Skip to content

Commit fb54473

Browse files
JacobBarthelmehJacobBarthelmeh
authored
Merge pull request #862 from ejohnstown/strings
Fix String References
2 parents deddd33 + 864c68a commit fb54473

File tree

3 files changed

+37
-34
lines changed

3 files changed

+37
-34
lines changed

‎ChangeLog.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# wolfSSH v1.4.22 (December 31, 2025)
1+
# wolfSSH v1.4.22 (January 5, 2026)
22

33
## Vulnerabilities
44

‎src/internal.c‎

Lines changed: 35 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -3599,12 +3599,17 @@ int GetString(char* s, word32* sSz, const byte* buf, word32 len, word32 *idx)
35993599

36003600
/* Gets the size of a string, allocates memory to hold it plus a NULL, then
36013601
* copies it into the allocated buffer, and terminates it with a NULL. */
3602-
int GetStringAlloc(void* heap, char** s, const byte* buf, word32 len, word32 *idx)
3602+
int GetStringAlloc(void* heap, char** s, word32* sSz,
3603+
const byte* buf, word32 len, word32 *idx)
36033604
{
36043605
int result;
36053606
const byte *str;
36063607
word32 strSz;
36073608

3609+
if (s == NULL) {
3610+
return WS_BAD_ARGUMENT;
3611+
}
3612+
36083613
result = GetStringRef(&strSz, &str, buf, len, idx);
36093614
if (result == WS_SUCCESS) {
36103615
char* newStr;
@@ -3620,6 +3625,8 @@ int GetStringAlloc(void* heap, char** s, const byte* buf, word32 len, word32 *id
36203625
if (*s != NULL)
36213626
WFREE(*s, heap, DYNTYPE_STRING);
36223627
*s = newStr;
3628+
if (sSz != NULL)
3629+
*sSz = strSz;
36233630
}
36243631

36253632
return result;
@@ -8184,14 +8191,15 @@ static int DoUserAuthInfoRequest(WOLFSSH* ssh, byte* buf, word32 len,
81848191

81858192
if (ret == WS_SUCCESS) {
81868193
begin = *idx;
8187-
ret = GetStringAlloc(heap, (char**)&authName, buf, len, &begin);
8194+
ret = GetStringAlloc(heap, (char**)&authName, NULL, buf, len, &begin);
81888195
}
81898196

81908197
if (ret == WS_SUCCESS)
8191-
ret = GetStringAlloc(heap, (char**)&authInstruction, buf, len, &begin);
8198+
ret = GetStringAlloc(heap, (char**)&authInstruction, NULL,
8199+
buf, len, &begin);
81928200

81938201
if (ret == WS_SUCCESS)
8194-
ret = GetStringAlloc(heap, (char**)&language, buf, len, &begin);
8202+
ret = GetStringAlloc(heap, (char**)&language, NULL, buf, len, &begin);
81958203

81968204
if (ret == WS_SUCCESS)
81978205
ret = GetUint32(&promptSz, buf, len, &begin);
@@ -8218,7 +8226,7 @@ static int DoUserAuthInfoRequest(WOLFSSH* ssh, byte* buf, word32 len,
82188226
} else {
82198227
WMEMSET(echo, 0, sizeof(byte) * promptSz);
82208228
for (entry = 0; entry < promptSz; entry++) {
8221-
ret = GetStringAlloc(heap, (char**)&prompts[entry],
8229+
ret = GetStringAlloc(heap, (char**)&prompts[entry], NULL,
82228230
buf, len, &begin);
82238231
if (ret != WS_SUCCESS)
82248232
break;
@@ -8283,7 +8291,7 @@ static int DoGlobalRequestFwd(WOLFSSH* ssh,
82838291
if (ret == WS_SUCCESS) {
82848292
begin = *idx;
82858293
WLOG(WS_LOG_INFO, "wantReply = %d, isCancel = %d", wantReply, isCancel);
8286-
ret = GetStringAlloc(ssh->ctx->heap, &bindAddr, buf, len, &begin);
8294+
ret = GetStringAlloc(ssh->ctx->heap, &bindAddr, NULL, buf, len, &begin);
82878295
}
82888296

82898297
if (ret == WS_SUCCESS) {
@@ -8398,14 +8406,14 @@ static int DoChannelOpenForward(WOLFSSH* ssh,
83988406

83998407
if (ret == WS_SUCCESS) {
84008408
begin = *idx;
8401-
ret = GetStringAlloc(ssh->ctx->heap, host, buf, len, &begin);
8409+
ret = GetStringAlloc(ssh->ctx->heap, host, NULL, buf, len, &begin);
84028410
}
84038411

84048412
if (ret == WS_SUCCESS)
84058413
ret = GetUint32(hostPort, buf, len, &begin);
84068414

84078415
if (ret == WS_SUCCESS)
8408-
ret = GetStringAlloc(ssh->ctx->heap, origin, buf, len, &begin);
8416+
ret = GetStringAlloc(ssh->ctx->heap, origin, NULL, buf, len, &begin);
84098417

84108418
if (ret == WS_SUCCESS)
84118419
ret = GetUint32(originPort, buf, len, &begin);
@@ -9113,7 +9121,7 @@ static int DoChannelRequest(WOLFSSH* ssh,
91139121
ssh->clientState = CLIENT_DONE;
91149122
}
91159123
else if (WSTRNCMP(type, "exec", typeSz) == 0) {
9116-
ret = GetStringAlloc(ssh->ctx->heap, &channel->command,
9124+
ret = GetStringAlloc(ssh->ctx->heap, &channel->command, NULL,
91179125
buf, len, &begin);
91189126
channel->sessionType = WOLFSSH_SESSION_EXEC;
91199127
if (ssh->ctx->channelReqExecCb) {
@@ -9124,7 +9132,7 @@ static int DoChannelRequest(WOLFSSH* ssh,
91249132
WLOG(WS_LOG_DEBUG, " command = %s", channel->command);
91259133
}
91269134
else if (WSTRNCMP(type, "subsystem", typeSz) == 0) {
9127-
ret = GetStringAlloc(ssh->ctx->heap, &channel->command,
9135+
ret = GetStringAlloc(ssh->ctx->heap, &channel->command, NULL,
91289136
buf, len, &begin);
91299137
channel->sessionType = WOLFSSH_SESSION_SUBSYSTEM;
91309138
if (ssh->ctx->channelReqSubsysCb) {
@@ -9137,39 +9145,34 @@ static int DoChannelRequest(WOLFSSH* ssh,
91379145
#ifdef WOLFSSH_TERM
91389146
else if (WSTRNCMP(type, "pty-req", typeSz) == 0) {
91399147
char term[32];
9140-
char* modes = NULL;
9141-
word32 termSz, modesSz = 0;
9142-
word32 widthChar, heightRows, widthPixels, heightPixels;
9148+
word32 termSz;
91439149

9144-
channel->ptyReq = 1; /* recieved a pty request */
9150+
channel->ptyReq = 1; /* received a pty request */
91459151
termSz = (word32)sizeof(term);
91469152
ret = GetString(term, &termSz, buf, len, &begin);
91479153
if (ret == WS_SUCCESS)
9148-
ret = GetUint32(&widthChar, buf, len, &begin);
9154+
ret = GetUint32(&ssh->widthChar, buf, len, &begin);
91499155
if (ret == WS_SUCCESS)
9150-
ret = GetUint32(&heightRows, buf, len, &begin);
9156+
ret = GetUint32(&ssh->heightRows, buf, len, &begin);
91519157
if (ret == WS_SUCCESS)
9152-
ret = GetUint32(&widthPixels, buf, len, &begin);
9158+
ret = GetUint32(&ssh->widthPixels, buf, len, &begin);
91539159
if (ret == WS_SUCCESS)
9154-
ret = GetUint32(&heightPixels, buf, len, &begin);
9160+
ret = GetUint32(&ssh->heightPixels, buf, len, &begin);
91559161
if (ret == WS_SUCCESS)
9156-
ret = GetStringAlloc(&modesSz, &modes, buf, len, &begin);
9162+
ret = GetStringAlloc(ssh->ctx->heap,
9163+
(char**)&ssh->modes, &ssh->modesSz,
9164+
buf, len, &begin);
91579165
if (ret == WS_SUCCESS) {
91589166
WLOG(WS_LOG_DEBUG, " term = %s", term);
9159-
WLOG(WS_LOG_DEBUG, " widthChar = %u", widthChar);
9160-
WLOG(WS_LOG_DEBUG, " heightRows = %u", heightRows);
9161-
WLOG(WS_LOG_DEBUG, " widthPixels = %u", widthPixels);
9162-
WLOG(WS_LOG_DEBUG, " heightPixels = %u", heightPixels);
9163-
WLOG(WS_LOG_DEBUG, " modesSz = %u", modesSz);
9164-
ssh->widthChar = widthChar;
9165-
ssh->heightRows = heightRows;
9166-
ssh->widthPixels = widthPixels;
9167-
ssh->heightPixels = heightPixels;
9168-
ssh->modes = (byte*)modes;
9169-
ssh->modesSz = modesSz;
9167+
WLOG(WS_LOG_DEBUG, " widthChar = %u", ssh->widthChar);
9168+
WLOG(WS_LOG_DEBUG, " heightRows = %u", ssh->heightRows);
9169+
WLOG(WS_LOG_DEBUG, " widthPixels = %u", ssh->widthPixels);
9170+
WLOG(WS_LOG_DEBUG, " heightPixels = %u", ssh->heightPixels);
9171+
WLOG(WS_LOG_DEBUG, " modesSz = %u", ssh->modesSz);
91709172
if (ssh->termResizeCb) {
9171-
if (ssh->termResizeCb(ssh, widthChar, heightRows,
9172-
widthPixels, heightPixels,
9173+
if (ssh->termResizeCb(ssh,
9174+
ssh->widthChar, ssh->heightRows,
9175+
ssh->widthPixels, ssh->heightPixels,
91739176
ssh->termCtx) != WS_SUCCESS) {
91749177
ret = WS_FATAL_ERROR;
91759178
}

‎wolfssh/internal.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1024,7 +1024,7 @@ WOLFSSH_LOCAL int GetMpint(word32* mpintSz, const byte** mpint,
10241024
const byte* buf, word32 len, word32* idx);
10251025
WOLFSSH_LOCAL int GetString(char* s, word32* sSz,
10261026
const byte* buf, word32 len, word32* idx);
1027-
WOLFSSH_LOCAL int GetStringAlloc(void* heap, char** s,
1027+
WOLFSSH_LOCAL int GetStringAlloc(void* heap, char** s, word32* sSz,
10281028
const byte* buf, word32 len, word32* idx);
10291029
WOLFSSH_LOCAL int GetStringRef(word32* strSz, const byte **str,
10301030
const byte* buf, word32 len, word32* idx);

0 commit comments

Comments
 (0)