xref: /freebsd/crypto/openssh/sshbuf.c (revision fe6060f10f634930ff71b7c50291ddc610da2475)
1 /*	$OpenBSD: sshbuf.c,v 1.15 2020/02/26 13:40:09 jsg Exp $	*/
2 /*
3  * Copyright (c) 2011 Damien Miller
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #define SSHBUF_INTERNAL
19 #include "includes.h"
20 
21 #include <sys/types.h>
22 #include <signal.h>
23 #include <stdlib.h>
24 #include <stdio.h>
25 #include <string.h>
26 
27 #include "ssherr.h"
28 #include "sshbuf.h"
29 #include "misc.h"
30 
31 static inline int
32 sshbuf_check_sanity(const struct sshbuf *buf)
33 {
34 	SSHBUF_TELL("sanity");
35 	if (__predict_false(buf == NULL ||
36 	    (!buf->readonly && buf->d != buf->cd) ||
37 	    buf->refcount < 1 || buf->refcount > SSHBUF_REFS_MAX ||
38 	    buf->cd == NULL ||
39 	    buf->max_size > SSHBUF_SIZE_MAX ||
40 	    buf->alloc > buf->max_size ||
41 	    buf->size > buf->alloc ||
42 	    buf->off > buf->size)) {
43 		/* Do not try to recover from corrupted buffer internals */
44 		SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
45 		ssh_signal(SIGSEGV, SIG_DFL);
46 		raise(SIGSEGV);
47 		return SSH_ERR_INTERNAL_ERROR;
48 	}
49 	return 0;
50 }
51 
52 static void
53 sshbuf_maybe_pack(struct sshbuf *buf, int force)
54 {
55 	SSHBUF_DBG(("force %d", force));
56 	SSHBUF_TELL("pre-pack");
57 	if (buf->off == 0 || buf->readonly || buf->refcount > 1)
58 		return;
59 	if (force ||
60 	    (buf->off >= SSHBUF_PACK_MIN && buf->off >= buf->size / 2)) {
61 		memmove(buf->d, buf->d + buf->off, buf->size - buf->off);
62 		buf->size -= buf->off;
63 		buf->off = 0;
64 		SSHBUF_TELL("packed");
65 	}
66 }
67 
68 struct sshbuf *
69 sshbuf_new(void)
70 {
71 	struct sshbuf *ret;
72 
73 	if ((ret = calloc(sizeof(*ret), 1)) == NULL)
74 		return NULL;
75 	ret->alloc = SSHBUF_SIZE_INIT;
76 	ret->max_size = SSHBUF_SIZE_MAX;
77 	ret->readonly = 0;
78 	ret->refcount = 1;
79 	ret->parent = NULL;
80 	if ((ret->cd = ret->d = calloc(1, ret->alloc)) == NULL) {
81 		free(ret);
82 		return NULL;
83 	}
84 	return ret;
85 }
86 
87 struct sshbuf *
88 sshbuf_from(const void *blob, size_t len)
89 {
90 	struct sshbuf *ret;
91 
92 	if (blob == NULL || len > SSHBUF_SIZE_MAX ||
93 	    (ret = calloc(sizeof(*ret), 1)) == NULL)
94 		return NULL;
95 	ret->alloc = ret->size = ret->max_size = len;
96 	ret->readonly = 1;
97 	ret->refcount = 1;
98 	ret->parent = NULL;
99 	ret->cd = blob;
100 	ret->d = NULL;
101 	return ret;
102 }
103 
104 int
105 sshbuf_set_parent(struct sshbuf *child, struct sshbuf *parent)
106 {
107 	int r;
108 
109 	if ((r = sshbuf_check_sanity(child)) != 0 ||
110 	    (r = sshbuf_check_sanity(parent)) != 0)
111 		return r;
112 	child->parent = parent;
113 	child->parent->refcount++;
114 	return 0;
115 }
116 
117 struct sshbuf *
118 sshbuf_fromb(struct sshbuf *buf)
119 {
120 	struct sshbuf *ret;
121 
122 	if (sshbuf_check_sanity(buf) != 0)
123 		return NULL;
124 	if ((ret = sshbuf_from(sshbuf_ptr(buf), sshbuf_len(buf))) == NULL)
125 		return NULL;
126 	if (sshbuf_set_parent(ret, buf) != 0) {
127 		sshbuf_free(ret);
128 		return NULL;
129 	}
130 	return ret;
131 }
132 
133 void
134 sshbuf_free(struct sshbuf *buf)
135 {
136 	if (buf == NULL)
137 		return;
138 	/*
139 	 * The following will leak on insane buffers, but this is the safest
140 	 * course of action - an invalid pointer or already-freed pointer may
141 	 * have been passed to us and continuing to scribble over memory would
142 	 * be bad.
143 	 */
144 	if (sshbuf_check_sanity(buf) != 0)
145 		return;
146 
147 	/*
148 	 * If we are a parent with still-extant children, then don't free just
149 	 * yet. The last child's call to sshbuf_free should decrement our
150 	 * refcount to 0 and trigger the actual free.
151 	 */
152 	buf->refcount--;
153 	if (buf->refcount > 0)
154 		return;
155 
156 	/*
157 	 * If we are a child, the free our parent to decrement its reference
158 	 * count and possibly free it.
159 	 */
160 	sshbuf_free(buf->parent);
161 	buf->parent = NULL;
162 
163 	if (!buf->readonly) {
164 		explicit_bzero(buf->d, buf->alloc);
165 		free(buf->d);
166 	}
167 	freezero(buf, sizeof(*buf));
168 }
169 
170 void
171 sshbuf_reset(struct sshbuf *buf)
172 {
173 	u_char *d;
174 
175 	if (buf->readonly || buf->refcount > 1) {
176 		/* Nonsensical. Just make buffer appear empty */
177 		buf->off = buf->size;
178 		return;
179 	}
180 	(void) sshbuf_check_sanity(buf);
181 	buf->off = buf->size = 0;
182 	if (buf->alloc != SSHBUF_SIZE_INIT) {
183 		if ((d = recallocarray(buf->d, buf->alloc, SSHBUF_SIZE_INIT,
184 		    1)) != NULL) {
185 			buf->cd = buf->d = d;
186 			buf->alloc = SSHBUF_SIZE_INIT;
187 		}
188 	}
189 	explicit_bzero(buf->d, SSHBUF_SIZE_INIT);
190 }
191 
192 size_t
193 sshbuf_max_size(const struct sshbuf *buf)
194 {
195 	return buf->max_size;
196 }
197 
198 size_t
199 sshbuf_alloc(const struct sshbuf *buf)
200 {
201 	return buf->alloc;
202 }
203 
204 const struct sshbuf *
205 sshbuf_parent(const struct sshbuf *buf)
206 {
207 	return buf->parent;
208 }
209 
210 u_int
211 sshbuf_refcount(const struct sshbuf *buf)
212 {
213 	return buf->refcount;
214 }
215 
216 int
217 sshbuf_set_max_size(struct sshbuf *buf, size_t max_size)
218 {
219 	size_t rlen;
220 	u_char *dp;
221 	int r;
222 
223 	SSHBUF_DBG(("set max buf = %p len = %zu", buf, max_size));
224 	if ((r = sshbuf_check_sanity(buf)) != 0)
225 		return r;
226 	if (max_size == buf->max_size)
227 		return 0;
228 	if (buf->readonly || buf->refcount > 1)
229 		return SSH_ERR_BUFFER_READ_ONLY;
230 	if (max_size > SSHBUF_SIZE_MAX)
231 		return SSH_ERR_NO_BUFFER_SPACE;
232 	/* pack and realloc if necessary */
233 	sshbuf_maybe_pack(buf, max_size < buf->size);
234 	if (max_size < buf->alloc && max_size > buf->size) {
235 		if (buf->size < SSHBUF_SIZE_INIT)
236 			rlen = SSHBUF_SIZE_INIT;
237 		else
238 			rlen = ROUNDUP(buf->size, SSHBUF_SIZE_INC);
239 		if (rlen > max_size)
240 			rlen = max_size;
241 		SSHBUF_DBG(("new alloc = %zu", rlen));
242 		if ((dp = recallocarray(buf->d, buf->alloc, rlen, 1)) == NULL)
243 			return SSH_ERR_ALLOC_FAIL;
244 		buf->cd = buf->d = dp;
245 		buf->alloc = rlen;
246 	}
247 	SSHBUF_TELL("new-max");
248 	if (max_size < buf->alloc)
249 		return SSH_ERR_NO_BUFFER_SPACE;
250 	buf->max_size = max_size;
251 	return 0;
252 }
253 
254 size_t
255 sshbuf_len(const struct sshbuf *buf)
256 {
257 	if (sshbuf_check_sanity(buf) != 0)
258 		return 0;
259 	return buf->size - buf->off;
260 }
261 
262 size_t
263 sshbuf_avail(const struct sshbuf *buf)
264 {
265 	if (sshbuf_check_sanity(buf) != 0 || buf->readonly || buf->refcount > 1)
266 		return 0;
267 	return buf->max_size - (buf->size - buf->off);
268 }
269 
270 const u_char *
271 sshbuf_ptr(const struct sshbuf *buf)
272 {
273 	if (sshbuf_check_sanity(buf) != 0)
274 		return NULL;
275 	return buf->cd + buf->off;
276 }
277 
278 u_char *
279 sshbuf_mutable_ptr(const struct sshbuf *buf)
280 {
281 	if (sshbuf_check_sanity(buf) != 0 || buf->readonly || buf->refcount > 1)
282 		return NULL;
283 	return buf->d + buf->off;
284 }
285 
286 int
287 sshbuf_check_reserve(const struct sshbuf *buf, size_t len)
288 {
289 	int r;
290 
291 	if ((r = sshbuf_check_sanity(buf)) != 0)
292 		return r;
293 	if (buf->readonly || buf->refcount > 1)
294 		return SSH_ERR_BUFFER_READ_ONLY;
295 	SSHBUF_TELL("check");
296 	/* Check that len is reasonable and that max_size + available < len */
297 	if (len > buf->max_size || buf->max_size - len < buf->size - buf->off)
298 		return SSH_ERR_NO_BUFFER_SPACE;
299 	return 0;
300 }
301 
302 int
303 sshbuf_allocate(struct sshbuf *buf, size_t len)
304 {
305 	size_t rlen, need;
306 	u_char *dp;
307 	int r;
308 
309 	SSHBUF_DBG(("allocate buf = %p len = %zu", buf, len));
310 	if ((r = sshbuf_check_reserve(buf, len)) != 0)
311 		return r;
312 	/*
313 	 * If the requested allocation appended would push us past max_size
314 	 * then pack the buffer, zeroing buf->off.
315 	 */
316 	sshbuf_maybe_pack(buf, buf->size + len > buf->max_size);
317 	SSHBUF_TELL("allocate");
318 	if (len + buf->size <= buf->alloc)
319 		return 0; /* already have it. */
320 
321 	/*
322 	 * Prefer to alloc in SSHBUF_SIZE_INC units, but
323 	 * allocate less if doing so would overflow max_size.
324 	 */
325 	need = len + buf->size - buf->alloc;
326 	rlen = ROUNDUP(buf->alloc + need, SSHBUF_SIZE_INC);
327 	SSHBUF_DBG(("need %zu initial rlen %zu", need, rlen));
328 	if (rlen > buf->max_size)
329 		rlen = buf->alloc + need;
330 	SSHBUF_DBG(("adjusted rlen %zu", rlen));
331 	if ((dp = recallocarray(buf->d, buf->alloc, rlen, 1)) == NULL) {
332 		SSHBUF_DBG(("realloc fail"));
333 		return SSH_ERR_ALLOC_FAIL;
334 	}
335 	buf->alloc = rlen;
336 	buf->cd = buf->d = dp;
337 	if ((r = sshbuf_check_reserve(buf, len)) < 0) {
338 		/* shouldn't fail */
339 		return r;
340 	}
341 	SSHBUF_TELL("done");
342 	return 0;
343 }
344 
345 int
346 sshbuf_reserve(struct sshbuf *buf, size_t len, u_char **dpp)
347 {
348 	u_char *dp;
349 	int r;
350 
351 	if (dpp != NULL)
352 		*dpp = NULL;
353 
354 	SSHBUF_DBG(("reserve buf = %p len = %zu", buf, len));
355 	if ((r = sshbuf_allocate(buf, len)) != 0)
356 		return r;
357 
358 	dp = buf->d + buf->size;
359 	buf->size += len;
360 	if (dpp != NULL)
361 		*dpp = dp;
362 	return 0;
363 }
364 
365 int
366 sshbuf_consume(struct sshbuf *buf, size_t len)
367 {
368 	int r;
369 
370 	SSHBUF_DBG(("len = %zu", len));
371 	if ((r = sshbuf_check_sanity(buf)) != 0)
372 		return r;
373 	if (len == 0)
374 		return 0;
375 	if (len > sshbuf_len(buf))
376 		return SSH_ERR_MESSAGE_INCOMPLETE;
377 	buf->off += len;
378 	/* deal with empty buffer */
379 	if (buf->off == buf->size)
380 		buf->off = buf->size = 0;
381 	SSHBUF_TELL("done");
382 	return 0;
383 }
384 
385 int
386 sshbuf_consume_end(struct sshbuf *buf, size_t len)
387 {
388 	int r;
389 
390 	SSHBUF_DBG(("len = %zu", len));
391 	if ((r = sshbuf_check_sanity(buf)) != 0)
392 		return r;
393 	if (len == 0)
394 		return 0;
395 	if (len > sshbuf_len(buf))
396 		return SSH_ERR_MESSAGE_INCOMPLETE;
397 	buf->size -= len;
398 	SSHBUF_TELL("done");
399 	return 0;
400 }
401 
402