1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
|
From 270d6aa2bb01f3430d07cce5f97b48b741e3df9c Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@cryptomilk.org>
Date: Fri, 7 Dec 2018 12:06:03 +0100
Subject: [PATCH] buffer: Use size_t for argc argument in ssh_buffer_(un)pack()
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
---
Upstream status: commit c306a693f3fbe
include/libssh/buffer.h | 4 ++--
src/buffer.c | 38 +++++++++++++++++++-------------------
2 files changed, 21 insertions(+), 21 deletions(-)
diff --git a/include/libssh/buffer.h b/include/libssh/buffer.h
index 4721cbe06c20..1c375343ee14 100644
--- a/include/libssh/buffer.h
+++ b/include/libssh/buffer.h
@@ -40,11 +40,11 @@ void *ssh_buffer_allocate(struct ssh_buffer_struct *buffer, uint32_t len);
int ssh_buffer_allocate_size(struct ssh_buffer_struct *buffer, uint32_t len);
int ssh_buffer_pack_va(struct ssh_buffer_struct *buffer,
const char *format,
- int argc,
+ size_t argc,
va_list ap);
int _ssh_buffer_pack(struct ssh_buffer_struct *buffer,
const char *format,
- int argc,
+ size_t argc,
...);
#define ssh_buffer_pack(buffer, format, ...) \
_ssh_buffer_pack((buffer), (format), __VA_NARG__(__VA_ARGS__), __VA_ARGS__, SSH_BUFFER_PACK_END)
diff --git a/src/buffer.c b/src/buffer.c
index b029f202660f..99863747fc3c 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -809,7 +809,7 @@ ssh_buffer_get_ssh_string(struct ssh_buffer_struct *buffer)
*/
static int ssh_buffer_pack_allocate_va(struct ssh_buffer_struct *buffer,
const char *format,
- int argc,
+ size_t argc,
va_list ap)
{
const char *p = NULL;
@@ -817,12 +817,12 @@ static int ssh_buffer_pack_allocate_va(struct ssh_buffer_struct *buffer,
char *cstring = NULL;
size_t needed_size = 0;
size_t len;
- int count; /* int for size comparison with argc */
+ size_t count;
int rc = SSH_OK;
for (p = format, count = 0; *p != '\0'; p++, count++) {
/* Invalid number of arguments passed */
- if (argc != -1 && count > argc) {
+ if (count > argc) {
return SSH_ERROR;
}
@@ -881,7 +881,7 @@ static int ssh_buffer_pack_allocate_va(struct ssh_buffer_struct *buffer,
}
}
- if (argc != -1 && argc != count) {
+ if (argc != count) {
return SSH_ERROR;
}
@@ -891,11 +891,7 @@ static int ssh_buffer_pack_allocate_va(struct ssh_buffer_struct *buffer,
*/
uint32_t canary = va_arg(ap, uint32_t);
if (canary != SSH_BUFFER_PACK_END) {
- if (argc == -1){
- return SSH_ERROR;
- } else {
- abort();
- }
+ abort();
}
}
@@ -918,7 +914,7 @@ static int ssh_buffer_pack_allocate_va(struct ssh_buffer_struct *buffer,
*/
int ssh_buffer_pack_va(struct ssh_buffer_struct *buffer,
const char *format,
- int argc,
+ size_t argc,
va_list ap)
{
int rc = SSH_ERROR;
@@ -934,11 +930,15 @@ int ssh_buffer_pack_va(struct ssh_buffer_struct *buffer,
char *cstring;
bignum b;
size_t len;
- int count; /* int for size comparison with argc */
+ size_t count;
+
+ if (argc > 256) {
+ return SSH_ERROR;
+ }
for (p = format, count = 0; *p != '\0'; p++, count++) {
/* Invalid number of arguments passed */
- if (argc != -1 && count > argc) {
+ if (count > argc) {
return SSH_ERROR;
}
@@ -1010,7 +1010,7 @@ int ssh_buffer_pack_va(struct ssh_buffer_struct *buffer,
}
}
- if (argc != -1 && argc != count) {
+ if (argc != count) {
return SSH_ERROR;
}
@@ -1018,11 +1018,7 @@ int ssh_buffer_pack_va(struct ssh_buffer_struct *buffer,
/* Check if our canary is intact, if not somthing really bad happened */
uint32_t canary = va_arg(ap, uint32_t);
if (canary != SSH_BUFFER_PACK_END) {
- if (argc == -1){
- return SSH_ERROR;
- } else {
- abort();
- }
+ abort();
}
}
return rc;
@@ -1050,12 +1046,16 @@ int ssh_buffer_pack_va(struct ssh_buffer_struct *buffer,
*/
int _ssh_buffer_pack(struct ssh_buffer_struct *buffer,
const char *format,
- int argc,
+ size_t argc,
...)
{
va_list ap;
int rc;
+ if (argc > 256) {
+ return SSH_ERROR;
+ }
+
va_start(ap, argc);
rc = ssh_buffer_pack_allocate_va(buffer, format, argc, ap);
va_end(ap);
--
2.20.1
|
