IABSD.fr/src/usr.bin/ssh/sshbuf.c

Branch : - branch - master - tag -

• Show log

  Commit

• Author : jsg
  Date : 2020-02-26 13:40:09
  Hash : c9831b39
  Message : change explicit_bzero();free() to freezero() While freezero() returns early if the pointer is NULL the tests for NULL in callers are left to avoid warnings about passing an uninitialised size argument across a function boundry. ok deraadt@ djm@

• usr.bin/ssh/sshbuf.c

• /*	$OpenBSD: sshbuf.c,v 1.15 2020/02/26 13:40:09 jsg Exp $	*/
  /*
   * Copyright (c) 2011 Damien Miller
   *
   * Permission to use, copy, modify, and distribute this software for any
   * purpose with or without fee is hereby granted, provided that the above
   * copyright notice and this permission notice appear in all copies.
   *
   * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
   * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
   * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
   * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
   */
  
  #include <sys/types.h>
  #include <signal.h>
  #include <stdlib.h>
  #include <stdio.h>
  #include <string.h>
  
  #include "ssherr.h"
  #define SSHBUF_INTERNAL
  #include "sshbuf.h"
  #include "misc.h"
  
  static inline int
  sshbuf_check_sanity(const struct sshbuf *buf)
  {
  	SSHBUF_TELL("sanity");
  	if (__predict_false(buf == NULL ||
  	    (!buf->readonly && buf->d != buf->cd) ||
  	    buf->refcount < 1 || buf->refcount > SSHBUF_REFS_MAX ||
  	    buf->cd == NULL ||
  	    buf->max_size > SSHBUF_SIZE_MAX ||
  	    buf->alloc > buf->max_size ||
  	    buf->size > buf->alloc ||
  	    buf->off > buf->size)) {
  		/* Do not try to recover from corrupted buffer internals */
  		SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
  		ssh_signal(SIGSEGV, SIG_DFL);
  		raise(SIGSEGV);
  		return SSH_ERR_INTERNAL_ERROR;
  	}
  	return 0;
  }
  
  static void
  sshbuf_maybe_pack(struct sshbuf *buf, int force)
  {
  	SSHBUF_DBG(("force %d", force));
  	SSHBUF_TELL("pre-pack");
  	if (buf->off == 0 || buf->readonly || buf->refcount > 1)
  		return;
  	if (force ||
  	    (buf->off >= SSHBUF_PACK_MIN && buf->off >= buf->size / 2)) {
  		memmove(buf->d, buf->d + buf->off, buf->size - buf->off);
  		buf->size -= buf->off;
  		buf->off = 0;
  		SSHBUF_TELL("packed");
  	}
  }
  
  struct sshbuf *
  sshbuf_new(void)
  {
  	struct sshbuf *ret;
  
  	if ((ret = calloc(sizeof(*ret), 1)) == NULL)
  		return NULL;
  	ret->alloc = SSHBUF_SIZE_INIT;
  	ret->max_size = SSHBUF_SIZE_MAX;
  	ret->readonly = 0;
  	ret->refcount = 1;
  	ret->parent = NULL;
  	if ((ret->cd = ret->d = calloc(1, ret->alloc)) == NULL) {
  		free(ret);
  		return NULL;
  	}
  	return ret;
  }
  
  struct sshbuf *
  sshbuf_from(const void *blob, size_t len)
  {
  	struct sshbuf *ret;
  
  	if (blob == NULL || len > SSHBUF_SIZE_MAX ||
  	    (ret = calloc(sizeof(*ret), 1)) == NULL)
  		return NULL;
  	ret->alloc = ret->size = ret->max_size = len;
  	ret->readonly = 1;
  	ret->refcount = 1;
  	ret->parent = NULL;
  	ret->cd = blob;
  	ret->d = NULL;
  	return ret;
  }
  
  int
  sshbuf_set_parent(struct sshbuf *child, struct sshbuf *parent)
  {
  	int r;
  
  	if ((r = sshbuf_check_sanity(child)) != 0 ||
  	    (r = sshbuf_check_sanity(parent)) != 0)
  		return r;
  	child->parent = parent;
  	child->parent->refcount++;
  	return 0;
  }
  
  struct sshbuf *
  sshbuf_fromb(struct sshbuf *buf)
  {
  	struct sshbuf *ret;
  
  	if (sshbuf_check_sanity(buf) != 0)
  		return NULL;
  	if ((ret = sshbuf_from(sshbuf_ptr(buf), sshbuf_len(buf))) == NULL)
  		return NULL;
  	if (sshbuf_set_parent(ret, buf) != 0) {
  		sshbuf_free(ret);
  		return NULL;
  	}
  	return ret;
  }
  
  void
  sshbuf_free(struct sshbuf *buf)
  {
  	if (buf == NULL)
  		return;
  	/*
  	 * The following will leak on insane buffers, but this is the safest
  	 * course of action - an invalid pointer or already-freed pointer may
  	 * have been passed to us and continuing to scribble over memory would
  	 * be bad.
  	 */
  	if (sshbuf_check_sanity(buf) != 0)
  		return;
  
  	/*
  	 * If we are a parent with still-extant children, then don't free just
  	 * yet. The last child's call to sshbuf_free should decrement our
  	 * refcount to 0 and trigger the actual free.
  	 */
  	buf->refcount--;
  	if (buf->refcount > 0)
  		return;
  
  	/*
  	 * If we are a child, the free our parent to decrement its reference
  	 * count and possibly free it.
  	 */
  	sshbuf_free(buf->parent);
  	buf->parent = NULL;
  
  	if (!buf->readonly) {
  		explicit_bzero(buf->d, buf->alloc);
  		free(buf->d);
  	}
  	freezero(buf, sizeof(*buf));
  }
  
  void
  sshbuf_reset(struct sshbuf *buf)
  {
  	u_char *d;
  
  	if (buf->readonly || buf->refcount > 1) {
  		/* Nonsensical. Just make buffer appear empty */
  		buf->off = buf->size;
  		return;
  	}
  	(void) sshbuf_check_sanity(buf);
  	buf->off = buf->size = 0;
  	if (buf->alloc != SSHBUF_SIZE_INIT) {
  		if ((d = recallocarray(buf->d, buf->alloc, SSHBUF_SIZE_INIT,
  		    1)) != NULL) {
  			buf->cd = buf->d = d;
  			buf->alloc = SSHBUF_SIZE_INIT;
  		}
  	}
  	explicit_bzero(buf->d, SSHBUF_SIZE_INIT);
  }
  
  size_t
  sshbuf_max_size(const struct sshbuf *buf)
  {
  	return buf->max_size;
  }
  
  size_t
  sshbuf_alloc(const struct sshbuf *buf)
  {
  	return buf->alloc;
  }
  
  const struct sshbuf *
  sshbuf_parent(const struct sshbuf *buf)
  {
  	return buf->parent;
  }
  
  u_int
  sshbuf_refcount(const struct sshbuf *buf)
  {
  	return buf->refcount;
  }
  
  int
  sshbuf_set_max_size(struct sshbuf *buf, size_t max_size)
  {
  	size_t rlen;
  	u_char *dp;
  	int r;
  
  	SSHBUF_DBG(("set max buf = %p len = %zu", buf, max_size));
  	if ((r = sshbuf_check_sanity(buf)) != 0)
  		return r;
  	if (max_size == buf->max_size)
  		return 0;
  	if (buf->readonly || buf->refcount > 1)
  		return SSH_ERR_BUFFER_READ_ONLY;
  	if (max_size > SSHBUF_SIZE_MAX)
  		return SSH_ERR_NO_BUFFER_SPACE;
  	/* pack and realloc if necessary */
  	sshbuf_maybe_pack(buf, max_size < buf->size);
  	if (max_size < buf->alloc && max_size > buf->size) {
  		if (buf->size < SSHBUF_SIZE_INIT)
  			rlen = SSHBUF_SIZE_INIT;
  		else
  			rlen = ROUNDUP(buf->size, SSHBUF_SIZE_INC);
  		if (rlen > max_size)
  			rlen = max_size;
  		SSHBUF_DBG(("new alloc = %zu", rlen));
  		if ((dp = recallocarray(buf->d, buf->alloc, rlen, 1)) == NULL)
  			return SSH_ERR_ALLOC_FAIL;
  		buf->cd = buf->d = dp;
  		buf->alloc = rlen;
  	}
  	SSHBUF_TELL("new-max");
  	if (max_size < buf->alloc)
  		return SSH_ERR_NO_BUFFER_SPACE;
  	buf->max_size = max_size;
  	return 0;
  }
  
  size_t
  sshbuf_len(const struct sshbuf *buf)
  {
  	if (sshbuf_check_sanity(buf) != 0)
  		return 0;
  	return buf->size - buf->off;
  }
  
  size_t
  sshbuf_avail(const struct sshbuf *buf)
  {
  	if (sshbuf_check_sanity(buf) != 0 || buf->readonly || buf->refcount > 1)
  		return 0;
  	return buf->max_size - (buf->size - buf->off);
  }
  
  const u_char *
  sshbuf_ptr(const struct sshbuf *buf)
  {
  	if (sshbuf_check_sanity(buf) != 0)
  		return NULL;
  	return buf->cd + buf->off;
  }
  
  u_char *
  sshbuf_mutable_ptr(const struct sshbuf *buf)
  {
  	if (sshbuf_check_sanity(buf) != 0 || buf->readonly || buf->refcount > 1)
  		return NULL;
  	return buf->d + buf->off;
  }
  
  int
  sshbuf_check_reserve(const struct sshbuf *buf, size_t len)
  {
  	int r;
  
  	if ((r = sshbuf_check_sanity(buf)) != 0)
  		return r;
  	if (buf->readonly || buf->refcount > 1)
  		return SSH_ERR_BUFFER_READ_ONLY;
  	SSHBUF_TELL("check");
  	/* Check that len is reasonable and that max_size + available < len */
  	if (len > buf->max_size || buf->max_size - len < buf->size - buf->off)
  		return SSH_ERR_NO_BUFFER_SPACE;
  	return 0;
  }
  
  int
  sshbuf_allocate(struct sshbuf *buf, size_t len)
  {
  	size_t rlen, need;
  	u_char *dp;
  	int r;
  
  	SSHBUF_DBG(("allocate buf = %p len = %zu", buf, len));
  	if ((r = sshbuf_check_reserve(buf, len)) != 0)
  		return r;
  	/*
  	 * If the requested allocation appended would push us past max_size
  	 * then pack the buffer, zeroing buf->off.
  	 */
  	sshbuf_maybe_pack(buf, buf->size + len > buf->max_size);
  	SSHBUF_TELL("allocate");
  	if (len + buf->size <= buf->alloc)
  		return 0; /* already have it. */
  
  	/*
  	 * Prefer to alloc in SSHBUF_SIZE_INC units, but
  	 * allocate less if doing so would overflow max_size.
  	 */
  	need = len + buf->size - buf->alloc;
  	rlen = ROUNDUP(buf->alloc + need, SSHBUF_SIZE_INC);
  	SSHBUF_DBG(("need %zu initial rlen %zu", need, rlen));
  	if (rlen > buf->max_size)
  		rlen = buf->alloc + need;
  	SSHBUF_DBG(("adjusted rlen %zu", rlen));
  	if ((dp = recallocarray(buf->d, buf->alloc, rlen, 1)) == NULL) {
  		SSHBUF_DBG(("realloc fail"));
  		return SSH_ERR_ALLOC_FAIL;
  	}
  	buf->alloc = rlen;
  	buf->cd = buf->d = dp;
  	if ((r = sshbuf_check_reserve(buf, len)) < 0) {
  		/* shouldn't fail */
  		return r;
  	}
  	SSHBUF_TELL("done");
  	return 0;
  }
  
  int
  sshbuf_reserve(struct sshbuf *buf, size_t len, u_char **dpp)
  {
  	u_char *dp;
  	int r;
  
  	if (dpp != NULL)
  		*dpp = NULL;
  
  	SSHBUF_DBG(("reserve buf = %p len = %zu", buf, len));
  	if ((r = sshbuf_allocate(buf, len)) != 0)
  		return r;
  
  	dp = buf->d + buf->size;
  	buf->size += len;
  	if (dpp != NULL)
  		*dpp = dp;
  	return 0;
  }
  
  int
  sshbuf_consume(struct sshbuf *buf, size_t len)
  {
  	int r;
  
  	SSHBUF_DBG(("len = %zu", len));
  	if ((r = sshbuf_check_sanity(buf)) != 0)
  		return r;
  	if (len == 0)
  		return 0;
  	if (len > sshbuf_len(buf))
  		return SSH_ERR_MESSAGE_INCOMPLETE;
  	buf->off += len;
  	/* deal with empty buffer */
  	if (buf->off == buf->size)
  		buf->off = buf->size = 0;
  	SSHBUF_TELL("done");
  	return 0;
  }
  
  int
  sshbuf_consume_end(struct sshbuf *buf, size_t len)
  {
  	int r;
  
  	SSHBUF_DBG(("len = %zu", len));
  	if ((r = sshbuf_check_sanity(buf)) != 0)
  		return r;
  	if (len == 0)
  		return 0;
  	if (len > sshbuf_len(buf))
  		return SSH_ERR_MESSAGE_INCOMPLETE;
  	buf->size -= len;
  	SSHBUF_TELL("done");
  	return 0;
  }