buffer: Avoid use of uninitialized values
Fixes the following oss-fuzz bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17565 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
Этот коммит содержится в:
родитель
aac682f60e
Коммит
aff7c500d5
13
src/buffer.c
13
src/buffer.c
@ -1119,6 +1119,7 @@ int ssh_buffer_unpack_va(struct ssh_buffer_struct *buffer,
|
|||||||
goto cleanup;
|
goto cleanup;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
rc = SSH_ERROR;
|
||||||
switch (*p) {
|
switch (*p) {
|
||||||
case 'b':
|
case 'b':
|
||||||
o.byte = va_arg(ap, uint8_t *);
|
o.byte = va_arg(ap, uint8_t *);
|
||||||
@ -1128,20 +1129,26 @@ int ssh_buffer_unpack_va(struct ssh_buffer_struct *buffer,
|
|||||||
case 'w':
|
case 'w':
|
||||||
o.word = va_arg(ap, uint16_t *);
|
o.word = va_arg(ap, uint16_t *);
|
||||||
rlen = ssh_buffer_get_data(buffer, o.word, sizeof(uint16_t));
|
rlen = ssh_buffer_get_data(buffer, o.word, sizeof(uint16_t));
|
||||||
|
if (rlen == 2) {
|
||||||
*o.word = ntohs(*o.word);
|
*o.word = ntohs(*o.word);
|
||||||
rc = rlen==2 ? SSH_OK : SSH_ERROR;
|
rc = SSH_OK;
|
||||||
|
}
|
||||||
break;
|
break;
|
||||||
case 'd':
|
case 'd':
|
||||||
o.dword = va_arg(ap, uint32_t *);
|
o.dword = va_arg(ap, uint32_t *);
|
||||||
rlen = ssh_buffer_get_u32(buffer, o.dword);
|
rlen = ssh_buffer_get_u32(buffer, o.dword);
|
||||||
|
if (rlen == 4) {
|
||||||
*o.dword = ntohl(*o.dword);
|
*o.dword = ntohl(*o.dword);
|
||||||
rc = rlen==4 ? SSH_OK : SSH_ERROR;
|
rc = SSH_OK;
|
||||||
|
}
|
||||||
break;
|
break;
|
||||||
case 'q':
|
case 'q':
|
||||||
o.qword = va_arg(ap, uint64_t*);
|
o.qword = va_arg(ap, uint64_t*);
|
||||||
rlen = ssh_buffer_get_u64(buffer, o.qword);
|
rlen = ssh_buffer_get_u64(buffer, o.qword);
|
||||||
|
if (rlen == 8) {
|
||||||
*o.qword = ntohll(*o.qword);
|
*o.qword = ntohll(*o.qword);
|
||||||
rc = rlen==8 ? SSH_OK : SSH_ERROR;
|
rc = SSH_OK;
|
||||||
|
}
|
||||||
break;
|
break;
|
||||||
case 'B':
|
case 'B':
|
||||||
o.bignum = va_arg(ap, bignum *);
|
o.bignum = va_arg(ap, bignum *);
|
||||||
|
Загрузка…
x
Ссылка в новой задаче
Block a user