upstream commit

fix signed/unsigned errors reported by clang-3.7; add
 sshbuf_dup_string() to replace a common idiom of strdup(sshbuf_ptr()) with
 better safety checking; feedback and ok markus@

Upstream-ID: 71f926d9bb3f1efed51319a6daf37e93d57c8820

1 files changed, 31 insertions, 20 deletions

diff --git a/sshd.c b/sshd.c
index d21aed515..8b8af2494 100644
--- a/sshd.c
+++ b/sshd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd.c,v 1.466 2016/03/07 19:02:43 djm Exp $ */
+/* $OpenBSD: sshd.c,v 1.467 2016/05/02 08:49:03 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -845,8 +845,8 @@ list_hostkey_types(void)
                         break;
                 }
         }
-        buffer_append(&b, "\0", 1);
-        ret = xstrdup(buffer_ptr(&b));
+        if ((ret = sshbuf_dup_string(&b)) == NULL)
+                fatal("%s: sshbuf_dup_string failed", __func__);
         buffer_free(&b);
         debug("list_hostkey_types: %s", ret);
         return ret;
@@ -1027,12 +1027,13 @@ usage(void)
 }
 
 static void
-send_rexec_state(int fd, Buffer *conf)
+send_rexec_state(int fd, struct sshbuf *conf)
 {
-        Buffer m;
+        struct sshbuf *m;
+        int r;
 
-        debug3("%s: entering fd = %d config len %d", __func__, fd,
-            buffer_len(conf));
+        debug3("%s: entering fd = %d config len %zu", __func__, fd,
+            sshbuf_len(conf));
 
         /*
          * Protocol from reexec master to child:
@@ -1046,31 +1047,41 @@ send_rexec_state(int fd, Buffer *conf)
          *      bignum  q                       "
          *      string rngseed          (only if OpenSSL is not self-seeded)
          */
-        buffer_init(&m);
-        buffer_put_cstring(&m, buffer_ptr(conf));
+        if ((m = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
+        if ((r = sshbuf_put_stringb(m, conf)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
 
 #ifdef WITH_SSH1
         if (sensitive_data.server_key != NULL &&
             sensitive_data.server_key->type == KEY_RSA1) {
-                buffer_put_int(&m, 1);
-                buffer_put_bignum(&m, sensitive_data.server_key->rsa->e);
-                buffer_put_bignum(&m, sensitive_data.server_key->rsa->n);
-                buffer_put_bignum(&m, sensitive_data.server_key->rsa->d);
-                buffer_put_bignum(&m, sensitive_data.server_key->rsa->iqmp);
-                buffer_put_bignum(&m, sensitive_data.server_key->rsa->p);
-                buffer_put_bignum(&m, sensitive_data.server_key->rsa->q);
+                if ((r = sshbuf_put_u32(m, 1)) != 0 ||
+                    (r = sshbuf_put_bignum1(m,
+                    sensitive_data.server_key->rsa->e)) != 0 ||
+                    (r = sshbuf_put_bignum1(m,
+                    sensitive_data.server_key->rsa->n)) != 0 ||
+                    (r = sshbuf_put_bignum1(m,
+                    sensitive_data.server_key->rsa->d)) != 0 ||
+                    (r = sshbuf_put_bignum1(m,
+                    sensitive_data.server_key->rsa->iqmp)) != 0 ||
+                    (r = sshbuf_put_bignum1(m,
+                    sensitive_data.server_key->rsa->p)) != 0 ||
+                    (r = sshbuf_put_bignum1(m,
+                    sensitive_data.server_key->rsa->q)) != 0)
+                        fatal("%s: buffer error: %s", __func__, ssh_err(r));
         } else
 #endif
-                buffer_put_int(&m, 0);
+                if ((r = sshbuf_put_u32(m, 1)) != 0)
+                        fatal("%s: buffer error: %s", __func__, ssh_err(r));
 
 #if defined(WITH_OPENSSL) && !defined(OPENSSL_PRNG_ONLY)
-        rexec_send_rng_seed(&m);
+        rexec_send_rng_seed(m);
 #endif
 
-        if (ssh_msg_send(fd, 0, &m) == -1)
+        if (ssh_msg_send(fd, 0, m) == -1)
                 fatal("%s: ssh_msg_send failed", __func__);
 
-        buffer_free(&m);
+        sshbuf_free(m);
 
         debug3("%s: done", __func__);
 }