X-Git-Url: https://git.distorted.org.uk/u/mdw/putty/blobdiff_plain/df0870fc8ceb5a8fea66a4d0fe00e7db12317e33..HEAD:/sftp.c

diff --git a/sftp.c b/sftp.c
index 4d5172b5..bf75779d 100644
--- a/sftp.c
+++ b/sftp.c
@@ -13,22 +13,10 @@
 #include "tree234.h"
 #include "sftp.h"
 
-#define GET_32BIT(cp) \
-    (((unsigned long)(unsigned char)(cp)[0] << 24) | \
-    ((unsigned long)(unsigned char)(cp)[1] << 16) | \
-    ((unsigned long)(unsigned char)(cp)[2] << 8) | \
-    ((unsigned long)(unsigned char)(cp)[3]))
-
-#define PUT_32BIT(cp, value) { \
-    (cp)[0] = (unsigned char)((value) >> 24); \
-    (cp)[1] = (unsigned char)((value) >> 16); \
-    (cp)[2] = (unsigned char)((value) >> 8); \
-    (cp)[3] = (unsigned char)(value); }
-
 struct sftp_packet {
     char *data;
-    int length, maxlen;
-    int savedpos;
+    unsigned length, maxlen;
+    unsigned savedpos;
     int type;
 };
 
@@ -42,7 +30,7 @@ static void fxp_internal_error(char *msg);
  */
 static void sftp_pkt_ensure(struct sftp_packet *pkt, int length)
 {
-    if (pkt->maxlen < length) {
+    if ((int)pkt->maxlen < length) {
 	pkt->maxlen = length + 256;
 	pkt->data = sresize(pkt->data, pkt->maxlen, char);
     }
@@ -57,6 +45,13 @@ static void sftp_pkt_addbyte(struct sftp_packet *pkt, unsigned char byte)
 {
     sftp_pkt_adddata(pkt, &byte, 1);
 }
+static void sftp_pkt_adduint32(struct sftp_packet *pkt,
+			       unsigned long value)
+{
+    unsigned char x[4];
+    PUT_32BIT(x, value);
+    sftp_pkt_adddata(pkt, x, 4);
+}
 static struct sftp_packet *sftp_pkt_init(int pkt_type)
 {
     struct sftp_packet *pkt;
@@ -65,6 +60,7 @@ static struct sftp_packet *sftp_pkt_init(int pkt_type)
     pkt->savedpos = -1;
     pkt->length = 0;
     pkt->maxlen = 0;
+    sftp_pkt_adduint32(pkt, 0); /* length field will be filled in later */
     sftp_pkt_addbyte(pkt, (unsigned char) pkt_type);
     return pkt;
 }
@@ -74,13 +70,6 @@ static void sftp_pkt_addbool(struct sftp_packet *pkt, unsigned char value)
     sftp_pkt_adddata(pkt, &value, 1);
 }
 */
-static void sftp_pkt_adduint32(struct sftp_packet *pkt,
-			       unsigned long value)
-{
-    unsigned char x[4];
-    PUT_32BIT(x, value);
-    sftp_pkt_adddata(pkt, x, 4);
-}
 static void sftp_pkt_adduint64(struct sftp_packet *pkt, uint64 value)
 {
     unsigned char x[8];
@@ -139,61 +128,67 @@ static void sftp_pkt_addattrs(struct sftp_packet *pkt, struct fxp_attrs attrs)
  * SFTP packet decode functions.
  */
 
-static unsigned char sftp_pkt_getbyte(struct sftp_packet *pkt)
+static int sftp_pkt_getbyte(struct sftp_packet *pkt, unsigned char *ret)
 {
-    unsigned char value;
     if (pkt->length - pkt->savedpos < 1)
-	return 0;		       /* arrgh, no way to decline (FIXME?) */
-    value = (unsigned char) pkt->data[pkt->savedpos];
+	return 0;
+    *ret = (unsigned char) pkt->data[pkt->savedpos];
     pkt->savedpos++;
-    return value;
+    return 1;
 }
-static unsigned long sftp_pkt_getuint32(struct sftp_packet *pkt)
+static int sftp_pkt_getuint32(struct sftp_packet *pkt, unsigned long *ret)
 {
-    unsigned long value;
     if (pkt->length - pkt->savedpos < 4)
-	return 0;		       /* arrgh, no way to decline (FIXME?) */
-    value = GET_32BIT(pkt->data + pkt->savedpos);
+	return 0;
+    *ret = GET_32BIT(pkt->data + pkt->savedpos);
     pkt->savedpos += 4;
-    return value;
+    return 1;
 }
-static void sftp_pkt_getstring(struct sftp_packet *pkt,
-			       char **p, int *length)
+static int sftp_pkt_getstring(struct sftp_packet *pkt,
+			      char **p, int *length)
 {
     *p = NULL;
     if (pkt->length - pkt->savedpos < 4)
-	return;
-    *length = GET_32BIT(pkt->data + pkt->savedpos);
+	return 0;
+    *length = toint(GET_32BIT(pkt->data + pkt->savedpos));
     pkt->savedpos += 4;
-    if (pkt->length - pkt->savedpos < *length)
-	return;
+    if ((int)(pkt->length - pkt->savedpos) < *length || *length < 0) {
+	*length = 0;
+	return 0;
+    }
     *p = pkt->data + pkt->savedpos;
     pkt->savedpos += *length;
+    return 1;
 }
-static struct fxp_attrs sftp_pkt_getattrs(struct sftp_packet *pkt)
+static int sftp_pkt_getattrs(struct sftp_packet *pkt, struct fxp_attrs *ret)
 {
-    struct fxp_attrs ret;
-    ret.flags = sftp_pkt_getuint32(pkt);
-    if (ret.flags & SSH_FILEXFER_ATTR_SIZE) {
+    if (!sftp_pkt_getuint32(pkt, &ret->flags))
+	return 0;
+    if (ret->flags & SSH_FILEXFER_ATTR_SIZE) {
 	unsigned long hi, lo;
-	hi = sftp_pkt_getuint32(pkt);
-	lo = sftp_pkt_getuint32(pkt);
-	ret.size = uint64_make(hi, lo);
+	if (!sftp_pkt_getuint32(pkt, &hi) ||
+	    !sftp_pkt_getuint32(pkt, &lo))
+	    return 0;
+	ret->size = uint64_make(hi, lo);
     }
-    if (ret.flags & SSH_FILEXFER_ATTR_UIDGID) {
-	ret.uid = sftp_pkt_getuint32(pkt);
-	ret.gid = sftp_pkt_getuint32(pkt);
+    if (ret->flags & SSH_FILEXFER_ATTR_UIDGID) {
+	if (!sftp_pkt_getuint32(pkt, &ret->uid) ||
+	    !sftp_pkt_getuint32(pkt, &ret->gid))
+	    return 0;
     }
-    if (ret.flags & SSH_FILEXFER_ATTR_PERMISSIONS) {
-	ret.permissions = sftp_pkt_getuint32(pkt);
+    if (ret->flags & SSH_FILEXFER_ATTR_PERMISSIONS) {
+	if (!sftp_pkt_getuint32(pkt, &ret->permissions))
+	    return 0;
     }
-    if (ret.flags & SSH_FILEXFER_ATTR_ACMODTIME) {
-	ret.atime = sftp_pkt_getuint32(pkt);
-	ret.mtime = sftp_pkt_getuint32(pkt);
+    if (ret->flags & SSH_FILEXFER_ATTR_ACMODTIME) {
+	if (!sftp_pkt_getuint32(pkt, &ret->atime) ||
+	    !sftp_pkt_getuint32(pkt, &ret->mtime))
+	    return 0;
     }
-    if (ret.flags & SSH_FILEXFER_ATTR_EXTENDED) {
-	int count;
-	count = sftp_pkt_getuint32(pkt);
+    if (ret->flags & SSH_FILEXFER_ATTR_EXTENDED) {
+	unsigned long count;
+	if (!sftp_pkt_getuint32(pkt, &count))
+	    return 0;
 	while (count--) {
 	    char *str;
 	    int len;
@@ -201,11 +196,12 @@ static struct fxp_attrs sftp_pkt_getattrs(struct sftp_packet *pkt)
 	     * We should try to analyse these, if we ever find one
 	     * we recognise.
 	     */
-	    sftp_pkt_getstring(pkt, &str, &len);
-	    sftp_pkt_getstring(pkt, &str, &len);
+	    if (!sftp_pkt_getstring(pkt, &str, &len) ||
+		!sftp_pkt_getstring(pkt, &str, &len))
+		return 0;
 	}
     }
-    return ret;
+    return 1;
 }
 static void sftp_pkt_free(struct sftp_packet *pkt)
 {
@@ -220,9 +216,8 @@ static void sftp_pkt_free(struct sftp_packet *pkt)
 int sftp_send(struct sftp_packet *pkt)
 {
     int ret;
-    char x[4];
-    PUT_32BIT(x, pkt->length);
-    ret = (sftp_senddata(x, 4) && sftp_senddata(pkt->data, pkt->length));
+    PUT_32BIT(pkt->data, pkt->length - 4);
+    ret = sftp_senddata(pkt->data, pkt->length);
     sftp_pkt_free(pkt);
     return ret;
 }
@@ -230,6 +225,7 @@ struct sftp_packet *sftp_recv(void)
 {
     struct sftp_packet *pkt;
     char x[4];
+    unsigned char uc;
 
     if (!sftp_recvdata(x, 4))
 	return NULL;
@@ -244,7 +240,12 @@ struct sftp_packet *sftp_recv(void)
 	return NULL;
     }
 
-    pkt->type = sftp_pkt_getbyte(pkt);
+    if (!sftp_pkt_getbyte(pkt, &uc)) {
+	sftp_pkt_free(pkt);
+	return NULL;
+    } else {
+	pkt->type = uc;
+    }
 
     return pkt;
 }
@@ -334,6 +335,14 @@ static struct sftp_request *sftp_alloc_request(void)
     return r;
 }
 
+void sftp_cleanup_request(void)
+{
+    if (sftp_requests != NULL) {
+	freetree234(sftp_requests);
+	sftp_requests = NULL;
+    }
+}
+
 void sftp_register(struct sftp_request *req)
 {
     req->registered = 1;
@@ -349,12 +358,14 @@ struct sftp_request *sftp_find_request(struct sftp_packet *pktin)
 	return NULL;
     }
 
-    id = sftp_pkt_getuint32(pktin);
+    if (!sftp_pkt_getuint32(pktin, &id)) {
+	fxp_internal_error("did not receive a valid SFTP packet\n");
+	return NULL;
+    }
     req = find234(sftp_requests, &id, sftp_reqfind);
 
     if (!req || !req->registered) {
 	fxp_internal_error("request ID mismatch\n");
-        sftp_pkt_free(pktin);
 	return NULL;
     }
 
@@ -405,12 +416,18 @@ static int fxp_got_status(struct sftp_packet *pktin)
 	fxp_error_message = "expected FXP_STATUS packet";
 	fxp_errtype = -1;
     } else {
-	fxp_errtype = sftp_pkt_getuint32(pktin);
-	if (fxp_errtype < 0 ||
-	    fxp_errtype >= sizeof(messages) / sizeof(*messages))
+	unsigned long ul;
+	if (!sftp_pkt_getuint32(pktin, &ul)) {
+	    fxp_error_message = "malformed FXP_STATUS packet";
+	    fxp_errtype = -1;
+	} else {
+	    fxp_errtype = ul;
+	    if (fxp_errtype < 0 ||
+		fxp_errtype >= sizeof(messages) / sizeof(*messages))
 		fxp_error_message = "unknown error code";
-	else
-	    fxp_error_message = messages[fxp_errtype];
+	    else
+		fxp_error_message = messages[fxp_errtype];
+	}
     }
 
     if (fxp_errtype == SSH_FX_OK)
@@ -443,7 +460,7 @@ int fxp_error_type(void)
 int fxp_init(void)
 {
     struct sftp_packet *pktout, *pktin;
-    int remotever;
+    unsigned long remotever;
 
     pktout = sftp_pkt_init(SSH_FXP_INIT);
     sftp_pkt_adduint32(pktout, SFTP_PROTO_VERSION);
@@ -459,7 +476,11 @@ int fxp_init(void)
         sftp_pkt_free(pktin);
 	return 0;
     }
-    remotever = sftp_pkt_getuint32(pktin);
+    if (!sftp_pkt_getuint32(pktin, &remotever)) {
+	fxp_internal_error("malformed FXP_VERSION packet");
+        sftp_pkt_free(pktin);
+	return 0;
+    }
     if (remotever > SFTP_PROTO_VERSION) {
 	fxp_internal_error
 	    ("remote protocol is more advanced than we support");
@@ -499,18 +520,16 @@ char *fxp_realpath_recv(struct sftp_packet *pktin, struct sftp_request *req)
     sfree(req);
 
     if (pktin->type == SSH_FXP_NAME) {
-	int count;
+	unsigned long count;
 	char *path;
 	int len;
 
-	count = sftp_pkt_getuint32(pktin);
-	if (count != 1) {
-	    fxp_internal_error("REALPATH returned name count != 1\n");
+	if (!sftp_pkt_getuint32(pktin, &count) || count != 1) {
+	    fxp_internal_error("REALPATH did not return name count of 1\n");
             sftp_pkt_free(pktin);
 	    return NULL;
 	}
-	sftp_pkt_getstring(pktin, &path, &len);
-	if (!path) {
+	if (!sftp_pkt_getstring(pktin, &path, &len)) {
 	    fxp_internal_error("REALPATH returned malformed FXP_NAME\n");
             sftp_pkt_free(pktin);
 	    return NULL;
@@ -528,7 +547,8 @@ char *fxp_realpath_recv(struct sftp_packet *pktin, struct sftp_request *req)
 /*
  * Open a file.
  */
-struct sftp_request *fxp_open_send(char *path, int type)
+struct sftp_request *fxp_open_send(char *path, int type,
+                                   struct fxp_attrs *attrs)
 {
     struct sftp_request *req = sftp_alloc_request();
     struct sftp_packet *pktout;
@@ -537,7 +557,10 @@ struct sftp_request *fxp_open_send(char *path, int type)
     sftp_pkt_adduint32(pktout, req->id);
     sftp_pkt_addstring(pktout, path);
     sftp_pkt_adduint32(pktout, type);
-    sftp_pkt_adduint32(pktout, 0);     /* (FIXME) empty ATTRS structure */
+    if (attrs)
+        sftp_pkt_addattrs(pktout, *attrs);
+    else
+        sftp_pkt_adduint32(pktout, 0); /* empty ATTRS structure */
     sftp_send(pktout);
 
     return req;
@@ -553,8 +576,7 @@ struct fxp_handle *fxp_open_recv(struct sftp_packet *pktin,
 	struct fxp_handle *handle;
 	int len;
 
-	sftp_pkt_getstring(pktin, &hstring, &len);
-	if (!hstring) {
+	if (!sftp_pkt_getstring(pktin, &hstring, &len)) {
 	    fxp_internal_error("OPEN returned malformed FXP_HANDLE\n");
             sftp_pkt_free(pktin);
 	    return NULL;
@@ -596,8 +618,7 @@ struct fxp_handle *fxp_opendir_recv(struct sftp_packet *pktin,
 	struct fxp_handle *handle;
 	int len;
 
-	sftp_pkt_getstring(pktin, &hstring, &len);
-	if (!hstring) {
+	if (!sftp_pkt_getstring(pktin, &hstring, &len)) {
 	    fxp_internal_error("OPENDIR returned malformed FXP_HANDLE\n");
             sftp_pkt_free(pktin);
 	    return NULL;
@@ -765,8 +786,12 @@ int fxp_stat_recv(struct sftp_packet *pktin, struct sftp_request *req,
 {
     sfree(req);
     if (pktin->type == SSH_FXP_ATTRS) {
-	*attrs = sftp_pkt_getattrs(pktin);
-        sftp_pkt_free(pktin);
+	if (!sftp_pkt_getattrs(pktin, attrs)) {
+	    fxp_internal_error("malformed SSH_FXP_ATTRS packet");
+	    sftp_pkt_free(pktin);
+	    return 0;
+	}
+	sftp_pkt_free(pktin);
 	return 1;
     } else {
 	fxp_got_status(pktin);
@@ -794,8 +819,12 @@ int fxp_fstat_recv(struct sftp_packet *pktin, struct sftp_request *req,
 {
     sfree(req);
     if (pktin->type == SSH_FXP_ATTRS) {
-	*attrs = sftp_pkt_getattrs(pktin);
-        sftp_pkt_free(pktin);
+	if (!sftp_pkt_getattrs(pktin, attrs)) {
+	    fxp_internal_error("malformed SSH_FXP_ATTRS packet");
+	    sftp_pkt_free(pktin);
+	    return 0;
+	}
+	sftp_pkt_free(pktin);
 	return 1;
     } else {
 	fxp_got_status(pktin);
@@ -892,7 +921,11 @@ int fxp_read_recv(struct sftp_packet *pktin, struct sftp_request *req,
 	char *str;
 	int rlen;
 
-	sftp_pkt_getstring(pktin, &str, &rlen);
+	if (!sftp_pkt_getstring(pktin, &str, &rlen)) {
+	    fxp_internal_error("READ returned malformed SSH_FXP_DATA packet");
+            sftp_pkt_free(pktin);
+	    return -1;
+	}
 
 	if (rlen > len || rlen < 0) {
 	    fxp_internal_error("READ returned more bytes than requested");
@@ -933,18 +966,55 @@ struct fxp_names *fxp_readdir_recv(struct sftp_packet *pktin,
     sfree(req);
     if (pktin->type == SSH_FXP_NAME) {
 	struct fxp_names *ret;
-	int i;
+	unsigned long i;
+
+	/*
+	 * Sanity-check the number of names. Minimum is obviously
+	 * zero. Maximum is the remaining space in the packet
+	 * divided by the very minimum length of a name, which is
+	 * 12 bytes (4 for an empty filename, 4 for an empty
+	 * longname, 4 for a set of attribute flags indicating that
+	 * no other attributes are supplied).
+	 */
+	if (!sftp_pkt_getuint32(pktin, &i) ||
+	    i > (pktin->length-pktin->savedpos)/12) {
+	    fxp_internal_error("malformed FXP_NAME packet");
+	    sftp_pkt_free(pktin);
+	    return NULL;
+	}
+
+	/*
+	 * Ensure the implicit multiplication in the snewn() call
+	 * doesn't suffer integer overflow and cause us to malloc
+	 * too little space.
+	 */
+	if (i > INT_MAX / sizeof(struct fxp_name)) {
+	    fxp_internal_error("unreasonably large FXP_NAME packet");
+	    sftp_pkt_free(pktin);
+	    return NULL;
+	}
+
 	ret = snew(struct fxp_names);
-	ret->nnames = sftp_pkt_getuint32(pktin);
+	ret->nnames = i;
 	ret->names = snewn(ret->nnames, struct fxp_name);
-	for (i = 0; i < ret->nnames; i++) {
-	    char *str;
-	    int len;
-	    sftp_pkt_getstring(pktin, &str, &len);
-	    ret->names[i].filename = mkstr(str, len);
-	    sftp_pkt_getstring(pktin, &str, &len);
-	    ret->names[i].longname = mkstr(str, len);
-	    ret->names[i].attrs = sftp_pkt_getattrs(pktin);
+	for (i = 0; i < (unsigned long)ret->nnames; i++) {
+	    char *str1, *str2;
+	    int len1, len2;
+	    if (!sftp_pkt_getstring(pktin, &str1, &len1) ||
+		!sftp_pkt_getstring(pktin, &str2, &len2) ||
+		!sftp_pkt_getattrs(pktin, &ret->names[i].attrs)) {
+		fxp_internal_error("malformed FXP_NAME packet");
+		while (i--) {
+		    sfree(ret->names[i].filename);
+		    sfree(ret->names[i].longname);
+		}
+		sfree(ret->names);
+		sfree(ret);
+		sfree(pktin);
+		return NULL;
+	    }
+	    ret->names[i].filename = mkstr(str1, len1);
+	    ret->names[i].longname = mkstr(str2, len2);
 	}
         sftp_pkt_free(pktin);
 	return ret;
@@ -1062,7 +1132,7 @@ static struct fxp_xfer *xfer_init(struct fxp_handle *fh, uint64 offset)
     xfer->offset = offset;
     xfer->head = xfer->tail = NULL;
     xfer->req_totalsize = 0;
-    xfer->req_maxsize = 16384;
+    xfer->req_maxsize = 1048576;
     xfer->err = 0;
     xfer->filesize = uint64_make(ULONG_MAX, ULONG_MAX);
     xfer->furthestdata = uint64_make(0, 0);
@@ -1081,7 +1151,8 @@ int xfer_done(struct fxp_xfer *xfer)
 
 void xfer_download_queue(struct fxp_xfer *xfer)
 {
-    while (xfer->req_totalsize < xfer->req_maxsize && !xfer->eof) {
+    while (xfer->req_totalsize < xfer->req_maxsize &&
+	   !xfer->eof && !xfer->err) {
 	/*
 	 * Queue a new read request.
 	 */
@@ -1101,7 +1172,7 @@ void xfer_download_queue(struct fxp_xfer *xfer)
 	xfer->tail = rr;
 	rr->next = NULL;
 
-	rr->len = 4096;
+	rr->len = 32768;
 	rr->buffer = snewn(rr->len, char);
 	sftp_register(req = fxp_read_send(xfer->fh, rr->offset, rr->len));
 	fxp_set_userdata(req, rr);
@@ -1125,15 +1196,23 @@ struct fxp_xfer *xfer_download_init(struct fxp_handle *fh, uint64 offset)
     return xfer;
 }
 
+/*
+ * Returns INT_MIN to indicate that it didn't even get as far as
+ * fxp_read_recv and hence has not freed pktin.
+ */
 int xfer_download_gotpkt(struct fxp_xfer *xfer, struct sftp_packet *pktin)
 {
     struct sftp_request *rreq;
     struct req *rr;
 
     rreq = sftp_find_request(pktin);
+    if (!rreq)
+        return INT_MIN;            /* this packet doesn't even make sense */
     rr = (struct req *)fxp_get_userdata(rreq);
-    if (!rr)
-	return 0;		       /* this packet isn't ours */
+    if (!rr) {
+        fxp_internal_error("request ID is not part of the current download");
+	return INT_MIN;		       /* this packet isn't ours */
+    }
     rr->retlen = fxp_read_recv(pktin, rreq, rr->buffer, rr->len);
 #ifdef DEBUG_DOWNLOAD
     printf("read request %p has returned [%d]\n", rr, rr->retlen);
@@ -1147,6 +1226,8 @@ int xfer_download_gotpkt(struct fxp_xfer *xfer, struct sftp_packet *pktin)
 #endif
     } else if (rr->retlen < 0) {
 	/* some error other than EOF; signal it back to caller */
+	xfer_set_error(xfer);
+	rr->complete = -1;
 	return -1;
     }
 
@@ -1302,6 +1383,10 @@ void xfer_upload_data(struct fxp_xfer *xfer, char *buffer, int len)
 #endif
 }
 
+/*
+ * Returns INT_MIN to indicate that it didn't even get as far as
+ * fxp_write_recv and hence has not freed pktin.
+ */
 int xfer_upload_gotpkt(struct fxp_xfer *xfer, struct sftp_packet *pktin)
 {
     struct sftp_request *rreq;
@@ -1309,9 +1394,13 @@ int xfer_upload_gotpkt(struct fxp_xfer *xfer, struct sftp_packet *pktin)
     int ret;
 
     rreq = sftp_find_request(pktin);
+    if (!rreq)
+        return INT_MIN;            /* this packet doesn't even make sense */
     rr = (struct req *)fxp_get_userdata(rreq);
-    if (!rr)
-	return 0;		       /* this packet isn't ours */
+    if (!rr) {
+        fxp_internal_error("request ID is not part of the current upload");
+	return INT_MIN;		       /* this packet isn't ours */
+    }
     ret = fxp_write_recv(pktin, rreq);
 #ifdef DEBUG_UPLOAD
     printf("write request %p has returned [%d]\n", rr, ret);