Head

GCC Code Coverage Report

Directory:	./		Exec	Total	Coverage
File:	usr.bin/ssh/lib/../sshbuf.c	Lines:	0	170	0.0 %
Date:	2017-11-13	Branches:	0	154	0.0 %


/*	$OpenBSD: sshbuf.c,v 1.11 2017/06/01 06:58:25 djm Exp $	*/
/*
 * Copyright (c) 2011 Damien Miller
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

#include <sys/types.h>
#include <signal.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>

#include "ssherr.h"
#define SSHBUF_INTERNAL
#include "sshbuf.h"
#include "misc.h"

static inline int
sshbuf_check_sanity(const struct sshbuf *buf)
{
	SSHBUF_TELL("sanity");
	if (__predict_false(buf == NULL ||
	    (!buf->readonly && buf->d != buf->cd) ||
	    buf->refcount < 1 || buf->refcount > SSHBUF_REFS_MAX ||
	    buf->cd == NULL ||
	    (buf->dont_free && (buf->readonly || buf->parent != NULL)) ||
	    buf->max_size > SSHBUF_SIZE_MAX ||
	    buf->alloc > buf->max_size ||
	    buf->size > buf->alloc ||
	    buf->off > buf->size)) {
		/* Do not try to recover from corrupted buffer internals */
		SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
		signal(SIGSEGV, SIG_DFL);
		raise(SIGSEGV);
		return SSH_ERR_INTERNAL_ERROR;
	}
	return 0;
}

static void
sshbuf_maybe_pack(struct sshbuf *buf, int force)
{
	SSHBUF_DBG(("force %d", force));
	SSHBUF_TELL("pre-pack");
	if (buf->off == 0 || buf->readonly || buf->refcount > 1)
		return;
	if (force ||
	    (buf->off >= SSHBUF_PACK_MIN && buf->off >= buf->size / 2)) {
		memmove(buf->d, buf->d + buf->off, buf->size - buf->off);
		buf->size -= buf->off;
		buf->off = 0;
		SSHBUF_TELL("packed");
	}
}

struct sshbuf *
sshbuf_new(void)
{
	struct sshbuf *ret;

	if ((ret = calloc(sizeof(*ret), 1)) == NULL)
		return NULL;
	ret->alloc = SSHBUF_SIZE_INIT;
	ret->max_size = SSHBUF_SIZE_MAX;
	ret->readonly = 0;
	ret->refcount = 1;
	ret->parent = NULL;
	if ((ret->cd = ret->d = calloc(1, ret->alloc)) == NULL) {
		free(ret);
		return NULL;
	}
	return ret;
}

struct sshbuf *
sshbuf_from(const void *blob, size_t len)
{
	struct sshbuf *ret;

	if (blob == NULL || len > SSHBUF_SIZE_MAX ||
	    (ret = calloc(sizeof(*ret), 1)) == NULL)
		return NULL;
	ret->alloc = ret->size = ret->max_size = len;
	ret->readonly = 1;
	ret->refcount = 1;
	ret->parent = NULL;
	ret->cd = blob;
	ret->d = NULL;
	return ret;
}

int
sshbuf_set_parent(struct sshbuf *child, struct sshbuf *parent)
{
	int r;

	if ((r = sshbuf_check_sanity(child)) != 0 ||
	    (r = sshbuf_check_sanity(parent)) != 0)
		return r;
	child->parent = parent;
	child->parent->refcount++;
	return 0;
}

struct sshbuf *
sshbuf_fromb(struct sshbuf *buf)
{
	struct sshbuf *ret;

	if (sshbuf_check_sanity(buf) != 0)
		return NULL;
	if ((ret = sshbuf_from(sshbuf_ptr(buf), sshbuf_len(buf))) == NULL)
		return NULL;
	if (sshbuf_set_parent(ret, buf) != 0) {
		sshbuf_free(ret);
		return NULL;
	}
	return ret;
}

void
sshbuf_init(struct sshbuf *ret)
{
	explicit_bzero(ret, sizeof(*ret));
	ret->alloc = SSHBUF_SIZE_INIT;
	ret->max_size = SSHBUF_SIZE_MAX;
	ret->readonly = 0;
	ret->dont_free = 1;
	ret->refcount = 1;
	if ((ret->cd = ret->d = calloc(1, ret->alloc)) == NULL)
		ret->alloc = 0;
}

void
sshbuf_free(struct sshbuf *buf)
{
	int dont_free = 0;

	if (buf == NULL)
		return;
	/*
	 * The following will leak on insane buffers, but this is the safest
	 * course of action - an invalid pointer or already-freed pointer may
	 * have been passed to us and continuing to scribble over memory would
	 * be bad.
	 */
	if (sshbuf_check_sanity(buf) != 0)
		return;
	/*
	 * If we are a child, the free our parent to decrement its reference
	 * count and possibly free it.
	 */
	sshbuf_free(buf->parent);
	buf->parent = NULL;
	/*
	 * If we are a parent with still-extant children, then don't free just
	 * yet. The last child's call to sshbuf_free should decrement our
	 * refcount to 0 and trigger the actual free.
	 */
	buf->refcount--;
	if (buf->refcount > 0)
		return;
	dont_free = buf->dont_free;
	if (!buf->readonly) {
		explicit_bzero(buf->d, buf->alloc);
		free(buf->d);
	}
	explicit_bzero(buf, sizeof(*buf));
	if (!dont_free)
		free(buf);
}

void
sshbuf_reset(struct sshbuf *buf)
{
	u_char *d;

	if (buf->readonly || buf->refcount > 1) {
		/* Nonsensical. Just make buffer appear empty */
		buf->off = buf->size;
		return;
	}
	(void) sshbuf_check_sanity(buf);
	buf->off = buf->size = 0;
	if (buf->alloc != SSHBUF_SIZE_INIT) {
		if ((d = recallocarray(buf->d, buf->alloc, SSHBUF_SIZE_INIT,
		    1)) != NULL) {
			buf->cd = buf->d = d;
			buf->alloc = SSHBUF_SIZE_INIT;
		}
	}
	explicit_bzero(buf->d, SSHBUF_SIZE_INIT);
}

size_t
sshbuf_max_size(const struct sshbuf *buf)
{
	return buf->max_size;
}

size_t
sshbuf_alloc(const struct sshbuf *buf)
{
	return buf->alloc;
}

const struct sshbuf *
sshbuf_parent(const struct sshbuf *buf)
{
	return buf->parent;
}

u_int
sshbuf_refcount(const struct sshbuf *buf)
{
	return buf->refcount;
}

int
sshbuf_set_max_size(struct sshbuf *buf, size_t max_size)
{
	size_t rlen;
	u_char *dp;
	int r;

	SSHBUF_DBG(("set max buf = %p len = %zu", buf, max_size));
	if ((r = sshbuf_check_sanity(buf)) != 0)
		return r;
	if (max_size == buf->max_size)
		return 0;
	if (buf->readonly || buf->refcount > 1)
		return SSH_ERR_BUFFER_READ_ONLY;
	if (max_size > SSHBUF_SIZE_MAX)
		return SSH_ERR_NO_BUFFER_SPACE;
	/* pack and realloc if necessary */
	sshbuf_maybe_pack(buf, max_size < buf->size);
	if (max_size < buf->alloc && max_size > buf->size) {
		if (buf->size < SSHBUF_SIZE_INIT)
			rlen = SSHBUF_SIZE_INIT;
		else
			rlen = ROUNDUP(buf->size, SSHBUF_SIZE_INC);
		if (rlen > max_size)
			rlen = max_size;
		SSHBUF_DBG(("new alloc = %zu", rlen));
		if ((dp = recallocarray(buf->d, buf->alloc, rlen, 1)) == NULL)
			return SSH_ERR_ALLOC_FAIL;
		buf->cd = buf->d = dp;
		buf->alloc = rlen;
	}
	SSHBUF_TELL("new-max");
	if (max_size < buf->alloc)
		return SSH_ERR_NO_BUFFER_SPACE;
	buf->max_size = max_size;
	return 0;
}

size_t
sshbuf_len(const struct sshbuf *buf)
{
	if (sshbuf_check_sanity(buf) != 0)
		return 0;
	return buf->size - buf->off;
}

size_t
sshbuf_avail(const struct sshbuf *buf)
{
	if (sshbuf_check_sanity(buf) != 0 || buf->readonly || buf->refcount > 1)
		return 0;
	return buf->max_size - (buf->size - buf->off);
}

const u_char *
sshbuf_ptr(const struct sshbuf *buf)
{
	if (sshbuf_check_sanity(buf) != 0)
		return NULL;
	return buf->cd + buf->off;
}

u_char *
sshbuf_mutable_ptr(const struct sshbuf *buf)
{
	if (sshbuf_check_sanity(buf) != 0 || buf->readonly || buf->refcount > 1)
		return NULL;
	return buf->d + buf->off;
}

int
sshbuf_check_reserve(const struct sshbuf *buf, size_t len)
{
	int r;

	if ((r = sshbuf_check_sanity(buf)) != 0)
		return r;
	if (buf->readonly || buf->refcount > 1)
		return SSH_ERR_BUFFER_READ_ONLY;
	SSHBUF_TELL("check");
	/* Check that len is reasonable and that max_size + available < len */
	if (len > buf->max_size || buf->max_size - len < buf->size - buf->off)
		return SSH_ERR_NO_BUFFER_SPACE;
	return 0;
}

int
sshbuf_allocate(struct sshbuf *buf, size_t len)
{
	size_t rlen, need;
	u_char *dp;
	int r;

	SSHBUF_DBG(("allocate buf = %p len = %zu", buf, len));
	if ((r = sshbuf_check_reserve(buf, len)) != 0)
		return r;
	/*
	 * If the requested allocation appended would push us past max_size
	 * then pack the buffer, zeroing buf->off.
	 */
	sshbuf_maybe_pack(buf, buf->size + len > buf->max_size);
	SSHBUF_TELL("allocate");
	if (len + buf->size <= buf->alloc)
		return 0; /* already have it. */

	/*
	 * Prefer to alloc in SSHBUF_SIZE_INC units, but
	 * allocate less if doing so would overflow max_size.
	 */
	need = len + buf->size - buf->alloc;
	rlen = ROUNDUP(buf->alloc + need, SSHBUF_SIZE_INC);
	SSHBUF_DBG(("need %zu initial rlen %zu", need, rlen));
	if (rlen > buf->max_size)
		rlen = buf->alloc + need;
	SSHBUF_DBG(("adjusted rlen %zu", rlen));
	if ((dp = recallocarray(buf->d, buf->alloc, rlen, 1)) == NULL) {
		SSHBUF_DBG(("realloc fail"));
		return SSH_ERR_ALLOC_FAIL;
	}
	buf->alloc = rlen;
	buf->cd = buf->d = dp;
	if ((r = sshbuf_check_reserve(buf, len)) < 0) {
		/* shouldn't fail */
		return r;
	}
	SSHBUF_TELL("done");
	return 0;
}

int
sshbuf_reserve(struct sshbuf *buf, size_t len, u_char **dpp)
{
	u_char *dp;
	int r;

	if (dpp != NULL)
		*dpp = NULL;

	SSHBUF_DBG(("reserve buf = %p len = %zu", buf, len));
	if ((r = sshbuf_allocate(buf, len)) != 0)
		return r;

	dp = buf->d + buf->size;
	buf->size += len;
	if (dpp != NULL)
		*dpp = dp;
	return 0;
}

int
sshbuf_consume(struct sshbuf *buf, size_t len)
{
	int r;

	SSHBUF_DBG(("len = %zu", len));
	if ((r = sshbuf_check_sanity(buf)) != 0)
		return r;
	if (len == 0)
		return 0;
	if (len > sshbuf_len(buf))
		return SSH_ERR_MESSAGE_INCOMPLETE;
	buf->off += len;
	/* deal with empty buffer */
	if (buf->off == buf->size)
		buf->off = buf->size = 0;
	SSHBUF_TELL("done");
	return 0;
}

int
sshbuf_consume_end(struct sshbuf *buf, size_t len)
{
	int r;

	SSHBUF_DBG(("len = %zu", len));
	if ((r = sshbuf_check_sanity(buf)) != 0)
		return r;
	if (len == 0)
		return 0;
	if (len > sshbuf_len(buf))
		return SSH_ERR_MESSAGE_INCOMPLETE;
	buf->size -= len;
	SSHBUF_TELL("done");
	return 0;
}



Generated by: GCOVR (Version 3.3)

Line	Branch	Exec	Source
1			/* $OpenBSD: sshbuf.c,v 1.11 2017/06/01 06:58:25 djm Exp $ */
2			/*
3			* Copyright (c) 2011 Damien Miller
4			*
5			* Permission to use, copy, modify, and distribute this software for any
6			* purpose with or without fee is hereby granted, provided that the above
7			* copyright notice and this permission notice appear in all copies.
8			*
9			* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10			* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11			* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12			* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13			* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14			* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15			* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16			*/
17
18			#include <sys/types.h>
19			#include <signal.h>
20			#include <stdlib.h>
21			#include <stdio.h>
22			#include <string.h>
23
24			#include "ssherr.h"
25			#define SSHBUF_INTERNAL
26			#include "sshbuf.h"
27			#include "misc.h"
28
29			static inline int
30			sshbuf_check_sanity(const struct sshbuf *buf)
31			{
32			SSHBUF_TELL("sanity");
33			if (__predict_false(buf == NULL \|\|
34			(!buf->readonly && buf->d != buf->cd) \|\|
35			buf->refcount < 1 \|\| buf->refcount > SSHBUF_REFS_MAX \|\|
36			buf->cd == NULL \|\|
37			(buf->dont_free && (buf->readonly \|\| buf->parent != NULL)) \|\|
38			buf->max_size > SSHBUF_SIZE_MAX \|\|
39			buf->alloc > buf->max_size \|\|
40			buf->size > buf->alloc \|\|
41			buf->off > buf->size)) {
42			/* Do not try to recover from corrupted buffer internals */
43			SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
44			signal(SIGSEGV, SIG_DFL);
45			raise(SIGSEGV);
46			return SSH_ERR_INTERNAL_ERROR;
47			}
48			return 0;
49			}
50
51			static void
52			sshbuf_maybe_pack(struct sshbuf *buf, int force)
53			{
54			SSHBUF_DBG(("force %d", force));
55			SSHBUF_TELL("pre-pack");
56			if (buf->off == 0 \|\| buf->readonly \|\| buf->refcount > 1)
57			return;
58			if (force \|\|
59			(buf->off >= SSHBUF_PACK_MIN && buf->off >= buf->size / 2)) {
60			memmove(buf->d, buf->d + buf->off, buf->size - buf->off);
61			buf->size -= buf->off;
62			buf->off = 0;
63			SSHBUF_TELL("packed");
64			}
65			}
66
67			struct sshbuf *
68			sshbuf_new(void)
69			{
70			struct sshbuf *ret;
71
72			if ((ret = calloc(sizeof(*ret), 1)) == NULL)
73			return NULL;
74			ret->alloc = SSHBUF_SIZE_INIT;
75			ret->max_size = SSHBUF_SIZE_MAX;
76			ret->readonly = 0;
77			ret->refcount = 1;
78			ret->parent = NULL;
79			if ((ret->cd = ret->d = calloc(1, ret->alloc)) == NULL) {
80			free(ret);
81			return NULL;
82			}
83			return ret;
84			}
85
86			struct sshbuf *
87			sshbuf_from(const void *blob, size_t len)
88			{
89			struct sshbuf *ret;
90
91			if (blob == NULL \|\| len > SSHBUF_SIZE_MAX \|\|
92			(ret = calloc(sizeof(*ret), 1)) == NULL)
93			return NULL;
94			ret->alloc = ret->size = ret->max_size = len;
95			ret->readonly = 1;
96			ret->refcount = 1;
97			ret->parent = NULL;
98			ret->cd = blob;
99			ret->d = NULL;
100			return ret;
101			}
102
103			int
104			sshbuf_set_parent(struct sshbuf child, struct sshbuf parent)
105			{
106			int r;
107
108			if ((r = sshbuf_check_sanity(child)) != 0 \|\|
109			(r = sshbuf_check_sanity(parent)) != 0)
110			return r;
111			child->parent = parent;
112			child->parent->refcount++;
113			return 0;
114			}
115
116			struct sshbuf *
117			sshbuf_fromb(struct sshbuf *buf)
118			{
119			struct sshbuf *ret;
120
121			if (sshbuf_check_sanity(buf) != 0)
122			return NULL;
123			if ((ret = sshbuf_from(sshbuf_ptr(buf), sshbuf_len(buf))) == NULL)
124			return NULL;
125			if (sshbuf_set_parent(ret, buf) != 0) {
126			sshbuf_free(ret);
127			return NULL;
128			}
129			return ret;
130			}
131
132			void
133			sshbuf_init(struct sshbuf *ret)
134			{
135			explicit_bzero(ret, sizeof(*ret));
136			ret->alloc = SSHBUF_SIZE_INIT;
137			ret->max_size = SSHBUF_SIZE_MAX;
138			ret->readonly = 0;
139			ret->dont_free = 1;
140			ret->refcount = 1;
141			if ((ret->cd = ret->d = calloc(1, ret->alloc)) == NULL)
142			ret->alloc = 0;
143			}
144
145			void
146			sshbuf_free(struct sshbuf *buf)
147			{
148			int dont_free = 0;
149
150			if (buf == NULL)
151			return;
152			/*
153			* The following will leak on insane buffers, but this is the safest
154			* course of action - an invalid pointer or already-freed pointer may
155			* have been passed to us and continuing to scribble over memory would
156			* be bad.
157			*/
158			if (sshbuf_check_sanity(buf) != 0)
159			return;
160			/*
161			* If we are a child, the free our parent to decrement its reference
162			* count and possibly free it.
163			*/
164			sshbuf_free(buf->parent);
165			buf->parent = NULL;
166			/*
167			* If we are a parent with still-extant children, then don't free just
168			* yet. The last child's call to sshbuf_free should decrement our
169			* refcount to 0 and trigger the actual free.
170			*/
171			buf->refcount--;
172			if (buf->refcount > 0)
173			return;
174			dont_free = buf->dont_free;
175			if (!buf->readonly) {
176			explicit_bzero(buf->d, buf->alloc);
177			free(buf->d);
178			}
179			explicit_bzero(buf, sizeof(*buf));
180			if (!dont_free)
181			free(buf);
182			}
183
184			void
185			sshbuf_reset(struct sshbuf *buf)
186			{
187			u_char *d;
188
189			if (buf->readonly \|\| buf->refcount > 1) {
190			/* Nonsensical. Just make buffer appear empty */
191			buf->off = buf->size;
192			return;
193			}
194			(void) sshbuf_check_sanity(buf);
195			buf->off = buf->size = 0;
196			if (buf->alloc != SSHBUF_SIZE_INIT) {
197			if ((d = recallocarray(buf->d, buf->alloc, SSHBUF_SIZE_INIT,
198			1)) != NULL) {
199			buf->cd = buf->d = d;
200			buf->alloc = SSHBUF_SIZE_INIT;
201			}
202			}
203			explicit_bzero(buf->d, SSHBUF_SIZE_INIT);
204			}
205
206			size_t
207			sshbuf_max_size(const struct sshbuf *buf)
208			{
209			return buf->max_size;
210			}
211
212			size_t
213			sshbuf_alloc(const struct sshbuf *buf)
214			{
215			return buf->alloc;
216			}
217
218			const struct sshbuf *
219			sshbuf_parent(const struct sshbuf *buf)
220			{
221			return buf->parent;
222			}
223
224			u_int
225			sshbuf_refcount(const struct sshbuf *buf)
226			{
227			return buf->refcount;
228			}
229
230			int
231			sshbuf_set_max_size(struct sshbuf *buf, size_t max_size)
232			{
233			size_t rlen;
234			u_char *dp;
235			int r;
236
237			SSHBUF_DBG(("set max buf = %p len = %zu", buf, max_size));
238			if ((r = sshbuf_check_sanity(buf)) != 0)
239			return r;
240			if (max_size == buf->max_size)
241			return 0;
242			if (buf->readonly \|\| buf->refcount > 1)
243			return SSH_ERR_BUFFER_READ_ONLY;
244			if (max_size > SSHBUF_SIZE_MAX)
245			return SSH_ERR_NO_BUFFER_SPACE;
246			/* pack and realloc if necessary */
247			sshbuf_maybe_pack(buf, max_size < buf->size);
248			if (max_size < buf->alloc && max_size > buf->size) {
249			if (buf->size < SSHBUF_SIZE_INIT)
250			rlen = SSHBUF_SIZE_INIT;
251			else
252			rlen = ROUNDUP(buf->size, SSHBUF_SIZE_INC);
253			if (rlen > max_size)
254			rlen = max_size;
255			SSHBUF_DBG(("new alloc = %zu", rlen));
256			if ((dp = recallocarray(buf->d, buf->alloc, rlen, 1)) == NULL)
257			return SSH_ERR_ALLOC_FAIL;
258			buf->cd = buf->d = dp;
259			buf->alloc = rlen;
260			}
261			SSHBUF_TELL("new-max");
262			if (max_size < buf->alloc)
263			return SSH_ERR_NO_BUFFER_SPACE;
264			buf->max_size = max_size;
265			return 0;
266			}
267
268			size_t
269			sshbuf_len(const struct sshbuf *buf)
270			{
271			if (sshbuf_check_sanity(buf) != 0)
272			return 0;
273			return buf->size - buf->off;
274			}
275
276			size_t
277			sshbuf_avail(const struct sshbuf *buf)
278			{
279			if (sshbuf_check_sanity(buf) != 0 \|\| buf->readonly \|\| buf->refcount > 1)
280			return 0;
281			return buf->max_size - (buf->size - buf->off);
282			}
283
284			const u_char *
285			sshbuf_ptr(const struct sshbuf *buf)
286			{
287			if (sshbuf_check_sanity(buf) != 0)
288			return NULL;
289			return buf->cd + buf->off;
290			}
291
292			u_char *
293			sshbuf_mutable_ptr(const struct sshbuf *buf)
294			{
295			if (sshbuf_check_sanity(buf) != 0 \|\| buf->readonly \|\| buf->refcount > 1)
296			return NULL;
297			return buf->d + buf->off;
298			}
299
300			int
301			sshbuf_check_reserve(const struct sshbuf *buf, size_t len)
302			{
303			int r;
304
305			if ((r = sshbuf_check_sanity(buf)) != 0)
306			return r;
307			if (buf->readonly \|\| buf->refcount > 1)
308			return SSH_ERR_BUFFER_READ_ONLY;
309			SSHBUF_TELL("check");
310			/* Check that len is reasonable and that max_size + available < len */
311			if (len > buf->max_size \|\| buf->max_size - len < buf->size - buf->off)
312			return SSH_ERR_NO_BUFFER_SPACE;
313			return 0;
314			}
315
316			int
317			sshbuf_allocate(struct sshbuf *buf, size_t len)
318			{
319			size_t rlen, need;
320			u_char *dp;
321			int r;
322
323			SSHBUF_DBG(("allocate buf = %p len = %zu", buf, len));
324			if ((r = sshbuf_check_reserve(buf, len)) != 0)
325			return r;
326			/*
327			* If the requested allocation appended would push us past max_size
328			* then pack the buffer, zeroing buf->off.
329			*/
330			sshbuf_maybe_pack(buf, buf->size + len > buf->max_size);
331			SSHBUF_TELL("allocate");
332			if (len + buf->size <= buf->alloc)
333			return 0; /* already have it. */
334
335			/*
336			* Prefer to alloc in SSHBUF_SIZE_INC units, but
337			* allocate less if doing so would overflow max_size.
338			*/
339			need = len + buf->size - buf->alloc;
340			rlen = ROUNDUP(buf->alloc + need, SSHBUF_SIZE_INC);
341			SSHBUF_DBG(("need %zu initial rlen %zu", need, rlen));
342			if (rlen > buf->max_size)
343			rlen = buf->alloc + need;
344			SSHBUF_DBG(("adjusted rlen %zu", rlen));
345			if ((dp = recallocarray(buf->d, buf->alloc, rlen, 1)) == NULL) {
346			SSHBUF_DBG(("realloc fail"));
347			return SSH_ERR_ALLOC_FAIL;
348			}
349			buf->alloc = rlen;
350			buf->cd = buf->d = dp;
351			if ((r = sshbuf_check_reserve(buf, len)) < 0) {
352			/* shouldn't fail */
353			return r;
354			}
355			SSHBUF_TELL("done");
356			return 0;
357			}
358
359			int
360			sshbuf_reserve(struct sshbuf buf, size_t len, u_char *dpp)
361			{
362			u_char *dp;
363			int r;
364
365			if (dpp != NULL)
366			*dpp = NULL;
367
368			SSHBUF_DBG(("reserve buf = %p len = %zu", buf, len));
369			if ((r = sshbuf_allocate(buf, len)) != 0)
370			return r;
371
372			dp = buf->d + buf->size;
373			buf->size += len;
374			if (dpp != NULL)
375			*dpp = dp;
376			return 0;
377			}
378
379			int
380			sshbuf_consume(struct sshbuf *buf, size_t len)
381			{
382			int r;
383
384			SSHBUF_DBG(("len = %zu", len));
385			if ((r = sshbuf_check_sanity(buf)) != 0)
386			return r;
387			if (len == 0)
388			return 0;
389			if (len > sshbuf_len(buf))
390			return SSH_ERR_MESSAGE_INCOMPLETE;
391			buf->off += len;
392			/* deal with empty buffer */
393			if (buf->off == buf->size)
394			buf->off = buf->size = 0;
395			SSHBUF_TELL("done");
396			return 0;
397			}
398
399			int
400			sshbuf_consume_end(struct sshbuf *buf, size_t len)
401			{
402			int r;
403
404			SSHBUF_DBG(("len = %zu", len));
405			if ((r = sshbuf_check_sanity(buf)) != 0)
406			return r;
407			if (len == 0)
408			return 0;
409			if (len > sshbuf_len(buf))
410			return SSH_ERR_MESSAGE_INCOMPLETE;
411			buf->size -= len;
412			SSHBUF_TELL("done");
413			return 0;
414			}
415