FreeBSD/contrib/ntp/libntp/authkeys.c
/* Note: There are two locations below where 'strncpy()' is used. While
 * this function is a hazard by itself, it's essential that it is used
 * here. Bug 1243 involved that the secret was filled with NUL bytes
 * after the first NUL encountered, and 'strlcpy()' simply does NOT have
 * this behaviour. So disabling the fix and reverting to the buggy
 * behaviour due to compatibility issues MUST also fill with NUL and
 * this needs 'strncpy'. Also, the secret is managed as a byte blob of a
 * given size, and eventually truncating it and replacing the last byte
 * with a NUL would be a bug.
 * perlinger@ntp.org 2015-10-10
 */
There are two locations below where 'strncpy()' is used. While
this function is a hazard by itself, it's essential that it is used
here. Bug 1243 involved that the secret was filled with NUL bytes
after the first NUL encountered, and 'strlcpy()' simply does NOT have
this behaviour. So disabling the fix and reverting to the buggy
behaviour due to compatibility issues MUST also fill with NUL and
this needs 'strncpy'. Also, the secret is managed as a byte blob of a
given size, and eventually truncating it and replacing the last byte
with a NUL would be a bug.
There are two locations below where ' strncpy () ' is used . While this function is a hazard by itself it ' s essential that it is used here . Bug 1243 involved that the secret was filled with NUL bytes after the first NUL encountered and ' strlcpy () ' simply does NOT have this behaviour . So disabling the fix and reverting to the buggy behaviour due to compatibility issues MUST also fill with NUL and this needs ' strncpy ' . Also the secret is managed as a byte blob of a given size and eventually truncating it and replacing the last byte with a NUL would be a bug .
void
MD5auth_setkey(
	keyid_t keyno,
	int	keytype,
	const u_char *key,
	size_t secretsize,
	KeyAccT *ka
	)
{
	symkey *	sk;
	u_char *	secret;
	DEBUG_ENSURE(keytype <= USHRT_MAX);
	DEBUG_ENSURE(secretsize < 4 * 1024);
	sk = auth_findkey(keyno);
	if (sk != NULL && keyno == sk->keyid) {
		if (NULL != sk->secret) {
			memset(sk->secret, 0, sk->secretsize);
			free(sk->secret);
		}
		sk->secret = emalloc(secretsize + 1);
		sk->type = (u_short)keytype;
		sk->secretsize = secretsize;
		if (ka != sk->keyacclist) {
			keyacc_all_free(sk->keyacclist);
			sk->keyacclist = ka;
		}
#ifndef DISABLE_BUG1243_FIX
		memcpy(sk->secret, key, secretsize);
#else
		strncpy((char *)sk->secret, (const char *)key,
			secretsize);
#endif
		authcache_flush_id(keyno);
		return;
	}
	secret = emalloc(secretsize + 1);
#ifndef DISABLE_BUG1243_FIX
	memcpy(secret, key, secretsize);
#else
	strncpy((char *)secret, (const char *)key, secretsize);
#endif
	allocsymkey(keyno, 0, (u_short)keytype, 0,
		    secretsize, secret, ka);
#ifdef DEBUG
	if (debug >= 4) {
		size_t	j;
		printf("auth_setkey: key %d type %d len %d ", (int)keyno,
		    keytype, (int)secretsize);
		for (j = 0; j < secretsize; j++) {
			printf("%02x", secret[j]);
		}
		printf("\n");
	}	
#endif
}
void MD5auth_setkey ( keyid_t keyno , int keytype , const u_char * key , size_t secretsize , KeyAccT * ka ) { symkey * sk ; u_char * secret ; DEBUG_ENSURE ( keytype <= USHRT_MAX ) ; DEBUG_ENSURE ( secretsize < 4 * 1024 ) ; sk = auth_findkey ( keyno ) ; if ( sk != NULL && keyno == sk -> keyid ) { if ( NULL != sk -> secret ) { memset ( sk -> secret , 0 , sk -> secretsize ) ; free ( sk -> secret ) ; } sk -> secret = emalloc ( secretsize + 1 ) ; sk -> type = ( u_short ) keytype ; sk -> secretsize = secretsize ; if ( ka != sk -> keyacclist ) { keyacc_all_free ( sk -> keyacclist ) ; sk -> keyacclist = ka ; } #ifndef DISABLE_BUG1243_FIX memcpy ( sk -> secret , key , secretsize ) ; #else strncpy ( ( char * ) sk -> secret , ( const char * ) key , secretsize ) ; #endif authcache_flush_id ( keyno ) ; return ; } secret = emalloc ( secretsize + 1 ) ; #ifndef DISABLE_BUG1243_FIX memcpy ( secret , key , secretsize ) ; #else strncpy ( ( char * ) secret , ( const char * ) key , secretsize ) ; #endif allocsymkey ( keyno , 0 , ( u_short ) keytype , 0 , secretsize , secret , ka ) ; #ifdef DEBUG if ( debug >= 4 ) { size_t j ; printf ( " " , ( int ) keyno , keytype , ( int ) secretsize ) ; for ( j = 0 ; j < secretsize ; j ++ ) { printf ( " " , secret [ j ] ) ; } printf ( " \n " ) ; } #endif }
Note: There are two locations below where 'strncpy()' is used.
Note : There are two locations below where ' strncpy () ' is used .
/*
	 * See if we already have the key.  If so just stick in the
	 * new value.
	 */ /* TALOS-CAN-0054: make sure we have a new buffer! */ /* make sure access lists don't leak here! */ /* >MUST< use 'strncpy()' here! See above! */ /*
	 * Need to allocate new structure.  Do it.
	 */ /* >MUST< use 'strncpy()' here! See above! */