X-Git-Url: https://git.distorted.org.uk/~mdw/sgt/putty/blobdiff_plain/cbe80b7552d1012f023f702fe3ca31750047f362..0affbab4b5e2a5fac19b261c4f74ea868f138340:/unix/uxcons.c

diff --git a/unix/uxcons.c b/unix/uxcons.c
index 2021f40e..4c14eb67 100644
--- a/unix/uxcons.c
+++ b/unix/uxcons.c
@@ -7,8 +7,10 @@
 #include <stdlib.h>
 #include <stdarg.h>
 #include <assert.h>
+
 #include <termios.h>
 #include <unistd.h>
+#include <fcntl.h>
 
 #include "putty.h"
 #include "storage.h"
@@ -161,7 +163,8 @@ int verify_ssh_host_key(void *frontend, char *host, int port, char *keytype,
 	newmode.c_lflag |= ECHO | ISIG | ICANON;
 	tcsetattr(0, TCSANOW, &newmode);
 	line[0] = '\0';
-	read(0, line, sizeof(line) - 1);
+	if (read(0, line, sizeof(line) - 1) <= 0)
+	    /* handled below */;
 	tcsetattr(0, TCSANOW, &oldmode);
     }
 
@@ -213,7 +216,8 @@ int askalg(void *frontend, const char *algtype, const char *algname,
 	newmode.c_lflag |= ECHO | ISIG | ICANON;
 	tcsetattr(0, TCSANOW, &newmode);
 	line[0] = '\0';
-	read(0, line, sizeof(line) - 1);
+	if (read(0, line, sizeof(line) - 1) <= 0)
+	    /* handled below */;
 	tcsetattr(0, TCSANOW, &oldmode);
     }
 
@@ -266,7 +270,8 @@ int askappend(void *frontend, Filename filename,
 	newmode.c_lflag |= ECHO | ISIG | ICANON;
 	tcsetattr(0, TCSANOW, &newmode);
 	line[0] = '\0';
-	read(0, line, sizeof(line) - 1);
+	if (read(0, line, sizeof(line) - 1) <= 0)
+	    /* handled below */;
 	tcsetattr(0, TCSANOW, &oldmode);
     }
 
@@ -322,18 +327,46 @@ void logevent(void *frontend, const char *string)
     postmsg(&cf);
 }
 
-static void console_data_untrusted(const char *data, int len)
+/*
+ * Special functions to read and print to the console for password
+ * prompts and the like. Uses /dev/tty or stdin/stderr, in that order
+ * of preference; also sanitises escape sequences out of the text, on
+ * the basis that it might have been sent by a hostile SSH server
+ * doing malicious keyboard-interactive.
+ */
+static void console_open(FILE **outfp, int *infd)
+{
+    int fd;
+
+    if ((fd = open("/dev/tty", O_RDWR)) >= 0) {
+        *infd = fd;
+        *outfp = fdopen(*infd, "w");
+    } else {
+        *infd = 0;
+        *outfp = stderr;
+    }
+}
+static void console_close(FILE *outfp, int infd)
+{
+    if (outfp != stderr)
+        fclose(outfp);             /* will automatically close infd too */
+}
+
+static void console_prompt_text(FILE *outfp, const char *data, int len)
 {
     int i;
+
     for (i = 0; i < len; i++)
 	if ((data[i] & 0x60) || (data[i] == '\n'))
-	    fputc(data[i], stdout);
-    fflush(stdout);
+	    fputc(data[i], outfp);
+    fflush(outfp);
 }
 
 int console_get_userpass_input(prompts_t *p, unsigned char *in, int inlen)
 {
     size_t curr_prompt;
+    FILE *outfp = NULL;
+    int infd;
 
     /*
      * Zero all the results, in case we abort half-way through.
@@ -347,22 +380,24 @@ int console_get_userpass_input(prompts_t *p, unsigned char *in, int inlen)
     if (p->n_prompts && console_batch_mode)
 	return 0;
 
+    console_open(&outfp, &infd);
+
     /*
      * Preamble.
      */
     /* We only print the `name' caption if we have to... */
     if (p->name_reqd && p->name) {
 	size_t l = strlen(p->name);
-	console_data_untrusted(p->name, l);
+	console_prompt_text(outfp, p->name, l);
 	if (p->name[l-1] != '\n')
-	    console_data_untrusted("\n", 1);
+	    console_prompt_text(outfp, "\n", 1);
     }
     /* ...but we always print any `instruction'. */
     if (p->instruction) {
 	size_t l = strlen(p->instruction);
-	console_data_untrusted(p->instruction, l);
+	console_prompt_text(outfp, p->instruction, l);
 	if (p->instruction[l-1] != '\n')
-	    console_data_untrusted("\n", 1);
+	    console_prompt_text(outfp, "\n", 1);
     }
 
     for (curr_prompt = 0; curr_prompt < p->n_prompts; curr_prompt++) {
@@ -371,32 +406,33 @@ int console_get_userpass_input(prompts_t *p, unsigned char *in, int inlen)
 	int i;
 	prompt_t *pr = p->prompts[curr_prompt];
 
-	tcgetattr(0, &oldmode);
+	tcgetattr(infd, &oldmode);
 	newmode = oldmode;
 	newmode.c_lflag |= ISIG | ICANON;
 	if (!pr->echo)
 	    newmode.c_lflag &= ~ECHO;
 	else
 	    newmode.c_lflag |= ECHO;
-	tcsetattr(0, TCSANOW, &newmode);
+	tcsetattr(infd, TCSANOW, &newmode);
 
-	console_data_untrusted(pr->prompt, strlen(pr->prompt));
+	console_prompt_text(outfp, pr->prompt, strlen(pr->prompt));
 
-	i = read(0, pr->result, pr->result_len - 1);
+	i = read(infd, pr->result, pr->result_len - 1);
 
-	tcsetattr(0, TCSANOW, &oldmode);
+	tcsetattr(infd, TCSANOW, &oldmode);
 
 	if (i > 0 && pr->result[i-1] == '\n')
 	    i--;
 	pr->result[i] = '\0';
 
 	if (!pr->echo)
-	    fputs("\n", stdout);
+	    console_prompt_text(outfp, "\n", 1);
 
     }
 
-    return 1; /* success */
+    console_close(outfp, infd);
 
+    return 1; /* success */
 }
 
 void frontend_keypress(void *handle)