1 /* $OpenBSD: sshbuf.c,v 1.15 2020/02/26 13:40:09 jsg Exp $ */ 2 /* 3 * Copyright (c) 2011 Damien Miller 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 #define SSHBUF_INTERNAL 19 #include "includes.h" 20 21 #include <sys/types.h> 22 #include <signal.h> 23 #include <stdlib.h> 24 #include <stdio.h> 25 #include <string.h> 26 27 #include "ssherr.h" 28 #include "sshbuf.h" 29 #include "misc.h" 30 31 static inline int 32 sshbuf_check_sanity(const struct sshbuf *buf) 33 { 34 SSHBUF_TELL("sanity"); 35 if (__predict_false(buf == NULL || 36 (!buf->readonly && buf->d != buf->cd) || 37 buf->refcount < 1 || buf->refcount > SSHBUF_REFS_MAX || 38 buf->cd == NULL || 39 buf->max_size > SSHBUF_SIZE_MAX || 40 buf->alloc > buf->max_size || 41 buf->size > buf->alloc || 42 buf->off > buf->size)) { 43 /* Do not try to recover from corrupted buffer internals */ 44 SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR")); 45 ssh_signal(SIGSEGV, SIG_DFL); 46 raise(SIGSEGV); 47 return SSH_ERR_INTERNAL_ERROR; 48 } 49 return 0; 50 } 51 52 static void 53 sshbuf_maybe_pack(struct sshbuf *buf, int force) 54 { 55 SSHBUF_DBG(("force %d", force)); 56 SSHBUF_TELL("pre-pack"); 57 if (buf->off == 0 || buf->readonly || buf->refcount > 1) 58 return; 59 if (force || 60 (buf->off >= SSHBUF_PACK_MIN && buf->off >= buf->size / 2)) { 61 memmove(buf->d, buf->d + buf->off, buf->size - buf->off); 62 buf->size -= buf->off; 63 buf->off = 0; 64 SSHBUF_TELL("packed"); 65 } 66 } 67 68 struct sshbuf * 69 sshbuf_new(void) 70 { 71 struct sshbuf *ret; 72 73 if ((ret = calloc(sizeof(*ret), 1)) == NULL) 74 return NULL; 75 ret->alloc = SSHBUF_SIZE_INIT; 76 ret->max_size = SSHBUF_SIZE_MAX; 77 ret->readonly = 0; 78 ret->refcount = 1; 79 ret->parent = NULL; 80 if ((ret->cd = ret->d = calloc(1, ret->alloc)) == NULL) { 81 free(ret); 82 return NULL; 83 } 84 return ret; 85 } 86 87 struct sshbuf * 88 sshbuf_from(const void *blob, size_t len) 89 { 90 struct sshbuf *ret; 91 92 if (blob == NULL || len > SSHBUF_SIZE_MAX || 93 (ret = calloc(sizeof(*ret), 1)) == NULL) 94 return NULL; 95 ret->alloc = ret->size = ret->max_size = len; 96 ret->readonly = 1; 97 ret->refcount = 1; 98 ret->parent = NULL; 99 ret->cd = blob; 100 ret->d = NULL; 101 return ret; 102 } 103 104 int 105 sshbuf_set_parent(struct sshbuf *child, struct sshbuf *parent) 106 { 107 int r; 108 109 if ((r = sshbuf_check_sanity(child)) != 0 || 110 (r = sshbuf_check_sanity(parent)) != 0) 111 return r; 112 child->parent = parent; 113 child->parent->refcount++; 114 return 0; 115 } 116 117 struct sshbuf * 118 sshbuf_fromb(struct sshbuf *buf) 119 { 120 struct sshbuf *ret; 121 122 if (sshbuf_check_sanity(buf) != 0) 123 return NULL; 124 if ((ret = sshbuf_from(sshbuf_ptr(buf), sshbuf_len(buf))) == NULL) 125 return NULL; 126 if (sshbuf_set_parent(ret, buf) != 0) { 127 sshbuf_free(ret); 128 return NULL; 129 } 130 return ret; 131 } 132 133 void 134 sshbuf_free(struct sshbuf *buf) 135 { 136 if (buf == NULL) 137 return; 138 /* 139 * The following will leak on insane buffers, but this is the safest 140 * course of action - an invalid pointer or already-freed pointer may 141 * have been passed to us and continuing to scribble over memory would 142 * be bad. 143 */ 144 if (sshbuf_check_sanity(buf) != 0) 145 return; 146 147 /* 148 * If we are a parent with still-extant children, then don't free just 149 * yet. The last child's call to sshbuf_free should decrement our 150 * refcount to 0 and trigger the actual free. 151 */ 152 buf->refcount--; 153 if (buf->refcount > 0) 154 return; 155 156 /* 157 * If we are a child, the free our parent to decrement its reference 158 * count and possibly free it. 159 */ 160 sshbuf_free(buf->parent); 161 buf->parent = NULL; 162 163 if (!buf->readonly) { 164 explicit_bzero(buf->d, buf->alloc); 165 free(buf->d); 166 } 167 freezero(buf, sizeof(*buf)); 168 } 169 170 void 171 sshbuf_reset(struct sshbuf *buf) 172 { 173 u_char *d; 174 175 if (buf->readonly || buf->refcount > 1) { 176 /* Nonsensical. Just make buffer appear empty */ 177 buf->off = buf->size; 178 return; 179 } 180 (void) sshbuf_check_sanity(buf); 181 buf->off = buf->size = 0; 182 if (buf->alloc != SSHBUF_SIZE_INIT) { 183 if ((d = recallocarray(buf->d, buf->alloc, SSHBUF_SIZE_INIT, 184 1)) != NULL) { 185 buf->cd = buf->d = d; 186 buf->alloc = SSHBUF_SIZE_INIT; 187 } 188 } 189 explicit_bzero(buf->d, SSHBUF_SIZE_INIT); 190 } 191 192 size_t 193 sshbuf_max_size(const struct sshbuf *buf) 194 { 195 return buf->max_size; 196 } 197 198 size_t 199 sshbuf_alloc(const struct sshbuf *buf) 200 { 201 return buf->alloc; 202 } 203 204 const struct sshbuf * 205 sshbuf_parent(const struct sshbuf *buf) 206 { 207 return buf->parent; 208 } 209 210 u_int 211 sshbuf_refcount(const struct sshbuf *buf) 212 { 213 return buf->refcount; 214 } 215 216 int 217 sshbuf_set_max_size(struct sshbuf *buf, size_t max_size) 218 { 219 size_t rlen; 220 u_char *dp; 221 int r; 222 223 SSHBUF_DBG(("set max buf = %p len = %zu", buf, max_size)); 224 if ((r = sshbuf_check_sanity(buf)) != 0) 225 return r; 226 if (max_size == buf->max_size) 227 return 0; 228 if (buf->readonly || buf->refcount > 1) 229 return SSH_ERR_BUFFER_READ_ONLY; 230 if (max_size > SSHBUF_SIZE_MAX) 231 return SSH_ERR_NO_BUFFER_SPACE; 232 /* pack and realloc if necessary */ 233 sshbuf_maybe_pack(buf, max_size < buf->size); 234 if (max_size < buf->alloc && max_size > buf->size) { 235 if (buf->size < SSHBUF_SIZE_INIT) 236 rlen = SSHBUF_SIZE_INIT; 237 else 238 rlen = ROUNDUP(buf->size, SSHBUF_SIZE_INC); 239 if (rlen > max_size) 240 rlen = max_size; 241 SSHBUF_DBG(("new alloc = %zu", rlen)); 242 if ((dp = recallocarray(buf->d, buf->alloc, rlen, 1)) == NULL) 243 return SSH_ERR_ALLOC_FAIL; 244 buf->cd = buf->d = dp; 245 buf->alloc = rlen; 246 } 247 SSHBUF_TELL("new-max"); 248 if (max_size < buf->alloc) 249 return SSH_ERR_NO_BUFFER_SPACE; 250 buf->max_size = max_size; 251 return 0; 252 } 253 254 size_t 255 sshbuf_len(const struct sshbuf *buf) 256 { 257 if (sshbuf_check_sanity(buf) != 0) 258 return 0; 259 return buf->size - buf->off; 260 } 261 262 size_t 263 sshbuf_avail(const struct sshbuf *buf) 264 { 265 if (sshbuf_check_sanity(buf) != 0 || buf->readonly || buf->refcount > 1) 266 return 0; 267 return buf->max_size - (buf->size - buf->off); 268 } 269 270 const u_char * 271 sshbuf_ptr(const struct sshbuf *buf) 272 { 273 if (sshbuf_check_sanity(buf) != 0) 274 return NULL; 275 return buf->cd + buf->off; 276 } 277 278 u_char * 279 sshbuf_mutable_ptr(const struct sshbuf *buf) 280 { 281 if (sshbuf_check_sanity(buf) != 0 || buf->readonly || buf->refcount > 1) 282 return NULL; 283 return buf->d + buf->off; 284 } 285 286 int 287 sshbuf_check_reserve(const struct sshbuf *buf, size_t len) 288 { 289 int r; 290 291 if ((r = sshbuf_check_sanity(buf)) != 0) 292 return r; 293 if (buf->readonly || buf->refcount > 1) 294 return SSH_ERR_BUFFER_READ_ONLY; 295 SSHBUF_TELL("check"); 296 /* Check that len is reasonable and that max_size + available < len */ 297 if (len > buf->max_size || buf->max_size - len < buf->size - buf->off) 298 return SSH_ERR_NO_BUFFER_SPACE; 299 return 0; 300 } 301 302 int 303 sshbuf_allocate(struct sshbuf *buf, size_t len) 304 { 305 size_t rlen, need; 306 u_char *dp; 307 int r; 308 309 SSHBUF_DBG(("allocate buf = %p len = %zu", buf, len)); 310 if ((r = sshbuf_check_reserve(buf, len)) != 0) 311 return r; 312 /* 313 * If the requested allocation appended would push us past max_size 314 * then pack the buffer, zeroing buf->off. 315 */ 316 sshbuf_maybe_pack(buf, buf->size + len > buf->max_size); 317 SSHBUF_TELL("allocate"); 318 if (len + buf->size <= buf->alloc) 319 return 0; /* already have it. */ 320 321 /* 322 * Prefer to alloc in SSHBUF_SIZE_INC units, but 323 * allocate less if doing so would overflow max_size. 324 */ 325 need = len + buf->size - buf->alloc; 326 rlen = ROUNDUP(buf->alloc + need, SSHBUF_SIZE_INC); 327 SSHBUF_DBG(("need %zu initial rlen %zu", need, rlen)); 328 if (rlen > buf->max_size) 329 rlen = buf->alloc + need; 330 SSHBUF_DBG(("adjusted rlen %zu", rlen)); 331 if ((dp = recallocarray(buf->d, buf->alloc, rlen, 1)) == NULL) { 332 SSHBUF_DBG(("realloc fail")); 333 return SSH_ERR_ALLOC_FAIL; 334 } 335 buf->alloc = rlen; 336 buf->cd = buf->d = dp; 337 if ((r = sshbuf_check_reserve(buf, len)) < 0) { 338 /* shouldn't fail */ 339 return r; 340 } 341 SSHBUF_TELL("done"); 342 return 0; 343 } 344 345 int 346 sshbuf_reserve(struct sshbuf *buf, size_t len, u_char **dpp) 347 { 348 u_char *dp; 349 int r; 350 351 if (dpp != NULL) 352 *dpp = NULL; 353 354 SSHBUF_DBG(("reserve buf = %p len = %zu", buf, len)); 355 if ((r = sshbuf_allocate(buf, len)) != 0) 356 return r; 357 358 dp = buf->d + buf->size; 359 buf->size += len; 360 if (dpp != NULL) 361 *dpp = dp; 362 return 0; 363 } 364 365 int 366 sshbuf_consume(struct sshbuf *buf, size_t len) 367 { 368 int r; 369 370 SSHBUF_DBG(("len = %zu", len)); 371 if ((r = sshbuf_check_sanity(buf)) != 0) 372 return r; 373 if (len == 0) 374 return 0; 375 if (len > sshbuf_len(buf)) 376 return SSH_ERR_MESSAGE_INCOMPLETE; 377 buf->off += len; 378 /* deal with empty buffer */ 379 if (buf->off == buf->size) 380 buf->off = buf->size = 0; 381 SSHBUF_TELL("done"); 382 return 0; 383 } 384 385 int 386 sshbuf_consume_end(struct sshbuf *buf, size_t len) 387 { 388 int r; 389 390 SSHBUF_DBG(("len = %zu", len)); 391 if ((r = sshbuf_check_sanity(buf)) != 0) 392 return r; 393 if (len == 0) 394 return 0; 395 if (len > sshbuf_len(buf)) 396 return SSH_ERR_MESSAGE_INCOMPLETE; 397 buf->size -= len; 398 SSHBUF_TELL("done"); 399 return 0; 400 } 401 402