security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-03 22:56:33 +02:00
Code Activity

Use inline functions to convert buffer data to scalars.

Browse source 
* include/host2net.h (buf16_to_ulong, buf16_to_uint): New.
(buf16_to_ushort, buf16_to_u16): New.
(buf32_to_size_t, buf32_to_ulong, buf32_to_uint, buf32_to_u32): New.
--

This fixes sign extension on shift problems.  Hanno Böck found a case
with an invalid read due to this problem.  To fix that almost all uses
of "<< 24" and "<< 8" are changed by this patch to use an inline
function from host2net.h.

(back ported from commit 2183683bd6)

Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Werner Koch 2015-02-12 20:34:44 +01:00
parent b62395cf59
commit 3627123dc8
20 changed files with 310 additions and 275 deletions
Download patch file Download diff file Expand all files Collapse all files

97
kbx/keybox-update.c
View file

@ -26,6 +26,7 @@
#include <unistd.h>
#include "keybox-defs.h"
#include "../include/host2net.h"
#define EXTSEP_S "."
@ -65,12 +66,12 @@ fseeko (FILE * stream, off_t newpos, int whence)
static int
create_tmp_file (const char *template,
char **r_bakfname, char **r_tmpfname, FILE **r_fp)
{
{
char *bakfname, *tmpfname;
*r_bakfname = NULL;
*r_tmpfname = NULL;
# ifdef USE_ONLY_8DOT3
/* Here is another Windoze bug?:
* you cant rename("pubring.kbx.tmp", "pubring.kbx");
@ -87,7 +88,7 @@ create_tmp_file (const char *template,
return gpg_error_from_syserror ();
strcpy (bakfname, template);
strcpy (bakfname+strlen(template)-4, EXTSEP_S "kb_");
tmpfname = xtrymalloc (strlen (template) + 1);
if (!tmpfname)
{
@ -98,14 +99,14 @@ create_tmp_file (const char *template,
strcpy (tmpfname,template);
strcpy (tmpfname + strlen (template)-4, EXTSEP_S "k__");
}
else
else
{ /* File does not end with kbx, thus we hope we are working on a
modern file system and appending a suffix works. */
bakfname = xtrymalloc ( strlen (template) + 5);
if (!bakfname)
return gpg_error_from_syserror ();
strcpy (stpcpy (bakfname, template), EXTSEP_S "kb_");
tmpfname = xtrymalloc ( strlen (template) + 5);
if (!tmpfname)
{
@ -120,7 +121,7 @@ create_tmp_file (const char *template,
if (!bakfname)
return gpg_error_from_syserror ();
strcpy (stpcpy (bakfname,template),"~");
tmpfname = xtrymalloc ( strlen (template) + 5);
if (!tmpfname)
{
@ -172,7 +173,7 @@ rename_tmp_file (const char *bakfname, const char *tmpfname,
/* First make a backup file except for secret keyboxes. */
if (!secret)
{
{
#if defined(HAVE_DOSISH_SYSTEM) || defined(__riscos__)
remove (bakfname);
#endif
@ -181,7 +182,7 @@ rename_tmp_file (const char *bakfname, const char *tmpfname,
return gpg_error_from_syserror ();
}
}
/* Then rename the file. */
#if defined(HAVE_DOSISH_SYSTEM) || defined(__riscos__)
remove (fname);
@ -199,7 +200,7 @@ rename_tmp_file (const char *bakfname, const char *tmpfname,
}
return rc;
}
return 0;
}
@ -211,7 +212,7 @@ rename_tmp_file (const char *bakfname, const char *tmpfname,
3 = update
*/
static int
blob_filecopy (int mode, const char *fname, KEYBOXBLOB blob,
blob_filecopy (int mode, const char *fname, KEYBOXBLOB blob,
int secret, off_t start_offset)
{
FILE *fp, *newfp;
@ -221,14 +222,14 @@ blob_filecopy (int mode, const char *fname, KEYBOXBLOB blob,
char buffer[4096];
int nread, nbytes;
/* Open the source file. Because we do a rename, we have to check the
/* Open the source file. Because we do a rename, we have to check the
permissions of the file */
if (access (fname, W_OK))
return gpg_error_from_syserror ();
fp = fopen (fname, "rb");
if (mode == 1 && !fp && errno == ENOENT)
{
{
/* Insert mode but file does not exist:
Create a new keybox file. */
newfp = fopen (fname, "wb");
@ -274,10 +275,10 @@ blob_filecopy (int mode, const char *fname, KEYBOXBLOB blob,
fclose (newfp);
goto leave;
}
/* prepare for insert */
if (mode == 1)
{
{
/* Copy everything to the new file. */
while ( (nread = fread (buffer, 1, DIM(buffer), fp)) > 0 )
{
@ -297,12 +298,12 @@ blob_filecopy (int mode, const char *fname, KEYBOXBLOB blob,
goto leave;
}
}
/* Prepare for delete or update. */
if ( mode == 2 || mode == 3 )
{
if ( mode == 2 || mode == 3 )
{
off_t current = 0;
/* Copy first part to the new file. */
while ( current < start_offset )
{
@ -313,7 +314,7 @@ blob_filecopy (int mode, const char *fname, KEYBOXBLOB blob,
if (!nread)
break;
current += nread;
if (fwrite (buffer, nread, 1, newfp) != 1)
{
rc = gpg_error_from_syserror ();
@ -329,7 +330,7 @@ blob_filecopy (int mode, const char *fname, KEYBOXBLOB blob,
fclose (newfp);
goto leave;
}
/* Skip this blob. */
rc = _keybox_read_blob (NULL, fp);
if (rc)
@ -339,10 +340,10 @@ blob_filecopy (int mode, const char *fname, KEYBOXBLOB blob,
return rc;
}
}
/* Do an insert or update. */
if ( mode == 1 || mode == 3 )
{
{
rc = _keybox_write_blob (blob, newfp);
if (rc)
{
@ -351,10 +352,10 @@ blob_filecopy (int mode, const char *fname, KEYBOXBLOB blob,
return rc;
}
}
/* Copy the rest of the packet for an delete or update. */
if (mode == 2 || mode == 3)
{
{
while ( (nread = fread (buffer, 1, DIM(buffer), fp)) > 0 )
{
if (fwrite (buffer, nread, 1, newfp) != 1)
@ -373,7 +374,7 @@ blob_filecopy (int mode, const char *fname, KEYBOXBLOB blob,
goto leave;
}
}
/* Close both files. */
if (fclose(fp))
{
@ -397,7 +398,7 @@ blob_filecopy (int mode, const char *fname, KEYBOXBLOB blob,
#ifdef KEYBOX_WITH_X509
#ifdef KEYBOX_WITH_X509
int
keybox_insert_cert (KEYBOX_HANDLE hd, ksba_cert_t cert,
unsigned char *sha1_digest)
@ -407,12 +408,12 @@ keybox_insert_cert (KEYBOX_HANDLE hd, ksba_cert_t cert,
KEYBOXBLOB blob;
if (!hd)
return gpg_error (GPG_ERR_INV_HANDLE);
return gpg_error (GPG_ERR_INV_HANDLE);
if (!hd->kb)
return gpg_error (GPG_ERR_INV_HANDLE);
return gpg_error (GPG_ERR_INV_HANDLE);
fname = hd->kb->fname;
if (!fname)
return gpg_error (GPG_ERR_INV_HANDLE);
return gpg_error (GPG_ERR_INV_HANDLE);
/* Close this one otherwise we will mess up the position for a next
search. Fixme: it would be better to adjust the position after
@ -466,12 +467,12 @@ keybox_set_flags (KEYBOX_HANDLE hd, int what, int idx, unsigned int value)
if (!hd->found.blob)
return gpg_error (GPG_ERR_NOTHING_FOUND);
if (!hd->kb)
return gpg_error (GPG_ERR_INV_HANDLE);
return gpg_error (GPG_ERR_INV_HANDLE);
if (!hd->found.blob)
return gpg_error (GPG_ERR_NOTHING_FOUND);
fname = hd->kb->fname;
if (!fname)
return gpg_error (GPG_ERR_INV_HANDLE);
return gpg_error (GPG_ERR_INV_HANDLE);
off = _keybox_get_blob_fileoffset (hd->found.blob);
if (off == (off_t)-1)
@ -481,7 +482,7 @@ keybox_set_flags (KEYBOX_HANDLE hd, int what, int idx, unsigned int value)
ec = _keybox_get_flag_location (buffer, length, what, &flag_pos, &flag_size);
if (ec)
return gpg_error (ec);
off += flag_pos;
_keybox_close_file (hd);
@ -503,7 +504,7 @@ keybox_set_flags (KEYBOX_HANDLE hd, int what, int idx, unsigned int value)
switch (flag_size)
{
case 1:
case 1:
case 2:
case 4:
if (fwrite (tmp+4-flag_size, flag_size, 1, fp) != 1)
@ -539,10 +540,10 @@ keybox_delete (KEYBOX_HANDLE hd)
if (!hd->found.blob)
return gpg_error (GPG_ERR_NOTHING_FOUND);
if (!hd->kb)
return gpg_error (GPG_ERR_INV_HANDLE);
return gpg_error (GPG_ERR_INV_HANDLE);
fname = hd->kb->fname;
if (!fname)
return gpg_error (GPG_ERR_INV_HANDLE);
return gpg_error (GPG_ERR_INV_HANDLE);
off = _keybox_get_blob_fileoffset (hd->found.blob);
if (off == (off_t)-1)
@ -588,18 +589,18 @@ keybox_compress (KEYBOX_HANDLE hd)
int skipped_deleted;
if (!hd)
return gpg_error (GPG_ERR_INV_HANDLE);
return gpg_error (GPG_ERR_INV_HANDLE);
if (!hd->kb)
return gpg_error (GPG_ERR_INV_HANDLE);
return gpg_error (GPG_ERR_INV_HANDLE);
if (hd->secret)
return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
fname = hd->kb->fname;
if (!fname)
return gpg_error (GPG_ERR_INV_HANDLE);
return gpg_error (GPG_ERR_INV_HANDLE);
_keybox_close_file (hd);
/* Open the source file. Because we do a rename, we have to check the
/* Open the source file. Because we do a rename, we have to check the
permissions of the file */
if (access (fname, W_OK))
return gpg_error_from_syserror ();
@ -623,9 +624,8 @@ keybox_compress (KEYBOX_HANDLE hd)
buffer = _keybox_get_blob_image (blob, &length);
if (length > 4 && buffer[4] == BLOBTYPE_HEADER)
{
u32 last_maint = ((buffer[20] << 24) | (buffer[20+1] << 16)
| (buffer[20+2] << 8) | (buffer[20+3]));
u32 last_maint = buf32_to_u32 (buffer+20);
if ( (last_maint + 3*3600) > time (NULL) )
{
fclose (fp);
@ -645,7 +645,7 @@ keybox_compress (KEYBOX_HANDLE hd)
return rc;;
}
/* Processing loop. By reading using _keybox_read_blob we
automagically skip any blobs flagged as deleted. Thus what we
only have to do is to check all ephemeral flagged blocks whether
@ -690,24 +690,23 @@ keybox_compress (KEYBOX_HANDLE hd)
continue;
}
if (_keybox_get_flag_location (buffer, length,
if (_keybox_get_flag_location (buffer, length,
KEYBOX_FLAG_BLOB, &pos, &size)
|| size != 2)
{
rc = gpg_error (GPG_ERR_BUG);
break;
}
blobflags = ((buffer[pos] << 8) | (buffer[pos+1]));
blobflags = buf16_to_uint (buffer+pos);
if ((blobflags & KEYBOX_FLAG_BLOB_EPHEMERAL))
{
/* This is an ephemeral blob. */
if (_keybox_get_flag_location (buffer, length,
if (_keybox_get_flag_location (buffer, length,
KEYBOX_FLAG_CREATED_AT, &pos, &size)
|| size != 4)
created_at = 0; /* oops. */
else
created_at = ((buffer[pos] << 24) | (buffer[pos+1] << 16)
| (buffer[pos+2] << 8) | (buffer[pos+3]));
created_at = buf32_to_u32 (buffer+pos);
if (created_at && created_at < cut_time)
{