DoServiceRequest Missing Bounds Check

Replace the original message parsing functions with the GetString()
function, which does better bounds checking.

Affected functions: DoServiceRequest, DoServiceAccept.
Issue: F-524, F-525

Author: ejohnstown

src/internal.c

@@ -6523,56 +6523,32 @@ static int DoDisconnect(WOLFSSH* ssh, byte* buf, word32 len, word32* idx)
 static int DoServiceRequest(WOLFSSH* ssh,
                             byte* buf, word32 len, word32* idx)
 {
-    word32 begin = *idx;
-    word32 nameSz;
-    char     serviceName[WOLFSSH_MAX_NAMESZ];
-
-    WOLFSSH_UNUSED(len);
-
-    ato32(buf + begin, &nameSz);
-    begin += LENGTH_SZ;
-
-    if (begin + nameSz > len || nameSz >= WOLFSSH_MAX_NAMESZ) {
-        return WS_BUFFER_E;
-    }
-
-    WMEMCPY(serviceName, buf + begin, nameSz);
-    begin += nameSz;
-    serviceName[nameSz] = 0;
+    char name[WOLFSSH_MAX_NAMESZ];
+    word32 nameSz = sizeof(name);
+    int ret;
 
-    *idx = begin;
+    ret = GetString(name, &nameSz, buf, len, idx);
 
-    WLOG(WS_LOG_DEBUG, "Requesting service: %s", serviceName);
+    WLOG(WS_LOG_DEBUG, "Requesting service: %s", name);
     ssh->clientState = CLIENT_USERAUTH_REQUEST_DONE;
 
-    return WS_SUCCESS;
+    return ret;
 }
 
 
 static int DoServiceAccept(WOLFSSH* ssh,
                            byte* buf, word32 len, word32* idx)
 {
-    word32 begin = *idx;
-    word32 nameSz;
-    char     serviceName[WOLFSSH_MAX_NAMESZ];
-
-    ato32(buf + begin, &nameSz);
-    begin += LENGTH_SZ;
-
-    if (begin + nameSz > len || nameSz >= WOLFSSH_MAX_NAMESZ) {
-        return WS_BUFFER_E;
-    }
-
-    WMEMCPY(serviceName, buf + begin, nameSz);
-    begin += nameSz;
-    serviceName[nameSz] = 0;
+    char name[WOLFSSH_MAX_NAMESZ];
+    word32 nameSz = sizeof(name);
+    int ret;
 
-    *idx = begin;
+    ret = GetString(name, &nameSz, buf, len, idx);
 
-    WLOG(WS_LOG_DEBUG, "Accepted service: %s", serviceName);
+    WLOG(WS_LOG_DEBUG, "Accepted service: %s", name);
     ssh->serverState = SERVER_USERAUTH_REQUEST_DONE;
 
-    return WS_SUCCESS;
+    return ret;
 }