Commit | Line | Data |
---|---|---|
f04dca8e EF |
1 | https://github.com/libssh2/libssh2/commit/dedcbd106f8e52d5586b0205bc7677e4c9868f9c.patch |
2 | ||
3 | From dedcbd106f8e52d5586b0205bc7677e4c9868f9c Mon Sep 17 00:00:00 2001 | |
4 | From: Will Cosgrove <will@panic.com> | |
5 | Date: Fri, 30 Aug 2019 09:57:38 -0700 | |
6 | Subject: [PATCH] packet.c: improve message parsing (#402) | |
7 | ||
8 | * packet.c: improve parsing of packets | |
9 | ||
10 | file: packet.c | |
11 | ||
12 | notes: | |
13 | Use _libssh2_get_string API in SSH_MSG_DEBUG/SSH_MSG_DISCONNECT. Additional uint32 bounds check in SSH_MSG_GLOBAL_REQUEST. | |
14 | --- | |
15 | src/packet.c | 68 ++++++++++++++++++++++------------------------------ | |
16 | 1 file changed, 29 insertions(+), 39 deletions(-) | |
17 | ||
18 | diff --git a/src/packet.c b/src/packet.c | |
19 | index 38ab62944..2e01bfc5d 100644 | |
20 | --- a/src/packet.c | |
21 | +++ b/src/packet.c | |
22 | @@ -419,8 +419,8 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data, | |
23 | size_t datalen, int macstate) | |
24 | { | |
25 | int rc = 0; | |
26 | - char *message = NULL; | |
27 | - char *language = NULL; | |
28 | + unsigned char *message = NULL; | |
29 | + unsigned char *language = NULL; | |
30 | size_t message_len = 0; | |
31 | size_t language_len = 0; | |
32 | LIBSSH2_CHANNEL *channelp = NULL; | |
33 | @@ -472,33 +472,23 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data, | |
34 | ||
35 | case SSH_MSG_DISCONNECT: | |
36 | if(datalen >= 5) { | |
37 | - size_t reason = _libssh2_ntohu32(data + 1); | |
38 | + uint32_t reason = 0; | |
39 | + struct string_buf buf; | |
40 | + buf.data = (unsigned char *)data; | |
41 | + buf.dataptr = buf.data; | |
42 | + buf.len = datalen; | |
43 | + buf.dataptr++; /* advance past type */ | |
44 | ||
45 | - if(datalen >= 9) { | |
46 | - message_len = _libssh2_ntohu32(data + 5); | |
47 | + _libssh2_get_u32(&buf, &reason); | |
48 | + _libssh2_get_string(&buf, &message, &message_len); | |
49 | + _libssh2_get_string(&buf, &language, &language_len); | |
50 | ||
51 | - if(message_len < datalen-13) { | |
52 | - /* 9 = packet_type(1) + reason(4) + message_len(4) */ | |
53 | - message = (char *) data + 9; | |
54 | - | |
55 | - language_len = | |
56 | - _libssh2_ntohu32(data + 9 + message_len); | |
57 | - language = (char *) data + 9 + message_len + 4; | |
58 | - | |
59 | - if(language_len > (datalen-13-message_len)) { | |
60 | - /* bad input, clear info */ | |
61 | - language = message = NULL; | |
62 | - language_len = message_len = 0; | |
63 | - } | |
64 | - } | |
65 | - else | |
66 | - /* bad size, clear it */ | |
67 | - message_len = 0; | |
68 | - } | |
69 | if(session->ssh_msg_disconnect) { | |
70 | - LIBSSH2_DISCONNECT(session, reason, message, | |
71 | - message_len, language, language_len); | |
72 | + LIBSSH2_DISCONNECT(session, reason, (const char *)message, | |
73 | + message_len, (const char *)language, | |
74 | + language_len); | |
75 | } | |
76 | + | |
77 | _libssh2_debug(session, LIBSSH2_TRACE_TRANS, | |
78 | "Disconnect(%d): %s(%s)", reason, | |
79 | message, language); | |
80 | @@ -539,24 +529,24 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data, | |
81 | int always_display = data[1]; | |
82 | ||
83 | if(datalen >= 6) { | |
84 | - message_len = _libssh2_ntohu32(data + 2); | |
85 | - | |
86 | - if(message_len <= (datalen - 10)) { | |
87 | - /* 6 = packet_type(1) + display(1) + message_len(4) */ | |
88 | - message = (char *) data + 6; | |
89 | - language_len = _libssh2_ntohu32(data + 6 + | |
90 | - message_len); | |
91 | - | |
92 | - if(language_len <= (datalen - 10 - message_len)) | |
93 | - language = (char *) data + 10 + message_len; | |
94 | - } | |
95 | + struct string_buf buf; | |
96 | + buf.data = (unsigned char *)data; | |
97 | + buf.dataptr = buf.data; | |
98 | + buf.len = datalen; | |
99 | + buf.dataptr += 2; /* advance past type & always display */ | |
100 | + | |
101 | + _libssh2_get_string(&buf, &message, &message_len); | |
102 | + _libssh2_get_string(&buf, &language, &language_len); | |
103 | } | |
104 | ||
105 | if(session->ssh_msg_debug) { | |
106 | - LIBSSH2_DEBUG(session, always_display, message, | |
107 | - message_len, language, language_len); | |
108 | + LIBSSH2_DEBUG(session, always_display, | |
109 | + (const char *)message, | |
110 | + message_len, (const char *)language, | |
111 | + language_len); | |
112 | } | |
113 | } | |
114 | + | |
115 | /* | |
116 | * _libssh2_debug will actually truncate this for us so | |
117 | * that it's not an inordinate about of data | |
118 | @@ -579,7 +569,7 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data, | |
119 | uint32_t len = 0; | |
120 | unsigned char want_reply = 0; | |
121 | len = _libssh2_ntohu32(data + 1); | |
122 | - if(datalen >= (6 + len)) { | |
123 | + if((len <= (UINT_MAX - 6)) && (datalen >= (6 + len))) { | |
124 | want_reply = data[5 + len]; | |
125 | _libssh2_debug(session, | |
126 | LIBSSH2_TRACE_CONN, |