From ebc71d908cc10cafea05e1aaaa7886d3f8b0bf80 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Tue, 12 Jan 2010 19:45:59 +1100 Subject: - djm@cvs.openbsd.org 2010/01/12 01:36:08 [buffer.h bufaux.c] add a buffer_get_string_ptr_ret() that does the same as buffer_get_string_ptr() but does not fatal() on error; ok dtucker@ --- bufaux.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) (limited to 'bufaux.c') diff --git a/bufaux.c b/bufaux.c index cd9a35ded..e17f001e1 100644 --- a/bufaux.c +++ b/bufaux.c @@ -1,4 +1,4 @@ -/* $OpenBSD: bufaux.c,v 1.46 2008/06/10 23:21:34 dtucker Exp $ */ +/* $OpenBSD: bufaux.c,v 1.47 2010/01/12 01:36:08 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -198,14 +198,17 @@ buffer_get_string(Buffer *buffer, u_int *length_ptr) } void * -buffer_get_string_ptr(Buffer *buffer, u_int *length_ptr) +buffer_get_string_ptr_ret(Buffer *buffer, u_int *length_ptr) { void *ptr; u_int len; - len = buffer_get_int(buffer); - if (len > 256 * 1024) - fatal("buffer_get_string_ptr: bad string length %u", len); + if (buffer_get_int_ret(&len, buffer) != 0) + return NULL; + if (len > 256 * 1024) { + error("buffer_get_string_ptr: bad string length %u", len); + return NULL; + } ptr = buffer_ptr(buffer); buffer_consume(buffer, len); if (length_ptr) @@ -213,6 +216,16 @@ buffer_get_string_ptr(Buffer *buffer, u_int *length_ptr) return (ptr); } +void * +buffer_get_string_ptr(Buffer *buffer, u_int *length_ptr) +{ + void *ret; + + if ((ret = buffer_get_string_ptr_ret(buffer, length_ptr)) == NULL) + fatal("buffer_get_string_ptr: buffer error"); + return (ret); +} + /* * Stores and arbitrary binary string in the buffer. */ -- cgit v1.2.3 From 17751bcab25681d341442fdc2386a30a6bea345e Mon Sep 17 00:00:00 2001 From: Damien Miller Date: Fri, 12 Feb 2010 07:35:08 +1100 Subject: - djm@cvs.openbsd.org 2010/02/02 22:49:34 [bufaux.c] make buffer_get_string_ret() really non-fatal in all cases (it was using buffer_get_int(), which could fatal() on buffer empty); ok markus dtucker --- ChangeLog | 8 ++++++++ bufaux.c | 7 +++++-- 2 files changed, 13 insertions(+), 2 deletions(-) (limited to 'bufaux.c') diff --git a/ChangeLog b/ChangeLog index 2c71e6c89..2c815a3ab 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,11 @@ +20100212 + - (djm) OpenBSD CVS Sync + - djm@cvs.openbsd.org 2010/02/02 22:49:34 + [bufaux.c] + make buffer_get_string_ret() really non-fatal in all cases (it was + using buffer_get_int(), which could fatal() on buffer empty); + ok markus dtucker + 20100210 - (djm) add -lselinux to LIBS before calling AC_CHECK_FUNCS for getseuserbyname; patch from calebcase AT gmail.com via diff --git a/bufaux.c b/bufaux.c index e17f001e1..4ef19c454 100644 --- a/bufaux.c +++ b/bufaux.c @@ -1,4 +1,4 @@ -/* $OpenBSD: bufaux.c,v 1.47 2010/01/12 01:36:08 djm Exp $ */ +/* $OpenBSD: bufaux.c,v 1.48 2010/02/02 22:49:34 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -166,7 +166,10 @@ buffer_get_string_ret(Buffer *buffer, u_int *length_ptr) u_int len; /* Get the length. */ - len = buffer_get_int(buffer); + if (buffer_get_int_ret(&len, buffer) != 0) { + error("buffer_get_string_ret: cannot extract length"); + return (NULL); + } if (len > 256 * 1024) { error("buffer_get_string_ret: bad string length %u", len); return (NULL); -- cgit v1.2.3