Custom identification strings are unchecked until deep in the system: better error checking

Author: aidankeefe2022

src/internal.c

@@ -13195,6 +13195,26 @@ int DoProtoId(WOLFSSH* ssh)
     return ret;
 }
 
+/* ProtoIdStr is checked for validity and will be rejected unless
+ * it adhears to these criteria:
+ * MUST be between 3 and 255 bytes in length
+ * MUST end with '\r\n'
+ * MUST NOT contain '\r' or '\n' in the body */
+int ValidateProtoId(const char* protoIdStr, word32 len)
+{
+    /* Length is checked first: the terminator and body checks below index
+     * and subtract from len. Minimum is one body byte plus CRLF. */
+    if (protoIdStr == NULL || len < 3 || protoIdStr[len-1] != '\n' ||
+            protoIdStr[len-2] != '\r' || len > WOLFSSH_PROTOID_LIMIT ||
+            WSTRNSTR(protoIdStr, "\n", len - 2) != NULL ||
+            WSTRNSTR(protoIdStr, "\r", len - 2) != NULL) {
+        WLOG(WS_LOG_ERROR, "Proto Id was invalid: it must end in \\r\\n, "
+                "be no longer than %d bytes, and must not contain "
+                "\\r or \\n in the body of the line", WOLFSSH_PROTOID_LIMIT);
+        return WS_BAD_ARGUMENT;
+    }
+    return WS_SUCCESS;
+}
 
 int SendProtoId(WOLFSSH* ssh)
 {

src/ssh.c

@@ -3447,10 +3447,18 @@ int wolfSSH_GetMaxAuthAttempts(WOLFSSH* ssh)
 int wolfSSH_CTX_SetSshProtoIdStr(WOLFSSH_CTX* ctx,
                                           const char* protoIdStr)
 {
+    int ret;
+    WLOG(WS_LOG_DEBUG, "Entering wolfSSH_CTX_SetSshProtoIdStr()");
+
     if (!ctx || !protoIdStr) {
         return WS_BAD_ARGUMENT;
     }
 
+    if ((ret = ValidateProtoId(protoIdStr, (word32)WSTRLEN(protoIdStr))) !=
+            WS_SUCCESS) {
+        return ret;
+    }
+
     ctx->sshProtoIdStr = protoIdStr;
     return WS_SUCCESS;
 }

wolfssh/internal.h

@@ -1547,6 +1547,7 @@ WOLFSSH_LOCAL int DoProtoId(WOLFSSH* ssh);
 WOLFSSH_LOCAL int wolfSSH_SendPacket(WOLFSSH* ssh);
 WOLFSSH_LOCAL int wolfSSH_OutputPending(WOLFSSH* ssh);
 WOLFSSH_LOCAL int SendProtoId(WOLFSSH* ssh);
+WOLFSSH_LOCAL int ValidateProtoId(const char* protoIdStr, word32 len);
 WOLFSSH_LOCAL int SendKexInit(WOLFSSH* ssh);
 WOLFSSH_LOCAL int SendKexDhInit(WOLFSSH* ssh);
 WOLFSSH_LOCAL int SendKexDhReply(WOLFSSH* ssh);

wolfssh/ssh.h

@@ -588,6 +588,13 @@ WOLFSSH_API int wolfSSH_SetUsername(WOLFSSH* ssh, const char* username);
 WOLFSSH_API char* wolfSSH_GetUsername(WOLFSSH* ssh);
 
 WOLFSSH_API int wolfSSH_CTX_SetBanner(WOLFSSH_CTX* ctx, const char* newBanner);
+/* ProtoIdStr is checked for validity and will be rejected unless
+ * it adhears to these criteria:
+ * MUST be between 3 and 255 bytes in length
+ * MUST end with '\r\n'
+ * MUST NOT contain '\r' or '\n' in the body
+ * If these are not adheared to the function will return WS_BAD_ARGUMENT
+ * and not load the ProtoId in to the WOLFSSH_CTX struct */
 WOLFSSH_API int wolfSSH_CTX_SetSshProtoIdStr(WOLFSSH_CTX* ctx,
         const char* protoIdStr);
 /* Set the server-side limit on failed userauth attempts per connection. The