lib/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2025-11-29 01:03:57 +03:00
Code Activity

misc: Avoid the 4KB stack buffer in ssh_bind_options_expand_escape

Browse Source 
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
Change-Id: Icfd24fdb8c7f549b8cb72d793cfc767979740fdc
This commit is contained in:
Xiang Xiao
2021-05-10 01:35:29 +08:00
committed by Jakub Jelen
parent 9eba361ca2
commit 925dc92d52
1 changed files with 23 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
src/options.c
View File

@@ -2031,8 +2031,9 @@ int ssh_bind_options_set(ssh_bind sshbind, enum ssh_bind_options_e type,
static char *ssh_bind_options_expand_escape(ssh_bind sshbind, const char *s) static char *ssh_bind_options_expand_escape(ssh_bind sshbind, const char *s)
{ {
char buf[MAX_BUF_SIZE]; char *buf = NULL;
char *r, *x = NULL; char *r = NULL;
char *x = NULL;
const char *p; const char *p;
size_t i, l; size_t i, l;
@@ -2048,6 +2049,13 @@ static char *ssh_bind_options_expand_escape(ssh_bind sshbind, const char *s)
return NULL; return NULL;
} }
buf = malloc(MAX_BUF_SIZE);
if (buf == NULL) {
ssh_set_error_oom(sshbind);
free(r);
return NULL;
}
p = r; p = r;
buf[0] = '\0'; buf[0] = '\0';
@@ -2056,6 +2064,7 @@ static char *ssh_bind_options_expand_escape(ssh_bind sshbind, const char *s)
buf[i] = *p; buf[i] = *p;
i++; i++;
if (i >= MAX_BUF_SIZE) { if (i >= MAX_BUF_SIZE) {
free(buf);
free(r); free(r);
return NULL; return NULL;
} }
@@ -2075,12 +2084,14 @@ static char *ssh_bind_options_expand_escape(ssh_bind sshbind, const char *s)
default: default:
ssh_set_error(sshbind, SSH_FATAL, ssh_set_error(sshbind, SSH_FATAL,
"Wrong escape sequence detected"); "Wrong escape sequence detected");
free(buf);
free(r); free(r);
return NULL; return NULL;
} }
if (x == NULL) { if (x == NULL) {
ssh_set_error_oom(sshbind); ssh_set_error_oom(sshbind);
free(buf);
free(r); free(r);
return NULL; return NULL;
} }
@@ -2089,18 +2100,26 @@ static char *ssh_bind_options_expand_escape(ssh_bind sshbind, const char *s)
if (i >= MAX_BUF_SIZE) { if (i >= MAX_BUF_SIZE) {
ssh_set_error(sshbind, SSH_FATAL, ssh_set_error(sshbind, SSH_FATAL,
"String too long"); "String too long");
free(buf);
free(x); free(x);
free(r); free(r);
return NULL; return NULL;
} }
l = strlen(buf); l = strlen(buf);
strncpy(buf + l, x, sizeof(buf) - l - 1); strncpy(buf + l, x, MAX_BUF_SIZE - l - 1);
buf[i] = '\0'; buf[i] = '\0';
SAFE_FREE(x); SAFE_FREE(x);
} }
free(r); free(r);
return strdup(buf);
/* strip the unused space by realloc */
x = realloc(buf, strlen(buf) + 1);
if (x == NULL) {
ssh_set_error_oom(sshbind);
free(buf);
}
return x;
} }
/** /**