don't incorrectly truncate logged strings retrieved from PKCS#11

modules; based on GHPR406 by Jakub Jelen; ok markus

diff --git a/usr.bin/ssh/ssh-pkcs11.c b/usr.bin/ssh/ssh-pkcs11.c
index e9aada6..0576b1c 100644 (file)
--- a/usr.bin/ssh/ssh-pkcs11.c
+++ b/usr.bin/ssh/ssh-pkcs11.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-pkcs11.c,v 1.58 2023/07/19 14:02:27 djm Exp $ */
+/* $OpenBSD: ssh-pkcs11.c,v 1.59 2023/07/27 22:26:49 djm Exp $ */
 /*
  * Copyright (c) 2010 Markus Friedl.  All rights reserved.
  * Copyright (c) 2014 Pedro Martelletto. All rights reserved.
@@ -612,19 +612,22 @@ pkcs11_ecdsa_wrap(struct pkcs11_provider *provider, CK_ULONG slotidx,
 }
 
 /* remove trailing spaces */
-static void
+static char *
 rmspace(u_char *buf, size_t len)
 {
        size_t i;
 
-       if (!len)
-               return;
-       for (i = len - 1;  i > 0; i--)
-               if (i == len - 1 || buf[i] == ' ')
+       if (len == 0)
+               return buf;
+       for (i = len - 1; i > 0; i--)
+               if (buf[i] == ' ')
                        buf[i] = '\0';
                else
                        break;
+       return buf;
 }
+/* Used to printf fixed-width, space-padded, unterminated strings using %.*s */
+#define RMSPACE(s) (int)sizeof(s), rmspace(s, sizeof(s))
 
 /*
  * open a pkcs11 session and login if required.
@@ -1539,15 +1542,13 @@ pkcs11_register_provider(char *provider_id, char *pin,
                    provider_id, rv);
                goto fail;
        }
-       rmspace(p->info.manufacturerID, sizeof(p->info.manufacturerID));
-       rmspace(p->info.libraryDescription, sizeof(p->info.libraryDescription));
-       debug("provider %s: manufacturerID <%s> cryptokiVersion %d.%d"
-           " libraryDescription <%s> libraryVersion %d.%d",
+       debug("provider %s: manufacturerID <%.*s> cryptokiVersion %d.%d"
+           " libraryDescription <%.*s> libraryVersion %d.%d",
            provider_id,
-           p->info.manufacturerID,
+           RMSPACE(p->info.manufacturerID),
            p->info.cryptokiVersion.major,
            p->info.cryptokiVersion.minor,
-           p->info.libraryDescription,
+           RMSPACE(p->info.libraryDescription),
            p->info.libraryVersion.major,
            p->info.libraryVersion.minor);
        if ((rv = f->C_GetSlotList(CK_TRUE, NULL, &p->nslots)) != CKR_OK) {
@@ -1582,15 +1583,13 @@ pkcs11_register_provider(char *provider_id, char *pin,
                            "provider %s slot %lu", provider_id, (u_long)i);
                        continue;
                }
-               rmspace(token->label, sizeof(token->label));
-               rmspace(token->manufacturerID, sizeof(token->manufacturerID));
-               rmspace(token->model, sizeof(token->model));
-               rmspace(token->serialNumber, sizeof(token->serialNumber));
-               debug("provider %s slot %lu: label <%s> manufacturerID <%s> "
-                   "model <%s> serial <%s> flags 0x%lx",
+               debug("provider %s slot %lu: label <%.*s> "
+                   "manufacturerID <%.*s> model <%.*s> serial <%.*s> "
+                   "flags 0x%lx",
                    provider_id, (unsigned long)i,
-                   token->label, token->manufacturerID, token->model,
-                   token->serialNumber, token->flags);
+                   RMSPACE(token->label), RMSPACE(token->manufacturerID),
+                   RMSPACE(token->model), RMSPACE(token->serialNumber),
+                   token->flags);
                /*
                 * open session, login with pin and retrieve public
                 * keys (if keyp is provided)