1. The echoserver's sftp_worker() was treating the WS_CHAN_RXD status as
an error and failing out. Updated to clear the error status.
2. wolfSSH_SFTP_read() was also treating WS_CHAN_RXD status as an error
and terminating the transfer. Update to treat like the other status.
When using a small file buffer for SCP, there was a combination of file
size and channel window size where SCP would read the remainder of the
file, close it, send a small message because the peer's window was full,
then try reading the file again. The change keeps trying to send if the
file buffer still has data.
(ZD #13808)
The OSS-Fuzz detected a possible use of uninitialized data. Since it is
text output for the STDERR of the peer, make sure the string is actually
null terminated before fprintf to stderr.
1. client.c: It was warning a recommendation to tag the function
`readInput()` as non-return. Changed the err_sys() calls to
`fprintf(stderr, ...)` and then return from the function.
2. internal.c: In functions `DoKexInit()` and
`DoUserAuthRequestPublicKey()`, initialized a couple variables that
could be used uninitialized.
3. wolfsftp.c: Fixed a variable that was shadowing a global label.
4. wolfsftp.c: In function `wolfSSH_SFTP_RecvFSTAT()`, initialized a
variable that could be used uninitialized.
5. scpclient.c: The command line argument was read into a char value
assuming it was signed, which is usually true. On the PowerPC this
value is unsigned. Promoted it to int to match the other tools.
1. configure.ac: Check that the DECLs for `pread()` and `pwrite()` exist
in unistd.h.
2. port.c: If `pread()` or `pwrite()` aren't available, use the local
versions that are wrappers around `seek()` and `read()` and
`write()`.
1. Free the handshake hash right after final.
2. Change GenerateKeys() to take a hashId as a parameter.
3. Clear the handshake hash ID right after freeing.
4. Free the handshake hash if the hash ID isn't NONE in
HandshakeINfoFree.
1. Fixed a leak from a commit earlier in this branch.
2. Freed the correct address name when a forwarded connection closes.
3. Only muck about with the childFd when using the shell.
4. Treat the error code WS_CHANNEL_CLOSED as status, not a failure.
1. Moved SendKexDhReply()'s signature data to the heap. (413)
2. Moved SendUserAuthRequest()'s signature data to the heap. (414)
3. Moved DoKexDhReply()'s signature data to the heap. (415)
4. Moved DoUserAuthRequestRsa()'s RSA key to the heap. (416)
5. Moved wolfSSH_ProcessBuffer()'s key buffer to the heap. (422)
6. Moved wolfSSH_ReadKey_buffer()'s key bugger to the heap. (423)
7. In the echoserver, fixed a small-stack related allocation. It was
using a DYNTYPE constant, but those aren't visible. Also, the
wrong variable name was getting freed. (rebase)
1. For DoChannelExtendedData(), removed the switch on the extended data
value type. It can only be one value, and it is checked when read from
the message. Checking it again in the switch statement leaves dead code.
(47)
2. In PreparePacket(), fix a possible dereference of NULL when checking
the outputBuffer length. (68)
3. Change the utility function CreateMpint() to return an error.
(69, 70, 71)
4. DoChannelOpenForward() updates idx in the error case, even if idx is
is NULL, don't bother updating it. (72)
5. In GenerateKeys(), if ssh is NULL, it might still check to see if its
aeadMode is set. Check the aeadMode only if everything is still OK.
(73)
6. In BundlePacket(), aeadMode was getting checked when ssh was NULL.
Check it if everything is still OK. (74)
7. PurgePacket() should check that the ssh passed to it isn't NULL.
(78, 79, 81)
8. Replumbed BuildUserAuthRequestRsa() to protect against trying to use
an signed error code as an unsigned value. (113)
9. In GenerateKey(), check that the returned digest size isn't 0 or a
negative error value. (130, 132)
10. In DoUserAuthReqEcc(), check the ssh pointer before dereferencing it
to get the key size for allocating the small stack key values. (252)
11. In DoUserAuthReqRsa(), check the ssh pointer before dereferencing it
to get the key size for allocating the small stack key values. (253)
12. In DoChannelRequest(), initialize the arrays for the read name and
value to a NULL string. It should log as blank for an error. (440)
13. In SendUserAuthRequest(), initialize the keySigId to ID_NONE. Later
in CleanupUserAuthRequestPublicKey(), explicitly check the keySigId
value for one of the four types: RSA or ECDSA. (442)
14. In SendKexDhReply(), changed the union's type field from isRsa to
pubKeyId, and explicitly checked against RSA or ECDSA. (444, 445, 446)
15. DoReceive() had a for(;;) loop but no control commands internally.
Removed the loop as redundant. (451)
Anthony Hu
Anthony Hu
John Safranek
Takashi Kojo
David Garske
Hideki Miyazaki
Jacob Barthelmeh
Eric Blankenhorn
Daniele Lacamera