From bd1e03a2e6753a3548e4e72197b9ca31041d113a Mon Sep 17 00:00:00 2001
From: moritz <>
Date: Wed, 10 Oct 2007 19:39:19 +0000
Subject: Replace use of strcpy(3) and other pointer goo in
 SSL_get_shared_ciphers() with strlcat(3).

ok deraadt@ markus@
---
 src/lib/libssl/src/ssl/ssl_lib.c | 27 ++++++++++++---------------
 src/lib/libssl/ssl_lib.c         | 27 ++++++++++++---------------
 2 files changed, 24 insertions(+), 30 deletions(-)

(limited to 'src')

diff --git a/src/lib/libssl/src/ssl/ssl_lib.c b/src/lib/libssl/src/ssl/ssl_lib.c
index e9fda28f63..0f4b7a475b 100644
--- a/src/lib/libssl/src/ssl/ssl_lib.c
+++ b/src/lib/libssl/src/ssl/ssl_lib.c
@@ -1168,36 +1168,33 @@ int SSL_set_cipher_list(SSL *s,const char *str)
 /* works well for SSLv2, not so good for SSLv3 */
 char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
 	{
-	char *p;
+	char *end;
 	STACK_OF(SSL_CIPHER) *sk;
 	SSL_CIPHER *c;
+	size_t curlen = 0;
 	int i;
 
 	if ((s->session == NULL) || (s->session->ciphers == NULL) ||
 		(len < 2))
 		return(NULL);
 
-	p=buf;
 	sk=s->session->ciphers;
+	buf[0] = '\0';
 	for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
 		{
-		int n;
-
 		c=sk_SSL_CIPHER_value(sk,i);
-		n=strlen(c->name);
-		if (n+1 > len)
+		end = buf + curlen;
+		if (strlcat(buf, c->name, len) >= len ||
+		    (curlen = strlcat(buf, ":", len)) >= len)
 			{
-			if (p != buf)
-				--p;
-			*p='\0';
-			return buf;
+			/* remove truncated cipher from list */
+			*end = '\0';
+			break;
 			}
-		strcpy(p,c->name);
-		p+=n;
-		*(p++)=':';
-		len-=n+1;
 		}
-	p[-1]='\0';
+	/* remove trailing colon */
+	if ((end = strrchr(buf, ':')) != NULL)
+		*end = '\0';
 	return(buf);
 	}
 
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index e9fda28f63..0f4b7a475b 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -1168,36 +1168,33 @@ int SSL_set_cipher_list(SSL *s,const char *str)
 /* works well for SSLv2, not so good for SSLv3 */
 char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
 	{
-	char *p;
+	char *end;
 	STACK_OF(SSL_CIPHER) *sk;
 	SSL_CIPHER *c;
+	size_t curlen = 0;
 	int i;
 
 	if ((s->session == NULL) || (s->session->ciphers == NULL) ||
 		(len < 2))
 		return(NULL);
 
-	p=buf;
 	sk=s->session->ciphers;
+	buf[0] = '\0';
 	for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
 		{
-		int n;
-
 		c=sk_SSL_CIPHER_value(sk,i);
-		n=strlen(c->name);
-		if (n+1 > len)
+		end = buf + curlen;
+		if (strlcat(buf, c->name, len) >= len ||
+		    (curlen = strlcat(buf, ":", len)) >= len)
 			{
-			if (p != buf)
-				--p;
-			*p='\0';
-			return buf;
+			/* remove truncated cipher from list */
+			*end = '\0';
+			break;
 			}
-		strcpy(p,c->name);
-		p+=n;
-		*(p++)=':';
-		len-=n+1;
 		}
-	p[-1]='\0';
+	/* remove trailing colon */
+	if ((end = strrchr(buf, ':')) != NULL)
+		*end = '\0';
 	return(buf);
 	}
 
-- 
cgit v1.2.3-55-g6feb