lib/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2025-11-29 01:03:57 +03:00
Code Activity

buffer: add a hidden canary to detect format errors

Browse Source 
Reviewed-by: Andreas Schneider <asn@samba.org>
This commit is contained in:
Aris Adamantiadis
2014-04-22 23:00:06 +02:00
committed by Andreas Schneider
parent 7bd62dd652
commit 3b4b0f01ec
2 changed files with 23 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
src/buffer.c
View File

@@ -732,6 +732,13 @@ int ssh_buffer_pack_va(struct ssh_buffer_struct *buffer, const char *format, va_
}
}
if (rc != SSH_ERROR){
/* verify that the last hidden argument is correct */
o.dword = va_arg(ap, uint32_t);
if (o.dword != SSH_BUFFER_PACK_END){
rc = SSH_ERROR;
}
}
return rc;
}
@@ -754,7 +761,7 @@ int ssh_buffer_pack_va(struct ssh_buffer_struct *buffer, const char *format, va_
* @warning when using 'P' with a constant size (e.g. 8), do not
* forget to cast to (size_t).
*/
int ssh_buffer_pack(struct ssh_buffer_struct *buffer, const char *format, ...){
int _ssh_buffer_pack(struct ssh_buffer_struct *buffer, const char *format, ...){
va_list ap;
int rc;
@@ -876,7 +883,13 @@ int ssh_buffer_unpack_va(struct ssh_buffer_struct *buffer, const char *format, v
break;
}
}
if (rc != SSH_ERROR){
/* verify that the last hidden argument is correct */
uint32_t canary = va_arg(ap, uint32_t);
if (canary != SSH_BUFFER_PACK_END){
rc = SSH_ERROR;
}
}
if (rc != SSH_OK){
/* Reset the format string and erase everything that was allocated */
last = p;
@@ -930,7 +943,7 @@ int ssh_buffer_unpack_va(struct ssh_buffer_struct *buffer, const char *format, v
* @warning when using 'P' with a constant size (e.g. 8), do not
* forget to cast to (size_t).
*/
int ssh_buffer_unpack(struct ssh_buffer_struct *buffer, const char *format, ...){
int _ssh_buffer_unpack(struct ssh_buffer_struct *buffer, const char *format, ...){
va_list ap;
int rc;