lib/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2025-11-27 13:21:11 +03:00
Code Activity

buffer: buffer: Improve argument checking of in ssh_buffer_pack()

Browse Source 
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Aris Adamantiadis <aris@0xbadc0de.be>
This commit is contained in:
Andreas Schneider
2015-02-02 16:59:48 +01:00
parent 6789170799
commit de10a7754b
2 changed files with 37 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
include/libssh/buffer.h
View File

@@ -64,9 +64,15 @@ int _ssh_buffer_pack(struct ssh_buffer_struct *buffer,
#define ssh_buffer_pack(buffer, format, ...) \ #define ssh_buffer_pack(buffer, format, ...) \
_ssh_buffer_pack((buffer), (format), __VA_NARG__(__VA_ARGS__), __VA_ARGS__, SSH_BUFFER_PACK_END) _ssh_buffer_pack((buffer), (format), __VA_NARG__(__VA_ARGS__), __VA_ARGS__, SSH_BUFFER_PACK_END)
int ssh_buffer_unpack_va(struct ssh_buffer_struct *buffer, const char *format, va_list ap); int ssh_buffer_unpack_va(struct ssh_buffer_struct *buffer,
int _ssh_buffer_unpack(struct ssh_buffer_struct *buffer, const char *format, ...); const char *format, int argc,
#define ssh_buffer_unpack(buffer, format, ...) _ssh_buffer_unpack((buffer),(format), __VA_ARGS__, SSH_BUFFER_PACK_END) va_list ap);
int _ssh_buffer_unpack(struct ssh_buffer_struct *buffer,
const char *format,
int argc,
...);
#define ssh_buffer_unpack(buffer, format, ...) \
_ssh_buffer_unpack((buffer), (format), __VA_NARG__(__VA_ARGS__), __VA_ARGS__, SSH_BUFFER_PACK_END)
int buffer_prepend_data(ssh_buffer buffer, const void *data, uint32_t len); int buffer_prepend_data(ssh_buffer buffer, const void *data, uint32_t len);
int buffer_add_buffer(ssh_buffer buffer, ssh_buffer source); int buffer_add_buffer(ssh_buffer buffer, ssh_buffer source);

33
src/buffer.c
View File

@@ -839,7 +839,11 @@ int _ssh_buffer_pack(struct ssh_buffer_struct *buffer,
* SSH_ERROR on error * SSH_ERROR on error
* @see ssh_buffer_get_format() for format list values. * @see ssh_buffer_get_format() for format list values.
*/ */
int ssh_buffer_unpack_va(struct ssh_buffer_struct *buffer, const char *format, va_list ap){ int ssh_buffer_unpack_va(struct ssh_buffer_struct *buffer,
const char *format,
int argc,
va_list ap)
{
int rc = SSH_ERROR; int rc = SSH_ERROR;
const char *p, *last; const char *p, *last;
union { union {
@@ -854,11 +858,17 @@ int ssh_buffer_unpack_va(struct ssh_buffer_struct *buffer, const char *format, v
size_t len, rlen; size_t len, rlen;
uint32_t u32len; uint32_t u32len;
va_list ap_copy; va_list ap_copy;
int count;
/* copy the argument list in case a rollback is needed */ /* copy the argument list in case a rollback is needed */
va_copy(ap_copy, ap); va_copy(ap_copy, ap);
for (p = format; *p != '\0'; p++) { for (p = format, count = 0; *p != '\0'; p++, count++) {
/* Invalid number of arguments passed */
if (count > argc) {
return SSH_ERROR;
}
switch (*p) { switch (*p) {
case 'b': case 'b':
o.byte = va_arg(ap, uint8_t *); o.byte = va_arg(ap, uint8_t *);
@@ -919,7 +929,10 @@ int ssh_buffer_unpack_va(struct ssh_buffer_struct *buffer, const char *format, v
break; break;
case 'P': case 'P':
len = va_arg(ap, size_t); len = va_arg(ap, size_t);
o.data = va_arg(ap, void **); o.data = va_arg(ap, void **);
count++;
*o.data = malloc(len); *o.data = malloc(len);
if(*o.data == NULL){ if(*o.data == NULL){
rc = SSH_ERROR; rc = SSH_ERROR;
@@ -942,6 +955,11 @@ int ssh_buffer_unpack_va(struct ssh_buffer_struct *buffer, const char *format, v
break; break;
} }
} }
if (argc != count) {
rc = SSH_ERROR;
}
if (rc != SSH_ERROR){ if (rc != SSH_ERROR){
/* verify that the last hidden argument is correct */ /* verify that the last hidden argument is correct */
uint32_t canary = va_arg(ap, uint32_t); uint32_t canary = va_arg(ap, uint32_t);
@@ -949,6 +967,7 @@ int ssh_buffer_unpack_va(struct ssh_buffer_struct *buffer, const char *format, v
rc = SSH_ERROR; rc = SSH_ERROR;
} }
} }
if (rc != SSH_OK){ if (rc != SSH_OK){
/* Reset the format string and erase everything that was allocated */ /* Reset the format string and erase everything that was allocated */
last = p; last = p;
@@ -1002,12 +1021,16 @@ int ssh_buffer_unpack_va(struct ssh_buffer_struct *buffer, const char *format, v
* @warning when using 'P' with a constant size (e.g. 8), do not * @warning when using 'P' with a constant size (e.g. 8), do not
* forget to cast to (size_t). * forget to cast to (size_t).
*/ */
int _ssh_buffer_unpack(struct ssh_buffer_struct *buffer, const char *format, ...){ int _ssh_buffer_unpack(struct ssh_buffer_struct *buffer,
const char *format,
int argc,
...)
{
va_list ap; va_list ap;
int rc; int rc;
va_start(ap, format); va_start(ap, argc);
rc = ssh_buffer_unpack_va(buffer, format, ap); rc = ssh_buffer_unpack_va(buffer, format, argc, ap);
va_end(ap); va_end(ap);
return rc; return rc;
} }