sshbuf.c revision 1.5 
1/*	$OpenBSD: sshbuf.c,v 1.5 2015/12/11 04:21:12 mmcc Exp $	*/
2/*
3 * Copyright (c) 2011 Damien Miller
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18#include <sys/param.h>	/* roundup */
19#include <sys/types.h>
20#include <signal.h>
21#include <stdlib.h>
22#include <stdio.h>
23#include <string.h>
24
25#include "ssherr.h"
26#define SSHBUF_INTERNAL
27#include "sshbuf.h"
28
29static inline int
30sshbuf_check_sanity(const struct sshbuf *buf)
31{
32	SSHBUF_TELL("sanity");
33	if (__predict_false(buf == NULL ||
34	    (!buf->readonly && buf->d != buf->cd) ||
35	    buf->refcount < 1 || buf->refcount > SSHBUF_REFS_MAX ||
36	    buf->cd == NULL ||
37	    (buf->dont_free && (buf->readonly || buf->parent != NULL)) ||
38	    buf->max_size > SSHBUF_SIZE_MAX ||
39	    buf->alloc > buf->max_size ||
40	    buf->size > buf->alloc ||
41	    buf->off > buf->size)) {
42		/* Do not try to recover from corrupted buffer internals */
43		SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
44		signal(SIGSEGV, SIG_DFL);
45		raise(SIGSEGV);
46		return SSH_ERR_INTERNAL_ERROR;
47	}
48	return 0;
49}
50
51static void
52sshbuf_maybe_pack(struct sshbuf *buf, int force)
53{
54	SSHBUF_DBG(("force %d", force));
55	SSHBUF_TELL("pre-pack");
56	if (buf->off == 0 || buf->readonly || buf->refcount > 1)
57		return;
58	if (force ||
59	    (buf->off >= SSHBUF_PACK_MIN && buf->off >= buf->size / 2)) {
60		memmove(buf->d, buf->d + buf->off, buf->size - buf->off);
61		buf->size -= buf->off;
62		buf->off = 0;
63		SSHBUF_TELL("packed");
64	}
65}
66
67struct sshbuf *
68sshbuf_new(void)
69{
70	struct sshbuf *ret;
71
72	if ((ret = calloc(sizeof(*ret), 1)) == NULL)
73		return NULL;
74	ret->alloc = SSHBUF_SIZE_INIT;
75	ret->max_size = SSHBUF_SIZE_MAX;
76	ret->readonly = 0;
77	ret->refcount = 1;
78	ret->parent = NULL;
79	if ((ret->cd = ret->d = calloc(1, ret->alloc)) == NULL) {
80		free(ret);
81		return NULL;
82	}
83	return ret;
84}
85
86struct sshbuf *
87sshbuf_from(const void *blob, size_t len)
88{
89	struct sshbuf *ret;
90
91	if (blob == NULL || len > SSHBUF_SIZE_MAX ||
92	    (ret = calloc(sizeof(*ret), 1)) == NULL)
93		return NULL;
94	ret->alloc = ret->size = ret->max_size = len;
95	ret->readonly = 1;
96	ret->refcount = 1;
97	ret->parent = NULL;
98	ret->cd = blob;
99	ret->d = NULL;
100	return ret;
101}
102
103int
104sshbuf_set_parent(struct sshbuf *child, struct sshbuf *parent)
105{
106	int r;
107
108	if ((r = sshbuf_check_sanity(child)) != 0 ||
109	    (r = sshbuf_check_sanity(parent)) != 0)
110		return r;
111	child->parent = parent;
112	child->parent->refcount++;
113	return 0;
114}
115
116struct sshbuf *
117sshbuf_fromb(struct sshbuf *buf)
118{
119	struct sshbuf *ret;
120
121	if (sshbuf_check_sanity(buf) != 0)
122		return NULL;
123	if ((ret = sshbuf_from(sshbuf_ptr(buf), sshbuf_len(buf))) == NULL)
124		return NULL;
125	if (sshbuf_set_parent(ret, buf) != 0) {
126		sshbuf_free(ret);
127		return NULL;
128	}
129	return ret;
130}
131
132void
133sshbuf_init(struct sshbuf *ret)
134{
135	bzero(ret, sizeof(*ret));
136	ret->alloc = SSHBUF_SIZE_INIT;
137	ret->max_size = SSHBUF_SIZE_MAX;
138	ret->readonly = 0;
139	ret->dont_free = 1;
140	ret->refcount = 1;
141	if ((ret->cd = ret->d = calloc(1, ret->alloc)) == NULL)
142		ret->alloc = 0;
143}
144
145void
146sshbuf_free(struct sshbuf *buf)
147{
148	int dont_free = 0;
149
150	if (buf == NULL)
151		return;
152	/*
153	 * The following will leak on insane buffers, but this is the safest
154	 * course of action - an invalid pointer or already-freed pointer may
155	 * have been passed to us and continuing to scribble over memory would
156	 * be bad.
157	 */
158	if (sshbuf_check_sanity(buf) != 0)
159		return;
160	/*
161	 * If we are a child, the free our parent to decrement its reference
162	 * count and possibly free it.
163	 */
164	sshbuf_free(buf->parent);
165	buf->parent = NULL;
166	/*
167	 * If we are a parent with still-extant children, then don't free just
168	 * yet. The last child's call to sshbuf_free should decrement our
169	 * refcount to 0 and trigger the actual free.
170	 */
171	buf->refcount--;
172	if (buf->refcount > 0)
173		return;
174	dont_free = buf->dont_free;
175	if (!buf->readonly) {
176		explicit_bzero(buf->d, buf->alloc);
177		free(buf->d);
178	}
179	bzero(buf, sizeof(*buf));
180	if (!dont_free)
181		free(buf);
182}
183
184void
185sshbuf_reset(struct sshbuf *buf)
186{
187	u_char *d;
188
189	if (buf->readonly || buf->refcount > 1) {
190		/* Nonsensical. Just make buffer appear empty */
191		buf->off = buf->size;
192		return;
193	}
194	if (sshbuf_check_sanity(buf) == 0)
195		bzero(buf->d, buf->alloc);
196	buf->off = buf->size = 0;
197	if (buf->alloc != SSHBUF_SIZE_INIT) {
198		if ((d = realloc(buf->d, SSHBUF_SIZE_INIT)) != NULL) {
199			buf->cd = buf->d = d;
200			buf->alloc = SSHBUF_SIZE_INIT;
201		}
202	}
203}
204
205size_t
206sshbuf_max_size(const struct sshbuf *buf)
207{
208	return buf->max_size;
209}
210
211size_t
212sshbuf_alloc(const struct sshbuf *buf)
213{
214	return buf->alloc;
215}
216
217const struct sshbuf *
218sshbuf_parent(const struct sshbuf *buf)
219{
220	return buf->parent;
221}
222
223u_int
224sshbuf_refcount(const struct sshbuf *buf)
225{
226	return buf->refcount;
227}
228
229int
230sshbuf_set_max_size(struct sshbuf *buf, size_t max_size)
231{
232	size_t rlen;
233	u_char *dp;
234	int r;
235
236	SSHBUF_DBG(("set max buf = %p len = %zu", buf, max_size));
237	if ((r = sshbuf_check_sanity(buf)) != 0)
238		return r;
239	if (max_size == buf->max_size)
240		return 0;
241	if (buf->readonly || buf->refcount > 1)
242		return SSH_ERR_BUFFER_READ_ONLY;
243	if (max_size > SSHBUF_SIZE_MAX)
244		return SSH_ERR_NO_BUFFER_SPACE;
245	/* pack and realloc if necessary */
246	sshbuf_maybe_pack(buf, max_size < buf->size);
247	if (max_size < buf->alloc && max_size > buf->size) {
248		if (buf->size < SSHBUF_SIZE_INIT)
249			rlen = SSHBUF_SIZE_INIT;
250		else
251			rlen = roundup(buf->size, SSHBUF_SIZE_INC);
252		if (rlen > max_size)
253			rlen = max_size;
254		bzero(buf->d + buf->size, buf->alloc - buf->size);
255		SSHBUF_DBG(("new alloc = %zu", rlen));
256		if ((dp = realloc(buf->d, rlen)) == NULL)
257			return SSH_ERR_ALLOC_FAIL;
258		buf->cd = buf->d = dp;
259		buf->alloc = rlen;
260	}
261	SSHBUF_TELL("new-max");
262	if (max_size < buf->alloc)
263		return SSH_ERR_NO_BUFFER_SPACE;
264	buf->max_size = max_size;
265	return 0;
266}
267
268size_t
269sshbuf_len(const struct sshbuf *buf)
270{
271	if (sshbuf_check_sanity(buf) != 0)
272		return 0;
273	return buf->size - buf->off;
274}
275
276size_t
277sshbuf_avail(const struct sshbuf *buf)
278{
279	if (sshbuf_check_sanity(buf) != 0 || buf->readonly || buf->refcount > 1)
280		return 0;
281	return buf->max_size - (buf->size - buf->off);
282}
283
284const u_char *
285sshbuf_ptr(const struct sshbuf *buf)
286{
287	if (sshbuf_check_sanity(buf) != 0)
288		return NULL;
289	return buf->cd + buf->off;
290}
291
292u_char *
293sshbuf_mutable_ptr(const struct sshbuf *buf)
294{
295	if (sshbuf_check_sanity(buf) != 0 || buf->readonly || buf->refcount > 1)
296		return NULL;
297	return buf->d + buf->off;
298}
299
300int
301sshbuf_check_reserve(const struct sshbuf *buf, size_t len)
302{
303	int r;
304
305	if ((r = sshbuf_check_sanity(buf)) != 0)
306		return r;
307	if (buf->readonly || buf->refcount > 1)
308		return SSH_ERR_BUFFER_READ_ONLY;
309	SSHBUF_TELL("check");
310	/* Check that len is reasonable and that max_size + available < len */
311	if (len > buf->max_size || buf->max_size - len < buf->size - buf->off)
312		return SSH_ERR_NO_BUFFER_SPACE;
313	return 0;
314}
315
316int
317sshbuf_reserve(struct sshbuf *buf, size_t len, u_char **dpp)
318{
319	size_t rlen, need;
320	u_char *dp;
321	int r;
322
323	if (dpp != NULL)
324		*dpp = NULL;
325
326	SSHBUF_DBG(("reserve buf = %p len = %zu", buf, len));
327	if ((r = sshbuf_check_reserve(buf, len)) != 0)
328		return r;
329	/*
330	 * If the requested allocation appended would push us past max_size
331	 * then pack the buffer, zeroing buf->off.
332	 */
333	sshbuf_maybe_pack(buf, buf->size + len > buf->max_size);
334	SSHBUF_TELL("reserve");
335	if (len + buf->size > buf->alloc) {
336		/*
337		 * Prefer to alloc in SSHBUF_SIZE_INC units, but
338		 * allocate less if doing so would overflow max_size.
339		 */
340		need = len + buf->size - buf->alloc;
341		rlen = roundup(buf->alloc + need, SSHBUF_SIZE_INC);
342		SSHBUF_DBG(("need %zu initial rlen %zu", need, rlen));
343		if (rlen > buf->max_size)
344			rlen = buf->alloc + need;
345		SSHBUF_DBG(("adjusted rlen %zu", rlen));
346		if ((dp = realloc(buf->d, rlen)) == NULL) {
347			SSHBUF_DBG(("realloc fail"));
348			if (dpp != NULL)
349				*dpp = NULL;
350			return SSH_ERR_ALLOC_FAIL;
351		}
352		buf->alloc = rlen;
353		buf->cd = buf->d = dp;
354		if ((r = sshbuf_check_reserve(buf, len)) < 0) {
355			/* shouldn't fail */
356			if (dpp != NULL)
357				*dpp = NULL;
358			return r;
359		}
360	}
361	dp = buf->d + buf->size;
362	buf->size += len;
363	SSHBUF_TELL("done");
364	if (dpp != NULL)
365		*dpp = dp;
366	return 0;
367}
368
369int
370sshbuf_consume(struct sshbuf *buf, size_t len)
371{
372	int r;
373
374	SSHBUF_DBG(("len = %zu", len));
375	if ((r = sshbuf_check_sanity(buf)) != 0)
376		return r;
377	if (len == 0)
378		return 0;
379	if (len > sshbuf_len(buf))
380		return SSH_ERR_MESSAGE_INCOMPLETE;
381	buf->off += len;
382	SSHBUF_TELL("done");
383	return 0;
384}
385
386int
387sshbuf_consume_end(struct sshbuf *buf, size_t len)
388{
389	int r;
390
391	SSHBUF_DBG(("len = %zu", len));
392	if ((r = sshbuf_check_sanity(buf)) != 0)
393		return r;
394	if (len == 0)
395		return 0;
396	if (len > sshbuf_len(buf))
397		return SSH_ERR_MESSAGE_INCOMPLETE;
398	buf->size -= len;
399	SSHBUF_TELL("done");
400	return 0;
401}
402
403