Commit Graph

78 Commits

Author SHA1 Message Date
Armin Novak
81526b19a2 [string,format] fix format strings for debug messages 2026-03-03 14:07:49 +01:00
Armin Novak
822257bf7c [c23,winpr] replace NULL with nullptr 2026-02-26 21:16:48 +01:00
Armin Novak
48267edf2f [winpr] add WINPR_C_ARRAY_INIT
since C23 allows c++ style initializing replace direct use with this
macro
2026-02-25 19:23:08 +01:00
akallabeth
91cd43ea7c [winpr,sspi] fix av pair checks
* check value range of av pair value
* cast to proper type when calling ntlm_av_pair_add
2026-01-09 09:24:36 +01:00
Armin Novak
0ebdd2995a [clang,warnings] fix Wjump-misses-init 2026-01-08 11:32:45 +01:00
akallabeth
74648eb3a9 [c,standard] use C99 inline 2025-09-26 11:29:26 +02:00
Armin Novak
3e6707c443 [warnings] fix issues from ci builder 2025-03-12 12:02:04 +01:00
akallabeth
1a5ba989e8 [warnings] fixed integer casts 2025-03-11 17:23:58 +01:00
akallabeth
d4f7fb081b [warnings] fix -Wunused-function
* delete unused functions that are no longer required
* define guard functions only used while debugging
2025-02-27 19:29:46 +01:00
akallabeth
a520f845a3 [warnings] fix -Wunused-macro
comment or delete macros that were not used.
2025-02-26 22:12:18 +01:00
akallabeth
76c2944d99 [winpr,warnings] fix -Wunused-parameter 2025-02-13 15:53:51 +01:00
akallabeth
307bf48870 [warnings] fix integer casting in winpr
* use WINPR_ASSERTING_INT_CAST to detect overflows in sign or narrow
  integer casts
* replace defines with static variables
2025-01-03 10:08:57 +01:00
akallabeth
e375556d07 [winpr,sysinfo] fix GetComputerNameA
* Trunctate to at most MAX_COMPUTERNAME_LENGTH characters
* Fix usage of function
2024-12-15 18:09:15 +01:00
akallabeth
f63a5a5a1f [winpr,endian] Use new winpr_Data_Write_* names 2024-12-08 22:55:58 +01:00
akallabeth
6dd1ee3055 [winpr,endianess] replace usage of Data_Read_*
Use new and improved winpr_Data_Get_*
2024-12-08 22:55:56 +01:00
akallabeth
a19305569d [assert] fix ULONG_MAX use
most of the time this was used to check ULONG limits. Replace with
correct UINT32_MAX
2024-09-16 08:22:40 +02:00
Armin Novak
2500fb7bfb [cleanup] refactor some checks 2024-04-15 12:40:01 +02:00
akallabeth
f69e1fe697 [clang-tidy] readability-duplicate-include 2024-02-15 11:49:16 +01:00
akallabeth
0ba995655d [clang-tidy] cppcoreguidelines-init-variables 2024-02-15 11:49:16 +01:00
akallabeth
5799fb2018 Replace ConvertFromUnicode and ConvertToUnicode
* Use new ConvertUtf8ToWChar, ConvertUtf8NToWChar,
  ConvertUtf8ToWCharAlloc and ConvertUtf8NToWCharAlloc
* Use new ConvertWCharToUtf8, ConvertWCharNToUtf8,
  ConvertWCharToUtf8Alloc and ConvertWCharNToUtf8Alloc
* Use new Stream UTF16 to/from UTF8 read/write functions
* Use new settings UTF16 to/from UTF8 read/write functions
2022-11-28 10:42:36 +01:00
Armin Novak
8d4332235e Refactored WinPR::NTLM
* added assertions
* added log messages
* removed code duplication
2022-03-22 10:59:58 +01:00
Armin Novak
6ed50b4b1d Refactored WinPR includes 2022-03-03 11:26:48 +01:00
akallabeth
bd42b34776 Decreased NTLM debug log verbosity 2022-01-13 17:20:48 +01:00
Biswapriyo Nath
a22bd407b0 winpr: Fix typo in NTLM_AV_ID member.
According to Microsoft specifications[1] the 10th member is named as MsvAvChannelBindings.
[1]: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nlmp/
2021-06-23 12:04:29 +02:00
akallabeth
6726772d8d Fixed integer warnings 2021-06-18 09:41:02 +02:00
Armin Novak
d36d94766e Replaced assert with WINPR_ASSERT 2021-06-14 09:37:07 +02:00
akallabeth
58a3122250 Fixed OOB read in ntlm_av_pair_get
CVE-2020-11097 thanks to @antonio-morales for finding this.
2020-06-22 11:51:39 +02:00
akallabeth
057b6df4ae Fixed memory leaks in ntlm 2020-06-22 11:51:38 +02:00
Armin Novak
72ca88f49c Reformatted to new style 2019-11-07 10:53:54 +01:00
Armin Novak
f8dd9a9f75 Fixed ntlm_av_pair_get_len return, no signed value required 2019-04-05 09:28:09 +02:00
Samuel Holland
6931f54fad Fix NTLM AvPair lists
There were two main issues here: First, the `ntlm_av_pair_add` and
`ntlm_av_pair_add_copy` were not adding a new `MsvAvEOL` to the end of
the list to replace the one they overwrote. This caused the second call
to one of those functions to fail (since it couldn't find the
terminator), which was the source of the test failure. It also caused
`ntlm_av_pair_list_length` and `ntlm_print_av_pair_list` to read out of
bounds until they happened to find the right word.

Second, several bounds checks were wrong or missing. For example,
`ntlm_av_pair_add` does not ensure that the value fits inside the list.
And `ntlm_av_pair_get_len` and `ntlm_av_pair_get_value_pointer` can
return error codes or NULL, but those error returns were ignored, and
the values used anyway (such as in `ntlm_av_pair_add_copy`).

This fixes the list handling code to have the invariant that all
functions returning `NTLM_AV_PAIR*` only return non-`NULL` if the entire
returned `AvPair` is within bounds. This removes the need for the length
parameter in functions that only operate on a single `AvPair`. This
check is performed by the new `ntlm_av_pair_check` helper, which is
added in some new places and used to simplify the code in others.

Other issues fixed along the way include:
 - `ntlm_av_pair_list_length` did not cast to `PBYTE`, so it was
   returning the number of `NTLM_AV_PAIR`-sized chunks (which was
   possibly not even an integer) instead of the number of bytes
 - I removed an impossible check for `offset <= 0` in
   `ntlm_av_pair_get_next_pointer`
 - The assertion that `Value != NULL` and the call to `CopyMemory` are
   only necessary if `AvLen` is nonzero
 - `ntlm_av_pair_get_next_pointer` (renamed to `ntlm_av_pair_next`)
   could be declared `static`

With this commit, TestNTLM now passes on powerpc64.

```
$ ./Testing/TestSspi TestNTLM
NTLM_NEGOTIATE (length = 40):
NTLM_CHALLENGE (length = 168):
NTLM_AUTHENTICATE (length = 352):
$ echo $?
0
```

Fixes #5250
2019-03-17 20:40:13 -05:00
Armin Novak
eb57ed3a30 Refactored ntlm_av_pairs API
Tightened checks, cleaned up code and improved redability.
2018-11-20 11:08:31 +01:00
Mariusz Zaborski
00374382d9 There is no reason to restrict nSize to 2 the hostname can be empty on
UNIX-like machines.
2018-04-06 21:07:51 +02:00
Armin Novak
50a0968c6a Removed unused variables. 2017-12-21 11:29:24 +01:00
Armin Novak
b11de26f98 Fixed GetComputerNameExA return checks. 2017-02-27 11:49:53 +01:00
akallabeth
8a22052b61 Fixed memory leaks. 2017-02-25 08:35:37 +01:00
akallabeth
705c0c1e12 Fixed GetComputerNameExA calls. #3815 2017-02-24 21:58:08 +01:00
Norbert Federa
f71b6b46e8 fix string format specifiers
- fixed invalid, missing or additional arguments
- removed all type casts from arguments
- added missing (void*) typecasts for %p arguments
- use inttypes defines where appropriate
2016-12-16 13:48:43 +01:00
Norbert Federa
53bd98883e winpr/crypt api changes and memory leak fixes
- winpr_HMAC_New() now just returnes the opaque WINPR_HMAC_CTX* pointer
  which has to be passed to winpr_HMAC_Init() for (re)initialization
  and since winpr_HMAC_Final() no more frees the context you always have to
  use the new function winpr_HMAC_Free() once winpr_HMAC_New() has succeded

- winpr_Digest_New() now just returns the opaque WINPR_DIGEST_CTX* pointer
  which has to be passed to winpr_Digest_Init() for (re)initialization
  and since winpr_Digest_Final() no more frees the context you always have to
  use the new function winpr_Digest_Free() once winpr_Digest_New() has succeded
2016-11-24 18:27:29 +01:00
Norbert Federa
7befab856c Support for OpenSSL 1.1.0 2016-11-24 17:50:09 +01:00
Martin Fleisz
71765b72e3 Merge pull request #3284 from ondrejholy/endianness
Endianness fixes
2016-08-25 08:17:52 +02:00
Norbert Federa
333a1110f5 winpr/sspi/ntlm: fix computer name len calculation
The lpnSize parameter for GetComputerNameEx specifies the total
size of the buffer (in characters).
However, the current code calculated the amount of bytes.
Since only GetComputerNameExA was used and because sizeof(CHAR) == 1
the result was correct but the math was wrong.
Credit goes to @byteboon
2016-06-30 17:15:40 +02:00
Norbert Federa
26ed09a14f winpr/sspi/ntlm: fix GetComputerNameExA parameters
On input, the lpnSize [in, out] parameter for GetComputerNameEx()
specifies the total size of the buffer (in characters).
Several functions in ntlm.c were off by one which caused ntlm to fail
if the netbios hostname's strlen was exactly MAX_COMPUTERNAME_LENGTH.
2016-06-14 12:37:37 +02:00
Ondrej Holy
95a1b53940 winpr/ntlm: Fix endianness in ntlm_av_pair_list
Data in ntlm_av_pair_list are accessed directly, which doesn't work on
big endian machines currently. The recieved data are stored as little
endian. Use conversion macros from endian.h to load and store the data
properly.

https://github.com/FreeRDP/FreeRDP/issues/2520
2016-05-30 13:37:15 +02:00
Armin Novak
f997421098 Unified hmac functions. 2016-02-24 21:50:08 +01:00
Marc-André Moreau
87c42127c7 libwinpr-sspi: remove OpenSSL dependency in NTLM SSPI module 2015-10-08 16:48:58 -04:00
Marc-André Moreau
ac62d43e0f winpr: isolate OpenSSL 2015-10-06 10:56:24 -04:00
Bernhard Miklautz
af81a91ea7 windows: fix compilation and warnings 2015-06-22 19:31:25 +02:00
Bernhard Miklautz
06502e6a91 misc: integrate pull request feedback 2015-06-22 19:24:30 +02:00
Bernhard Miklautz
fc6a3cf3c1 sspi/ntlm: integrate pull request comments 2015-06-22 19:23:58 +02:00