commit 438d0cc30baf8e97fd870f5e620833e0a45401aa from: Omar Polo date: Tue Aug 16 09:35:18 2022 UTC fix snprintf error handling follow the "proper secure idiom" described in the CAVEATS section of printf(3). reminded by tb@ and millert@ commit - ea8d9c76cc8fdc1dacfcc1cb952769fcd0930b10 commit + 438d0cc30baf8e97fd870f5e620833e0a45401aa blob - eef8f6da182a48139985e84999b8606a6f412d73 blob + 1c6b1412caff118a949c9987314837db9934aa5e --- got/got.c +++ got/got.c @@ -10598,7 +10598,7 @@ histedit_syntax_error(int lineno) ret = snprintf(msg, sizeof(msg), "histedit syntax error on line %d", lineno); - if (ret == -1 || ret >= sizeof(msg)) + if (ret < 0 || (size_t)ret >= sizeof(msg)) return got_error(GOT_ERR_HISTEDIT_SYNTAX); return got_error_msg(GOT_ERR_HISTEDIT_SYNTAX, msg); blob - b533dd484371ccaf0bb075196a1d7009d4058083 blob + 748db3ece24e2a35e37196d7d1f2d8f1a3b071c8 --- gotwebd/parse.y +++ gotwebd/parse.y @@ -202,7 +202,8 @@ main : PREFORK NUMBER { sizeof(gotwebd->unix_socket_name), "%s%s", strlen(gotwebd->httpd_chroot) ? gotwebd->httpd_chroot : D_HTTPD_CHROOT, $2); - if (n < 0) { + if (n < 0 || + (size_t)n >= sizeof(gotwebd->unix_socket_name)) { yyerror("%s: unix_socket_name truncated", __func__); free($2); @@ -367,7 +368,8 @@ serveropts1 : REPOS_PATH STRING { sizeof(new_srv->unix_socket_name), "%s%s", strlen(gotwebd->httpd_chroot) ? gotwebd->httpd_chroot : D_HTTPD_CHROOT, $2); - if (n < 0) { + if (n < 0 || + (size_t)n >= sizeof(new_srv->unix_socket_name)) { yyerror("%s: unix_socket_name truncated", __func__); free($2); @@ -886,7 +888,7 @@ conf_new_server(const char *name) n = snprintf(srv->unix_socket_name, sizeof(srv->unix_socket_name), "%s%s", D_HTTPD_CHROOT, D_UNIX_SOCKET); - if (n < 0) + if (n < 0 || (size_t)n >= sizeof(srv->unix_socket_name)) fatalx("%s: snprintf", __func__); n = strlcpy(srv->repos_path, D_GOTPATH, sizeof(srv->repos_path)); blob - 0b020ab754c33ba525068d380e871877d551f8e5 blob + cf2a3d1df8e8ab807643e41c0104908853476046 --- gotwebd/sockets.c +++ gotwebd/sockets.c @@ -179,7 +179,7 @@ sockets_dup_new_socket(struct socket *p_sock, struct s n = snprintf(sock->conf.name, GOTWEBD_MAXTEXT, "%s_child", p_sock->conf.srv_name); - if (n < 0) { + if (n < 0 || (size_t)n >= GOTWEBD_MAXTEXT) { free(p_sock->conf.al); free(p_sock); free(sock->conf.al); @@ -252,7 +252,7 @@ sockets_conf_new_socket(struct gotwebd *env, struct se n = snprintf(sock->conf.name, GOTWEBD_MAXTEXT, "%s_parent", srv->name); - if (n < 0) { + if (n < 0 || (size_t)n >= GOTWEBD_MAXTEXT) { free(sock->conf.al); free(sock); fatalx("%s: snprintf", __func__); blob - 9ce30e5bcc35c7934d3795a978a487d7624ef00b blob + f208e82e92fa8d5f11f714140e353215e8477e04 --- lib/error.c +++ lib/error.c @@ -364,7 +364,7 @@ got_error_no_obj(struct got_object_id *id) return got_error(GOT_ERR_NO_OBJ); ret = snprintf(msg, sizeof(msg), "object %s not found", id_str); - if (ret == -1 || ret >= sizeof(msg)) + if (ret < 0 || (size_t)ret >= sizeof(msg)) return got_error(GOT_ERR_NO_OBJ); return got_error_msg(GOT_ERR_NO_OBJ, msg); @@ -377,7 +377,7 @@ got_error_not_ref(const char *refname) int ret; ret = snprintf(msg, sizeof(msg), "reference %s not found", refname); - if (ret == -1 || ret >= sizeof(msg)) + if (ret < 0 || (size_t)ret >= sizeof(msg)) return got_error(GOT_ERR_NOT_REF); return got_error_msg(GOT_ERR_NOT_REF, msg); blob - 05652e3057827e3b2c8cc76f5e95d07a081979a7 blob + d04cf5a35d684cf2759fc02be9b1dc9887309ebb --- lib/object_create.c +++ lib/object_create.c @@ -272,7 +272,7 @@ te_mode2str(char *buf, size_t len, struct got_tree_ent return got_error(GOT_ERR_BAD_FILETYPE); ret = snprintf(buf, len, "%o ", mode); - if (ret == -1 || ret >= len) + if (ret < 0 || (size_t)ret >= len) return got_error(GOT_ERR_NO_SPACE); return NULL; } blob - a845118f6e6f64c5061dd5eef11341341e9ad2ff blob + 52cedcef2588aa0c074d4d486c05e33a3bac7eb4 --- lib/pkt.c +++ lib/pkt.c @@ -160,10 +160,11 @@ const struct got_error * got_pkt_writepkt(int fd, char *buf, int nbuf, int chattygot) { char len[5]; - int i; + int i, ret; ssize_t w; - if (snprintf(len, sizeof(len), "%04x", nbuf + 4) >= sizeof(len)) + ret = snprintf(len, sizeof(len), "%04x", nbuf + 4); + if (ret < 0 || (size_t)ret >= sizeof(len)) return got_error(GOT_ERR_NO_SPACE); w = write(fd, len, 4); if (w == -1) blob - 11ba3814d20b1e2326659222ac27df0feeb7f5d5 blob + 9d2cd0e1577f750520a0a270694966b5cb57d10d --- libexec/got-fetch-pack/got-fetch-pack.c +++ libexec/got-fetch-pack/got-fetch-pack.c @@ -490,7 +490,7 @@ fetch_pack(int fd, int packfd, uint8_t *pack_sha1, n = snprintf(buf, sizeof(buf), "want %s%s\n", hashstr, sent_my_capabilites || my_capabilities == NULL ? "" : my_capabilities); - if (n >= sizeof(buf)) { + if (n < 0 || (size_t)n >= sizeof(buf)) { err = got_error(GOT_ERR_NO_SPACE); goto done; } @@ -511,7 +511,7 @@ fetch_pack(int fd, int packfd, uint8_t *pack_sha1, struct got_object_id *id = pe->data; got_sha1_digest_to_str(id->sha1, hashstr, sizeof(hashstr)); n = snprintf(buf, sizeof(buf), "have %s\n", hashstr); - if (n >= sizeof(buf)) { + if (n < 0 || (size_t)n >= sizeof(buf)) { err = got_error(GOT_ERR_NO_SPACE); goto done; } blob - 11e392eb0efbb98ce85ecbfda9488b3f1373f483 blob + 515ae625ac960496d011cf026341c9040df9c1b8 --- libexec/got-send-pack/got-send-pack.c +++ libexec/got-send-pack/got-send-pack.c @@ -284,7 +284,7 @@ describe_refchange(int *n, int *sent_my_capabilites, { *n = snprintf(buf, bufsize, "%s %s %s", old_hashstr, new_hashstr, refname); - if (*n >= bufsize) + if (*n < 0 || (size_t)*n >= bufsize) return got_error(GOT_ERR_NO_SPACE); /* @@ -300,7 +300,7 @@ describe_refchange(int *n, int *sent_my_capabilites, return got_error(GOT_ERR_NO_SPACE); m = snprintf(buf + *n + 1, /* offset after '\0' */ bufsize - (*n + 1), "%s\n", my_capabilities); - if (*n + m >= bufsize) + if (m < 0 || *n + m >= bufsize) return got_error(GOT_ERR_NO_SPACE); *n += m; *sent_my_capabilites = 1;