1 /* $OpenBSD: sshbuf-getput-basic.c,v 1.13 2022/05/25 06:03:44 djm Exp $ */
2 /*
3 * Copyright (c) 2011 Damien Miller
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17 #include "includes.h"
18 __RCSID("$NetBSD: sshbuf-getput-basic.c,v 1.12 2022/10/05 22:39:36 christos Exp $");
19
20 #include <sys/types.h>
21
22 #include <stdarg.h>
23 #include <stdlib.h>
24 #include <stdio.h>
25 #include <string.h>
26 #include <stdint.h>
27
28 #include "ssherr.h"
29 #define SSHBUF_INTERNAL
30 #include "sshbuf.h"
31
32 int
sshbuf_get(struct sshbuf * buf,void * v,size_t len)33 sshbuf_get(struct sshbuf *buf, void *v, size_t len)
34 {
35 const u_char *p = sshbuf_ptr(buf);
36 int r;
37
38 if ((r = sshbuf_consume(buf, len)) < 0)
39 return r;
40 if (v != NULL && len != 0)
41 memcpy(v, p, len);
42 return 0;
43 }
44
45 int
sshbuf_get_u64(struct sshbuf * buf,u_int64_t * valp)46 sshbuf_get_u64(struct sshbuf *buf, u_int64_t *valp)
47 {
48 const u_char *p = sshbuf_ptr(buf);
49 int r;
50
51 if ((r = sshbuf_consume(buf, 8)) < 0)
52 return r;
53 if (valp != NULL)
54 *valp = PEEK_U64(p);
55 return 0;
56 }
57
58 int
sshbuf_get_u32(struct sshbuf * buf,u_int32_t * valp)59 sshbuf_get_u32(struct sshbuf *buf, u_int32_t *valp)
60 {
61 const u_char *p = sshbuf_ptr(buf);
62 int r;
63
64 if ((r = sshbuf_consume(buf, 4)) < 0)
65 return r;
66 if (valp != NULL)
67 *valp = PEEK_U32(p);
68 return 0;
69 }
70
71 int
sshbuf_get_u16(struct sshbuf * buf,u_int16_t * valp)72 sshbuf_get_u16(struct sshbuf *buf, u_int16_t *valp)
73 {
74 const u_char *p = sshbuf_ptr(buf);
75 int r;
76
77 if ((r = sshbuf_consume(buf, 2)) < 0)
78 return r;
79 if (valp != NULL)
80 *valp = PEEK_U16(p);
81 return 0;
82 }
83
84 int
sshbuf_get_u8(struct sshbuf * buf,u_char * valp)85 sshbuf_get_u8(struct sshbuf *buf, u_char *valp)
86 {
87 const u_char *p = sshbuf_ptr(buf);
88 int r;
89
90 if ((r = sshbuf_consume(buf, 1)) < 0)
91 return r;
92 if (valp != NULL)
93 *valp = (u_int8_t)*p;
94 return 0;
95 }
96
97 static int
check_offset(const struct sshbuf * buf,int wr,size_t offset,size_t len)98 check_offset(const struct sshbuf *buf, int wr, size_t offset, size_t len)
99 {
100 if (sshbuf_ptr(buf) == NULL) /* calls sshbuf_check_sanity() */
101 return SSH_ERR_INTERNAL_ERROR;
102 if (offset >= SIZE_MAX - len)
103 return SSH_ERR_INVALID_ARGUMENT;
104 if (offset + len > sshbuf_len(buf)) {
105 return wr ?
106 SSH_ERR_NO_BUFFER_SPACE : SSH_ERR_MESSAGE_INCOMPLETE;
107 }
108 return 0;
109 }
110
111 static int
check_roffset(const struct sshbuf * buf,size_t offset,size_t len,const u_char ** p)112 check_roffset(const struct sshbuf *buf, size_t offset, size_t len,
113 const u_char **p)
114 {
115 int r;
116
117 *p = NULL;
118 if ((r = check_offset(buf, 0, offset, len)) != 0)
119 return r;
120 *p = sshbuf_ptr(buf) + offset;
121 return 0;
122 }
123
124 int
sshbuf_peek_u64(const struct sshbuf * buf,size_t offset,u_int64_t * valp)125 sshbuf_peek_u64(const struct sshbuf *buf, size_t offset, u_int64_t *valp)
126 {
127 const u_char *p = NULL;
128 int r;
129
130 if (valp != NULL)
131 *valp = 0;
132 if ((r = check_roffset(buf, offset, 8, &p)) != 0)
133 return r;
134 if (valp != NULL)
135 *valp = PEEK_U64(p);
136 return 0;
137 }
138
139 int
sshbuf_peek_u32(const struct sshbuf * buf,size_t offset,u_int32_t * valp)140 sshbuf_peek_u32(const struct sshbuf *buf, size_t offset, u_int32_t *valp)
141 {
142 const u_char *p = NULL;
143 int r;
144
145 if (valp != NULL)
146 *valp = 0;
147 if ((r = check_roffset(buf, offset, 4, &p)) != 0)
148 return r;
149 if (valp != NULL)
150 *valp = PEEK_U32(p);
151 return 0;
152 }
153
154 int
sshbuf_peek_u16(const struct sshbuf * buf,size_t offset,u_int16_t * valp)155 sshbuf_peek_u16(const struct sshbuf *buf, size_t offset, u_int16_t *valp)
156 {
157 const u_char *p = NULL;
158 int r;
159
160 if (valp != NULL)
161 *valp = 0;
162 if ((r = check_roffset(buf, offset, 2, &p)) != 0)
163 return r;
164 if (valp != NULL)
165 *valp = PEEK_U16(p);
166 return 0;
167 }
168
169 int
sshbuf_peek_u8(const struct sshbuf * buf,size_t offset,u_char * valp)170 sshbuf_peek_u8(const struct sshbuf *buf, size_t offset, u_char *valp)
171 {
172 const u_char *p = NULL;
173 int r;
174
175 if (valp != NULL)
176 *valp = 0;
177 if ((r = check_roffset(buf, offset, 1, &p)) != 0)
178 return r;
179 if (valp != NULL)
180 *valp = *p;
181 return 0;
182 }
183
184 int
sshbuf_get_string(struct sshbuf * buf,u_char ** valp,size_t * lenp)185 sshbuf_get_string(struct sshbuf *buf, u_char **valp, size_t *lenp)
186 {
187 const u_char *val;
188 size_t len;
189 int r;
190
191 if (valp != NULL)
192 *valp = NULL;
193 if (lenp != NULL)
194 *lenp = 0;
195 if ((r = sshbuf_get_string_direct(buf, &val, &len)) < 0)
196 return r;
197 if (valp != NULL) {
198 if ((*valp = malloc(len + 1)) == NULL) {
199 SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL"));
200 return SSH_ERR_ALLOC_FAIL;
201 }
202 if (len != 0)
203 memcpy(*valp, val, len);
204 (*valp)[len] = '\0';
205 }
206 if (lenp != NULL)
207 *lenp = len;
208 return 0;
209 }
210
211 int
sshbuf_get_string_direct(struct sshbuf * buf,const u_char ** valp,size_t * lenp)212 sshbuf_get_string_direct(struct sshbuf *buf, const u_char **valp, size_t *lenp)
213 {
214 size_t len;
215 const u_char *p;
216 int r;
217
218 if (valp != NULL)
219 *valp = NULL;
220 if (lenp != NULL)
221 *lenp = 0;
222 if ((r = sshbuf_peek_string_direct(buf, &p, &len)) < 0)
223 return r;
224 if (valp != NULL)
225 *valp = p;
226 if (lenp != NULL)
227 *lenp = len;
228 if (sshbuf_consume(buf, len + 4) != 0) {
229 /* Shouldn't happen */
230 SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
231 SSHBUF_ABORT();
232 return SSH_ERR_INTERNAL_ERROR;
233 }
234 return 0;
235 }
236
237 int
sshbuf_peek_string_direct(const struct sshbuf * buf,const u_char ** valp,size_t * lenp)238 sshbuf_peek_string_direct(const struct sshbuf *buf, const u_char **valp,
239 size_t *lenp)
240 {
241 u_int32_t len;
242 const u_char *p = sshbuf_ptr(buf);
243
244 if (valp != NULL)
245 *valp = NULL;
246 if (lenp != NULL)
247 *lenp = 0;
248 if (sshbuf_len(buf) < 4) {
249 SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE"));
250 return SSH_ERR_MESSAGE_INCOMPLETE;
251 }
252 len = PEEK_U32(p);
253 if (len > SSHBUF_SIZE_MAX - 4) {
254 SSHBUF_DBG(("SSH_ERR_STRING_TOO_LARGE"));
255 return SSH_ERR_STRING_TOO_LARGE;
256 }
257 if (sshbuf_len(buf) - 4 < len) {
258 SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE"));
259 return SSH_ERR_MESSAGE_INCOMPLETE;
260 }
261 if (valp != NULL)
262 *valp = p + 4;
263 if (lenp != NULL)
264 *lenp = len;
265 return 0;
266 }
267
268 int
sshbuf_get_cstring(struct sshbuf * buf,char ** valp,size_t * lenp)269 sshbuf_get_cstring(struct sshbuf *buf, char **valp, size_t *lenp)
270 {
271 size_t len;
272 const u_char *p, *z;
273 int r;
274
275 if (valp != NULL)
276 *valp = NULL;
277 if (lenp != NULL)
278 *lenp = 0;
279 if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0)
280 return r;
281 /* Allow a \0 only at the end of the string */
282 if (len > 0 &&
283 (z = memchr(p , '\0', len)) != NULL && z < p + len - 1) {
284 SSHBUF_DBG(("SSH_ERR_INVALID_FORMAT"));
285 return SSH_ERR_INVALID_FORMAT;
286 }
287 if ((r = sshbuf_skip_string(buf)) != 0)
288 return -1;
289 if (valp != NULL) {
290 if ((*valp = malloc(len + 1)) == NULL) {
291 SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL"));
292 return SSH_ERR_ALLOC_FAIL;
293 }
294 if (len != 0)
295 memcpy(*valp, p, len);
296 (*valp)[len] = '\0';
297 }
298 if (lenp != NULL)
299 *lenp = (size_t)len;
300 return 0;
301 }
302
303 int
sshbuf_get_stringb(struct sshbuf * buf,struct sshbuf * v)304 sshbuf_get_stringb(struct sshbuf *buf, struct sshbuf *v)
305 {
306 u_int32_t len;
307 u_char *p;
308 int r;
309
310 /*
311 * Use sshbuf_peek_string_direct() to figure out if there is
312 * a complete string in 'buf' and copy the string directly
313 * into 'v'.
314 */
315 if ((r = sshbuf_peek_string_direct(buf, NULL, NULL)) != 0 ||
316 (r = sshbuf_get_u32(buf, &len)) != 0 ||
317 (r = sshbuf_reserve(v, len, &p)) != 0 ||
318 (r = sshbuf_get(buf, p, len)) != 0)
319 return r;
320 return 0;
321 }
322
323 int
sshbuf_put(struct sshbuf * buf,const void * v,size_t len)324 sshbuf_put(struct sshbuf *buf, const void *v, size_t len)
325 {
326 u_char *p;
327 int r;
328
329 if ((r = sshbuf_reserve(buf, len, &p)) < 0)
330 return r;
331 if (len != 0)
332 memcpy(p, v, len);
333 return 0;
334 }
335
336 int
sshbuf_putb(struct sshbuf * buf,const struct sshbuf * v)337 sshbuf_putb(struct sshbuf *buf, const struct sshbuf *v)
338 {
339 if (v == NULL)
340 return 0;
341 return sshbuf_put(buf, sshbuf_ptr(v), sshbuf_len(v));
342 }
343
344 int
sshbuf_putf(struct sshbuf * buf,const char * fmt,...)345 sshbuf_putf(struct sshbuf *buf, const char *fmt, ...)
346 {
347 va_list ap;
348 int r;
349
350 va_start(ap, fmt);
351 r = sshbuf_putfv(buf, fmt, ap);
352 va_end(ap);
353 return r;
354 }
355
356 int
sshbuf_putfv(struct sshbuf * buf,const char * fmt,va_list ap)357 sshbuf_putfv(struct sshbuf *buf, const char *fmt, va_list ap)
358 {
359 va_list ap2;
360 int r, len;
361 u_char *p;
362
363 va_copy(ap2, ap);
364 if ((len = vsnprintf(NULL, 0, fmt, ap2)) < 0) {
365 r = SSH_ERR_INVALID_ARGUMENT;
366 goto out;
367 }
368 if (len == 0) {
369 r = 0;
370 goto out; /* Nothing to do */
371 }
372 va_end(ap2);
373 va_copy(ap2, ap);
374 if ((r = sshbuf_reserve(buf, (size_t)len + 1, &p)) < 0)
375 goto out;
376 if ((r = vsnprintf((char *)p, len + 1, fmt, ap2)) != len) {
377 r = SSH_ERR_INTERNAL_ERROR;
378 goto out; /* Shouldn't happen */
379 }
380 /* Consume terminating \0 */
381 if ((r = sshbuf_consume_end(buf, 1)) != 0)
382 goto out;
383 r = 0;
384 out:
385 va_end(ap2);
386 return r;
387 }
388
389 int
sshbuf_put_u64(struct sshbuf * buf,u_int64_t val)390 sshbuf_put_u64(struct sshbuf *buf, u_int64_t val)
391 {
392 u_char *p;
393 int r;
394
395 if ((r = sshbuf_reserve(buf, 8, &p)) < 0)
396 return r;
397 POKE_U64(p, val);
398 return 0;
399 }
400
401 int
sshbuf_put_u32(struct sshbuf * buf,u_int32_t val)402 sshbuf_put_u32(struct sshbuf *buf, u_int32_t val)
403 {
404 u_char *p;
405 int r;
406
407 if ((r = sshbuf_reserve(buf, 4, &p)) < 0)
408 return r;
409 POKE_U32(p, val);
410 return 0;
411 }
412
413 int
sshbuf_put_u16(struct sshbuf * buf,u_int16_t val)414 sshbuf_put_u16(struct sshbuf *buf, u_int16_t val)
415 {
416 u_char *p;
417 int r;
418
419 if ((r = sshbuf_reserve(buf, 2, &p)) < 0)
420 return r;
421 POKE_U16(p, val);
422 return 0;
423 }
424
425 int
sshbuf_put_u8(struct sshbuf * buf,u_char val)426 sshbuf_put_u8(struct sshbuf *buf, u_char val)
427 {
428 u_char *p;
429 int r;
430
431 if ((r = sshbuf_reserve(buf, 1, &p)) < 0)
432 return r;
433 p[0] = val;
434 return 0;
435 }
436
437 static int
check_woffset(struct sshbuf * buf,size_t offset,size_t len,u_char ** p)438 check_woffset(struct sshbuf *buf, size_t offset, size_t len, u_char **p)
439 {
440 int r;
441
442 *p = NULL;
443 if ((r = check_offset(buf, 1, offset, len)) != 0)
444 return r;
445 if (sshbuf_mutable_ptr(buf) == NULL)
446 return SSH_ERR_BUFFER_READ_ONLY;
447 *p = sshbuf_mutable_ptr(buf) + offset;
448 return 0;
449 }
450
451 int
sshbuf_poke_u64(struct sshbuf * buf,size_t offset,u_int64_t val)452 sshbuf_poke_u64(struct sshbuf *buf, size_t offset, u_int64_t val)
453 {
454 u_char *p = NULL;
455 int r;
456
457 if ((r = check_woffset(buf, offset, 8, &p)) != 0)
458 return r;
459 POKE_U64(p, val);
460 return 0;
461 }
462
463 int
sshbuf_poke_u32(struct sshbuf * buf,size_t offset,u_int32_t val)464 sshbuf_poke_u32(struct sshbuf *buf, size_t offset, u_int32_t val)
465 {
466 u_char *p = NULL;
467 int r;
468
469 if ((r = check_woffset(buf, offset, 4, &p)) != 0)
470 return r;
471 POKE_U32(p, val);
472 return 0;
473 }
474
475 int
sshbuf_poke_u16(struct sshbuf * buf,size_t offset,u_int16_t val)476 sshbuf_poke_u16(struct sshbuf *buf, size_t offset, u_int16_t val)
477 {
478 u_char *p = NULL;
479 int r;
480
481 if ((r = check_woffset(buf, offset, 2, &p)) != 0)
482 return r;
483 POKE_U16(p, val);
484 return 0;
485 }
486
487 int
sshbuf_poke_u8(struct sshbuf * buf,size_t offset,u_char val)488 sshbuf_poke_u8(struct sshbuf *buf, size_t offset, u_char val)
489 {
490 u_char *p = NULL;
491 int r;
492
493 if ((r = check_woffset(buf, offset, 1, &p)) != 0)
494 return r;
495 *p = val;
496 return 0;
497 }
498
499 int
sshbuf_poke(struct sshbuf * buf,size_t offset,void * v,size_t len)500 sshbuf_poke(struct sshbuf *buf, size_t offset, void *v, size_t len)
501 {
502 u_char *p = NULL;
503 int r;
504
505 if ((r = check_woffset(buf, offset, len, &p)) != 0)
506 return r;
507 memcpy(p, v, len);
508 return 0;
509 }
510
511 int
sshbuf_put_string(struct sshbuf * buf,const void * v,size_t len)512 sshbuf_put_string(struct sshbuf *buf, const void *v, size_t len)
513 {
514 u_char *d;
515 int r;
516
517 if (len > SSHBUF_SIZE_MAX - 4) {
518 SSHBUF_DBG(("SSH_ERR_NO_BUFFER_SPACE"));
519 return SSH_ERR_NO_BUFFER_SPACE;
520 }
521 if ((r = sshbuf_reserve(buf, len + 4, &d)) < 0)
522 return r;
523 POKE_U32(d, len);
524 if (len != 0)
525 memcpy(d + 4, v, len);
526 return 0;
527 }
528
529 int
sshbuf_put_cstring(struct sshbuf * buf,const char * v)530 sshbuf_put_cstring(struct sshbuf *buf, const char *v)
531 {
532 return sshbuf_put_string(buf, __UNCONST(v), v == NULL ? 0 : strlen(v));
533 }
534
535 int
sshbuf_put_stringb(struct sshbuf * buf,const struct sshbuf * v)536 sshbuf_put_stringb(struct sshbuf *buf, const struct sshbuf *v)
537 {
538 if (v == NULL)
539 return sshbuf_put_string(buf, NULL, 0);
540
541 return sshbuf_put_string(buf, sshbuf_ptr(v), sshbuf_len(v));
542 }
543
544 int
sshbuf_froms(struct sshbuf * buf,struct sshbuf ** bufp)545 sshbuf_froms(struct sshbuf *buf, struct sshbuf **bufp)
546 {
547 const u_char *p;
548 size_t len;
549 struct sshbuf *ret;
550 int r;
551
552 if (buf == NULL || bufp == NULL)
553 return SSH_ERR_INVALID_ARGUMENT;
554 *bufp = NULL;
555 if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0)
556 return r;
557 if ((ret = sshbuf_from(p, len)) == NULL)
558 return SSH_ERR_ALLOC_FAIL;
559 if ((r = sshbuf_consume(buf, len + 4)) != 0 || /* Shouldn't happen */
560 (r = sshbuf_set_parent(ret, buf)) != 0) {
561 sshbuf_free(ret);
562 return r;
563 }
564 *bufp = ret;
565 return 0;
566 }
567
568 int
sshbuf_put_bignum2_bytes(struct sshbuf * buf,const void * v,size_t len)569 sshbuf_put_bignum2_bytes(struct sshbuf *buf, const void *v, size_t len)
570 {
571 u_char *d;
572 const u_char *s = (const u_char *)v;
573 int r, prepend;
574
575 if (len > SSHBUF_SIZE_MAX - 5) {
576 SSHBUF_DBG(("SSH_ERR_NO_BUFFER_SPACE"));
577 return SSH_ERR_NO_BUFFER_SPACE;
578 }
579 /* Skip leading zero bytes */
580 for (; len > 0 && *s == 0; len--, s++)
581 ;
582 /*
583 * If most significant bit is set then prepend a zero byte to
584 * avoid interpretation as a negative number.
585 */
586 prepend = len > 0 && (s[0] & 0x80) != 0;
587 if ((r = sshbuf_reserve(buf, len + 4 + prepend, &d)) < 0)
588 return r;
589 POKE_U32(d, len + prepend);
590 if (prepend)
591 d[4] = 0;
592 if (len != 0)
593 memcpy(d + 4 + prepend, s, len);
594 return 0;
595 }
596
597 int
sshbuf_get_bignum2_bytes_direct(struct sshbuf * buf,const u_char ** valp,size_t * lenp)598 sshbuf_get_bignum2_bytes_direct(struct sshbuf *buf,
599 const u_char **valp, size_t *lenp)
600 {
601 const u_char *d;
602 size_t len, olen;
603 int r;
604
605 if ((r = sshbuf_peek_string_direct(buf, &d, &olen)) < 0)
606 return r;
607 len = olen;
608 /* Refuse negative (MSB set) bignums */
609 if ((len != 0 && (*d & 0x80) != 0))
610 return SSH_ERR_BIGNUM_IS_NEGATIVE;
611 /* Refuse overlong bignums, allow prepended \0 to avoid MSB set */
612 if (len > SSHBUF_MAX_BIGNUM + 1 ||
613 (len == SSHBUF_MAX_BIGNUM + 1 && *d != 0))
614 return SSH_ERR_BIGNUM_TOO_LARGE;
615 /* Trim leading zeros */
616 while (len > 0 && *d == 0x00) {
617 d++;
618 len--;
619 }
620 if (valp != NULL)
621 *valp = d;
622 if (lenp != NULL)
623 *lenp = len;
624 if (sshbuf_consume(buf, olen + 4) != 0) {
625 /* Shouldn't happen */
626 SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
627 SSHBUF_ABORT();
628 return SSH_ERR_INTERNAL_ERROR;
629 }
630 return 0;
631 }
632