mirror of
https://github.com/signalwire/freeswitch.git
synced 2026-10-04 02:03:59 +00:00
switch_b64_encode wrote each base64 character before checking the output bound, and computed that bound as `bytes >= (int)olen - 1`. Both are unsafe: - Writing before the check meant a buffer with no room for a data byte still received one: `olen == 1` wrote a character at index 0 and the NUL at index 1, and `olen == 0` (where `(int)olen - 1` is -1) wrote two bytes, both past the end. - Casting the unsigned `olen` to `int` truncated it above INT_MAX, producing a wrong bound for very large buffers. Reject `olen == 0`, make the output index `bytes` a `size_t`, and test `bytes + 1 >= olen` before each write, so the bound never casts or underflows and always leaves the last byte for the terminator. Apply the same `bytes + 1 < olen` guard to the trailing partial-group character and the `=` padding, so no write can pass the end. Remove the dead line-wrap counter `y`: it only gated a commented-out newline emit, so it counted and reset with no effect on the output. Add unit tests covering the output-bound edges for every write site.
364 lines
13 KiB
C
364 lines
13 KiB
C
/*
|
|
* FreeSWITCH Modular Media Switching Software Library / Soft-Switch Application
|
|
* Copyright (C) 2005-2018, Anthony Minessale II <anthm@freeswitch.org>
|
|
*
|
|
* Version: MPL 1.1
|
|
*
|
|
* The contents of this file are subject to the Mozilla Public License Version
|
|
* 1.1 (the "License"); you may not use this file except in compliance with
|
|
* the License. You may obtain a copy of the License at
|
|
* http://www.mozilla.org/MPL/
|
|
*
|
|
* Software distributed under the License is distributed on an "AS IS" basis,
|
|
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
|
|
* for the specific language governing rights and limitations under the
|
|
* License.
|
|
*
|
|
* The Original Code is FreeSWITCH Modular Media Switching Software Library / Soft-Switch Application
|
|
*
|
|
* The Initial Developer of the Original Code is
|
|
* Anthony Minessale II <anthm@freeswitch.org>
|
|
* Portions created by the Initial Developer are Copyright (C)
|
|
* the Initial Developer. All Rights Reserved.
|
|
*
|
|
* Contributor(s):
|
|
* Seven Du <seven@signalwire.com>
|
|
* Windy Wang <xiaofengcanyuexp@163.com>
|
|
*
|
|
* switch_utils.c -- tests switch_utils
|
|
*
|
|
*/
|
|
|
|
#include <switch.h>
|
|
#include <test/switch_test.h>
|
|
|
|
FST_MINCORE_BEGIN("./conf")
|
|
|
|
FST_SUITE_BEGIN(switch_hash)
|
|
|
|
FST_SETUP_BEGIN()
|
|
{
|
|
}
|
|
FST_SETUP_END()
|
|
|
|
FST_TEARDOWN_BEGIN()
|
|
{
|
|
}
|
|
FST_TEARDOWN_END()
|
|
|
|
FST_TEST_BEGIN(benchmark)
|
|
{
|
|
char encoded[1024];
|
|
char *s = "ABCD";
|
|
|
|
switch_url_encode(s, encoded, sizeof(encoded));
|
|
switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_INFO, "encoded: [%s]\n", encoded);
|
|
fst_check_string_equals(encoded, "ABCD");
|
|
|
|
s = "&bryän#!杜金房";
|
|
switch_url_encode(s, encoded, sizeof(encoded));
|
|
switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_INFO, "encoded: [%s]\n", encoded);
|
|
fst_check_string_equals(encoded, "%26bry%C3%A4n%23!%E6%9D%9C%E9%87%91%E6%88%BF");
|
|
}
|
|
FST_TEST_END()
|
|
|
|
FST_TEST_BEGIN(b64)
|
|
{
|
|
switch_size_t size;
|
|
char *str = "ABC";
|
|
unsigned char b64_str[6];
|
|
char decoded_str[4];
|
|
switch_status_t status = switch_b64_encode((unsigned char *)str, strlen(str), b64_str, sizeof(b64_str));
|
|
switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_INFO, "b64_str: %s\n", b64_str);
|
|
fst_check(status == SWITCH_STATUS_SUCCESS);
|
|
fst_check_string_equals((const char *)b64_str, "QUJD");
|
|
|
|
size = switch_b64_decode((const char *)b64_str, decoded_str, sizeof(decoded_str));
|
|
switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_INFO, "decoded_str: %s\n", decoded_str);
|
|
fst_check_string_equals(decoded_str, str);
|
|
fst_check(size == 4);
|
|
}
|
|
FST_TEST_END()
|
|
|
|
FST_TEST_BEGIN(b64_pad2)
|
|
{
|
|
switch_size_t size;
|
|
char str[] = {0, 0, 0, 0};
|
|
unsigned char b64_str[128];
|
|
char decoded_str[128];
|
|
int i;
|
|
switch_status_t status = switch_b64_encode((unsigned char *)str, sizeof(str), b64_str, sizeof(b64_str));
|
|
switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_INFO, "b64_str: %s\n", b64_str);
|
|
fst_check(status == SWITCH_STATUS_SUCCESS);
|
|
fst_check_string_equals((const char *)b64_str, "AAAAAA==");
|
|
|
|
size = switch_b64_decode((const char *)b64_str, decoded_str, sizeof(decoded_str));
|
|
switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_INFO, "decoded_str: %s\n", decoded_str);
|
|
fst_check_string_equals(decoded_str, str);
|
|
fst_check(size == sizeof(str) + 1);
|
|
for (i = 0; i < sizeof(str); i++) {
|
|
fst_check(decoded_str[i] == str[i]);
|
|
}
|
|
}
|
|
FST_TEST_END()
|
|
|
|
FST_TEST_BEGIN(b64_pad1)
|
|
{
|
|
switch_size_t size;
|
|
char str[] = {0, 0, 0, 0, 0};
|
|
unsigned char b64_str[128];
|
|
char decoded_str[128];
|
|
int i;
|
|
switch_status_t status = switch_b64_encode((unsigned char *)str, sizeof(str), b64_str, sizeof(b64_str));
|
|
switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_INFO, "b64_str: %s\n", b64_str);
|
|
fst_check(status == SWITCH_STATUS_SUCCESS);
|
|
fst_check_string_equals((const char *)b64_str, "AAAAAAA=");
|
|
|
|
size = switch_b64_decode((const char *)b64_str, decoded_str, sizeof(decoded_str));
|
|
switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_INFO, "decoded_str: %s\n", decoded_str);
|
|
fst_check_string_equals(decoded_str, str);
|
|
fst_check(size == sizeof(str) + 1);
|
|
for (i = 0; i < sizeof(str); i++) {
|
|
fst_check(decoded_str[i] == str[i]);
|
|
}
|
|
}
|
|
FST_TEST_END()
|
|
|
|
FST_TEST_BEGIN(b64_roundtrip)
|
|
{
|
|
/* Encode then decode inputs covering all three padding cases; the base64 output must
|
|
match the known value and decode back to the original bytes. Unlike b64_pad1/b64_pad2
|
|
(all-zero input), these push non-zero bytes through the padded final group. */
|
|
struct {
|
|
const char *plain;
|
|
const char *encoded;
|
|
} cases[] = {
|
|
{ "Man", "TWFu" }, /* no padding */
|
|
{ "Ma", "TWE=" }, /* one pad byte */
|
|
{ "M", "TQ==" }, /* two pad bytes */
|
|
{ "Hello, World!", "SGVsbG8sIFdvcmxkIQ==" }
|
|
};
|
|
int i;
|
|
|
|
for (i = 0; i < (int) (sizeof(cases) / sizeof(cases[0])); i++) {
|
|
unsigned char encoded[64];
|
|
char decoded[64];
|
|
switch_size_t plain_len = strlen(cases[i].plain);
|
|
switch_size_t decoded_len;
|
|
switch_status_t status = switch_b64_encode((unsigned char *) cases[i].plain, plain_len, encoded, sizeof(encoded));
|
|
|
|
fst_xcheck(status == SWITCH_STATUS_SUCCESS, "encode must succeed");
|
|
fst_check_string_equals((const char *) encoded, cases[i].encoded);
|
|
|
|
decoded_len = switch_b64_decode((const char *) encoded, decoded, sizeof(decoded));
|
|
fst_xcheck(decoded_len == plain_len + 1, "decode must return the plaintext length plus the trailing NUL");
|
|
fst_check_string_equals(decoded, cases[i].plain);
|
|
}
|
|
}
|
|
FST_TEST_END()
|
|
|
|
FST_TEST_BEGIN(b64_decode_output_bounds)
|
|
{
|
|
/* The 0xAA sentinel across the destination catches any write outside the region
|
|
the decode call is allowed to touch. */
|
|
unsigned char guarded[32];
|
|
switch_size_t size;
|
|
int i;
|
|
|
|
/* Decode with olen == 0: no room even for the trailing NUL, so the decoder must
|
|
write nothing and return 0. */
|
|
memset(guarded, 0xAA, sizeof(guarded));
|
|
size = switch_b64_decode("QUJDQUJDQUJDQUJDQUJDQUJDQUJDQUJD", (char *) guarded, 0);
|
|
fst_xcheck(size == 0, "olen==0 decode must return 0");
|
|
for (i = 0; i < (int) sizeof(guarded); i++) {
|
|
fst_xcheck(guarded[i] == 0xAA, "olen==0 decode must not write any output byte");
|
|
}
|
|
|
|
/* Decode with olen == 1: room only for the terminating NUL at index 0; no decoded
|
|
data byte may be written. */
|
|
memset(guarded, 0xAA, sizeof(guarded));
|
|
size = switch_b64_decode("QUJDQUJDQUJDQUJD", (char *) guarded, 1);
|
|
fst_xcheck(size == 1, "olen==1 decode must return 1 (NUL only)");
|
|
fst_xcheck(guarded[0] == '\0', "olen==1 decode must store the NUL at index 0");
|
|
for (i = 1; i < (int) sizeof(guarded); i++) {
|
|
fst_xcheck(guarded[i] == 0xAA, "olen==1 decode must not write past index 0");
|
|
}
|
|
|
|
/* Decode with a small olen: up to olen-1 decoded bytes, then the trailing NUL at
|
|
index olen-1, and nothing beyond. "QUJD" decodes to "ABC". */
|
|
memset(guarded, 0xAA, sizeof(guarded));
|
|
size = switch_b64_decode("QUJD", (char *) guarded, 2);
|
|
fst_xcheck(size == 2, "bounded decode must return olen");
|
|
fst_xcheck(guarded[0] == 'A', "first decoded byte must be written");
|
|
fst_xcheck(guarded[1] == '\0', "trailing NUL must be at index olen-1");
|
|
for (i = 2; i < (int) sizeof(guarded); i++) {
|
|
fst_xcheck(guarded[i] == 0xAA, "bounded decode must not write past index olen-1");
|
|
}
|
|
}
|
|
FST_TEST_END()
|
|
|
|
FST_TEST_BEGIN(b64_decode_non_alphabet_bytes)
|
|
{
|
|
/* Bytes outside the base64 alphabet, including those >= 0x80, are skipped and never used
|
|
as a lookup-table index. */
|
|
char decoded[8];
|
|
switch_size_t size;
|
|
|
|
/* "QUJD" ("ABC") with a non-alphabet 0x80 byte spliced in. */
|
|
size = switch_b64_decode("QU\x80" "JD", decoded, sizeof(decoded));
|
|
fst_xcheck(size == 4, "non-alphabet byte must be skipped, leaving 3 data bytes plus the NUL");
|
|
fst_check_string_equals(decoded, "ABC");
|
|
}
|
|
FST_TEST_END()
|
|
|
|
FST_TEST_BEGIN(b64_encode_output_bounds)
|
|
{
|
|
/* The 0xAA sentinel across the destination catches any write outside the region
|
|
the encode call is allowed to touch. */
|
|
unsigned char guarded[32];
|
|
unsigned char encode_in[] = { 'A', 'B', 'C' };
|
|
unsigned char one_byte[] = { 'A' };
|
|
switch_status_t status;
|
|
int i;
|
|
|
|
/* Encode with olen == 0: no room even for the trailing NUL, so encode must refuse and
|
|
write nothing. */
|
|
memset(guarded, 0xAA, sizeof(guarded));
|
|
status = switch_b64_encode(encode_in, sizeof(encode_in), guarded, 0);
|
|
fst_xcheck(status == SWITCH_STATUS_FALSE, "olen==0 encode must return SWITCH_STATUS_FALSE");
|
|
for (i = 0; i < (int) sizeof(guarded); i++) {
|
|
fst_xcheck(guarded[i] == 0xAA, "olen==0 encode must not write any output byte");
|
|
}
|
|
|
|
/* Encode with olen == 1: room only for the terminating NUL at index 0; no data byte may
|
|
be written past it. */
|
|
memset(guarded, 0xAA, sizeof(guarded));
|
|
status = switch_b64_encode(encode_in, sizeof(encode_in), guarded, 1);
|
|
fst_xcheck(status == SWITCH_STATUS_SUCCESS, "olen==1 encode must succeed writing only the NUL");
|
|
fst_xcheck(guarded[0] == '\0', "olen==1 encode must store the NUL at index 0");
|
|
for (i = 1; i < (int) sizeof(guarded); i++) {
|
|
fst_xcheck(guarded[i] == 0xAA, "olen==1 encode must not write past index 0");
|
|
}
|
|
|
|
/* Encode into a buffer smaller than the full result: output is bounded to olen-1 bytes,
|
|
then the trailing NUL at index olen-1, and nothing beyond. "ABC" encodes to "QUJD";
|
|
olen 3 keeps "QU". */
|
|
memset(guarded, 0xAA, sizeof(guarded));
|
|
status = switch_b64_encode(encode_in, sizeof(encode_in), guarded, 3);
|
|
fst_xcheck(status == SWITCH_STATUS_SUCCESS, "bounded encode must succeed");
|
|
fst_check_string_equals((const char *) guarded, "QU");
|
|
fst_xcheck(guarded[2] == '\0', "trailing NUL must be at index olen-1");
|
|
for (i = 3; i < (int) sizeof(guarded); i++) {
|
|
fst_xcheck(guarded[i] == 0xAA, "bounded encode must not write past index olen-1");
|
|
}
|
|
|
|
/* A 1-byte input has a 2-bit remainder, so it exercises the trailing partial-group byte and
|
|
the '=' padding - sites the 3-byte cases above never reach. "A" encodes to "QQ==". */
|
|
|
|
/* olen == 2: the main-loop character fills the buffer to olen-1, so the partial-group byte
|
|
must be skipped and only the NUL written. */
|
|
memset(guarded, 0xAA, sizeof(guarded));
|
|
status = switch_b64_encode(one_byte, sizeof(one_byte), guarded, 2);
|
|
fst_xcheck(status == SWITCH_STATUS_SUCCESS, "olen==2 encode must succeed");
|
|
fst_check_string_equals((const char *) guarded, "Q");
|
|
fst_xcheck(guarded[1] == '\0', "trailing NUL must be at index olen-1");
|
|
for (i = 2; i < (int) sizeof(guarded); i++) {
|
|
fst_xcheck(guarded[i] == 0xAA, "olen==2 encode must not write the partial-group byte past the buffer");
|
|
}
|
|
|
|
/* olen == 3: the partial-group byte fits, but the '=' padding must be skipped for lack of room. */
|
|
memset(guarded, 0xAA, sizeof(guarded));
|
|
status = switch_b64_encode(one_byte, sizeof(one_byte), guarded, 3);
|
|
fst_xcheck(status == SWITCH_STATUS_SUCCESS, "olen==3 encode must succeed");
|
|
fst_check_string_equals((const char *) guarded, "QQ");
|
|
fst_xcheck(guarded[2] == '\0', "trailing NUL must be at index olen-1");
|
|
for (i = 3; i < (int) sizeof(guarded); i++) {
|
|
fst_xcheck(guarded[i] == 0xAA, "olen==3 encode must not write padding past the buffer");
|
|
}
|
|
|
|
/* Ample olen: the full result, including partial-group byte and '=' padding, is produced. */
|
|
memset(guarded, 0xAA, sizeof(guarded));
|
|
status = switch_b64_encode(one_byte, sizeof(one_byte), guarded, sizeof(guarded));
|
|
fst_xcheck(status == SWITCH_STATUS_SUCCESS, "encode must succeed");
|
|
fst_check_string_equals((const char *) guarded, "QQ==");
|
|
}
|
|
FST_TEST_END()
|
|
|
|
#define test_uri_count 6
|
|
|
|
/* Currently tests only clear_uri() */
|
|
FST_TEST_BEGIN(test_switch_http_parse_header)
|
|
{
|
|
int i = 0;
|
|
switch_status_t status = SWITCH_STATUS_SUCCESS;
|
|
switch_http_request_t request = {0};
|
|
char bad_uris[][200] = {
|
|
"/t/o/o/_/l/o/n/g/_/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/a/2/3/4",
|
|
"without_a_slash/",
|
|
};
|
|
char raw_uris[test_uri_count][200] = {
|
|
"/////////uri1",
|
|
"/././././uri2",
|
|
"/uri3/uri3_1/.//uri3_2/../../uri3_3",
|
|
"/../../../uri4",
|
|
"/uri5/uri5_1/",
|
|
"/uri6/uri6_1",
|
|
};
|
|
const char clear_uris[test_uri_count][200] = {
|
|
"/uri1",
|
|
"/uri2",
|
|
"/uri3/uri3_3",
|
|
"/uri4",
|
|
"/uri5/uri5_1",
|
|
"/uri6/uri6_1",
|
|
};
|
|
|
|
for (i = 0; i < (sizeof(bad_uris) / sizeof(bad_uris[0])); i++) {
|
|
char bad_header[256];
|
|
const char *bad_uri = bad_uris[i];
|
|
|
|
/* Use precision specifier to suppress false-positive "format-truncation" warning. */
|
|
snprintf(bad_header, sizeof(bad_header), "GET %.199s HTTP/1.1\r\n\r\nBODY", bad_uri);
|
|
|
|
fst_check((status = switch_http_parse_header(bad_header, sizeof(bad_header), &request)) == SWITCH_STATUS_FALSE);
|
|
|
|
if (status == SWITCH_STATUS_SUCCESS) {
|
|
switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "Bad uri parsed [%d]: [%s]\n", i, request.uri);
|
|
switch_http_free_request(&request);
|
|
}
|
|
}
|
|
|
|
for (i = 0; i < test_uri_count; i++) {
|
|
char raw_header[256];
|
|
const char *clear_uri = clear_uris[i];
|
|
const char *raw_uri = raw_uris[i];
|
|
|
|
/* Use precision specifier to suppress false-positive "format-truncation" warning. */
|
|
snprintf(raw_header, sizeof(raw_header), "GET %.199s HTTP/1.1\r\n\r\nBODY", raw_uri);
|
|
|
|
fst_check((status = switch_http_parse_header(raw_header, sizeof(raw_header), &request)) == SWITCH_STATUS_SUCCESS);
|
|
fst_check_string_equals(clear_uri, request.uri);
|
|
|
|
if (status == SWITCH_STATUS_SUCCESS) {
|
|
switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_INFO, "URI [%d]: [%s] => [%s]\n", i, raw_uri, request.uri);
|
|
switch_http_free_request(&request);
|
|
}
|
|
}
|
|
}
|
|
FST_TEST_END()
|
|
|
|
FST_SUITE_END()
|
|
|
|
FST_MINCORE_END()
|
|
|
|
/* For Emacs:
|
|
* Local Variables:
|
|
* mode:c
|
|
* indent-tabs-mode:t
|
|
* tab-width:4
|
|
* c-basic-offset:4
|
|
* End:
|
|
* For VIM:
|
|
* vim:set softtabstop=4 shiftwidth=4 tabstop=4 noet:
|
|
*/
|