kopia lustrzana https://gitlab.com/sane-project/backends
epson2: Rewrite network I/O
This addresses GHSL-2020-075 as well as all other problematic code uncovered as a result of investigating that. This includes: - buffer overflows due to use of unchecked lengths - integer overflows due to type conversions - potential memory leaks - checking for memory allocation failures Re #279.merge-requests/457/head
rodzic
e52a5bf719
commit
fff83e7eac
|
@ -32,11 +32,12 @@
|
||||||
|
|
||||||
#include "sane/sanei_debug.h"
|
#include "sane/sanei_debug.h"
|
||||||
|
|
||||||
static int
|
static ssize_t
|
||||||
sanei_epson_net_read_raw(Epson_Scanner *s, unsigned char *buf, ssize_t wanted,
|
sanei_epson_net_read_raw(Epson_Scanner *s, unsigned char *buf, ssize_t wanted,
|
||||||
SANE_Status *status)
|
SANE_Status *status)
|
||||||
{
|
{
|
||||||
int ready, read = -1;
|
int ready;
|
||||||
|
ssize_t read = -1;
|
||||||
fd_set readable;
|
fd_set readable;
|
||||||
struct timeval tv;
|
struct timeval tv;
|
||||||
|
|
||||||
|
@ -62,111 +63,136 @@ sanei_epson_net_read_raw(Epson_Scanner *s, unsigned char *buf, ssize_t wanted,
|
||||||
return read;
|
return read;
|
||||||
}
|
}
|
||||||
|
|
||||||
int
|
static ssize_t
|
||||||
|
sanei_epson_net_read_buf(Epson_Scanner *s, unsigned char *buf, ssize_t wanted,
|
||||||
|
SANE_Status * status)
|
||||||
|
{
|
||||||
|
ssize_t read = 0;
|
||||||
|
|
||||||
|
DBG(23, "%s: reading up to %lu from buffer at %p, %lu available\n",
|
||||||
|
__func__, (u_long) wanted, s->netptr, (u_long) s->netlen);
|
||||||
|
|
||||||
|
if ((size_t) wanted > s->netlen) {
|
||||||
|
*status = SANE_STATUS_IO_ERROR;
|
||||||
|
wanted = s->netlen;
|
||||||
|
}
|
||||||
|
|
||||||
|
memcpy(buf, s->netptr, wanted);
|
||||||
|
read = wanted;
|
||||||
|
|
||||||
|
s->netptr += read;
|
||||||
|
s->netlen -= read;
|
||||||
|
|
||||||
|
if (s->netlen == 0) {
|
||||||
|
DBG(23, "%s: freeing %p\n", __func__, s->netbuf);
|
||||||
|
free(s->netbuf);
|
||||||
|
s->netbuf = s->netptr = NULL;
|
||||||
|
s->netlen = 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
return read;
|
||||||
|
}
|
||||||
|
|
||||||
|
ssize_t
|
||||||
sanei_epson_net_read(Epson_Scanner *s, unsigned char *buf, ssize_t wanted,
|
sanei_epson_net_read(Epson_Scanner *s, unsigned char *buf, ssize_t wanted,
|
||||||
SANE_Status * status)
|
SANE_Status * status)
|
||||||
{
|
{
|
||||||
ssize_t size;
|
if (wanted < 0) {
|
||||||
ssize_t read = 0;
|
*status = SANE_STATUS_INVAL;
|
||||||
unsigned char header[12];
|
|
||||||
|
|
||||||
/* read from buffer, if available */
|
|
||||||
if (s->netptr != s->netbuf) {
|
|
||||||
DBG(23, "reading %lu from buffer at %p, %lu available\n",
|
|
||||||
(u_long) wanted, s->netptr, (u_long) s->netlen);
|
|
||||||
|
|
||||||
memcpy(buf, s->netptr, wanted);
|
|
||||||
read = wanted;
|
|
||||||
|
|
||||||
s->netlen -= wanted;
|
|
||||||
|
|
||||||
if (s->netlen == 0) {
|
|
||||||
DBG(23, "%s: freeing %p\n", __func__, s->netbuf);
|
|
||||||
free(s->netbuf);
|
|
||||||
s->netbuf = s->netptr = NULL;
|
|
||||||
s->netlen = 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
return read;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* receive net header */
|
|
||||||
size = sanei_epson_net_read_raw(s, header, 12, status);
|
|
||||||
if (size != 12) {
|
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
size_t size;
|
||||||
|
ssize_t read = 0;
|
||||||
|
unsigned char header[12];
|
||||||
|
|
||||||
|
/* read from remainder of buffer */
|
||||||
|
if (s->netptr) {
|
||||||
|
return sanei_epson_net_read_buf(s, buf, wanted, status);
|
||||||
|
}
|
||||||
|
|
||||||
|
/* receive net header */
|
||||||
|
read = sanei_epson_net_read_raw(s, header, 12, status);
|
||||||
|
if (read != 12) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* validate header */
|
||||||
if (header[0] != 'I' || header[1] != 'S') {
|
if (header[0] != 'I' || header[1] != 'S') {
|
||||||
DBG(1, "header mismatch: %02X %02x\n", header[0], header[1]);
|
DBG(1, "header mismatch: %02X %02x\n", header[0], header[1]);
|
||||||
*status = SANE_STATUS_IO_ERROR;
|
*status = SANE_STATUS_IO_ERROR;
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/* parse payload size */
|
||||||
size = be32atoh(&header[6]);
|
size = be32atoh(&header[6]);
|
||||||
|
|
||||||
DBG(23, "%s: wanted = %lu, available = %lu\n", __func__,
|
|
||||||
(u_long) wanted, (u_long) size);
|
|
||||||
|
|
||||||
*status = SANE_STATUS_GOOD;
|
*status = SANE_STATUS_GOOD;
|
||||||
|
|
||||||
if (size == wanted) {
|
if (!s->netbuf) {
|
||||||
|
DBG(15, "%s: direct read\n", __func__);
|
||||||
|
DBG(23, "%s: wanted = %lu, available = %lu\n", __func__,
|
||||||
|
(u_long) wanted, (u_long) size);
|
||||||
|
|
||||||
DBG(15, "%s: full read\n", __func__);
|
if ((size_t) wanted > size) {
|
||||||
|
wanted = size;
|
||||||
read = sanei_epson_net_read_raw(s, buf, size, status);
|
|
||||||
|
|
||||||
if (s->netbuf) {
|
|
||||||
free(s->netbuf);
|
|
||||||
s->netbuf = NULL;
|
|
||||||
s->netlen = 0;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if (read < 0) {
|
read = sanei_epson_net_read_raw(s, buf, wanted, status);
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* } else if (wanted < size && s->netlen == size) { */
|
|
||||||
} else {
|
} else {
|
||||||
DBG(23, "%s: partial read\n", __func__);
|
DBG(15, "%s: buffered read\n", __func__);
|
||||||
|
DBG(23, "%s: bufferable = %lu, available = %lu\n", __func__,
|
||||||
|
(u_long) s->netlen, (u_long) size);
|
||||||
|
|
||||||
read = sanei_epson_net_read_raw(s, s->netbuf, size, status);
|
if (s->netlen > size) {
|
||||||
if (read != size) {
|
s->netlen = size;
|
||||||
return 0;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
s->netlen = size - wanted;
|
/* fill buffer */
|
||||||
s->netptr += wanted;
|
read = sanei_epson_net_read_raw(s, s->netbuf, s->netlen, status);
|
||||||
read = wanted;
|
s->netptr = s->netbuf;
|
||||||
|
s->netlen = (read > 0 ? read : 0);
|
||||||
|
|
||||||
DBG(23, "0,4 %02x %02x\n", s->netbuf[0], s->netbuf[4]);
|
/* copy wanted part */
|
||||||
DBG(23, "storing %lu to buffer at %p, next read at %p, %lu bytes left\n",
|
read = sanei_epson_net_read_buf(s, buf, wanted, status);
|
||||||
(u_long) size, s->netbuf, s->netptr, (u_long) s->netlen);
|
|
||||||
|
|
||||||
memcpy(buf, s->netbuf, wanted);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
return read;
|
return read;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
size_t
|
||||||
int
|
|
||||||
sanei_epson_net_write(Epson_Scanner *s, unsigned int cmd, const unsigned char *buf,
|
sanei_epson_net_write(Epson_Scanner *s, unsigned int cmd, const unsigned char *buf,
|
||||||
size_t buf_size, size_t reply_len, SANE_Status *status)
|
size_t buf_size, size_t reply_len, SANE_Status *status)
|
||||||
{
|
{
|
||||||
unsigned char *h1, *h2, *payload;
|
unsigned char *h1, *h2, *payload;
|
||||||
unsigned char *packet = malloc(12 + 8 + buf_size);
|
unsigned char *packet = malloc(12 + 8 + buf_size);
|
||||||
|
|
||||||
/* XXX check allocation failure */
|
if (!packet) {
|
||||||
|
*status = SANE_STATUS_NO_MEM;
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
h1 = packet;
|
h1 = packet;
|
||||||
h2 = packet + 12;
|
h2 = packet + 12;
|
||||||
payload = packet + 12 + 8;
|
payload = packet + 12 + 8;
|
||||||
|
|
||||||
if (reply_len) {
|
if (reply_len) {
|
||||||
s->netbuf = s->netptr = malloc(reply_len);
|
if (s->netbuf) {
|
||||||
|
DBG(23, "%s, freeing %p, %ld bytes unprocessed\n",
|
||||||
|
__func__, s->netbuf, (u_long) s->netlen);
|
||||||
|
free(s->netbuf);
|
||||||
|
s->netbuf = s->netptr = NULL;
|
||||||
|
s->netlen = 0;
|
||||||
|
}
|
||||||
|
s->netbuf = malloc(reply_len);
|
||||||
|
if (!s->netbuf) {
|
||||||
|
free(packet);
|
||||||
|
*status = SANE_STATUS_NO_MEM;
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
s->netlen = reply_len;
|
s->netlen = reply_len;
|
||||||
DBG(24, "allocated %lu bytes at %p\n",
|
DBG(24, "%s: allocated %lu bytes at %p\n", __func__,
|
||||||
(u_long) reply_len, s->netbuf);
|
(u_long) s->netlen, s->netbuf);
|
||||||
}
|
}
|
||||||
|
|
||||||
DBG(24, "%s: cmd = %04x, buf = %p, buf_size = %lu, reply_len = %lu\n",
|
DBG(24, "%s: cmd = %04x, buf = %p, buf_size = %lu, reply_len = %lu\n",
|
||||||
|
|
|
@ -4,9 +4,9 @@
|
||||||
#include <sys/types.h>
|
#include <sys/types.h>
|
||||||
#include "../include/sane/sane.h"
|
#include "../include/sane/sane.h"
|
||||||
|
|
||||||
extern int sanei_epson_net_read(struct Epson_Scanner *s, unsigned char *buf, ssize_t buf_size,
|
extern ssize_t sanei_epson_net_read(struct Epson_Scanner *s, unsigned char *buf, ssize_t buf_size,
|
||||||
SANE_Status *status);
|
SANE_Status *status);
|
||||||
extern int sanei_epson_net_write(struct Epson_Scanner *s, unsigned int cmd, const unsigned char *buf,
|
extern size_t sanei_epson_net_write(struct Epson_Scanner *s, unsigned int cmd, const unsigned char *buf,
|
||||||
size_t buf_size, size_t reply_len,
|
size_t buf_size, size_t reply_len,
|
||||||
SANE_Status *status);
|
SANE_Status *status);
|
||||||
extern SANE_Status sanei_epson_net_lock(struct Epson_Scanner *s);
|
extern SANE_Status sanei_epson_net_lock(struct Epson_Scanner *s);
|
||||||
|
|
Ładowanie…
Reference in New Issue