File: | src/usr.bin/ssh/ssh-keyscan/../sshbuf.c |
Warning: | line 126, column 3 Potential leak of memory pointed to by 'ret' |
Press '?' to see keyboard shortcuts
Keyboard shortcuts:
1 | /* $OpenBSD: sshbuf.c,v 1.15 2020/02/26 13:40:09 jsg Exp $ */ | |||
2 | /* | |||
3 | * Copyright (c) 2011 Damien Miller | |||
4 | * | |||
5 | * Permission to use, copy, modify, and distribute this software for any | |||
6 | * purpose with or without fee is hereby granted, provided that the above | |||
7 | * copyright notice and this permission notice appear in all copies. | |||
8 | * | |||
9 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES | |||
10 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF | |||
11 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR | |||
12 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | |||
13 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN | |||
14 | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF | |||
15 | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | |||
16 | */ | |||
17 | ||||
18 | #include <sys/types.h> | |||
19 | #include <signal.h> | |||
20 | #include <stdlib.h> | |||
21 | #include <stdio.h> | |||
22 | #include <string.h> | |||
23 | ||||
24 | #include "ssherr.h" | |||
25 | #define SSHBUF_INTERNAL | |||
26 | #include "sshbuf.h" | |||
27 | #include "misc.h" | |||
28 | ||||
29 | static inline int | |||
30 | sshbuf_check_sanity(const struct sshbuf *buf) | |||
31 | { | |||
32 | SSHBUF_TELL("sanity"); | |||
33 | if (__predict_false(buf == NULL ||__builtin_expect(((buf == ((void *)0) || (!buf->readonly && buf->d != buf->cd) || buf->refcount < 1 || buf-> refcount > 0x100000 || buf->cd == ((void *)0) || buf-> max_size > 0x8000000 || buf->alloc > buf->max_size || buf->size > buf->alloc || buf->off > buf-> size) != 0), 0) | |||
34 | (!buf->readonly && buf->d != buf->cd) ||__builtin_expect(((buf == ((void *)0) || (!buf->readonly && buf->d != buf->cd) || buf->refcount < 1 || buf-> refcount > 0x100000 || buf->cd == ((void *)0) || buf-> max_size > 0x8000000 || buf->alloc > buf->max_size || buf->size > buf->alloc || buf->off > buf-> size) != 0), 0) | |||
35 | buf->refcount < 1 || buf->refcount > SSHBUF_REFS_MAX ||__builtin_expect(((buf == ((void *)0) || (!buf->readonly && buf->d != buf->cd) || buf->refcount < 1 || buf-> refcount > 0x100000 || buf->cd == ((void *)0) || buf-> max_size > 0x8000000 || buf->alloc > buf->max_size || buf->size > buf->alloc || buf->off > buf-> size) != 0), 0) | |||
36 | buf->cd == NULL ||__builtin_expect(((buf == ((void *)0) || (!buf->readonly && buf->d != buf->cd) || buf->refcount < 1 || buf-> refcount > 0x100000 || buf->cd == ((void *)0) || buf-> max_size > 0x8000000 || buf->alloc > buf->max_size || buf->size > buf->alloc || buf->off > buf-> size) != 0), 0) | |||
37 | buf->max_size > SSHBUF_SIZE_MAX ||__builtin_expect(((buf == ((void *)0) || (!buf->readonly && buf->d != buf->cd) || buf->refcount < 1 || buf-> refcount > 0x100000 || buf->cd == ((void *)0) || buf-> max_size > 0x8000000 || buf->alloc > buf->max_size || buf->size > buf->alloc || buf->off > buf-> size) != 0), 0) | |||
38 | buf->alloc > buf->max_size ||__builtin_expect(((buf == ((void *)0) || (!buf->readonly && buf->d != buf->cd) || buf->refcount < 1 || buf-> refcount > 0x100000 || buf->cd == ((void *)0) || buf-> max_size > 0x8000000 || buf->alloc > buf->max_size || buf->size > buf->alloc || buf->off > buf-> size) != 0), 0) | |||
39 | buf->size > buf->alloc ||__builtin_expect(((buf == ((void *)0) || (!buf->readonly && buf->d != buf->cd) || buf->refcount < 1 || buf-> refcount > 0x100000 || buf->cd == ((void *)0) || buf-> max_size > 0x8000000 || buf->alloc > buf->max_size || buf->size > buf->alloc || buf->off > buf-> size) != 0), 0) | |||
40 | buf->off > buf->size)__builtin_expect(((buf == ((void *)0) || (!buf->readonly && buf->d != buf->cd) || buf->refcount < 1 || buf-> refcount > 0x100000 || buf->cd == ((void *)0) || buf-> max_size > 0x8000000 || buf->alloc > buf->max_size || buf->size > buf->alloc || buf->off > buf-> size) != 0), 0)) { | |||
41 | /* Do not try to recover from corrupted buffer internals */ | |||
42 | SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR")); | |||
43 | ssh_signal(SIGSEGV11, SIG_DFL(void (*)(int))0); | |||
44 | raise(SIGSEGV11); | |||
45 | return SSH_ERR_INTERNAL_ERROR-1; | |||
46 | } | |||
47 | return 0; | |||
48 | } | |||
49 | ||||
50 | static void | |||
51 | sshbuf_maybe_pack(struct sshbuf *buf, int force) | |||
52 | { | |||
53 | SSHBUF_DBG(("force %d", force)); | |||
54 | SSHBUF_TELL("pre-pack"); | |||
55 | if (buf->off == 0 || buf->readonly || buf->refcount > 1) | |||
56 | return; | |||
57 | if (force || | |||
58 | (buf->off >= SSHBUF_PACK_MIN8192 && buf->off >= buf->size / 2)) { | |||
59 | memmove(buf->d, buf->d + buf->off, buf->size - buf->off); | |||
60 | buf->size -= buf->off; | |||
61 | buf->off = 0; | |||
62 | SSHBUF_TELL("packed"); | |||
63 | } | |||
64 | } | |||
65 | ||||
66 | struct sshbuf * | |||
67 | sshbuf_new(void) | |||
68 | { | |||
69 | struct sshbuf *ret; | |||
70 | ||||
71 | if ((ret = calloc(sizeof(*ret), 1)) == NULL((void *)0)) | |||
72 | return NULL((void *)0); | |||
73 | ret->alloc = SSHBUF_SIZE_INIT256; | |||
74 | ret->max_size = SSHBUF_SIZE_MAX0x8000000; | |||
75 | ret->readonly = 0; | |||
76 | ret->refcount = 1; | |||
77 | ret->parent = NULL((void *)0); | |||
78 | if ((ret->cd = ret->d = calloc(1, ret->alloc)) == NULL((void *)0)) { | |||
79 | free(ret); | |||
80 | return NULL((void *)0); | |||
81 | } | |||
82 | return ret; | |||
83 | } | |||
84 | ||||
85 | struct sshbuf * | |||
86 | sshbuf_from(const void *blob, size_t len) | |||
87 | { | |||
88 | struct sshbuf *ret; | |||
89 | ||||
90 | if (blob == NULL((void *)0) || len
| |||
91 | (ret = calloc(sizeof(*ret), 1)) == NULL((void *)0)) | |||
92 | return NULL((void *)0); | |||
93 | ret->alloc = ret->size = ret->max_size = len; | |||
94 | ret->readonly = 1; | |||
95 | ret->refcount = 1; | |||
96 | ret->parent = NULL((void *)0); | |||
97 | ret->cd = blob; | |||
98 | ret->d = NULL((void *)0); | |||
99 | return ret; | |||
100 | } | |||
101 | ||||
102 | int | |||
103 | sshbuf_set_parent(struct sshbuf *child, struct sshbuf *parent) | |||
104 | { | |||
105 | int r; | |||
106 | ||||
107 | if ((r = sshbuf_check_sanity(child)) != 0 || | |||
108 | (r = sshbuf_check_sanity(parent)) != 0) | |||
109 | return r; | |||
110 | child->parent = parent; | |||
111 | child->parent->refcount++; | |||
112 | return 0; | |||
113 | } | |||
114 | ||||
115 | struct sshbuf * | |||
116 | sshbuf_fromb(struct sshbuf *buf) | |||
117 | { | |||
118 | struct sshbuf *ret; | |||
119 | ||||
120 | if (sshbuf_check_sanity(buf) != 0) | |||
| ||||
121 | return NULL((void *)0); | |||
122 | if ((ret = sshbuf_from(sshbuf_ptr(buf), sshbuf_len(buf))) == NULL((void *)0)) | |||
123 | return NULL((void *)0); | |||
124 | if (sshbuf_set_parent(ret, buf) != 0) { | |||
125 | sshbuf_free(ret); | |||
126 | return NULL((void *)0); | |||
| ||||
127 | } | |||
128 | return ret; | |||
129 | } | |||
130 | ||||
131 | void | |||
132 | sshbuf_free(struct sshbuf *buf) | |||
133 | { | |||
134 | if (buf == NULL((void *)0)) | |||
135 | return; | |||
136 | /* | |||
137 | * The following will leak on insane buffers, but this is the safest | |||
138 | * course of action - an invalid pointer or already-freed pointer may | |||
139 | * have been passed to us and continuing to scribble over memory would | |||
140 | * be bad. | |||
141 | */ | |||
142 | if (sshbuf_check_sanity(buf) != 0) | |||
143 | return; | |||
144 | ||||
145 | /* | |||
146 | * If we are a parent with still-extant children, then don't free just | |||
147 | * yet. The last child's call to sshbuf_free should decrement our | |||
148 | * refcount to 0 and trigger the actual free. | |||
149 | */ | |||
150 | buf->refcount--; | |||
151 | if (buf->refcount > 0) | |||
152 | return; | |||
153 | ||||
154 | /* | |||
155 | * If we are a child, the free our parent to decrement its reference | |||
156 | * count and possibly free it. | |||
157 | */ | |||
158 | sshbuf_free(buf->parent); | |||
159 | buf->parent = NULL((void *)0); | |||
160 | ||||
161 | if (!buf->readonly) { | |||
162 | explicit_bzero(buf->d, buf->alloc); | |||
163 | free(buf->d); | |||
164 | } | |||
165 | freezero(buf, sizeof(*buf)); | |||
166 | } | |||
167 | ||||
168 | void | |||
169 | sshbuf_reset(struct sshbuf *buf) | |||
170 | { | |||
171 | u_char *d; | |||
172 | ||||
173 | if (buf->readonly || buf->refcount > 1) { | |||
174 | /* Nonsensical. Just make buffer appear empty */ | |||
175 | buf->off = buf->size; | |||
176 | return; | |||
177 | } | |||
178 | (void) sshbuf_check_sanity(buf); | |||
179 | buf->off = buf->size = 0; | |||
180 | if (buf->alloc != SSHBUF_SIZE_INIT256) { | |||
181 | if ((d = recallocarray(buf->d, buf->alloc, SSHBUF_SIZE_INIT256, | |||
182 | 1)) != NULL((void *)0)) { | |||
183 | buf->cd = buf->d = d; | |||
184 | buf->alloc = SSHBUF_SIZE_INIT256; | |||
185 | } | |||
186 | } | |||
187 | explicit_bzero(buf->d, SSHBUF_SIZE_INIT256); | |||
188 | } | |||
189 | ||||
190 | size_t | |||
191 | sshbuf_max_size(const struct sshbuf *buf) | |||
192 | { | |||
193 | return buf->max_size; | |||
194 | } | |||
195 | ||||
196 | size_t | |||
197 | sshbuf_alloc(const struct sshbuf *buf) | |||
198 | { | |||
199 | return buf->alloc; | |||
200 | } | |||
201 | ||||
202 | const struct sshbuf * | |||
203 | sshbuf_parent(const struct sshbuf *buf) | |||
204 | { | |||
205 | return buf->parent; | |||
206 | } | |||
207 | ||||
208 | u_int | |||
209 | sshbuf_refcount(const struct sshbuf *buf) | |||
210 | { | |||
211 | return buf->refcount; | |||
212 | } | |||
213 | ||||
214 | int | |||
215 | sshbuf_set_max_size(struct sshbuf *buf, size_t max_size) | |||
216 | { | |||
217 | size_t rlen; | |||
218 | u_char *dp; | |||
219 | int r; | |||
220 | ||||
221 | SSHBUF_DBG(("set max buf = %p len = %zu", buf, max_size)); | |||
222 | if ((r = sshbuf_check_sanity(buf)) != 0) | |||
223 | return r; | |||
224 | if (max_size == buf->max_size) | |||
225 | return 0; | |||
226 | if (buf->readonly || buf->refcount > 1) | |||
227 | return SSH_ERR_BUFFER_READ_ONLY-49; | |||
228 | if (max_size > SSHBUF_SIZE_MAX0x8000000) | |||
229 | return SSH_ERR_NO_BUFFER_SPACE-9; | |||
230 | /* pack and realloc if necessary */ | |||
231 | sshbuf_maybe_pack(buf, max_size < buf->size); | |||
232 | if (max_size < buf->alloc && max_size > buf->size) { | |||
233 | if (buf->size < SSHBUF_SIZE_INIT256) | |||
234 | rlen = SSHBUF_SIZE_INIT256; | |||
235 | else | |||
236 | rlen = ROUNDUP(buf->size, SSHBUF_SIZE_INC)((((buf->size)+((256)-1))/(256))*(256)); | |||
237 | if (rlen > max_size) | |||
238 | rlen = max_size; | |||
239 | SSHBUF_DBG(("new alloc = %zu", rlen)); | |||
240 | if ((dp = recallocarray(buf->d, buf->alloc, rlen, 1)) == NULL((void *)0)) | |||
241 | return SSH_ERR_ALLOC_FAIL-2; | |||
242 | buf->cd = buf->d = dp; | |||
243 | buf->alloc = rlen; | |||
244 | } | |||
245 | SSHBUF_TELL("new-max"); | |||
246 | if (max_size < buf->alloc) | |||
247 | return SSH_ERR_NO_BUFFER_SPACE-9; | |||
248 | buf->max_size = max_size; | |||
249 | return 0; | |||
250 | } | |||
251 | ||||
252 | size_t | |||
253 | sshbuf_len(const struct sshbuf *buf) | |||
254 | { | |||
255 | if (sshbuf_check_sanity(buf) != 0) | |||
256 | return 0; | |||
257 | return buf->size - buf->off; | |||
258 | } | |||
259 | ||||
260 | size_t | |||
261 | sshbuf_avail(const struct sshbuf *buf) | |||
262 | { | |||
263 | if (sshbuf_check_sanity(buf) != 0 || buf->readonly || buf->refcount > 1) | |||
264 | return 0; | |||
265 | return buf->max_size - (buf->size - buf->off); | |||
266 | } | |||
267 | ||||
268 | const u_char * | |||
269 | sshbuf_ptr(const struct sshbuf *buf) | |||
270 | { | |||
271 | if (sshbuf_check_sanity(buf) != 0) | |||
272 | return NULL((void *)0); | |||
273 | return buf->cd + buf->off; | |||
274 | } | |||
275 | ||||
276 | u_char * | |||
277 | sshbuf_mutable_ptr(const struct sshbuf *buf) | |||
278 | { | |||
279 | if (sshbuf_check_sanity(buf) != 0 || buf->readonly || buf->refcount > 1) | |||
280 | return NULL((void *)0); | |||
281 | return buf->d + buf->off; | |||
282 | } | |||
283 | ||||
284 | int | |||
285 | sshbuf_check_reserve(const struct sshbuf *buf, size_t len) | |||
286 | { | |||
287 | int r; | |||
288 | ||||
289 | if ((r = sshbuf_check_sanity(buf)) != 0) | |||
290 | return r; | |||
291 | if (buf->readonly || buf->refcount > 1) | |||
292 | return SSH_ERR_BUFFER_READ_ONLY-49; | |||
293 | SSHBUF_TELL("check"); | |||
294 | /* Check that len is reasonable and that max_size + available < len */ | |||
295 | if (len > buf->max_size || buf->max_size - len < buf->size - buf->off) | |||
296 | return SSH_ERR_NO_BUFFER_SPACE-9; | |||
297 | return 0; | |||
298 | } | |||
299 | ||||
300 | int | |||
301 | sshbuf_allocate(struct sshbuf *buf, size_t len) | |||
302 | { | |||
303 | size_t rlen, need; | |||
304 | u_char *dp; | |||
305 | int r; | |||
306 | ||||
307 | SSHBUF_DBG(("allocate buf = %p len = %zu", buf, len)); | |||
308 | if ((r = sshbuf_check_reserve(buf, len)) != 0) | |||
309 | return r; | |||
310 | /* | |||
311 | * If the requested allocation appended would push us past max_size | |||
312 | * then pack the buffer, zeroing buf->off. | |||
313 | */ | |||
314 | sshbuf_maybe_pack(buf, buf->size + len > buf->max_size); | |||
315 | SSHBUF_TELL("allocate"); | |||
316 | if (len + buf->size <= buf->alloc) | |||
317 | return 0; /* already have it. */ | |||
318 | ||||
319 | /* | |||
320 | * Prefer to alloc in SSHBUF_SIZE_INC units, but | |||
321 | * allocate less if doing so would overflow max_size. | |||
322 | */ | |||
323 | need = len + buf->size - buf->alloc; | |||
324 | rlen = ROUNDUP(buf->alloc + need, SSHBUF_SIZE_INC)((((buf->alloc + need)+((256)-1))/(256))*(256)); | |||
325 | SSHBUF_DBG(("need %zu initial rlen %zu", need, rlen)); | |||
326 | if (rlen > buf->max_size) | |||
327 | rlen = buf->alloc + need; | |||
328 | SSHBUF_DBG(("adjusted rlen %zu", rlen)); | |||
329 | if ((dp = recallocarray(buf->d, buf->alloc, rlen, 1)) == NULL((void *)0)) { | |||
330 | SSHBUF_DBG(("realloc fail")); | |||
331 | return SSH_ERR_ALLOC_FAIL-2; | |||
332 | } | |||
333 | buf->alloc = rlen; | |||
334 | buf->cd = buf->d = dp; | |||
335 | if ((r = sshbuf_check_reserve(buf, len)) < 0) { | |||
336 | /* shouldn't fail */ | |||
337 | return r; | |||
338 | } | |||
339 | SSHBUF_TELL("done"); | |||
340 | return 0; | |||
341 | } | |||
342 | ||||
343 | int | |||
344 | sshbuf_reserve(struct sshbuf *buf, size_t len, u_char **dpp) | |||
345 | { | |||
346 | u_char *dp; | |||
347 | int r; | |||
348 | ||||
349 | if (dpp != NULL((void *)0)) | |||
350 | *dpp = NULL((void *)0); | |||
351 | ||||
352 | SSHBUF_DBG(("reserve buf = %p len = %zu", buf, len)); | |||
353 | if ((r = sshbuf_allocate(buf, len)) != 0) | |||
354 | return r; | |||
355 | ||||
356 | dp = buf->d + buf->size; | |||
357 | buf->size += len; | |||
358 | if (dpp != NULL((void *)0)) | |||
359 | *dpp = dp; | |||
360 | return 0; | |||
361 | } | |||
362 | ||||
363 | int | |||
364 | sshbuf_consume(struct sshbuf *buf, size_t len) | |||
365 | { | |||
366 | int r; | |||
367 | ||||
368 | SSHBUF_DBG(("len = %zu", len)); | |||
369 | if ((r = sshbuf_check_sanity(buf)) != 0) | |||
370 | return r; | |||
371 | if (len == 0) | |||
372 | return 0; | |||
373 | if (len > sshbuf_len(buf)) | |||
374 | return SSH_ERR_MESSAGE_INCOMPLETE-3; | |||
375 | buf->off += len; | |||
376 | /* deal with empty buffer */ | |||
377 | if (buf->off == buf->size) | |||
378 | buf->off = buf->size = 0; | |||
379 | SSHBUF_TELL("done"); | |||
380 | return 0; | |||
381 | } | |||
382 | ||||
383 | int | |||
384 | sshbuf_consume_end(struct sshbuf *buf, size_t len) | |||
385 | { | |||
386 | int r; | |||
387 | ||||
388 | SSHBUF_DBG(("len = %zu", len)); | |||
389 | if ((r = sshbuf_check_sanity(buf)) != 0) | |||
390 | return r; | |||
391 | if (len == 0) | |||
392 | return 0; | |||
393 | if (len > sshbuf_len(buf)) | |||
394 | return SSH_ERR_MESSAGE_INCOMPLETE-3; | |||
395 | buf->size -= len; | |||
396 | SSHBUF_TELL("done"); | |||
397 | return 0; | |||
398 | } | |||
399 |