1/*	$OpenBSD: sshbuf.c,v 1.12 2018/07/09 21:56:06 markus Exp $	*/
2/*
3 * Copyright (c) 2011 Damien Miller
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18#define SSHBUF_INTERNAL
19#include "includes.h"
20
21#include <sys/types.h>
22#include <signal.h>
23#include <stdlib.h>
24#include <stdio.h>
25#include <string.h>
26
27#include "ssherr.h"
28#include "sshbuf.h"
29#include "misc.h"
30
31static inline int
32sshbuf_check_sanity(const struct sshbuf *buf)
33{
34	SSHBUF_TELL("sanity");
35	if (__predict_false(buf == NULL ||
36	    (!buf->readonly && buf->d != buf->cd) ||
37	    buf->refcount < 1 || buf->refcount > SSHBUF_REFS_MAX ||
38	    buf->cd == NULL ||
39	    buf->max_size > SSHBUF_SIZE_MAX ||
40	    buf->alloc > buf->max_size ||
41	    buf->size > buf->alloc ||
42	    buf->off > buf->size)) {
43		/* Do not try to recover from corrupted buffer internals */
44		SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
45		signal(SIGSEGV, SIG_DFL);
46		raise(SIGSEGV);
47		return SSH_ERR_INTERNAL_ERROR;
48	}
49	return 0;
50}
51
52static void
53sshbuf_maybe_pack(struct sshbuf *buf, int force)
54{
55	SSHBUF_DBG(("force %d", force));
56	SSHBUF_TELL("pre-pack");
57	if (buf->off == 0 || buf->readonly || buf->refcount > 1)
58		return;
59	if (force ||
60	    (buf->off >= SSHBUF_PACK_MIN && buf->off >= buf->size / 2)) {
61		memmove(buf->d, buf->d + buf->off, buf->size - buf->off);
62		buf->size -= buf->off;
63		buf->off = 0;
64		SSHBUF_TELL("packed");
65	}
66}
67
68struct sshbuf *
69sshbuf_new(void)
70{
71	struct sshbuf *ret;
72
73	if ((ret = calloc(sizeof(*ret), 1)) == NULL)
74		return NULL;
75	ret->alloc = SSHBUF_SIZE_INIT;
76	ret->max_size = SSHBUF_SIZE_MAX;
77	ret->readonly = 0;
78	ret->refcount = 1;
79	ret->parent = NULL;
80	if ((ret->cd = ret->d = calloc(1, ret->alloc)) == NULL) {
81		free(ret);
82		return NULL;
83	}
84	return ret;
85}
86
87struct sshbuf *
88sshbuf_from(const void *blob, size_t len)
89{
90	struct sshbuf *ret;
91
92	if (blob == NULL || len > SSHBUF_SIZE_MAX ||
93	    (ret = calloc(sizeof(*ret), 1)) == NULL)
94		return NULL;
95	ret->alloc = ret->size = ret->max_size = len;
96	ret->readonly = 1;
97	ret->refcount = 1;
98	ret->parent = NULL;
99	ret->cd = blob;
100	ret->d = NULL;
101	return ret;
102}
103
104int
105sshbuf_set_parent(struct sshbuf *child, struct sshbuf *parent)
106{
107	int r;
108
109	if ((r = sshbuf_check_sanity(child)) != 0 ||
110	    (r = sshbuf_check_sanity(parent)) != 0)
111		return r;
112	child->parent = parent;
113	child->parent->refcount++;
114	return 0;
115}
116
117struct sshbuf *
118sshbuf_fromb(struct sshbuf *buf)
119{
120	struct sshbuf *ret;
121
122	if (sshbuf_check_sanity(buf) != 0)
123		return NULL;
124	if ((ret = sshbuf_from(sshbuf_ptr(buf), sshbuf_len(buf))) == NULL)
125		return NULL;
126	if (sshbuf_set_parent(ret, buf) != 0) {
127		sshbuf_free(ret);
128		return NULL;
129	}
130	return ret;
131}
132
133void
134sshbuf_free(struct sshbuf *buf)
135{
136	if (buf == NULL)
137		return;
138	/*
139	 * The following will leak on insane buffers, but this is the safest
140	 * course of action - an invalid pointer or already-freed pointer may
141	 * have been passed to us and continuing to scribble over memory would
142	 * be bad.
143	 */
144	if (sshbuf_check_sanity(buf) != 0)
145		return;
146	/*
147	 * If we are a child, the free our parent to decrement its reference
148	 * count and possibly free it.
149	 */
150	sshbuf_free(buf->parent);
151	buf->parent = NULL;
152	/*
153	 * If we are a parent with still-extant children, then don't free just
154	 * yet. The last child's call to sshbuf_free should decrement our
155	 * refcount to 0 and trigger the actual free.
156	 */
157	buf->refcount--;
158	if (buf->refcount > 0)
159		return;
160	if (!buf->readonly) {
161		explicit_bzero(buf->d, buf->alloc);
162		free(buf->d);
163	}
164	explicit_bzero(buf, sizeof(*buf));
165	free(buf);
166}
167
168void
169sshbuf_reset(struct sshbuf *buf)
170{
171	u_char *d;
172
173	if (buf->readonly || buf->refcount > 1) {
174		/* Nonsensical. Just make buffer appear empty */
175		buf->off = buf->size;
176		return;
177	}
178	(void) sshbuf_check_sanity(buf);
179	buf->off = buf->size = 0;
180	if (buf->alloc != SSHBUF_SIZE_INIT) {
181		if ((d = recallocarray(buf->d, buf->alloc, SSHBUF_SIZE_INIT,
182		    1)) != NULL) {
183			buf->cd = buf->d = d;
184			buf->alloc = SSHBUF_SIZE_INIT;
185		}
186	}
187	explicit_bzero(buf->d, SSHBUF_SIZE_INIT);
188}
189
190size_t
191sshbuf_max_size(const struct sshbuf *buf)
192{
193	return buf->max_size;
194}
195
196size_t
197sshbuf_alloc(const struct sshbuf *buf)
198{
199	return buf->alloc;
200}
201
202const struct sshbuf *
203sshbuf_parent(const struct sshbuf *buf)
204{
205	return buf->parent;
206}
207
208u_int
209sshbuf_refcount(const struct sshbuf *buf)
210{
211	return buf->refcount;
212}
213
214int
215sshbuf_set_max_size(struct sshbuf *buf, size_t max_size)
216{
217	size_t rlen;
218	u_char *dp;
219	int r;
220
221	SSHBUF_DBG(("set max buf = %p len = %zu", buf, max_size));
222	if ((r = sshbuf_check_sanity(buf)) != 0)
223		return r;
224	if (max_size == buf->max_size)
225		return 0;
226	if (buf->readonly || buf->refcount > 1)
227		return SSH_ERR_BUFFER_READ_ONLY;
228	if (max_size > SSHBUF_SIZE_MAX)
229		return SSH_ERR_NO_BUFFER_SPACE;
230	/* pack and realloc if necessary */
231	sshbuf_maybe_pack(buf, max_size < buf->size);
232	if (max_size < buf->alloc && max_size > buf->size) {
233		if (buf->size < SSHBUF_SIZE_INIT)
234			rlen = SSHBUF_SIZE_INIT;
235		else
236			rlen = ROUNDUP(buf->size, SSHBUF_SIZE_INC);
237		if (rlen > max_size)
238			rlen = max_size;
239		SSHBUF_DBG(("new alloc = %zu", rlen));
240		if ((dp = recallocarray(buf->d, buf->alloc, rlen, 1)) == NULL)
241			return SSH_ERR_ALLOC_FAIL;
242		buf->cd = buf->d = dp;
243		buf->alloc = rlen;
244	}
245	SSHBUF_TELL("new-max");
246	if (max_size < buf->alloc)
247		return SSH_ERR_NO_BUFFER_SPACE;
248	buf->max_size = max_size;
249	return 0;
250}
251
252size_t
253sshbuf_len(const struct sshbuf *buf)
254{
255	if (sshbuf_check_sanity(buf) != 0)
256		return 0;
257	return buf->size - buf->off;
258}
259
260size_t
261sshbuf_avail(const struct sshbuf *buf)
262{
263	if (sshbuf_check_sanity(buf) != 0 || buf->readonly || buf->refcount > 1)
264		return 0;
265	return buf->max_size - (buf->size - buf->off);
266}
267
268const u_char *
269sshbuf_ptr(const struct sshbuf *buf)
270{
271	if (sshbuf_check_sanity(buf) != 0)
272		return NULL;
273	return buf->cd + buf->off;
274}
275
276u_char *
277sshbuf_mutable_ptr(const struct sshbuf *buf)
278{
279	if (sshbuf_check_sanity(buf) != 0 || buf->readonly || buf->refcount > 1)
280		return NULL;
281	return buf->d + buf->off;
282}
283
284int
285sshbuf_check_reserve(const struct sshbuf *buf, size_t len)
286{
287	int r;
288
289	if ((r = sshbuf_check_sanity(buf)) != 0)
290		return r;
291	if (buf->readonly || buf->refcount > 1)
292		return SSH_ERR_BUFFER_READ_ONLY;
293	SSHBUF_TELL("check");
294	/* Check that len is reasonable and that max_size + available < len */
295	if (len > buf->max_size || buf->max_size - len < buf->size - buf->off)
296		return SSH_ERR_NO_BUFFER_SPACE;
297	return 0;
298}
299
300int
301sshbuf_allocate(struct sshbuf *buf, size_t len)
302{
303	size_t rlen, need;
304	u_char *dp;
305	int r;
306
307	SSHBUF_DBG(("allocate buf = %p len = %zu", buf, len));
308	if ((r = sshbuf_check_reserve(buf, len)) != 0)
309		return r;
310	/*
311	 * If the requested allocation appended would push us past max_size
312	 * then pack the buffer, zeroing buf->off.
313	 */
314	sshbuf_maybe_pack(buf, buf->size + len > buf->max_size);
315	SSHBUF_TELL("allocate");
316	if (len + buf->size <= buf->alloc)
317		return 0; /* already have it. */
318
319	/*
320	 * Prefer to alloc in SSHBUF_SIZE_INC units, but
321	 * allocate less if doing so would overflow max_size.
322	 */
323	need = len + buf->size - buf->alloc;
324	rlen = ROUNDUP(buf->alloc + need, SSHBUF_SIZE_INC);
325	SSHBUF_DBG(("need %zu initial rlen %zu", need, rlen));
326	if (rlen > buf->max_size)
327		rlen = buf->alloc + need;
328	SSHBUF_DBG(("adjusted rlen %zu", rlen));
329	if ((dp = recallocarray(buf->d, buf->alloc, rlen, 1)) == NULL) {
330		SSHBUF_DBG(("realloc fail"));
331		return SSH_ERR_ALLOC_FAIL;
332	}
333	buf->alloc = rlen;
334	buf->cd = buf->d = dp;
335	if ((r = sshbuf_check_reserve(buf, len)) < 0) {
336		/* shouldn't fail */
337		return r;
338	}
339	SSHBUF_TELL("done");
340	return 0;
341}
342
343int
344sshbuf_reserve(struct sshbuf *buf, size_t len, u_char **dpp)
345{
346	u_char *dp;
347	int r;
348
349	if (dpp != NULL)
350		*dpp = NULL;
351
352	SSHBUF_DBG(("reserve buf = %p len = %zu", buf, len));
353	if ((r = sshbuf_allocate(buf, len)) != 0)
354		return r;
355
356	dp = buf->d + buf->size;
357	buf->size += len;
358	if (dpp != NULL)
359		*dpp = dp;
360	return 0;
361}
362
363int
364sshbuf_consume(struct sshbuf *buf, size_t len)
365{
366	int r;
367
368	SSHBUF_DBG(("len = %zu", len));
369	if ((r = sshbuf_check_sanity(buf)) != 0)
370		return r;
371	if (len == 0)
372		return 0;
373	if (len > sshbuf_len(buf))
374		return SSH_ERR_MESSAGE_INCOMPLETE;
375	buf->off += len;
376	/* deal with empty buffer */
377	if (buf->off == buf->size)
378		buf->off = buf->size = 0;
379	SSHBUF_TELL("done");
380	return 0;
381}
382
383int
384sshbuf_consume_end(struct sshbuf *buf, size_t len)
385{
386	int r;
387
388	SSHBUF_DBG(("len = %zu", len));
389	if ((r = sshbuf_check_sanity(buf)) != 0)
390		return r;
391	if (len == 0)
392		return 0;
393	if (len > sshbuf_len(buf))
394		return SSH_ERR_MESSAGE_INCOMPLETE;
395	buf->size -= len;
396	SSHBUF_TELL("done");
397	return 0;
398}
399
400