/usr/src/usr.bin/ssh/ssh-keysign/../match.c

Bug Summary

File:	src/usr.bin/ssh/ssh-keysign/../match.c
Warning:	line 297, column 11 Null pointer passed as 1st argument to string length function

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name match.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.bin/ssh/ssh-keysign/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/usr.bin/ssh/ssh-keysign/.. -D WITH_OPENSSL -D WITH_ZLIB -D ENABLE_PKCS11 -D HAVE_DLOPEN -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -Wno-unused-parameter -fdebug-compilation-dir=/usr/src/usr.bin/ssh/ssh-keysign/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.bin/ssh/ssh-keysign/../match.c

1/* $OpenBSD: match.c,v 1.43 2020/11/03 22:53:12 djm Exp $ */
2/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
*                    All rights reserved
* Simple pattern matching, with '*' and '?' as wildcards.
*
* As far as I am concerned, the code I have written for this software
* can be used freely for any purpose.  Any derived versions of this
* software must be clearly marked as such, and if the derived work is
* incompatible with the protocol description in the RFC file, it must be
* called by a name other than "ssh" or "Secure Shell".
*/
14/*
* Copyright (c) 2000 Markus Friedl.  All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

38#include <sys/types.h>

40#include <ctype.h>
41#include <stdlib.h>
42#include <string.h>
43#include <stdarg.h>
44#include <stdio.h>

46#include "xmalloc.h"
47#include "match.h"
48#include "misc.h"

50/*
* Returns true if the given string matches the pattern (which may contain ?
* and * as wildcards), and zero if it does not match.
*/
54int
55match_pattern(const char *s, const char *pattern)
56{
for (;;) {
/* If at end of pattern, accept if also at end of string. */
if (!*pattern)
	return !*s;

if (*pattern == '*') {
	/* Skip this and any consecutive asterisks. */
	while (*pattern == '*')
		pattern++;

	/* If at end of pattern, accept immediately. */
	if (!*pattern)
		return 1;

	/* If next character in pattern is known, optimize. */
	if (*pattern != '?' && *pattern != '*') {
		/*
		 * Look instances of the next character in
		 * pattern, and try to match starting from
		 * those.
		 */
		for (; *s; s++)
			if (*s == *pattern &&
			    match_pattern(s + 1, pattern + 1))
				return 1;
		/* Failed. */
		return 0;
	}
	/*
	 * Move ahead one character at a time and try to
	 * match at each position.
	 */
	for (; *s; s++)
		if (match_pattern(s, pattern))
			return 1;
	/* Failed. */
	return 0;
}
/*
 * There must be at least one more character in the string.
 * If we are at the end, fail.
 */
if (!*s)
	return 0;

/* Check if the next character of the string is acceptable. */
if (*pattern != '?' && *pattern != *s)
	return 0;

/* Move to the next character, both in string and in pattern. */
s++;
pattern++;
}
/* NOTREACHED */
111}

113/*
* Tries to match the string against the
* comma-separated sequence of subpatterns (each possibly preceded by ! to
* indicate negation).  Returns -1 if negation matches, 1 if there is
* a positive match, 0 if there is no match at all.
*/
119int
120match_pattern_list(const char *string, const char *pattern, int dolower)
121{
char sub[1024];
int negated;
int got_positive;
u_int i, subi, len = strlen(pattern);

got_positive = 0;
for (i = 0; i < len;) {
/* Check if the subpattern is negated. */
if (pattern[i] == '!') {
	negated = 1;
	i++;
} else
	negated = 0;

/*
 * Extract the subpattern up to a comma or end.  Convert the
 * subpattern to lowercase.
 */
for (subi = 0;
    i < len && subi < sizeof(sub) - 1 && pattern[i] != ',';
    subi++, i++)
	sub[subi] = dolower && isupper((u_char)pattern[i]) ?
	    tolower((u_char)pattern[i]) : pattern[i];
/* If subpattern too long, return failure (no match). */
if (subi >= sizeof(sub) - 1)
	return 0;

/* If the subpattern was terminated by a comma, then skip it. */
if (i < len && pattern[i] == ',')
	i++;

/* Null-terminate the subpattern. */
sub[subi] = '\0';

/* Try to match the subpattern against the string. */
if (match_pattern(string, sub)) {
	if (negated)
		return -1;		/* Negative */
	else
		got_positive = 1;	/* Positive */
}
}

/*
* Return success if got a positive match.  If there was a negative
* match, we have already returned -1 and never get here.
*/
return got_positive;
170}

172/* Match a list representing users or groups. */
173int
174match_usergroup_pattern_list(const char *string, const char *pattern)
175{
/* Case sensitive match */
return match_pattern_list(string, pattern, 0);
178}

180/*
* Tries to match the host name (which must be in all lowercase) against the
* comma-separated sequence of subpatterns (each possibly preceded by ! to
* indicate negation).  Returns -1 if negation matches, 1 if there is
* a positive match, 0 if there is no match at all.
*/
186int
187match_hostname(const char *host, const char *pattern)
188{
char *hostcopy = xstrdup(host);
int r;

lowercase(hostcopy);
r = match_pattern_list(hostcopy, pattern, 1);
free(hostcopy);
return r;
196}

198/*
* returns 0 if we get a negative match for the hostname or the ip
* or if we get no match at all.  returns -1 on error, or 1 on
* successful match.
*/
203int
204match_host_and_ip(const char *host, const char *ipaddr,
  const char *patterns)
206{
int mhost, mip;

if ((mip = addr_match_list(ipaddr, patterns)) == -2)
return -1; /* error in ipaddr match */
else if (host == NULL((void *)0) || ipaddr == NULL((void *)0) || mip == -1)
return 0; /* negative ip address match, or testing pattern */

/* negative hostname match */
if ((mhost = match_hostname(host, patterns)) == -1)
return 0;
/* no match at all */
if (mhost == 0 && mip == 0)
return 0;
return 1;
221}

223/*
* Match user, user@host_or_ip, user@host_or_ip_list against pattern.
* If user, host and ipaddr are all NULL then validate pattern/
* Returns -1 on invalid pattern, 0 on no match, 1 on match.
*/
228int
229match_user(const char *user, const char *host, const char *ipaddr,
  const char *pattern)
231{
char *p, *pat;
int ret;

/* test mode */
if (user == NULL((void *)0) && host == NULL((void *)0) && ipaddr == NULL((void *)0)) {
if ((p = strchr(pattern, '@')) != NULL((void *)0) &&
    match_host_and_ip(NULL((void *)0), NULL((void *)0), p + 1) < 0)
	return -1;
return 0;
}

if ((p = strchr(pattern, '@')) == NULL((void *)0))
return match_pattern(user, pattern);

pat = xstrdup(pattern);
p = strchr(pat, '@');
*p++ = '\0';

if ((ret = match_pattern(user, pat)) == 1)
ret = match_host_and_ip(host, ipaddr, p);
free(pat);

return ret;
255}

257/*
* Returns first item from client-list that is also supported by server-list,
* caller must free the returned string.
*/
261#define	MAX_PROP40	40
262#define	SEP","	","
263char *
264match_list(const char *client, const char *server, u_int *next)
265{
char *sproposals[MAX_PROP40];
char *c, *s, *p, *ret, *cp, *sp;
int i, j, nproposals;

c = cp = xstrdup(client);
1
The value of 'cp' is assigned to 'c'→
s = sp = xstrdup(server);

for ((p = strsep(&sp, SEP",")), i=0; p && *p != '\0';
2
←
Assuming 'p' is null→
   (p = strsep(&sp, SEP",")), i++) {
if (i < MAX_PROP40)
	sproposals[i] = p;
else
	break;
}
nproposals = i;

for ((p = strsep(&cp, SEP",")), i=0; p && *p != '\0';
3
←
Assuming 'p' is null→
   (p = strsep(&cp, SEP",")), i++) {
for (j = 0; j < nproposals; j++) {
	if (strcmp(p, sproposals[j]) == 0) {
		ret = xstrdup(p);
		if (next != NULL((void *)0))
			*next = (cp == NULL((void *)0)) ?
			    strlen(c) : (u_int)(cp - c);
		free(c);
		free(s);
		return ret;
	}
}
}
if (next != NULL((void *)0))
4
←
Assuming 'next' is not equal to NULL→
5
←
Taking true branch→
*next = strlen(c);
6
←
Null pointer passed as 1st argument to string length function
free(c);
free(s);
return NULL((void *)0);
301}

303/*
* Filter proposal using pattern-list filter.
* "denylist" determines sense of filter:
* non-zero indicates that items matching filter should be excluded.
* zero indicates that only items matching filter should be included.
* returns NULL on allocation error, otherwise caller must free result.
*/
310static char *
311filter_list(const char *proposal, const char *filter, int denylist)
312{
size_t len = strlen(proposal) + 1;
char *fix_prop = malloc(len);
char *orig_prop = strdup(proposal);
char *cp, *tmp;
int r;

if (fix_prop == NULL((void *)0) || orig_prop == NULL((void *)0)) {
free(orig_prop);
free(fix_prop);
return NULL((void *)0);
}

tmp = orig_prop;
*fix_prop = '\0';
while ((cp = strsep(&tmp, ",")) != NULL((void *)0)) {
r = match_pattern_list(cp, filter, 0);
if ((denylist && r != 1) || (!denylist && r == 1)) {
	if (*fix_prop != '\0')
		strlcat(fix_prop, ",", len);
	strlcat(fix_prop, cp, len);
}
}
free(orig_prop);
return fix_prop;
337}

339/*
* Filters a comma-separated list of strings, excluding any entry matching
* the 'filter' pattern list. Caller must free returned string.
*/
343char *
344match_filter_denylist(const char *proposal, const char *filter)
345{
return filter_list(proposal, filter, 1);
347}

349/*
* Filters a comma-separated list of strings, including only entries matching
* the 'filter' pattern list. Caller must free returned string.
*/
353char *
354match_filter_allowlist(const char *proposal, const char *filter)
355{
return filter_list(proposal, filter, 0);
357}