From 5faba9bcb050ac316fe8c3dbfa4ecd4fc29fe230 Mon Sep 17 00:00:00 2001
From: reshke <reshke@double.cloud>
Date: Thu, 26 Oct 2023 13:51:38 +0500
Subject: [PATCH] Fix auth query password caching segfault (#536)

---
 sources/auth_query.c | 15 ++++++++++----
 sources/scram.c      |  7 ++++---
 sources/scram.h      | 49 ++++++++++++++++++++++----------------------
 3 files changed, 40 insertions(+), 31 deletions(-)

diff --git a/sources/auth_query.c b/sources/auth_query.c
index c45756a99..0710f63f0 100644
--- a/sources/auth_query.c
+++ b/sources/auth_query.c
@@ -122,17 +122,21 @@ int od_auth_query(od_client_t *client, char *peer)
 
 	if (value->data == NULL) {
 		/* one-time initialize */
-		value->data = malloc(sizeof(od_auth_cache_value_t));
 		value->len = sizeof(od_auth_cache_value_t);
+		value->data = malloc(value->len);
+		/* OOM */
+		if (value->data == NULL) {
+			goto error;
+		}
+		memset(((od_auth_cache_value_t *)(value->data)), 0, value->len);
 	}
 
 	cache_value = (od_auth_cache_value_t *)value->data;
 
 	current_time = machine_time_us();
 
-	if (cache_value != NULL
-	    /* password cached for 10 sec */
-	    && current_time - cache_value->timestamp < 10 * interval_usec) {
+	if (/* password cached for 10 sec */
+	    current_time - cache_value->timestamp < 10 * interval_usec) {
 		od_debug(&instance->logger, "auth_query", NULL, NULL,
 			 "reusing cached password for user %.*s",
 			 user->name_len, user->name);
@@ -246,6 +250,9 @@ int od_auth_query(od_client_t *client, char *peer)
 	if (cache_value->passwd != NULL) {
 		/* drop previous value */
 		free(cache_value->passwd);
+
+		// there should be cache_value->passwd = NULL for sanity
+		// but this is meaninigless sinse we assing new value just below
 	}
 	cache_value->passwd_len = password->password_len;
 	cache_value->passwd = malloc(password->password_len);
diff --git a/sources/scram.c b/sources/scram.c
index b88417860..757ba22ff 100644
--- a/sources/scram.c
+++ b/sources/scram.c
@@ -844,11 +844,12 @@ od_retcode_t od_scram_verify_client_proof(od_scram_state_t *scram_state,
 	for (int i = 0; i < OD_SCRAM_MAX_KEY_LEN; i++)
 		client_key[i] = client_proof[i] ^ client_signature[i];
 
-	od_scram_H(client_key, OD_SCRAM_MAX_KEY_LEN, client_stored_key, &errstr);
+	od_scram_H(client_key, OD_SCRAM_MAX_KEY_LEN, client_stored_key,
+		   &errstr);
 	od_scram_HMAC_free(ctx);
 
-	if (memcmp(client_stored_key, scram_state->stored_key, OD_SCRAM_MAX_KEY_LEN) !=
-	    0)
+	if (memcmp(client_stored_key, scram_state->stored_key,
+		   OD_SCRAM_MAX_KEY_LEN) != 0)
 		return NOT_OK_RESPONSE;
 
 	return OK_RESPONSE;
diff --git a/sources/scram.h b/sources/scram.h
index 2096f5bc1..6bd3b00d0 100644
--- a/sources/scram.h
+++ b/sources/scram.h
@@ -63,55 +63,56 @@ typedef struct pg_hmac_ctx od_scram_ctx_t;
 
 #endif
 
-
 #if PG_VERSION_NUM >= 160000
 
-#define od_scram_ServerKey(salted_password, result, errstr) \
-	scram_ServerKey(salted_password, PG_SHA256, SCRAM_SHA_256_KEY_LEN, result, errstr)
+#define od_scram_ServerKey(salted_password, result, errstr)                \
+	scram_ServerKey(salted_password, PG_SHA256, SCRAM_SHA_256_KEY_LEN, \
+			result, errstr)
 
-#define od_scram_SaltedPassword(password, salt, saltlen, iterations, result, \
-				errstr)                                      \
-	scram_SaltedPassword(password, PG_SHA256, SCRAM_SHA_256_KEY_LEN, salt, saltlen, iterations, result,    \
-			     errstr)
+#define od_scram_SaltedPassword(password, salt, saltlen, iterations, result,   \
+				errstr)                                        \
+	scram_SaltedPassword(password, PG_SHA256, SCRAM_SHA_256_KEY_LEN, salt, \
+			     saltlen, iterations, result, errstr)
 
-#	define od_scram_H(input, len, result, errstr) \
+#define od_scram_H(input, len, result, errstr) \
 	scram_H(input, PG_SHA256, SCRAM_SHA_256_KEY_LEN, result, errstr)
 
-#	define od_scram_ClientKey(salted_password, result, errstr) \
-	scram_ClientKey(salted_password,  PG_SHA256, SCRAM_SHA_256_KEY_LEN, result, errstr)
+#define od_scram_ClientKey(salted_password, result, errstr)                \
+	scram_ClientKey(salted_password, PG_SHA256, SCRAM_SHA_256_KEY_LEN, \
+			result, errstr)
 
-#else 
+#else
 
-#	if PG_VERSION_NUM >= 150000
-#	define od_scram_ServerKey(salted_password, result, errstr) \
-		scram_ServerKey(salted_password, result, errstr)
+#if PG_VERSION_NUM >= 150000
+#define od_scram_ServerKey(salted_password, result, errstr) \
+	scram_ServerKey(salted_password, result, errstr)
 
-#	define od_scram_SaltedPassword(password, salt, saltlen, iterations, result, \
+#define od_scram_SaltedPassword(password, salt, saltlen, iterations, result, \
 				errstr)                                      \
 	scram_SaltedPassword(password, salt, saltlen, iterations, result,    \
 			     errstr)
 
-#	define od_scram_H(input, len, result, errstr) \
+#define od_scram_H(input, len, result, errstr) \
 	scram_H(input, len, result, errstr)
 
-#	define od_scram_ClientKey(salted_password, result, errstr) \
+#define od_scram_ClientKey(salted_password, result, errstr) \
 	scram_ClientKey(salted_password, result, errstr)
 
-#	else
+#else
 
-#	define od_scram_ServerKey(salted_password, result, errstr) \
-		scram_ServerKey(salted_password, result)
+#define od_scram_ServerKey(salted_password, result, errstr) \
+	scram_ServerKey(salted_password, result)
 
-#	define od_scram_SaltedPassword(password, salt, saltlen, iterations, result, \
+#define od_scram_SaltedPassword(password, salt, saltlen, iterations, result, \
 				errstr)                                      \
 	scram_SaltedPassword(password, salt, saltlen, iterations, result)
 
-#	define od_scram_H(input, len, result, errstr) scram_H(input, len, result)
+#define od_scram_H(input, len, result, errstr) scram_H(input, len, result)
 
-#	define od_scram_ClientKey(salted_password, result, errstr) \
+#define od_scram_ClientKey(salted_password, result, errstr) \
 	scram_ClientKey(salted_password, result)
 
-#	endif
+#endif
 #endif
 
 typedef struct od_scram_state od_scram_state_t;