lib/libssh2
1
0
Fork 0
mirror of https://github.com/libssh2/libssh2.git synced 2025-11-20 02:42:09 +03:00
Code Activity

kex.c: kex_agree_instr() improve string reading (#552)

Browse Source 
* kex.c: kex_agree_instr() improve string reading

file: kex.c
notes: if haystack isn't null terminated we should use memchr() not strchar(). We should also make sure we don't walk off the end of the buffer.
credit: 
Will Cosgrove, reviewed by Michael Buckley
This commit is contained in:
Will Cosgrove
2021-02-02 10:11:14 -08:00
committed by GitHub
parent c69f1f27dc
commit cde13f6201
1 changed files with 22 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
src/kex.c
View File

@@ -3286,24 +3286,40 @@ kex_agree_instr(unsigned char *haystack, unsigned long haystack_len,
const unsigned char *needle, unsigned long needle_len)
{
unsigned char *s;
unsigned char *end_haystack;
unsigned long left;
/* Haystack too short to bother trying */
if(haystack_len < needle_len) {
if(haystack == NULL || needle == NULL) {
return NULL;
}
/* Haystack too short to bother trying */
if(haystack_len < needle_len || needle_len == 0) {
return NULL;
}
s = haystack;
end_haystack = &haystack[haystack_len];
left = end_haystack - s;
/* Needle at start of haystack */
if((strncmp((char *) haystack, (char *) needle, needle_len) == 0) &&
(needle_len == haystack_len || haystack[needle_len] == ',')) {
return haystack;
}
s = haystack;
/* Search until we run out of comas or we run out of haystack,
whichever comes first */
while((s = (unsigned char *) strchr((char *) s, ','))
&& ((haystack_len - (s - haystack)) > needle_len)) {
s++;
while((s = (unsigned char *) memchr((char *) s, ',', left))) {
/* Advance buffer past coma if we can */
left = end_haystack - s;
if((left >= 1) && (left <= haystack_len) && (left > needle_len)) {
s++;
}
else {
return NULL;
}
/* Needle at X position */
if((strncmp((char *) s, (char *) needle, needle_len) == 0) &&
(((s - haystack) + needle_len) == haystack_len