From da36873b7662484f9478fd3d4b10f7a1937c083c Mon Sep 17 00:00:00 2001 From: leitner Date: Tue, 15 Apr 2014 20:40:01 +0000 Subject: [PATCH] mmap_read now returns const char*, remove warnings reject non-minimal encodings for lengths and tags catch too-large-value overflows in tags --- acl.c | 15 ++++++++++----- addindex.c | 6 +++--- asn1dump.c | 2 +- dumpacls.c | 2 +- dumpidx.c | 10 +++++----- idx2ldif.c | 4 ++-- scan_asn1length.c | 44 +++++++++++++++++++++++--------------------- scan_asn1tagint.c | 3 ++- t2.c | 2 +- tinyldap.c | 22 +++++++++++----------- 10 files changed, 59 insertions(+), 51 deletions(-) diff --git a/acl.c b/acl.c index dc630fa..1e46483 100644 --- a/acl.c +++ b/acl.c @@ -273,7 +273,7 @@ int marshalfilter(stralloc* x,struct assertion* a) { } } -int marshal(char* map,size_t filelen,const char* filename) { +int marshal(const char* map,size_t filelen,const char* filename) { size_t filters,acls,i,j,k; size_t filter_offset; //,acl_offset; struct acl* a; @@ -358,7 +358,7 @@ nomem: int found=0; for (j=0; jattrs[k])) { - a->attrs[k]=map+uint32_read(map+attrtab+j*4); + a->attrs[k]=(char*)map+uint32_read(map+attrtab+j*4); found=1; break; } @@ -369,7 +369,7 @@ nomem: * the address where mmap mapped the file. */ char* tmp=a->attrs[k]; // buffer_putmflush(buffer_1,"adding attribute ",a->attrs[k],"\n"); - a->attrs[k]=map+filelen+ + a->attrs[k]=(char*)map+filelen+ 2*4+ /* index_type and next */ (filters+2)*4+ /* filters_count plus (filter_count+1)*uint32 */ x.len; @@ -489,11 +489,16 @@ shortwrite: int main(int argc,char* argv[]) { size_t filelen; char* filename=argc>1?argv[1]:"data"; - char* map=mmap_read(filename,&filelen); + const char* map=mmap_read(filename,&filelen); + + if (!map) { + buffer_putmflush(buffer_2,"Could not open ",filename,"\n"); + return 0; + } if (filelen<5*4 || uint32_read(map)!=0xfefe1da9) { buffer_putsflush(buffer_2,"not a valid tinyldap data file!\n"); - exit(0); + return 0; } if (readacls("acls")==-1) die(1,"readacls failed"); diff --git a/addindex.c b/addindex.c index 37b5367..75ca4c4 100644 --- a/addindex.c +++ b/addindex.c @@ -89,7 +89,7 @@ int main(int argc,char* argv[]) { if (strchr(argv[3],'f')) fastindex=1; if (strchr(argv[3],'h')) mode=HASHTABLE; } - map=mmap_read(filename,&filelen); + map=(char*)mmap_read(filename,&filelen); if (!map) diesys(111,"Could not open \"",filename,"\""); uint32_unpack(map,&magic); @@ -102,7 +102,7 @@ int main(int argc,char* argv[]) { { unsigned int i; - char* x=map+5*4+size_of_string_table; + const char* x=map+5*4+size_of_string_table; wanted=casesensitive=dn=objectClass=0; for (i=0; i #include "asn1.h" -size_t scan_asn1length(const char* src,const char* max,size_t* length) { - const char* orig=src; - if (src>=max) return 0; -/* If the highest bit of the first byte is clear, the byte is the length. - * Otherwise the next n bytes are the length (n being the lower 7 bits) */ - if (*src&0x80) { - int chars=*src&0x7f; - size_t l=0; - while (chars>0) { - if (++src>=max) return 0; - if (l>(((unsigned long)-1)>>8)) return 0; /* catch integer overflow */ - l=l*256+(unsigned char)*src; - --chars; - } - *length=l; - } else - *length=*src&0x7f; - src++; - if (src+*length>max) return 0; /* catch integer overflow */ - if ((uintptr_t)src+*length<(uintptr_t)src) return 0; /* gcc 4.1 removes this check without the cast to uintptr_t */ - return src-orig; +size_t scan_asn1length(const char* src,const char* max,size_t* value) { + size_t len=max-src; + if (len==0 || len>=-(uintptr_t)src) return 0; + unsigned int i,c=*src; + size_t l; + if ((c&0x80)==0) { + l=c&0x7f; + i=1; + } else { + /* Highest bit set: lower 7 bits is the length of the length value in bytes. */ + c&=0x7f; + if (!c) return 0; /* length 0x80 means indefinite length encoding, not supported here */ + l=(unsigned char)src[1]; + if (l==0) return 0; /* not minimally encoded: 0x81 0x00 instead of 0x00 */ + if (c>sizeof(l)) return 0; /* too many bytes, does not fit into target integer type */ + for (i=2; i<=c; ++i) + l=l*256+(unsigned char)src[i]; + if (l<0x7f) return 0; /* not minimally encoded: 0x81 0x70 instead of 0x70 */ + } + if (l>len-i) return 0; /* if the length would not fit into the buffer, return 0 */ + *value=l; + return i; } + diff --git a/scan_asn1tagint.c b/scan_asn1tagint.c index 49a9974..2c23fa2 100644 --- a/scan_asn1tagint.c +++ b/scan_asn1tagint.c @@ -3,9 +3,10 @@ size_t scan_asn1tagint(const char* src,const char* max,unsigned long* val) { const char* orig=src; unsigned long l=0; + if (src==max || (unsigned char)src[0]==0x80) return 0; /* catch non-minimal encoding */ for (;; ++src) { if (src>=max) return 0; - if (l>(((unsigned long)-1)>>7)) return 0; /* catch integer overflow */ + if (l>>(sizeof(l)*8-7)) return 0; /* catch integer overflow */ l=l*128+(*src&0x7F); if (!(*src&0x80)) break; } diff --git a/t2.c b/t2.c index 62fa421..79062fd 100644 --- a/t2.c +++ b/t2.c @@ -84,7 +84,7 @@ int main(int argc,char* argv[]) { #if 1 unsigned long size; // char* ldapsequence=mmap_read("req",&size); - char* ldapsequence=mmap_read(argc>1?argv[1]:"/tmp/ldap/127.000.000.001.00389-127.000.000.001.38433",&size); + const char* ldapsequence=mmap_read(argc>1?argv[1]:"/tmp/ldap/127.000.000.001.00389-127.000.000.001.38433",&size); unsigned long messageid, op, len; int res; unsigned long done=0; diff --git a/tinyldap.c b/tinyldap.c index 7222766..ffc8b84 100644 --- a/tinyldap.c +++ b/tinyldap.c @@ -50,7 +50,7 @@ #define HUGE_SIZE_FOR_SANITY_CHECKS 1024*1024 /* basic operation: the whole data file is mmapped read-only at the beginning and stays there. */ -char* map; /* where the file is mapped */ +const char* map; /* where the file is mapped */ size_t filelen; /* how many bytes are mapped (the whole file) */ uint32 magic,attribute_count,record_count,indices_offset,size_of_string_table; /* these are the first values from the file, see the file "FORMAT" @@ -113,7 +113,7 @@ static void fixup(struct Filter* f) { case PRESENT: case APPROX: { - char* x=map+5*4+size_of_string_table; + const char* x=map+5*4+size_of_string_table; size_t i; f->attrofs=f->attrflag=0; for (i=0; iattrofs=0; for (i=0; iHUGE_SIZE_FOR_SANITY_CHECKS/sizeof(struct AttributeDescriptionList)) return; adl=alloca((attribute_count)*sizeof(struct AttributeDescriptionList)); @@ -1528,7 +1528,7 @@ static int handle(int in,int out) { if (err!=success) goto authfailure; else { - char* c=0; + const char* c=0; uint32 authdn=0; char* authdn_str=0; if (idx==(size_t)-1) { // found in journal @@ -1544,7 +1544,7 @@ static int handle(int in,int out) { uint32 j; uint32_unpack(map+indices_offset+4*idx,&j); uint32_unpack(map+j+8,&authdn); - authdn_str=map+authdn; + authdn_str=(char*)map+authdn; authdn=j; if (!(j=ldap_find_attr_value(j,userPassword_ofs))) { buffer_putsflush(buffer_2,"no userPassword attribute found, bind failed!\n"); @@ -1634,7 +1634,7 @@ authfailure: if (indexable(sr.filter)) { reply_with_index(&sr,&messageid,out); } else { - char* x=map+5*4+size_of_string_table+attribute_count*8; + const char* x=map+5*4+size_of_string_table+attribute_count*8; size_t i; #if (debug != 0) if (debug) buffer_putsflush(buffer_2,"query can NOT be answered with index!\n"); @@ -1946,7 +1946,7 @@ static unsigned char* bstrdup(unsigned char* c) { } static unsigned char* bstrdup_attrib(unsigned char* c) { - char* x=map+5*4+size_of_string_table; + const char* x=map+5*4+size_of_string_table; size_t i,l; if (*c) l=str_len((char*)c)+1;