1 /*	$OpenBSD: sshbuf-getput-basic.c,v 1.10 2019/12/13 19:09:37 djm Exp $	*/
2 /*
3  * Copyright (c) 2011 Damien Miller
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #define SSHBUF_INTERNAL
19 #include "includes.h"
20 
21 #include <sys/types.h>
22 
23 #include <stdarg.h>
24 #include <stdlib.h>
25 #include <stdio.h>
26 #include <string.h>
27 #ifdef HAVE_STDINT_H
28 # include <stdint.h>
29 #endif
30 
31 #include "ssherr.h"
32 #include "sshbuf.h"
33 
34 int
35 sshbuf_get(struct sshbuf *buf, void *v, size_t len)
36 {
37 	const u_char *p = sshbuf_ptr(buf);
38 	int r;
39 
40 	if ((r = sshbuf_consume(buf, len)) < 0)
41 		return r;
42 	if (v != NULL && len != 0)
43 		memcpy(v, p, len);
44 	return 0;
45 }
46 
47 int
48 sshbuf_get_u64(struct sshbuf *buf, u_int64_t *valp)
49 {
50 	const u_char *p = sshbuf_ptr(buf);
51 	int r;
52 
53 	if ((r = sshbuf_consume(buf, 8)) < 0)
54 		return r;
55 	if (valp != NULL)
56 		*valp = PEEK_U64(p);
57 	return 0;
58 }
59 
60 int
61 sshbuf_get_u32(struct sshbuf *buf, u_int32_t *valp)
62 {
63 	const u_char *p = sshbuf_ptr(buf);
64 	int r;
65 
66 	if ((r = sshbuf_consume(buf, 4)) < 0)
67 		return r;
68 	if (valp != NULL)
69 		*valp = PEEK_U32(p);
70 	return 0;
71 }
72 
73 int
74 sshbuf_get_u16(struct sshbuf *buf, u_int16_t *valp)
75 {
76 	const u_char *p = sshbuf_ptr(buf);
77 	int r;
78 
79 	if ((r = sshbuf_consume(buf, 2)) < 0)
80 		return r;
81 	if (valp != NULL)
82 		*valp = PEEK_U16(p);
83 	return 0;
84 }
85 
86 int
87 sshbuf_get_u8(struct sshbuf *buf, u_char *valp)
88 {
89 	const u_char *p = sshbuf_ptr(buf);
90 	int r;
91 
92 	if ((r = sshbuf_consume(buf, 1)) < 0)
93 		return r;
94 	if (valp != NULL)
95 		*valp = (u_int8_t)*p;
96 	return 0;
97 }
98 
99 static int
100 check_offset(const struct sshbuf *buf, int wr, size_t offset, size_t len)
101 {
102 	if (sshbuf_ptr(buf) == NULL) /* calls sshbuf_check_sanity() */
103 		return SSH_ERR_INTERNAL_ERROR;
104 	if (offset >= SIZE_MAX - len)
105 		return SSH_ERR_INVALID_ARGUMENT;
106 	if (offset + len > sshbuf_len(buf)) {
107 		return wr ?
108 		    SSH_ERR_NO_BUFFER_SPACE : SSH_ERR_MESSAGE_INCOMPLETE;
109 	}
110 	return 0;
111 }
112 
113 static int
114 check_roffset(const struct sshbuf *buf, size_t offset, size_t len,
115     const u_char **p)
116 {
117 	int r;
118 
119 	*p = NULL;
120 	if ((r = check_offset(buf, 0, offset, len)) != 0)
121 		return r;
122 	*p = sshbuf_ptr(buf) + offset;
123 	return 0;
124 }
125 
126 int
127 sshbuf_peek_u64(const struct sshbuf *buf, size_t offset, u_int64_t *valp)
128 {
129 	const u_char *p = NULL;
130 	int r;
131 
132 	if (valp != NULL)
133 		*valp = 0;
134 	if ((r = check_roffset(buf, offset, 8, &p)) != 0)
135 		return r;
136 	if (valp != NULL)
137 		*valp = PEEK_U64(p);
138 	return 0;
139 }
140 
141 int
142 sshbuf_peek_u32(const struct sshbuf *buf, size_t offset, u_int32_t *valp)
143 {
144 	const u_char *p = NULL;
145 	int r;
146 
147 	if (valp != NULL)
148 		*valp = 0;
149 	if ((r = check_roffset(buf, offset, 4, &p)) != 0)
150 		return r;
151 	if (valp != NULL)
152 		*valp = PEEK_U32(p);
153 	return 0;
154 }
155 
156 int
157 sshbuf_peek_u16(const struct sshbuf *buf, size_t offset, u_int16_t *valp)
158 {
159 	const u_char *p = NULL;
160 	int r;
161 
162 	if (valp != NULL)
163 		*valp = 0;
164 	if ((r = check_roffset(buf, offset, 2, &p)) != 0)
165 		return r;
166 	if (valp != NULL)
167 		*valp = PEEK_U16(p);
168 	return 0;
169 }
170 
171 int
172 sshbuf_peek_u8(const struct sshbuf *buf, size_t offset, u_char *valp)
173 {
174 	const u_char *p = NULL;
175 	int r;
176 
177 	if (valp != NULL)
178 		*valp = 0;
179 	if ((r = check_roffset(buf, offset, 1, &p)) != 0)
180 		return r;
181 	if (valp != NULL)
182 		*valp = *p;
183 	return 0;
184 }
185 
186 int
187 sshbuf_get_string(struct sshbuf *buf, u_char **valp, size_t *lenp)
188 {
189 	const u_char *val;
190 	size_t len;
191 	int r;
192 
193 	if (valp != NULL)
194 		*valp = NULL;
195 	if (lenp != NULL)
196 		*lenp = 0;
197 	if ((r = sshbuf_get_string_direct(buf, &val, &len)) < 0)
198 		return r;
199 	if (valp != NULL) {
200 		if ((*valp = malloc(len + 1)) == NULL) {
201 			SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL"));
202 			return SSH_ERR_ALLOC_FAIL;
203 		}
204 		if (len != 0)
205 			memcpy(*valp, val, len);
206 		(*valp)[len] = '\0';
207 	}
208 	if (lenp != NULL)
209 		*lenp = len;
210 	return 0;
211 }
212 
213 int
214 sshbuf_get_string_direct(struct sshbuf *buf, const u_char **valp, size_t *lenp)
215 {
216 	size_t len;
217 	const u_char *p;
218 	int r;
219 
220 	if (valp != NULL)
221 		*valp = NULL;
222 	if (lenp != NULL)
223 		*lenp = 0;
224 	if ((r = sshbuf_peek_string_direct(buf, &p, &len)) < 0)
225 		return r;
226 	if (valp != NULL)
227 		*valp = p;
228 	if (lenp != NULL)
229 		*lenp = len;
230 	if (sshbuf_consume(buf, len + 4) != 0) {
231 		/* Shouldn't happen */
232 		SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
233 		SSHBUF_ABORT();
234 		return SSH_ERR_INTERNAL_ERROR;
235 	}
236 	return 0;
237 }
238 
239 int
240 sshbuf_peek_string_direct(const struct sshbuf *buf, const u_char **valp,
241     size_t *lenp)
242 {
243 	u_int32_t len;
244 	const u_char *p = sshbuf_ptr(buf);
245 
246 	if (valp != NULL)
247 		*valp = NULL;
248 	if (lenp != NULL)
249 		*lenp = 0;
250 	if (sshbuf_len(buf) < 4) {
251 		SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE"));
252 		return SSH_ERR_MESSAGE_INCOMPLETE;
253 	}
254 	len = PEEK_U32(p);
255 	if (len > SSHBUF_SIZE_MAX - 4) {
256 		SSHBUF_DBG(("SSH_ERR_STRING_TOO_LARGE"));
257 		return SSH_ERR_STRING_TOO_LARGE;
258 	}
259 	if (sshbuf_len(buf) - 4 < len) {
260 		SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE"));
261 		return SSH_ERR_MESSAGE_INCOMPLETE;
262 	}
263 	if (valp != NULL)
264 		*valp = p + 4;
265 	if (lenp != NULL)
266 		*lenp = len;
267 	return 0;
268 }
269 
270 int
271 sshbuf_get_cstring(struct sshbuf *buf, char **valp, size_t *lenp)
272 {
273 	size_t len;
274 	const u_char *p, *z;
275 	int r;
276 
277 	if (valp != NULL)
278 		*valp = NULL;
279 	if (lenp != NULL)
280 		*lenp = 0;
281 	if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0)
282 		return r;
283 	/* Allow a \0 only at the end of the string */
284 	if (len > 0 &&
285 	    (z = memchr(p , '\0', len)) != NULL && z < p + len - 1) {
286 		SSHBUF_DBG(("SSH_ERR_INVALID_FORMAT"));
287 		return SSH_ERR_INVALID_FORMAT;
288 	}
289 	if ((r = sshbuf_skip_string(buf)) != 0)
290 		return -1;
291 	if (valp != NULL) {
292 		if ((*valp = malloc(len + 1)) == NULL) {
293 			SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL"));
294 			return SSH_ERR_ALLOC_FAIL;
295 		}
296 		if (len != 0)
297 			memcpy(*valp, p, len);
298 		(*valp)[len] = '\0';
299 	}
300 	if (lenp != NULL)
301 		*lenp = (size_t)len;
302 	return 0;
303 }
304 
305 int
306 sshbuf_get_stringb(struct sshbuf *buf, struct sshbuf *v)
307 {
308 	u_int32_t len;
309 	u_char *p;
310 	int r;
311 
312 	/*
313 	 * Use sshbuf_peek_string_direct() to figure out if there is
314 	 * a complete string in 'buf' and copy the string directly
315 	 * into 'v'.
316 	 */
317 	if ((r = sshbuf_peek_string_direct(buf, NULL, NULL)) != 0 ||
318 	    (r = sshbuf_get_u32(buf, &len)) != 0 ||
319 	    (r = sshbuf_reserve(v, len, &p)) != 0 ||
320 	    (r = sshbuf_get(buf, p, len)) != 0)
321 		return r;
322 	return 0;
323 }
324 
325 int
326 sshbuf_put(struct sshbuf *buf, const void *v, size_t len)
327 {
328 	u_char *p;
329 	int r;
330 
331 	if ((r = sshbuf_reserve(buf, len, &p)) < 0)
332 		return r;
333 	if (len != 0)
334 		memcpy(p, v, len);
335 	return 0;
336 }
337 
338 int
339 sshbuf_putb(struct sshbuf *buf, const struct sshbuf *v)
340 {
341 	return sshbuf_put(buf, sshbuf_ptr(v), sshbuf_len(v));
342 }
343 
344 int
345 sshbuf_putf(struct sshbuf *buf, const char *fmt, ...)
346 {
347 	va_list ap;
348 	int r;
349 
350 	va_start(ap, fmt);
351 	r = sshbuf_putfv(buf, fmt, ap);
352 	va_end(ap);
353 	return r;
354 }
355 
356 int
357 sshbuf_putfv(struct sshbuf *buf, const char *fmt, va_list ap)
358 {
359 	va_list ap2;
360 	int r, len;
361 	u_char *p;
362 
363 	VA_COPY(ap2, ap);
364 	if ((len = vsnprintf(NULL, 0, fmt, ap2)) < 0) {
365 		r = SSH_ERR_INVALID_ARGUMENT;
366 		goto out;
367 	}
368 	if (len == 0) {
369 		r = 0;
370 		goto out; /* Nothing to do */
371 	}
372 	va_end(ap2);
373 	VA_COPY(ap2, ap);
374 	if ((r = sshbuf_reserve(buf, (size_t)len + 1, &p)) < 0)
375 		goto out;
376 	if ((r = vsnprintf((char *)p, len + 1, fmt, ap2)) != len) {
377 		r = SSH_ERR_INTERNAL_ERROR;
378 		goto out; /* Shouldn't happen */
379 	}
380 	/* Consume terminating \0 */
381 	if ((r = sshbuf_consume_end(buf, 1)) != 0)
382 		goto out;
383 	r = 0;
384  out:
385 	va_end(ap2);
386 	return r;
387 }
388 
389 int
390 sshbuf_put_u64(struct sshbuf *buf, u_int64_t val)
391 {
392 	u_char *p;
393 	int r;
394 
395 	if ((r = sshbuf_reserve(buf, 8, &p)) < 0)
396 		return r;
397 	POKE_U64(p, val);
398 	return 0;
399 }
400 
401 int
402 sshbuf_put_u32(struct sshbuf *buf, u_int32_t val)
403 {
404 	u_char *p;
405 	int r;
406 
407 	if ((r = sshbuf_reserve(buf, 4, &p)) < 0)
408 		return r;
409 	POKE_U32(p, val);
410 	return 0;
411 }
412 
413 int
414 sshbuf_put_u16(struct sshbuf *buf, u_int16_t val)
415 {
416 	u_char *p;
417 	int r;
418 
419 	if ((r = sshbuf_reserve(buf, 2, &p)) < 0)
420 		return r;
421 	POKE_U16(p, val);
422 	return 0;
423 }
424 
425 int
426 sshbuf_put_u8(struct sshbuf *buf, u_char val)
427 {
428 	u_char *p;
429 	int r;
430 
431 	if ((r = sshbuf_reserve(buf, 1, &p)) < 0)
432 		return r;
433 	p[0] = val;
434 	return 0;
435 }
436 
437 static int
438 check_woffset(struct sshbuf *buf, size_t offset, size_t len, u_char **p)
439 {
440 	int r;
441 
442 	*p = NULL;
443 	if ((r = check_offset(buf, 1, offset, len)) != 0)
444 		return r;
445 	if (sshbuf_mutable_ptr(buf) == NULL)
446 		return SSH_ERR_BUFFER_READ_ONLY;
447 	*p = sshbuf_mutable_ptr(buf) + offset;
448 	return 0;
449 }
450 
451 int
452 sshbuf_poke_u64(struct sshbuf *buf, size_t offset, u_int64_t val)
453 {
454 	u_char *p = NULL;
455 	int r;
456 
457 	if ((r = check_woffset(buf, offset, 8, &p)) != 0)
458 		return r;
459 	POKE_U64(p, val);
460 	return 0;
461 }
462 
463 int
464 sshbuf_poke_u32(struct sshbuf *buf, size_t offset, u_int32_t val)
465 {
466 	u_char *p = NULL;
467 	int r;
468 
469 	if ((r = check_woffset(buf, offset, 4, &p)) != 0)
470 		return r;
471 	POKE_U32(p, val);
472 	return 0;
473 }
474 
475 int
476 sshbuf_poke_u16(struct sshbuf *buf, size_t offset, u_int16_t val)
477 {
478 	u_char *p = NULL;
479 	int r;
480 
481 	if ((r = check_woffset(buf, offset, 2, &p)) != 0)
482 		return r;
483 	POKE_U16(p, val);
484 	return 0;
485 }
486 
487 int
488 sshbuf_poke_u8(struct sshbuf *buf, size_t offset, u_char val)
489 {
490 	u_char *p = NULL;
491 	int r;
492 
493 	if ((r = check_woffset(buf, offset, 1, &p)) != 0)
494 		return r;
495 	*p = val;
496 	return 0;
497 }
498 
499 int
500 sshbuf_poke(struct sshbuf *buf, size_t offset, void *v, size_t len)
501 {
502 	u_char *p = NULL;
503 	int r;
504 
505 	if ((r = check_woffset(buf, offset, len, &p)) != 0)
506 		return r;
507 	memcpy(p, v, len);
508 	return 0;
509 }
510 
511 int
512 sshbuf_put_string(struct sshbuf *buf, const void *v, size_t len)
513 {
514 	u_char *d;
515 	int r;
516 
517 	if (len > SSHBUF_SIZE_MAX - 4) {
518 		SSHBUF_DBG(("SSH_ERR_NO_BUFFER_SPACE"));
519 		return SSH_ERR_NO_BUFFER_SPACE;
520 	}
521 	if ((r = sshbuf_reserve(buf, len + 4, &d)) < 0)
522 		return r;
523 	POKE_U32(d, len);
524 	if (len != 0)
525 		memcpy(d + 4, v, len);
526 	return 0;
527 }
528 
529 int
530 sshbuf_put_cstring(struct sshbuf *buf, const char *v)
531 {
532 	return sshbuf_put_string(buf, v, v == NULL ? 0 : strlen(v));
533 }
534 
535 int
536 sshbuf_put_stringb(struct sshbuf *buf, const struct sshbuf *v)
537 {
538 	if (v == NULL)
539 		return sshbuf_put_string(buf, NULL, 0);
540 
541 	return sshbuf_put_string(buf, sshbuf_ptr(v), sshbuf_len(v));
542 }
543 
544 int
545 sshbuf_froms(struct sshbuf *buf, struct sshbuf **bufp)
546 {
547 	const u_char *p;
548 	size_t len;
549 	struct sshbuf *ret;
550 	int r;
551 
552 	if (buf == NULL || bufp == NULL)
553 		return SSH_ERR_INVALID_ARGUMENT;
554 	*bufp = NULL;
555 	if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0)
556 		return r;
557 	if ((ret = sshbuf_from(p, len)) == NULL)
558 		return SSH_ERR_ALLOC_FAIL;
559 	if ((r = sshbuf_consume(buf, len + 4)) != 0 ||  /* Shouldn't happen */
560 	    (r = sshbuf_set_parent(ret, buf)) != 0) {
561 		sshbuf_free(ret);
562 		return r;
563 	}
564 	*bufp = ret;
565 	return 0;
566 }
567 
568 int
569 sshbuf_put_bignum2_bytes(struct sshbuf *buf, const void *v, size_t len)
570 {
571 	u_char *d;
572 	const u_char *s = (const u_char *)v;
573 	int r, prepend;
574 
575 	if (len > SSHBUF_SIZE_MAX - 5) {
576 		SSHBUF_DBG(("SSH_ERR_NO_BUFFER_SPACE"));
577 		return SSH_ERR_NO_BUFFER_SPACE;
578 	}
579 	/* Skip leading zero bytes */
580 	for (; len > 0 && *s == 0; len--, s++)
581 		;
582 	/*
583 	 * If most significant bit is set then prepend a zero byte to
584 	 * avoid interpretation as a negative number.
585 	 */
586 	prepend = len > 0 && (s[0] & 0x80) != 0;
587 	if ((r = sshbuf_reserve(buf, len + 4 + prepend, &d)) < 0)
588 		return r;
589 	POKE_U32(d, len + prepend);
590 	if (prepend)
591 		d[4] = 0;
592 	if (len != 0)
593 		memcpy(d + 4 + prepend, s, len);
594 	return 0;
595 }
596 
597 int
598 sshbuf_get_bignum2_bytes_direct(struct sshbuf *buf,
599     const u_char **valp, size_t *lenp)
600 {
601 	const u_char *d;
602 	size_t len, olen;
603 	int r;
604 
605 	if ((r = sshbuf_peek_string_direct(buf, &d, &olen)) < 0)
606 		return r;
607 	len = olen;
608 	/* Refuse negative (MSB set) bignums */
609 	if ((len != 0 && (*d & 0x80) != 0))
610 		return SSH_ERR_BIGNUM_IS_NEGATIVE;
611 	/* Refuse overlong bignums, allow prepended \0 to avoid MSB set */
612 	if (len > SSHBUF_MAX_BIGNUM + 1 ||
613 	    (len == SSHBUF_MAX_BIGNUM + 1 && *d != 0))
614 		return SSH_ERR_BIGNUM_TOO_LARGE;
615 	/* Trim leading zeros */
616 	while (len > 0 && *d == 0x00) {
617 		d++;
618 		len--;
619 	}
620 	if (valp != NULL)
621 		*valp = d;
622 	if (lenp != NULL)
623 		*lenp = len;
624 	if (sshbuf_consume(buf, olen + 4) != 0) {
625 		/* Shouldn't happen */
626 		SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
627 		SSHBUF_ABORT();
628 		return SSH_ERR_INTERNAL_ERROR;
629 	}
630 	return 0;
631 }
632