diff options
| author |   djm <djm@openbsd.org> | 2010-08-31 09:58:37 +0000 |
|---|---|---|
| committer | djm <djm@openbsd.org> | 2010-08-31 09:58:37 +0000 |
| commit | 867f0cfffd899a24317337f8aa094f0865eceb6f (patch) | |
| tree | da8aa0e9152490f921d4c416cddc05dc8555c8d3 /usr.bin/ssh/buffer.h | |
| parent | do not return EOPNOTSUPP for unknown activate actions (diff) | |
| download | wireguard-openbsd-867f0cfffd899a24317337f8aa094f0865eceb6f.tar.xz wireguard-openbsd-867f0cfffd899a24317337f8aa094f0865eceb6f.zip | |
Add buffer_get_cstring() and related functions that verify that the
string extracted from the buffer contains no embedded \0 characters*
This prevents random (possibly malicious) crap from being appended to
strings where it would not be noticed if the string is used with
a string(3) function.
Use the new API in a few sensitive places.
* actually, we allow a single one at the end of the string for now because
we don't know how many deployed implementations get this wrong, but don't
count on this to remain indefinitely.
Diffstat (limited to 'usr.bin/ssh/buffer.h')
| -rw-r--r-- | usr.bin/ssh/buffer.h | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/usr.bin/ssh/buffer.h b/usr.bin/ssh/buffer.h index 4ef4f80b35a..93baae2c820 100644 --- a/usr.bin/ssh/buffer.h +++ b/usr.bin/ssh/buffer.h @@ -1,4 +1,4 @@ -/* $OpenBSD: buffer.h,v 1.19 2010/02/09 03:56:28 djm Exp $ */ +/* $OpenBSD: buffer.h,v 1.20 2010/08/31 09:58:37 djm Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> @@ -68,6 +68,7 @@ void buffer_put_char(Buffer *, int); void *buffer_get_string(Buffer *, u_int *); void *buffer_get_string_ptr(Buffer *, u_int *); void buffer_put_string(Buffer *, const void *, u_int); +char *buffer_get_cstring(Buffer *, u_int *); void buffer_put_cstring(Buffer *, const char *); #define buffer_skip_string(b) \ @@ -81,6 +82,7 @@ int buffer_get_short_ret(u_short *, Buffer *); int buffer_get_int_ret(u_int *, Buffer *); int buffer_get_int64_ret(u_int64_t *, Buffer *); void *buffer_get_string_ret(Buffer *, u_int *); +char *buffer_get_cstring_ret(Buffer *, u_int *); void *buffer_get_string_ptr_ret(Buffer *, u_int *); int buffer_get_char_ret(char *, Buffer *); |