Fixes and memory leak elimination in SRP authentication.

3 files changed, 73 insertions, 41 deletions

diff --git a/lib/auth/srp_passwd.c b/lib/auth/srp_passwd.c
index 78c9b0bb2c..c00a6bb5c8 100644
--- a/lib/auth/srp_passwd.c
+++ b/lib/auth/srp_passwd.c
@@ -206,6 +206,7 @@ pwd_read_conf (const char *pconf_file, SRP_PWD_ENTRY * entry, int idx)
   char line[2 * 1024];
   unsigned i, len;
   char indexstr[10];
+  int ret;
 
   snprintf (indexstr, sizeof(indexstr), "%u", (unsigned int)idx);
 
@@ -228,14 +229,22 @@ pwd_read_conf (const char *pconf_file, SRP_PWD_ENTRY * entry, int idx)
       if (strncmp (indexstr, line, MAX (i, len)) == 0)
         {
           if ((idx = pwd_put_values2 (entry, line)) >= 0)
-            return 0;
+            {
+              ret = 0;
+              goto cleanup;
+            }
           else
             {
-              return GNUTLS_E_SRP_PWD_ERROR;
+              ret = GNUTLS_E_SRP_PWD_ERROR;
+              goto cleanup;
             }
         }
     }
-  return GNUTLS_E_SRP_PWD_ERROR;
+  ret = GNUTLS_E_SRP_PWD_ERROR;
+  
+cleanup:
+  fclose(fd);
+  return ret;
 
 }
 
@@ -244,12 +253,12 @@ _gnutls_srp_pwd_read_entry (gnutls_session_t state, char *username,
                             SRP_PWD_ENTRY ** _entry)
 {
   gnutls_srp_server_credentials_t cred;
-  FILE *fd;
+  FILE *fd = NULL;
   char line[2 * 1024];
   unsigned i, len;
   int ret;
   int idx, last_idx;
-  SRP_PWD_ENTRY *entry;
+  SRP_PWD_ENTRY *entry = NULL;
 
   *_entry = gnutls_calloc (1, sizeof (SRP_PWD_ENTRY));
   if (*_entry == NULL)
@@ -264,8 +273,8 @@ _gnutls_srp_pwd_read_entry (gnutls_session_t state, char *username,
   if (cred == NULL)
     {
       gnutls_assert ();
-      _gnutls_srp_entry_free (entry);
-      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+      ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+      goto cleanup;
     }
 
   /* if the callback which sends the parameters is
@@ -284,8 +293,7 @@ _gnutls_srp_pwd_read_entry (gnutls_session_t state, char *username,
               if (ret < 0)
                 {
                   gnutls_assert ();
-                  _gnutls_srp_entry_free (entry);
-                  return ret;
+                  goto cleanup;
                 }
               return 0;
             }
@@ -299,8 +307,8 @@ _gnutls_srp_pwd_read_entry (gnutls_session_t state, char *username,
       if (ret < 0)
         {
           gnutls_assert ();
-          _gnutls_srp_entry_free (entry);
-          return GNUTLS_E_SRP_PWD_ERROR;
+          ret = GNUTLS_E_SRP_PWD_ERROR;
+          goto cleanup;
         }
 
       return 0;
@@ -312,7 +320,8 @@ _gnutls_srp_pwd_read_entry (gnutls_session_t state, char *username,
   if (cred->password_file == NULL)
     {
       gnutls_assert ();
-      return GNUTLS_E_SRP_PWD_ERROR;
+      ret = GNUTLS_E_SRP_PWD_ERROR;
+      goto cleanup;
     }
 
   /* Open the selected password file.
@@ -321,8 +330,8 @@ _gnutls_srp_pwd_read_entry (gnutls_session_t state, char *username,
   if (fd == NULL)
     {
       gnutls_assert ();
-      _gnutls_srp_entry_free (entry);
-      return GNUTLS_E_SRP_PWD_ERROR;
+      ret = GNUTLS_E_SRP_PWD_ERROR;
+      goto cleanup;
     }
 
   last_idx = 1;                 /* a default value */
@@ -348,20 +357,20 @@ _gnutls_srp_pwd_read_entry (gnutls_session_t state, char *username,
               last_idx = idx;
               if (pwd_read_conf (cred->password_conf_file, entry, idx) == 0)
                 {
-                  return 0;
+                  goto found;
                 }
               else
                 {
                   gnutls_assert ();
-                  _gnutls_srp_entry_free (entry);
-                  return GNUTLS_E_SRP_PWD_ERROR;
+                  ret = GNUTLS_E_SRP_PWD_ERROR;
+                  goto cleanup;
                 }
             }
           else
             {
               gnutls_assert ();
-              _gnutls_srp_entry_free (entry);
-              return GNUTLS_E_SRP_PWD_ERROR;
+              ret = GNUTLS_E_SRP_PWD_ERROR;
+              goto cleanup;
             }
         }
     }
@@ -375,17 +384,21 @@ _gnutls_srp_pwd_read_entry (gnutls_session_t state, char *username,
       if (ret < 0)
         {
           gnutls_assert ();
-          _gnutls_srp_entry_free (entry);
-          return ret;
+          goto cleanup;
         }
 
-      return 0;
+      goto found;
     }
 
+cleanup:
   gnutls_assert ();
+  if (fd) fclose(fd);
   _gnutls_srp_entry_free (entry);
   return GNUTLS_E_SRP_PWD_ERROR;
 
+found:
+  if (fd) fclose(fd);
+  return 0;
 }
 
 /* Randomizes the given password entry. It actually sets the verifier
diff --git a/lib/ext/srp.c b/lib/ext/srp.c
index 84b25ded8c..54929ca179 100644
--- a/lib/ext/srp.c
+++ b/lib/ext/srp.c
@@ -108,7 +108,7 @@ _gnutls_srp_send_params (gnutls_session_t session,
   unsigned len;
   int ret;
   extension_priv_data_t epriv;
-  srp_ext_st *priv;
+  srp_ext_st *priv = NULL;
   char *username = NULL, *password = NULL;
 
   if (_gnutls_kx_priority (session, GNUTLS_KX_SRP) < 0 &&
@@ -129,13 +129,37 @@ _gnutls_srp_send_params (gnutls_session_t session,
       if (cred == NULL)
         return 0;
 
+      priv = gnutls_malloc (sizeof (*priv));
+      if (priv == NULL)
+        return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
+
       if (cred->username != NULL)
         {                       /* send username */
           len = MIN (strlen (cred->username), 255);
 
           ret = _gnutls_buffer_append_data_prefix(extdata, 8, cred->username, len);
           if (ret < 0)
-            return gnutls_assert_val(ret);
+            {
+              gnutls_assert();
+              goto cleanup;
+            }
+
+          priv->username = strdup(cred->username);
+          if (priv->username == NULL)
+            {
+              gnutls_assert();
+              goto cleanup;
+            }
+
+          priv->password = strdup(cred->password);
+          if (priv->password == NULL)
+            {
+              gnutls_assert();
+              goto cleanup;
+            }
+
+          epriv.ptr = priv;
+          _gnutls_ext_set_session_data (session, GNUTLS_EXTENSION_SRP, epriv);
 
           return len + 1;
         }
@@ -153,20 +177,9 @@ _gnutls_srp_send_params (gnutls_session_t session,
 
           len = MIN (strlen (username), 255);
 
-          priv = gnutls_malloc (sizeof (*priv));
-          if (priv == NULL)
-            {
-              gnutls_assert ();
-              ret = GNUTLS_E_MEMORY_ERROR;
-              goto cleanup;
-            }
-
           priv->username = username;
           priv->password = password;
 
-          epriv.ptr = priv;
-          _gnutls_ext_set_session_data (session, GNUTLS_EXTENSION_SRP, epriv);
-
           ret = _gnutls_buffer_append_data_prefix(extdata, 8, username, len);
           if (ret < 0)
             {
@@ -174,6 +187,9 @@ _gnutls_srp_send_params (gnutls_session_t session,
               goto cleanup;
             }
 
+          epriv.ptr = priv;
+          _gnutls_ext_set_session_data (session, GNUTLS_EXTENSION_SRP, epriv);
+
           return len + 1;
         }
     }
@@ -182,6 +198,7 @@ _gnutls_srp_send_params (gnutls_session_t session,
 cleanup:
   gnutls_free (username);
   gnutls_free (password);
+  gnutls_free (priv);
   
   return ret;
 }
diff --git a/lib/gnutls_errors.c b/lib/gnutls_errors.c
index 85542ef4e5..c70b3bfdbe 100644
--- a/lib/gnutls_errors.c
+++ b/lib/gnutls_errors.c
@@ -502,11 +502,13 @@ _gnutls_mpi_log (const char *prefix, bigint_t a)
   char *hexbuf;
   int res;
 
+  if (_gnutls_log_level < 2) return;
+
   res = _gnutls_mpi_print (a, NULL, &binlen);
-  if (res != 0)
+  if (res < 0 && res != GNUTLS_E_SHORT_MEMORY_BUFFER)
     {
       gnutls_assert ();
-      _gnutls_hard_log ("MPI: can't print value (%d/%d)\n", res,
+      _gnutls_hard_log ("MPI: %s can't print value (%d/%d)\n", prefix, res,
                         (int) binlen);
       return;
     }
@@ -514,7 +516,7 @@ _gnutls_mpi_log (const char *prefix, bigint_t a)
   if (binlen > 1024 * 1024)
     {
       gnutls_assert ();
-      _gnutls_hard_log ("MPI: too large mpi (%d)\n", (int) binlen);
+      _gnutls_hard_log ("MPI: %s too large mpi (%d)\n", prefix, (int) binlen);
       return;
     }
 
@@ -522,7 +524,7 @@ _gnutls_mpi_log (const char *prefix, bigint_t a)
   if (!binbuf)
     {
       gnutls_assert ();
-      _gnutls_hard_log ("MPI: out of memory (%d)\n", (int) binlen);
+      _gnutls_hard_log ("MPI: %s out of memory (%d)\n", prefix, (int) binlen);
       return;
     }
 
@@ -530,7 +532,7 @@ _gnutls_mpi_log (const char *prefix, bigint_t a)
   if (res != 0)
     {
       gnutls_assert ();
-      _gnutls_hard_log ("MPI: can't print value (%d/%d)\n", res,
+      _gnutls_hard_log ("MPI: %s can't print value (%d/%d)\n", prefix, res,
                         (int) binlen);
       gnutls_free (binbuf);
       return;
@@ -542,7 +544,7 @@ _gnutls_mpi_log (const char *prefix, bigint_t a)
   if (!hexbuf)
     {
       gnutls_assert ();
-      _gnutls_hard_log ("MPI: out of memory (hex %d)\n", (int) hexlen);
+      _gnutls_hard_log ("MPI: %s out of memory (hex %d)\n", prefix, (int) hexlen);
       gnutls_free (binbuf);
       return;
     }