > SSHBUF_SIZE_MAX - 4) { ------------------ | | 39| 356k|#define SSHBUF_SIZE_MAX 0x8000000 /* Hard maximum size */ ------------------ | Branch (517:6): [True: 0, False: 356k] ------------------ 518| 0| SSHBUF_DBG(("SSH_ERR_NO_BUFFER_SPACE")); 519| 0| return SSH_ERR_NO_BUFFER_SPACE; ------------------ | | 33| 0|#define SSH_ERR_NO_BUFFER_SPACE -9 ------------------ 520| 0| } 521| 356k| if ((r = sshbuf_reserve(buf, len + 4, &d)) < 0) ------------------ | Branch (521:6): [True: 0, False: 356k] ------------------ 522| 0| return r; 523| 356k| POKE_U32(d, len); ------------------ | | 372| 356k| do { \ | | 373| 356k| const uint32_t __v = (v); \ | | 374| 356k| ((u_char *)(p))[0] = (__v >> 24) & 0xff; \ | | 375| 356k| ((u_char *)(p))[1] = (__v >> 16) & 0xff; \ | | 376| 356k| ((u_char *)(p))[2] = (__v >> 8) & 0xff; \ | | 377| 356k| ((u_char *)(p))[3] = __v & 0xff; \ | | 378| 356k| } while (0) | | ------------------ | | | Branch (378:11): [Folded, False: 356k] | | ------------------ ------------------ 524| 356k| if (len != 0) ------------------ | Branch (524:6): [True: 199k, False: 157k] ------------------ 525| 199k| memcpy(d + 4, v, len); 526| 356k| return 0; 527| 356k|} sshbuf_put_cstring: 531| 353k|{ 532| 353k| return sshbuf_put_string(buf, v, v == NULL ? 0 : strlen(v)); ------------------ | Branch (532:35): [True: 0, False: 353k] ------------------ 533| 353k|} sshbuf_put_stringb: 537| 3.19k|{ 538| 3.19k| if (v == NULL) ------------------ | Branch (538:6): [True: 0, False: 3.19k] ------------------ 539| 0| return sshbuf_put_string(buf, NULL, 0); 540| | 541| 3.19k| return sshbuf_put_string(buf, sshbuf_ptr(v), sshbuf_len(v)); 542| 3.19k|} sshbuf_froms: 546| 559|{ 547| 559| const u_char *p; 548| 559| size_t len; 549| 559| struct sshbuf *ret; 550| 559| int r; 551| | 552| 559| if (buf == NULL || bufp == NULL) ------------------ | Branch (552:6): [True: 0, False: 559] | Branch (552:21): [True: 0, False: 559] ------------------ 553| 0| return SSH_ERR_INVALID_ARGUMENT; ------------------ | | 34| 0|#define SSH_ERR_INVALID_ARGUMENT -10 ------------------ 554| 559| *bufp = NULL; 555| 559| if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0) ------------------ | Branch (555:6): [True: 103, False: 456] ------------------ 556| 103| return r; 557| 456| if ((ret = sshbuf_from(p, len)) == NULL) ------------------ | Branch (557:6): [True: 0, False: 456] ------------------ 558| 0| return SSH_ERR_ALLOC_FAIL; ------------------ | | 26| 0|#define SSH_ERR_ALLOC_FAIL -2 ------------------ 559| 456| if ((r = sshbuf_consume(buf, len + 4)) != 0 || /* Shouldn't happen */ ------------------ | Branch (559:6): [True: 0, False: 456] ------------------ 560| 456| (r = sshbuf_set_parent(ret, buf)) != 0) { ------------------ | Branch (560:6): [True: 0, False: 456] ------------------ 561| 0| sshbuf_free(ret); 562| 0| return r; 563| 0| } 564| 456| *bufp = ret; 565| 456| return 0; 566| 456|} sshbuf_new: 94| 7.38k|{ 95| 7.38k| struct sshbuf *ret; 96| | 97| 7.38k| if ((ret = calloc(1, sizeof(*ret))) == NULL) ------------------ | Branch (97:6): [True: 0, False: 7.38k] ------------------ 98| 0| return NULL; 99| 7.38k| ret->alloc = SSHBUF_SIZE_INIT; ------------------ | | 409| 7.38k|# define SSHBUF_SIZE_INIT 256 /* Initial allocation */ ------------------ 100| 7.38k| ret->max_size = SSHBUF_SIZE_MAX; ------------------ | | 39| 7.38k|#define SSHBUF_SIZE_MAX 0x8000000 /* Hard maximum size */ ------------------ 101| 7.38k| ret->readonly = 0; 102| 7.38k| ret->refcount = 1; 103| 7.38k| ret->parent = NULL; 104| 7.38k| if ((ret->cd = ret->d = calloc(1, ret->alloc)) == NULL) { ------------------ | Branch (104:6): [True: 0, False: 7.38k] ------------------ 105| 0| free(ret); 106| 0| return NULL; 107| 0| } 108| 7.38k| return ret; 109| 7.38k|} sshbuf_from: 113| 456|{ 114| 456| struct sshbuf *ret; 115| | 116| 456| if (blob == NULL || len > SSHBUF_SIZE_MAX || ------------------ | | 39| 912|#define SSHBUF_SIZE_MAX 0x8000000 /* Hard maximum size */ ------------------ | Branch (116:6): [True: 0, False: 456] | Branch (116:22): [True: 0, False: 456] ------------------ 117| 456| (ret = calloc(1, sizeof(*ret))) == NULL) ------------------ | Branch (117:6): [True: 0, False: 456] ------------------ 118| 0| return NULL; 119| 456| ret->alloc = ret->size = ret->max_size = len; 120| 456| ret->readonly = 1; 121| 456| ret->refcount = 1; 122| 456| ret->parent = NULL; 123| 456| ret->cd = blob; 124| | ret->d = NULL; 125| 456| return ret; 126| 456|} sshbuf_set_parent: 130| 456|{ 131| 456| int r; 132| | 133| 456| if ((r = sshbuf_check_sanity(child)) != 0 || ------------------ | Branch (133:6): [True: 0, False: 456] ------------------ 134| 456| (r = sshbuf_check_sanity(parent)) != 0) ------------------ | Branch (134:6): [True: 0, False: 456] ------------------ 135| 0| return r; 136| 456| if ((child->parent != NULL && child->parent != parent) || ------------------ | Branch (136:7): [True: 0, False: 456] | Branch (136:32): [True: 0, False: 0] ------------------ 137| 456| child == parent) ------------------ | Branch (137:6): [True: 0, False: 456] ------------------ 138| 0| return SSH_ERR_INTERNAL_ERROR; ------------------ | | 25| 0|#define SSH_ERR_INTERNAL_ERROR -1 ------------------ 139| 456| child->parent = parent; 140| 456| child->parent->refcount++; 141| 456| return 0; 142| 456|} sshbuf_free: 162| 11.5k|{ 163| 11.5k| if (buf == NULL) ------------------ | Branch (163:6): [True: 5.53k, False: 6.03k] ------------------ 164| 5.53k| return; 165| | /* 166| | * The following will leak on insane buffers, but this is the safest 167| | * course of action - an invalid pointer or already-freed pointer may 168| | * have been passed to us and continuing to scribble over memory would 169| | * be bad. 170| | */ 171| 6.03k| if (sshbuf_check_sanity(buf) != 0) ------------------ | Branch (171:6): [True: 0, False: 6.03k] ------------------ 172| 0| return; 173| | 174| | /* 175| | * If we are a parent with still-extant children, then don't free just 176| | * yet. The last child's call to sshbuf_free should decrement our 177| | * refcount to 0 and trigger the actual free. 178| | */ 179| 6.03k| buf->refcount--; 180| 6.03k| if (buf->refcount > 0) ------------------ | Branch (180:6): [True: 246, False: 5.78k] ------------------ 181| 246| return; 182| | 183| | /* 184| | * If we are a child, then free our parent to decrement its reference 185| | * count and possibly free it. 186| | */ 187| 5.78k| sshbuf_free(buf->parent); 188| 5.78k| buf->parent = NULL; 189| | 190| 5.78k| if (!buf->readonly) ------------------ | Branch (190:6): [True: 5.53k, False: 246] ------------------ 191| 5.53k| freezero(buf->d, buf->alloc); 192| 5.78k| freezero(buf, sizeof(*buf)); 193| 5.78k|} sshbuf_reset: 197| 6.59k|{ 198| 6.59k| u_char *d; 199| | 200| 6.59k| if (buf->readonly || buf->refcount > 1) { ------------------ | Branch (200:6): [True: 0, False: 6.59k] | Branch (200:23): [True: 0, False: 6.59k] ------------------ 201| | /* Nonsensical. Just make buffer appear empty */ 202| 0| buf->off = buf->size; 203| 0| return; 204| 0| } 205| 6.59k| if (sshbuf_check_sanity(buf) != 0) ------------------ | Branch (205:6): [True: 0, False: 6.59k] ------------------ 206| 0| return; 207| 6.59k| buf->off = buf->size = 0; 208| 6.59k| if (buf->alloc != SSHBUF_SIZE_INIT) { ------------------ | | 409| 6.59k|# define SSHBUF_SIZE_INIT 256 /* Initial allocation */ ------------------ | Branch (208:6): [True: 3.75k, False: 2.84k] ------------------ 209| 3.75k| if ((d = recallocarray(buf->d, buf->alloc, SSHBUF_SIZE_INIT, ------------------ | | 409| 3.75k|# define SSHBUF_SIZE_INIT 256 /* Initial allocation */ ------------------ | Branch (209:7): [True: 3.75k, False: 0] ------------------ 210| 3.75k| 1)) != NULL) { 211| 3.75k| buf->cd = buf->d = d; 212| 3.75k| buf->alloc = SSHBUF_SIZE_INIT; ------------------ | | 409| 3.75k|# define SSHBUF_SIZE_INIT 256 /* Initial allocation */ ------------------ 213| 3.75k| } 214| 3.75k| } 215| 6.59k| explicit_bzero(buf->d, buf->alloc); 216| 6.59k|} sshbuf_len: 282| 708k|{ 283| 708k| if (sshbuf_check_sanity(buf) != 0) ------------------ | Branch (283:6): [True: 0, False: 708k] ------------------ 284| 0| return 0; 285| 708k| return buf->size - buf->off; 286| 708k|} sshbuf_ptr: 298| 349k|{ 299| 349k| if (sshbuf_check_sanity(buf) != 0) ------------------ | Branch (299:6): [True: 0, False: 349k] ------------------ 300| 0| return NULL; 301| 349k| return buf->cd + buf->off; 302| 349k|} sshbuf_check_reserve: 314| 381k|{ 315| 381k| int r; 316| | 317| 381k| if ((r = sshbuf_check_sanity(buf)) != 0) ------------------ | Branch (317:6): [True: 0, False: 381k] ------------------ 318| 0| return r; 319| 381k| if (buf->readonly || buf->refcount > 1) ------------------ | Branch (319:6): [True: 0, False: 381k] | Branch (319:23): [True: 0, False: 381k] ------------------ 320| 0| return SSH_ERR_BUFFER_READ_ONLY; ------------------ | | 73| 0|#define SSH_ERR_BUFFER_READ_ONLY -49 ------------------ 321| 381k| SSHBUF_TELL("check"); 322| | /* Check that len is reasonable and that max_size + available < len */ 323| 381k| if (len > buf->max_size || buf->max_size - len < buf->size - buf->off) ------------------ | Branch (323:6): [True: 0, False: 381k] | Branch (323:29): [True: 0, False: 381k] ------------------ 324| 0| return SSH_ERR_NO_BUFFER_SPACE; ------------------ | | 33| 0|#define SSH_ERR_NO_BUFFER_SPACE -9 ------------------ 325| 381k| return 0; 326| 381k|} sshbuf_allocate: 330| 369k|{ 331| 369k| size_t rlen, need; 332| 369k| u_char *dp; 333| 369k| int r; 334| | 335| 369k| SSHBUF_DBG(("allocate buf = %p len = %zu", buf, len)); 336| 369k| if ((r = sshbuf_check_reserve(buf, len)) != 0) ------------------ | Branch (336:6): [True: 0, False: 369k] ------------------ 337| 0| return r; 338| | /* 339| | * If the requested allocation appended would push us past max_size 340| | * then pack the buffer, zeroing buf->off. 341| | */ 342| 369k| sshbuf_maybe_pack(buf, buf->size + len > buf->max_size); 343| 369k| SSHBUF_TELL("allocate"); 344| 369k| if (len + buf->size <= buf->alloc) ------------------ | Branch (344:6): [True: 357k, False: 11.6k] ------------------ 345| 357k| return 0; /* already have it. */ 346| | 347| | /* 348| | * Prefer to alloc in SSHBUF_SIZE_INC units, but 349| | * allocate less if doing so would overflow max_size. 350| | */ 351| 11.6k| need = len + buf->size - buf->alloc; 352| 11.6k| rlen = ROUNDUP(buf->alloc + need, SSHBUF_SIZE_INC); ------------------ | | 270| 11.6k|#define ROUNDUP(x, y) ((((x)+((y)-1))/(y))*(y)) ------------------ 353| 11.6k| SSHBUF_DBG(("need %zu initial rlen %zu", need, rlen)); 354| 11.6k| if (rlen > buf->max_size) ------------------ | Branch (354:6): [True: 0, False: 11.6k] ------------------ 355| 0| rlen = buf->alloc + need; 356| 11.6k| SSHBUF_DBG(("adjusted rlen %zu", rlen)); 357| 11.6k| if ((dp = recallocarray(buf->d, buf->alloc, rlen, 1)) == NULL) { ------------------ | Branch (357:6): [True: 0, False: 11.6k] ------------------ 358| 0| SSHBUF_DBG(("realloc fail")); 359| 0| return SSH_ERR_ALLOC_FAIL; ------------------ | | 26| 0|#define SSH_ERR_ALLOC_FAIL -2 ------------------ 360| 0| } 361| 11.6k| buf->alloc = rlen; 362| 11.6k| buf->cd = buf->d = dp; 363| 11.6k| if ((r = sshbuf_check_reserve(buf, len)) < 0) { ------------------ | Branch (363:6): [True: 0, False: 11.6k] ------------------ 364| | /* shouldn't fail */ 365| 0| return r; 366| 0| } 367| 11.6k| SSHBUF_TELL("done"); 368| 11.6k| return 0; 369| 11.6k|} sshbuf_reserve: 373| 369k|{ 374| 369k| u_char *dp; 375| 369k| int r; 376| | 377| 369k| if (dpp != NULL) ------------------ | Branch (377:6): [True: 369k, False: 0] ------------------ 378| 369k| *dpp = NULL; 379| | 380| 369k| SSHBUF_DBG(("reserve buf = %p len = %zu", buf, len)); 381| 369k| if ((r = sshbuf_allocate(buf, len)) != 0) ------------------ | Branch (381:6): [True: 0, False: 369k] ------------------ 382| 0| return r; 383| | 384| 369k| dp = buf->d + buf->size; 385| 369k| buf->size += len; 386| 369k| if (dpp != NULL) ------------------ | Branch (386:6): [True: 369k, False: 0] ------------------ 387| 369k| *dpp = dp; 388| 369k| return 0; 389| 369k|} sshbuf_consume: 393| 338k|{ 394| 338k| int r; 395| | 396| 338k| SSHBUF_DBG(("len = %zu", len)); 397| 338k| if ((r = sshbuf_check_sanity(buf)) != 0) ------------------ | Branch (397:6): [True: 0, False: 338k] ------------------ 398| 0| return r; 399| 338k| if (len == 0) ------------------ | Branch (399:6): [True: 0, False: 338k] ------------------ 400| 0| return 0; 401| 338k| if (len > sshbuf_len(buf)) ------------------ | Branch (401:6): [True: 221, False: 338k] ------------------ 402| 221| return SSH_ERR_MESSAGE_INCOMPLETE; ------------------ | | 27| 221|#define SSH_ERR_MESSAGE_INCOMPLETE -3 ------------------ 403| 338k| buf->off += len; 404| | /* deal with empty buffer */ 405| 338k| if (buf->off == buf->size) ------------------ | Branch (405:6): [True: 3.47k, False: 334k] ------------------ 406| 3.47k| buf->off = buf->size = 0; 407| 338k| SSHBUF_TELL("done"); 408| 338k| return 0; 409| 338k|} sshbuf.c:sshbuf_check_sanity: 56| 1.79M|{ 57| 1.79M| SSHBUF_TELL("sanity"); 58| 1.79M| if (__predict_false(buf == NULL || ------------------ | | 986| 34.5M|# define __predict_false(exp) __builtin_expect(((exp) != 0), 0) | | ------------------ | | | Branch (986:35): [True: 0, False: 1.79M] | | | Branch (986:54): [True: 543k, False: 1.24M] | | | Branch (986:54): [True: 0, False: 543k] | | | Branch (986:54): [True: 0, False: 1.79M] | | | Branch (986:54): [True: 0, False: 1.79M] | | | Branch (986:54): [True: 0, False: 1.79M] | | | Branch (986:54): [True: 0, False: 1.79M] | | | Branch (986:54): [True: 0, False: 1.79M] | | | Branch (986:54): [True: 0, False: 1.79M] | | | Branch (986:54): [True: 0, False: 1.79M] | | | Branch (986:54): [True: 0, False: 1.79M] | | | Branch (986:54): [True: 0, False: 1.79M] | | ------------------ ------------------ 59| 1.79M| (!buf->readonly && buf->d != buf->cd) || 60| 1.79M| buf->parent == buf || 61| 1.79M| buf->refcount < 1 || buf->refcount > SSHBUF_REFS_MAX || 62| 1.79M| buf->cd == NULL || 63| 1.79M| buf->max_size > SSHBUF_SIZE_MAX || 64| 1.79M| buf->alloc > buf->max_size || 65| 1.79M| buf->size > buf->alloc || 66| 1.79M| buf->off > buf->size)) { 67| | /* Do not try to recover from corrupted buffer internals */ 68| 0| SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR")); 69| 0| ssh_signal(SIGSEGV, SIG_DFL); 70| 0| raise(SIGSEGV); 71| 0| return SSH_ERR_INTERNAL_ERROR; ------------------ | | 25| 0|#define SSH_ERR_INTERNAL_ERROR -1 ------------------ 72| 0| } 73| 1.79M| return 0; 74| 1.79M|} sshbuf.c:sshbuf_maybe_pack: 78| 369k|{ 79| 369k| SSHBUF_DBG(("force %d", force)); 80| 369k| SSHBUF_TELL("pre-pack"); 81| 369k| if (buf->off == 0 || buf->readonly || buf->refcount > 1) ------------------ | Branch (81:6): [True: 369k, False: 0] | Branch (81:23): [True: 0, False: 0] | Branch (81:40): [True: 0, False: 0] ------------------ 82| 369k| return; 83| 0| if (force || ------------------ | Branch (83:6): [True: 0, False: 0] ------------------ 84| 0| (buf->off >= SSHBUF_PACK_MIN && buf->off >= buf->size / 2)) { ------------------ | | 411| 0|# define SSHBUF_PACK_MIN 8192 /* Minimum packable offset */ ------------------ | Branch (84:7): [True: 0, False: 0] | Branch (84:38): [True: 0, False: 0] ------------------ 85| 0| memmove(buf->d, buf->d + buf->off, buf->size - buf->off); 86| 0| buf->size -= buf->off; 87| 0| buf->off = 0; 88| 0| SSHBUF_TELL("packed"); 89| 0| } 90| 0|} ssh_err: 24| 653|{ 25| 653| const char *msg = NULL; 26| | 27| 653| switch (n) { 28| 0| case SSH_ERR_SUCCESS: ------------------ | | 24| 0|#define SSH_ERR_SUCCESS 0 ------------------ | Branch (28:2): [True: 0, False: 653] ------------------ 29| 0| return "success"; 30| 0| case SSH_ERR_INTERNAL_ERROR: ------------------ | | 25| 0|#define SSH_ERR_INTERNAL_ERROR -1 ------------------ | Branch (30:2): [True: 0, False: 653] ------------------ 31| 0| return "unexpected internal error"; 32| 0| case SSH_ERR_ALLOC_FAIL: ------------------ | | 26| 0|#define SSH_ERR_ALLOC_FAIL -2 ------------------ | Branch (32:2): [True: 0, False: 653] ------------------ 33| 0| return "memory allocation failed"; 34| 524| case SSH_ERR_MESSAGE_INCOMPLETE: ------------------ | | 27| 524|#define SSH_ERR_MESSAGE_INCOMPLETE -3 ------------------ | Branch (34:2): [True: 524, False: 129] ------------------ 35| 524| return "incomplete message"; 36| 36| case SSH_ERR_INVALID_FORMAT: ------------------ | | 28| 36|#define SSH_ERR_INVALID_FORMAT -4 ------------------ | Branch (36:2): [True: 36, False: 617] ------------------ 37| 36| return "invalid format"; 38| 0| case SSH_ERR_BIGNUM_IS_NEGATIVE: ------------------ | | 29| 0|#define SSH_ERR_BIGNUM_IS_NEGATIVE -5 ------------------ | Branch (38:2): [True: 0, False: 653] ------------------ 39| 0| return "bignum is negative"; 40| 93| case SSH_ERR_STRING_TOO_LARGE: ------------------ | | 30| 93|#define SSH_ERR_STRING_TOO_LARGE -6 ------------------ | Branch (40:2): [True: 93, False: 560] ------------------ 41| 93| return "string is too large"; 42| 0| case SSH_ERR_BIGNUM_TOO_LARGE: ------------------ | | 31| 0|#define SSH_ERR_BIGNUM_TOO_LARGE -7 ------------------ | Branch (42:2): [True: 0, False: 653] ------------------ 43| 0| return "bignum is too large"; 44| 0| case SSH_ERR_ECPOINT_TOO_LARGE: ------------------ | | 32| 0|#define SSH_ERR_ECPOINT_TOO_LARGE -8 ------------------ | Branch (44:2): [True: 0, False: 653] ------------------ 45| 0| return "elliptic curve point is too large"; 46| 0| case SSH_ERR_NO_BUFFER_SPACE: ------------------ | | 33| 0|#define SSH_ERR_NO_BUFFER_SPACE -9 ------------------ | Branch (46:2): [True: 0, False: 653] ------------------ 47| 0| return "insufficient buffer space"; 48| 0| case SSH_ERR_INVALID_ARGUMENT: ------------------ | | 34| 0|#define SSH_ERR_INVALID_ARGUMENT -10 ------------------ | Branch (48:2): [True: 0, False: 653] ------------------ 49| 0| return "invalid argument"; 50| 0| case SSH_ERR_KEY_BITS_MISMATCH: ------------------ | | 35| 0|#define SSH_ERR_KEY_BITS_MISMATCH -11 ------------------ | Branch (50:2): [True: 0, False: 653] ------------------ 51| 0| return "key bits do not match"; 52| 0| case SSH_ERR_EC_CURVE_INVALID: ------------------ | | 36| 0|#define SSH_ERR_EC_CURVE_INVALID -12 ------------------ | Branch (52:2): [True: 0, False: 653] ------------------ 53| 0| return "invalid elliptic curve"; 54| 0| case SSH_ERR_KEY_TYPE_MISMATCH: ------------------ | | 37| 0|#define SSH_ERR_KEY_TYPE_MISMATCH -13 ------------------ | Branch (54:2): [True: 0, False: 653] ------------------ 55| 0| return "key type does not match"; 56| 0| case SSH_ERR_KEY_TYPE_UNKNOWN: ------------------ | | 38| 0|#define SSH_ERR_KEY_TYPE_UNKNOWN -14 /* XXX UNSUPPORTED? */ ------------------ | Branch (56:2): [True: 0, False: 653] ------------------ 57| 0| return "unknown or unsupported key type"; 58| 0| case SSH_ERR_EC_CURVE_MISMATCH: ------------------ | | 39| 0|#define SSH_ERR_EC_CURVE_MISMATCH -15 ------------------ | Branch (58:2): [True: 0, False: 653] ------------------ 59| 0| return "elliptic curve does not match"; 60| 0| case SSH_ERR_EXPECTED_CERT: ------------------ | | 40| 0|#define SSH_ERR_EXPECTED_CERT -16 ------------------ | Branch (60:2): [True: 0, False: 653] ------------------ 61| 0| return "plain key provided where certificate required"; 62| 0| case SSH_ERR_KEY_LACKS_CERTBLOB: ------------------ | | 41| 0|#define SSH_ERR_KEY_LACKS_CERTBLOB -17 ------------------ | Branch (62:2): [True: 0, False: 653] ------------------ 63| 0| return "key lacks certificate data"; 64| 0| case SSH_ERR_KEY_CERT_UNKNOWN_TYPE: ------------------ | | 42| 0|#define SSH_ERR_KEY_CERT_UNKNOWN_TYPE -18 ------------------ | Branch (64:2): [True: 0, False: 653] ------------------ 65| 0| return "unknown/unsupported certificate type"; 66| 0| case SSH_ERR_KEY_CERT_INVALID_SIGN_KEY: ------------------ | | 43| 0|#define SSH_ERR_KEY_CERT_INVALID_SIGN_KEY -19 ------------------ | Branch (66:2): [True: 0, False: 653] ------------------ 67| 0| return "invalid certificate signing key"; 68| 0| case SSH_ERR_KEY_INVALID_EC_VALUE: ------------------ | | 44| 0|#define SSH_ERR_KEY_INVALID_EC_VALUE -20 ------------------ | Branch (68:2): [True: 0, False: 653] ------------------ 69| 0| return "invalid elliptic curve value"; 70| 0| case SSH_ERR_SIGNATURE_INVALID: ------------------ | | 45| 0|#define SSH_ERR_SIGNATURE_INVALID -21 ------------------ | Branch (70:2): [True: 0, False: 653] ------------------ 71| 0| return "incorrect signature"; 72| 0| case SSH_ERR_LIBCRYPTO_ERROR: ------------------ | | 46| 0|#define SSH_ERR_LIBCRYPTO_ERROR -22 ------------------ | Branch (72:2): [True: 0, False: 653] ------------------ 73| 0| msg = ssherr_libcrypto(); 74| 0| return msg != NULL ? msg : "error in libcrypto"; ------------------ | Branch (74:10): [True: 0, False: 0] ------------------ 75| 0| case SSH_ERR_INTERNAL_CRYPTO_ERROR: ------------------ | | 86| 0|#define SSH_ERR_INTERNAL_CRYPTO_ERROR -62 ------------------ | Branch (75:2): [True: 0, False: 653] ------------------ 76| 0| return "cryptographic operation failed"; 77| 0| case SSH_ERR_UNEXPECTED_TRAILING_DATA: ------------------ | | 47| 0|#define SSH_ERR_UNEXPECTED_TRAILING_DATA -23 ------------------ | Branch (77:2): [True: 0, False: 653] ------------------ 78| 0| return "unexpected bytes remain after decoding"; 79| 0| case SSH_ERR_SYSTEM_ERROR: ------------------ | | 48| 0|#define SSH_ERR_SYSTEM_ERROR -24 ------------------ | Branch (79:2): [True: 0, False: 653] ------------------ 80| 0| return strerror(errno); 81| 0| case SSH_ERR_KEY_CERT_INVALID: ------------------ | | 49| 0|#define SSH_ERR_KEY_CERT_INVALID -25 ------------------ | Branch (81:2): [True: 0, False: 653] ------------------ 82| 0| return "invalid certificate"; 83| 0| case SSH_ERR_AGENT_COMMUNICATION: ------------------ | | 50| 0|#define SSH_ERR_AGENT_COMMUNICATION -26 ------------------ | Branch (83:2): [True: 0, False: 653] ------------------ 84| 0| return "communication with agent failed"; 85| 0| case SSH_ERR_AGENT_FAILURE: ------------------ | | 51| 0|#define SSH_ERR_AGENT_FAILURE -27 ------------------ | Branch (85:2): [True: 0, False: 653] ------------------ 86| 0| return "agent refused operation"; 87| 0| case SSH_ERR_DH_GEX_OUT_OF_RANGE: ------------------ | | 52| 0|#define SSH_ERR_DH_GEX_OUT_OF_RANGE -28 ------------------ | Branch (87:2): [True: 0, False: 653] ------------------ 88| 0| return "DH GEX group out of range"; 89| 0| case SSH_ERR_DISCONNECTED: ------------------ | | 53| 0|#define SSH_ERR_DISCONNECTED -29 ------------------ | Branch (89:2): [True: 0, False: 653] ------------------ 90| 0| return "disconnected"; 91| 0| case SSH_ERR_MAC_INVALID: ------------------ | | 54| 0|#define SSH_ERR_MAC_INVALID -30 ------------------ | Branch (91:2): [True: 0, False: 653] ------------------ 92| 0| return "message authentication code incorrect"; 93| 0| case SSH_ERR_NO_CIPHER_ALG_MATCH: ------------------ | | 55| 0|#define SSH_ERR_NO_CIPHER_ALG_MATCH -31 ------------------ | Branch (93:2): [True: 0, False: 653] ------------------ 94| 0| return "no matching cipher found"; 95| 0| case SSH_ERR_NO_MAC_ALG_MATCH: ------------------ | | 56| 0|#define SSH_ERR_NO_MAC_ALG_MATCH -32 ------------------ | Branch (95:2): [True: 0, False: 653] ------------------ 96| 0| return "no matching MAC found"; 97| 0| case SSH_ERR_NO_COMPRESS_ALG_MATCH: ------------------ | | 57| 0|#define SSH_ERR_NO_COMPRESS_ALG_MATCH -33 ------------------ | Branch (97:2): [True: 0, False: 653] ------------------ 98| 0| return "no matching compression method found"; 99| 0| case SSH_ERR_NO_KEX_ALG_MATCH: ------------------ | | 58| 0|#define SSH_ERR_NO_KEX_ALG_MATCH -34 ------------------ | Branch (99:2): [True: 0, False: 653] ------------------ 100| 0| return "no matching key exchange method found"; 101| 0| case SSH_ERR_NO_HOSTKEY_ALG_MATCH: ------------------ | | 59| 0|#define SSH_ERR_NO_HOSTKEY_ALG_MATCH -35 ------------------ | Branch (101:2): [True: 0, False: 653] ------------------ 102| 0| return "no matching host key type found"; 103| 0| case SSH_ERR_PROTOCOL_MISMATCH: ------------------ | | 61| 0|#define SSH_ERR_PROTOCOL_MISMATCH -37 ------------------ | Branch (103:2): [True: 0, False: 653] ------------------ 104| 0| return "protocol version mismatch"; 105| 0| case SSH_ERR_NO_PROTOCOL_VERSION: ------------------ | | 62| 0|#define SSH_ERR_NO_PROTOCOL_VERSION -38 ------------------ | Branch (105:2): [True: 0, False: 653] ------------------ 106| 0| return "could not read protocol version"; 107| 0| case SSH_ERR_NO_HOSTKEY_LOADED: ------------------ | | 60| 0|#define SSH_ERR_NO_HOSTKEY_LOADED -36 ------------------ | Branch (107:2): [True: 0, False: 653] ------------------ 108| 0| return "could not load host key"; 109| 0| case SSH_ERR_NEED_REKEY: ------------------ | | 63| 0|#define SSH_ERR_NEED_REKEY -39 ------------------ | Branch (109:2): [True: 0, False: 653] ------------------ 110| 0| return "rekeying not supported by peer"; 111| 0| case SSH_ERR_PASSPHRASE_TOO_SHORT: ------------------ | | 64| 0|#define SSH_ERR_PASSPHRASE_TOO_SHORT -40 ------------------ | Branch (111:2): [True: 0, False: 653] ------------------ 112| 0| return "passphrase is too short (minimum five characters)"; 113| 0| case SSH_ERR_FILE_CHANGED: ------------------ | | 65| 0|#define SSH_ERR_FILE_CHANGED -41 ------------------ | Branch (113:2): [True: 0, False: 653] ------------------ 114| 0| return "file changed while reading"; 115| 0| case SSH_ERR_KEY_UNKNOWN_CIPHER: ------------------ | | 66| 0|#define SSH_ERR_KEY_UNKNOWN_CIPHER -42 ------------------ | Branch (115:2): [True: 0, False: 653] ------------------ 116| 0| return "key encrypted using unsupported cipher"; 117| 0| case SSH_ERR_KEY_WRONG_PASSPHRASE: ------------------ | | 67| 0|#define SSH_ERR_KEY_WRONG_PASSPHRASE -43 ------------------ | Branch (117:2): [True: 0, False: 653] ------------------ 118| 0| return "incorrect passphrase supplied to decrypt private key"; 119| 0| case SSH_ERR_KEY_BAD_PERMISSIONS: ------------------ | | 68| 0|#define SSH_ERR_KEY_BAD_PERMISSIONS -44 ------------------ | Branch (119:2): [True: 0, False: 653] ------------------ 120| 0| return "bad permissions"; 121| 0| case SSH_ERR_KEY_CERT_MISMATCH: ------------------ | | 69| 0|#define SSH_ERR_KEY_CERT_MISMATCH -45 ------------------ | Branch (121:2): [True: 0, False: 653] ------------------ 122| 0| return "certificate does not match key"; 123| 0| case SSH_ERR_KEY_NOT_FOUND: ------------------ | | 70| 0|#define SSH_ERR_KEY_NOT_FOUND -46 ------------------ | Branch (123:2): [True: 0, False: 653] ------------------ 124| 0| return "key not found"; 125| 0| case SSH_ERR_AGENT_NOT_PRESENT: ------------------ | | 71| 0|#define SSH_ERR_AGENT_NOT_PRESENT -47 ------------------ | Branch (125:2): [True: 0, False: 653] ------------------ 126| 0| return "agent not present"; 127| 0| case SSH_ERR_AGENT_NO_IDENTITIES: ------------------ | | 72| 0|#define SSH_ERR_AGENT_NO_IDENTITIES -48 ------------------ | Branch (127:2): [True: 0, False: 653] ------------------ 128| 0| return "agent contains no identities"; 129| 0| case SSH_ERR_BUFFER_READ_ONLY: ------------------ | | 73| 0|#define SSH_ERR_BUFFER_READ_ONLY -49 ------------------ | Branch (129:2): [True: 0, False: 653] ------------------ 130| 0| return "internal error: buffer is read-only"; 131| 0| case SSH_ERR_KRL_BAD_MAGIC: ------------------ | | 74| 0|#define SSH_ERR_KRL_BAD_MAGIC -50 ------------------ | Branch (131:2): [True: 0, False: 653] ------------------ 132| 0| return "KRL file has invalid magic number"; 133| 0| case SSH_ERR_KEY_REVOKED: ------------------ | | 75| 0|#define SSH_ERR_KEY_REVOKED -51 ------------------ | Branch (133:2): [True: 0, False: 653] ------------------ 134| 0| return "Key is revoked"; 135| 0| case SSH_ERR_CONN_CLOSED: ------------------ | | 76| 0|#define SSH_ERR_CONN_CLOSED -52 ------------------ | Branch (135:2): [True: 0, False: 653] ------------------ 136| 0| return "Connection closed"; 137| 0| case SSH_ERR_CONN_TIMEOUT: ------------------ | | 77| 0|#define SSH_ERR_CONN_TIMEOUT -53 ------------------ | Branch (137:2): [True: 0, False: 653] ------------------ 138| 0| return "Connection timed out"; 139| 0| case SSH_ERR_CONN_CORRUPT: ------------------ | | 78| 0|#define SSH_ERR_CONN_CORRUPT -54 ------------------ | Branch (139:2): [True: 0, False: 653] ------------------ 140| 0| return "Connection corrupted"; 141| 0| case SSH_ERR_PROTOCOL_ERROR: ------------------ | | 79| 0|#define SSH_ERR_PROTOCOL_ERROR -55 ------------------ | Branch (141:2): [True: 0, False: 653] ------------------ 142| 0| return "Protocol error"; 143| 0| case SSH_ERR_KEY_LENGTH: ------------------ | | 80| 0|#define SSH_ERR_KEY_LENGTH -56 ------------------ | Branch (143:2): [True: 0, False: 653] ------------------ 144| 0| return "Invalid key length"; 145| 0| case SSH_ERR_NUMBER_TOO_LARGE: ------------------ | | 81| 0|#define SSH_ERR_NUMBER_TOO_LARGE -57 ------------------ | Branch (145:2): [True: 0, False: 653] ------------------ 146| 0| return "number is too large"; 147| 0| case SSH_ERR_KEY_ALG_UNSUPPORTED: ------------------ | | 87| 0|#define SSH_ERR_KEY_ALG_UNSUPPORTED -63 ------------------ | Branch (147:2): [True: 0, False: 653] ------------------ 148| 0| return "key algorithm not supported"; 149| 0| case SSH_ERR_SIGN_ALG_UNSUPPORTED: ------------------ | | 82| 0|#define SSH_ERR_SIGN_ALG_UNSUPPORTED -58 ------------------ | Branch (149:2): [True: 0, False: 653] ------------------ 150| 0| return "signature algorithm not supported"; 151| 0| case SSH_ERR_FEATURE_UNSUPPORTED: ------------------ | | 83| 0|#define SSH_ERR_FEATURE_UNSUPPORTED -59 ------------------ | Branch (151:2): [True: 0, False: 653] ------------------ 152| 0| return "requested feature not supported"; 153| 0| case SSH_ERR_DEVICE_NOT_FOUND: ------------------ | | 84| 0|#define SSH_ERR_DEVICE_NOT_FOUND -60 ------------------ | Branch (153:2): [True: 0, False: 653] ------------------ 154| 0| return "device not found"; 155| 0| default: ------------------ | Branch (155:2): [True: 0, False: 653] ------------------ 156| 0| return "unknown error"; 157| 653| } 158| 653|} xmalloc: 33| 167|{ 34| 167| void *ptr; 35| | 36| 167| if (size == 0) ------------------ | Branch (36:6): [True: 0, False: 167] ------------------ 37| 0| fatal("xmalloc: zero size"); ------------------ | | 115| 0|#define fatal(...) sshfatal(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 38| 167| ptr = malloc(size); 39| 167| if (ptr == NULL) ------------------ | Branch (39:6): [True: 0, False: 167] ------------------ 40| 0| fatal("xmalloc: out of memory (allocating %zu bytes)", size); ------------------ | | 115| 0|#define fatal(...) sshfatal(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 41| 167| return ptr; 42| 167|} xreallocarray: 62| 5|{ 63| 5| void *new_ptr; 64| | 65| 5| new_ptr = reallocarray(ptr, nmemb, size); 66| 5| if (new_ptr == NULL) ------------------ | Branch (66:6): [True: 0, False: 5] ------------------ 67| 0| fatal("xreallocarray: out of memory (%zu elements of %zu bytes)", ------------------ | | 115| 0|#define fatal(...) sshfatal(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 68| 5| nmemb, size); 69| 5| return new_ptr; 70| 5|} xstrdup: 86| 162|{ 87| 162| size_t len; 88| 162| char *cp; 89| | 90| 162| len = strlen(str) + 1; 91| 162| cp = xmalloc(len); 92| 162| return memcpy(cp, str, len); 93| 162|} xvasprintf: 97| 44|{ 98| 44| int i; 99| | 100| 44| i = vasprintf(ret, fmt, ap); 101| 44| if (i < 0 || *ret == NULL) ------------------ | Branch (101:6): [True: 0, False: 44] | Branch (101:15): [True: 0, False: 44] ------------------ 102| 0| fatal("xvasprintf: could not allocate memory"); ------------------ | | 115| 0|#define fatal(...) sshfatal(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) ------------------ 103| 44| return i; 104| 44|} xasprintf: 108| 44|{ 109| 44| va_list ap; 110| 44| int i; 111| | 112| 44| va_start(ap, fmt); 113| 44| i = xvasprintf(ret, fmt, ap); 114| | va_end(ap); 115| 44| return i; 116| 44|}