From 28b6111db0f4ced931f2ce4b890a8d109904b8e2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20Perrad?= Date: Wed, 20 Mar 2019 15:09:19 +0100 Subject: [PATCH] use strlcpy & strlcat (#74) * refactor checkpubkeyperms() with safe BSD functions fix gcc8 warnings ``` svr-authpubkey.c: In function 'checkpubkeyperms': svr-authpubkey.c:427:2: warning: 'strncat' specified bound 5 equals source length [-Wstringop-overflow=] strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ svr-authpubkey.c:433:2: warning: 'strncat' specified bound 16 equals source length [-Wstringop-overflow=] strncat(filename, "/authorized_keys", 16); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ``` see https://www.sudo.ws/todd/papers/strlcpy.html * restore strlcpy in xstrdup see original https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/xmalloc.c?rev=1.16 --- scpmisc.c | 2 +- svr-authpubkey.c | 9 +++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/scpmisc.c b/scpmisc.c index 33e1891..c2f053e 100644 --- a/scpmisc.c +++ b/scpmisc.c @@ -102,7 +102,7 @@ xstrdup(const char *str) len = strlen(str) + 1; cp = xmalloc(len); - strncpy(cp, str, len); + strlcpy(cp, str, len); return cp; } diff --git a/svr-authpubkey.c b/svr-authpubkey.c index ae1402d..dafa99a 100644 --- a/svr-authpubkey.c +++ b/svr-authpubkey.c @@ -424,8 +424,9 @@ static int checkpubkeyperms() { /* allocate max required pathname storage, * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */ - filename = m_malloc(len + 22); - strncpy(filename, ses.authstate.pw_dir, len+1); + len += 22; + filename = m_malloc(len); + strlcpy(filename, ses.authstate.pw_dir, len); /* check ~ */ if (checkfileperm(filename) != DROPBEAR_SUCCESS) { @@ -433,13 +434,13 @@ static int checkpubkeyperms() { } /* check ~/.ssh */ - strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */ + strlcat(filename, "/.ssh", len); if (checkfileperm(filename) != DROPBEAR_SUCCESS) { goto out; } /* now check ~/.ssh/authorized_keys */ - strncat(filename, "/authorized_keys", 16); + strlcat(filename, "/authorized_keys", len); if (checkfileperm(filename) != DROPBEAR_SUCCESS) { goto out; }