Commander1024
51f835c22f
- Enforce exact service and channel names with bounded failure parsing - Add hash-pinned offline notice assembly and regression coverage - Record advisory dispositions, provenance, integration evidence, and remaining gates
66 lines
2.7 KiB
C
66 lines
2.7 KiB
C
/* SPDX-License-Identifier: GPL-3.0-only */
|
|
static void remaining_parsers(byte *end)
|
|
{
|
|
WOLFSSH ssh = {.clientState=9};
|
|
const byte service[] = "ssh-userauth";
|
|
for (word32 offset=0; offset<=3; offset++) {
|
|
for (word32 size=0; size<=16; size++) {
|
|
byte *p=end-offset-size;
|
|
memset(p,0,offset+size);
|
|
if (size>=4) {
|
|
put(p+offset,12);
|
|
memcpy(p+offset+4,service,size-4);
|
|
}
|
|
word32 idx=offset;
|
|
ssh.clientState=9;
|
|
assert(DoServiceRequest(&ssh,p,offset+size,&idx)==
|
|
(size==16?WS_SUCCESS:WS_BUFFER_E));
|
|
assert(idx==(size==16?offset+size:offset));
|
|
assert(ssh.clientState==(size==16?42:9));
|
|
cases++;
|
|
}
|
|
}
|
|
/* Equal-length mismatch at every byte, embedded NUL, prefix and suffix. */
|
|
for (word32 n=0;n<=13;n++) {
|
|
byte *p=end-4-n;
|
|
put(p,n); memcpy(p+4,service,n);
|
|
word32 idx=0; ssh.clientState=9;
|
|
assert(DoServiceRequest(&ssh,p,n+4,&idx)==
|
|
(n==12?WS_SUCCESS:WS_INVALID_STATE_E));
|
|
assert(idx==(n==12?n+4:0) && ssh.clientState==(n==12?42:9));
|
|
cases++;
|
|
}
|
|
for (word32 pos=0;pos<12;pos++) {
|
|
byte *p=end-16; put(p,12); memcpy(p+4,service,12); p[4+pos]=0;
|
|
word32 idx=0; ssh.clientState=9;
|
|
assert(DoServiceRequest(&ssh,p,16,&idx)==WS_INVALID_STATE_E);
|
|
assert(idx==0 && ssh.clientState==9); cases++;
|
|
}
|
|
/* CHANNEL_FAILURE has exactly one recipient; never mutate session/channel. */
|
|
for (word32 offset=0;offset<=3;offset++) {
|
|
for (word32 size=0;size<=8;size++) {
|
|
byte *p=end-offset-size; memset(p,0,offset+size);
|
|
if(size>=4) put(p+offset,7);
|
|
word32 idx=offset; finds=0; channel.peerWindowSz=123;
|
|
ssh.clientState=9;
|
|
assert(DoChannelFailure(&ssh,p,offset+size,&idx)==
|
|
(size==4?WS_CHANOPEN_FAILED:WS_BUFFER_E));
|
|
assert(idx==(size==4?offset+4:offset));
|
|
assert(finds==(size==4?1u:0u));
|
|
assert(ssh.clientState==9 && channel.peerWindowSz==123); cases++;
|
|
}
|
|
}
|
|
byte *p=end-4; put(p,8); word32 idx=0;
|
|
assert(DoChannelFailure(&ssh,p,4,&idx)==WS_INVALID_CHANID && idx==0);
|
|
const word32 invalid[]={4,5,UINT32_MAX-3,UINT32_MAX};
|
|
for(unsigned j=0;j<4;j++) {
|
|
idx=invalid[j]; finds=0;
|
|
assert(DoChannelFailure(&ssh,p,4,&idx)==WS_BUFFER_E);
|
|
assert(idx==invalid[j] && finds==0); cases++;
|
|
}
|
|
idx=0;
|
|
assert(DoChannelFailure(NULL,p,4,&idx)==WS_BAD_ARGUMENT);
|
|
assert(DoChannelFailure(&ssh,NULL,4,&idx)==WS_BAD_ARGUMENT);
|
|
assert(DoChannelFailure(&ssh,p,4,NULL)==WS_BAD_ARGUMENT);
|
|
}
|