1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

while ( p < now )
{
    // Treat p as unsigned, so we have a happy compiler.
    const unsigned char* pU = (const unsigned char*)p;
    
    // Code contributed by Fletcher Dunn: (modified by lee)
    switch (*pU) {
    // ...
    case TIXML_UTF_LEAD_0:
        if ( encoding == TIXML_ENCODING_UTF8 )
        {
            if ( *(p+1) && *(p+2) )
            {
                // In these cases, don't advance the column. These are
                // 0-width spaces.
                if ( *(pU+1)==TIXML_UTF_LEAD_1 && *(pU+2)==TIXML_UTF_LEAD_2 )
                    p += 3; 
                else if ( *(pU+1)==0xbfU && *(pU+2)==0xbeU )
                    p += 3; 
                else if ( *(pU+1)==0xbfU && *(pU+2)==0xbfU )
                    p += 3; 
                else
                    { p +=3; ++col; }   // A normal character.
            }
        }
        else
        {
            ++p;
            ++col;
        }
        break;
        // ...
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14

bool TiXmlBase::StringEqual( const char* p,
                             const char* tag,
                             bool ignoreCase,
                             TiXmlEncoding encoding )
{
    assert( p );
    assert( tag );
    if ( !p || !*p )
    {
        assert( 0 );    // assert
        return false;
    }
    // ......
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

static int show_preauthpage(struct MHD_Connection *connection, const char *query)
{
    s_config *config = config_get_config();
    char *msg;
    const char *user_agent;
    char *enc_user_agent;
    char *preauthpath;
    char *cmd;
    char *enc_query;
    int rc;
    int ret;
    struct MHD_Response *response;
    preauthpath = safe_calloc(SMALL_BUF);
    safe_asprintf(&preauthpath, "/%s/", config->preauthdir);
    if (strcmp(preauthpath, config->fas_path) == 0) {
        free (preauthpath);
        user_agent = safe_calloc(USER_AGENT);
        enc_user_agent = safe_calloc(ENC_USER_AGENT);

        MHD_get_connection_values(connection, MHD_HEADER_KIND, get_user_agent_callback, &user_agent);

        uh_urlencode(enc_user_agent, ENC_USER_AGENT, user_agent, strlen(user_agent));  // strlen(NULL)
        // ......
    }
    // ......
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

size_t unescape(void * cls, struct MHD_Connection *c, char *src)
{
    char *unescapecmd;
    char *msg;

    debug(LOG_DEBUG, "Escaped string=%s\n", src);

    unescapecmd = safe_calloc(QUERYMAXLEN);
    msg = safe_calloc(QUERYMAXLEN);

    // 命令注入
    snprintf(unescapecmd, QUERYMAXLEN, "/usr/lib/opennds/unescape.sh -url \"%s\"", src);
    debug(LOG_DEBUG, "unescapecmd=%s\n", unescapecmd);

    if (execute_ret_url_encoded(msg, sizeof(msg) - 1, unescapecmd) == 0) {
        debug(LOG_DEBUG, "Unescaped string=%s\n", msg);
        strcpy(src, msg);
    }

    free(unescapecmd);
    free(msg);

    return strlen(src);
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

static int preauthenticated(struct MHD_Connection *connection, const char *url, t_client *client)
{
    s_config *config = config_get_config();
    const char *host = config->gw_address;
    const char *accept = NULL;
    const char *redirect_url;
    char *query;
    char *querystr;
    // ......

    // Check for preauthdir
    if (check_authdir_match(url, config->preauthdir)) {

        debug(LOG_DEBUG, "preauthdir url detected: %s", url);
        query = safe_calloc(QUERYMAXLEN);    // #define QUERYMAXLEN 8192

        if (!query) {
            ret = send_error(connection, 503);
            free(query);
            return ret;
        }

        get_query(connection, &query, QUERYSEPARATOR);  // Heap Buffer Overflow
        debug(LOG_DEBUG, "preauthenticated: show_preauthpage [%s]", query);
        ret = show_preauthpage(connection, query);
        free(query);
        return ret;
    }
    // ......
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

// save the query or empty string into **query.
static int get_query(struct MHD_Connection *connection, char **query, const char *separator)
{
    int element_counter;
    char **elements;
    char *query_str;
    struct collect_query collect_query;
    int i;
    int j;
    int length = 0;

    // ......
    // length 的长度依赖于 URL Query String 内容
    for (i = 0; i < element_counter; i++) {
        if (!elements[i])
            continue;
        length += strlen(elements[i]);

        if (i > 0) // q=foo&o=bar the '&' need also some space
            length++;
    }

    // ......
    for (i = 0, j = 0; i < element_counter; i++) {
        // ......
        strncpy(*query + j, elements[i], length - j);  // Heap Buffer Overflow
        // ......
    }
    // ......
}