Re: Harden dropbear memory allocator

2015-04-12 Thread Loganaden Velvindron
On Sun, Apr 12, 2015 at 12:34 PM, Matt Johnston wrote: > Hi Logan, > > Thanks for looking at that - certainly something to be wary > of. I've actually removed netio.c's malloc altogether a > couple of weeks ago though had neglected to push it until > now https://secure.ucc.asn.au/hg/dropbear/rev/c

Re: Dropbear for lwIP

2015-04-12 Thread Matt Johnston
On Thu, Apr 09, 2015 at 06:50:01AM +0200, Karl Karpfen wrote: > Hi, > > is it already possible to use Dropbear with the embedded TCP/IP stack lwIP? Hi Karl, I haven't heard of anyone doing that. Cheers, Matt

Re: Harden dropbear memory allocator

2015-04-12 Thread Matt Johnston
Hi Logan, Thanks for looking at that - certainly something to be wary of. I've actually removed netio.c's malloc altogether a couple of weeks ago though had neglected to push it until now https://secure.ucc.asn.au/hg/dropbear/rev/cc6116cc0b5c (my github mirror isn't updated, the machine that does

Harden dropbear memory allocator

2015-04-12 Thread Loganaden Velvindron
Hi All, OpenBSD introduced a new API known as reallocarray(): If malloc() must be used with multiplication, be sure to test for overflow: size_t num, size; ... /* Check for size_t overflow */ if (size && num > SIZE_MAX / size) errc(1, EOVERFLOW, "overflow"); if ((p = malloc(size * num)) == NUL