shinys000114/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2026-02-11 18:50:28 +09:00
Code Issues Packages Projects Releases Wiki Activity

Add error checking to handle_channel_request().

Browse Source 
git-svn-id: svn+ssh://svn.berlios.de/svnroot/repos/libssh/trunk@448 7dcaeef0-15fb-0310-b436-a5af3365683c
This commit is contained in:
Andreas Schneider
2009-04-09 15:40:43 +00:00
parent 3ad76af469
commit e954d54215
1 changed files with 133 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files

203
libssh/messages.c
View File

@@ -458,83 +458,146 @@ error:
return SSH_ERROR; return SSH_ERROR;
} }
static SSH_MESSAGE *handle_channel_request(SSH_SESSION *session){ static SSH_MESSAGE *handle_channel_request(SSH_SESSION *session) {
u32 channel; SSH_MESSAGE *msg = NULL;
STRING *type; STRING *type = NULL;
char *type_c; char *type_c = NULL;
u8 want_reply; u32 channel;
SSH_MESSAGE *msg; u8 want_reply;
enter_function(); enter_function();
msg = message_new(session);
if (msg == NULL) { msg = message_new(session);
return NULL; if (msg == NULL) {
return NULL;
}
buffer_get_u32(session->in_buffer, &channel);
channel = ntohl(channel);
type = buffer_get_ssh_string(session->in_buffer);
if (type == NULL) {
goto error;
}
type_c = string_to_char(type);
if (type_c == NULL) {
goto error;
}
string_free(type);
buffer_get_u8(session->in_buffer,&want_reply);
ssh_log(session, SSH_LOG_PACKET,
"Received a %s channel_request for channel %d (want_reply=%hhd)",
type_c, channel, want_reply);
msg->type = SSH_CHANNEL_REQUEST;
msg->channel_request.channel = ssh_channel_from_local(session, channel);
msg->channel_request.want_reply = want_reply;
if (strcmp(type_c, "pty-req") == 0) {
STRING *term = NULL;
char *term_c = NULL;
SAFE_FREE(type_c);
term = buffer_get_ssh_string(session->in_buffer);
if (term == NULL) {
goto error;
} }
buffer_get_u32(session->in_buffer,&channel); term_c = string_to_char(term);
channel=ntohl(channel); if (term_c == NULL) {
type=buffer_get_ssh_string(session->in_buffer); string_free(term);
buffer_get_u8(session->in_buffer,&want_reply); goto error;
type_c=string_to_char(type);
free(type);
ssh_log(session, SSH_LOG_PACKET,
"Received a %s channel_request for channel %d (want_reply=%hhd)",
type_c, channel, want_reply);
msg->type=SSH_CHANNEL_REQUEST;
msg->channel_request.channel=ssh_channel_from_local(session,channel);
msg->channel_request.want_reply=want_reply;
if(!strcmp(type_c,"pty-req")){
STRING *term;
char *term_c;
free(type_c);
term=buffer_get_ssh_string(session->in_buffer);
term_c=string_to_char(term);
free(term);
msg->channel_request.type=SSH_CHANNEL_REQUEST_PTY;
msg->channel_request.TERM=term_c;
buffer_get_u32(session->in_buffer,&msg->channel_request.width);
buffer_get_u32(session->in_buffer,&msg->channel_request.height);
buffer_get_u32(session->in_buffer,&msg->channel_request.pxwidth);
buffer_get_u32(session->in_buffer,&msg->channel_request.pxheight);
msg->channel_request.width=ntohl(msg->channel_request.width);
msg->channel_request.height=ntohl(msg->channel_request.height);
msg->channel_request.pxwidth=ntohl(msg->channel_request.pxwidth);
msg->channel_request.pxheight=ntohl(msg->channel_request.pxheight);
msg->channel_request.modes=buffer_get_ssh_string(session->in_buffer);
leave_function();
return msg;
} }
if(!strcmp(type_c,"subsystem")){ string_free(term);
STRING *subsys;
char *subsys_c; msg->channel_request.type = SSH_CHANNEL_REQUEST_PTY;
free(type_c); msg->channel_request.TERM = term_c;
subsys=buffer_get_ssh_string(session->in_buffer);
subsys_c=string_to_char(subsys); buffer_get_u32(session->in_buffer, &msg->channel_request.width);
free(subsys); buffer_get_u32(session->in_buffer, &msg->channel_request.height);
msg->channel_request.type=SSH_CHANNEL_REQUEST_SUBSYSTEM; buffer_get_u32(session->in_buffer, &msg->channel_request.pxwidth);
msg->channel_request.subsystem=subsys_c; buffer_get_u32(session->in_buffer, &msg->channel_request.pxheight);
leave_function();
return msg; msg->channel_request.width = ntohl(msg->channel_request.width);
} msg->channel_request.height = ntohl(msg->channel_request.height);
if(!strcmp(type_c,"shell")){ msg->channel_request.pxwidth = ntohl(msg->channel_request.pxwidth);
free(type_c); msg->channel_request.pxheight = ntohl(msg->channel_request.pxheight);
msg->channel_request.type=SSH_CHANNEL_REQUEST_SHELL; msg->channel_request.modes = buffer_get_ssh_string(session->in_buffer);
leave_function(); if (msg->channel_request.modes == NULL) {
return msg; SAFE_FREE(term_c);
} goto error;
if(!strcmp(type_c,"exec")){
STRING *cmd=buffer_get_ssh_string(session->in_buffer);
free(type_c);
msg->channel_request.type=SSH_CHANNEL_REQUEST_EXEC;
msg->channel_request.command=string_to_char(cmd);
free(cmd);
leave_function();
return msg;
} }
msg->channel_request.type=SSH_CHANNEL_UNKNOWN;
free(type_c);
leave_function(); leave_function();
return msg; return msg;
}
if (strcmp(type_c, "subsystem") == 0) {
STRING *subsys = NULL;
char *subsys_c = NULL;
SAFE_FREE(type_c);
subsys = buffer_get_ssh_string(session->in_buffer);
if (subsys == NULL) {
goto error;
}
subsys_c = string_to_char(subsys);
if (subsys_c == NULL) {
string_free(subsys);
goto error;
}
string_free(subsys);
msg->channel_request.type = SSH_CHANNEL_REQUEST_SUBSYSTEM;
msg->channel_request.subsystem = subsys_c;
leave_function();
return msg;
}
if (strcmp(type_c, "shell") == 0) {
SAFE_FREE(type_c);
msg->channel_request.type = SSH_CHANNEL_REQUEST_SHELL;
leave_function();
return msg;
}
if (strcmp(type_c, "exec") == 0) {
STRING *cmd = NULL;
SAFE_FREE(type_c);
cmd = buffer_get_ssh_string(session->in_buffer);
if (cmd == NULL) {
goto error;
}
msg->channel_request.type = SSH_CHANNEL_REQUEST_EXEC;
msg->channel_request.command = string_to_char(cmd);
if (msg->channel_request.command == NULL) {
string_free(cmd);
goto error;
}
string_free(cmd);
leave_function();
return msg;
}
msg->channel_request.type = SSH_CHANNEL_UNKNOWN;
SAFE_FREE(type_c);
leave_function();
return msg;
error:
string_free(type);
SAFE_FREE(type_c);
ssh_message_free(msg);
leave_function();
return NULL;
} }
char *ssh_message_channel_request_subsystem(SSH_MESSAGE *msg){ char *ssh_message_channel_request_subsystem(SSH_MESSAGE *msg){