[Bug 4006] New: sshbuf: optional -fbounds-safety annotations for private d/alloc

[bugzilla-daemon at mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=4006

            Bug ID: 4006
           Summary: sshbuf: optional -fbounds-safety annotations for
                    private d/alloc
           Product: Portable OpenSSH
           Version: 10.5p1
          Hardware: Other
                OS: Linux
            Status: NEW
          Severity: enhancement
          Priority: P5
         Component: Miscellaneous
          Assignee: unassigned-bugs at mindrot.org
          Reporter: jeff at incrediblybased.co

Created attachment 3987
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3987&action=edit
unified diff: optional sshbuf -fbounds-safety (default OFF)

Optional secure-by-design hardening for Portable OpenSSH's private
sshbuf
byte container (used on SSH protocol encode/decode paths).

Problem / motivation
--------------------
struct sshbuf already tracks capacity in `alloc` for the private buffer
pointer `d`, but the compiler cannot see that relationship.
Experimental
Clang -fbounds-safety can enforce spatial bounds when the companion is
annotated (__sized_by / similar).

What this patch does
--------------------
1. Adds sshbuf_bounds_safety.h with inert SSHBUF_SIZED_BY* macros
   (empty by default).
2. Annotates only the private field pair: d →
SSHBUF_SIZED_BY_OR_NULL(alloc)
   (d may be NULL on readonly buffers).
3. Keeps existing field order / layout.
4. Makes sshbuf_reset / sshbuf_set_max_size assign capacity before
pointer
   (matching existing allocate/new paths).
5. Adds configure --enable-fbounds-safety (default OFF) →
   -DSSHBUF_SUPPORT_FBOUNDS_SAFETY + -fbounds-safety.

Default builds are unchanged: macros expand to nothing; no new runtime
checks without the experimental flag. This is not a vulnerability
report
and includes no PoC / no CVE claim.

Testing
-------
- ./configure --disable-fbounds-safety && make (sshbuf objects) — PASS
  (macros inert).
- --enable-fbounds-safety needs a Clang toolchain with -fbounds-safety
/
  ptrcheck.h (not required for default builds).

Notes for reviewers
-------------------
- sshbuf.c is OpenBSD-synced; portable-only bit is configure.ac + the
new
  header. Happy to adjust style / sync approach as preferred.
- Prior art pattern: inert annotation macros behind an opt-in flag
  (similar to other C projects adopting optional -fbounds-safety).
- Patch also attempted via openssh-unix-dev but non-member posts are
  rejected; filing here per README / openssh.com/report.html guidance.

Author: Jeff Bindel <jeff at incrediblybased.co>
(also LaptopsPlural on GitHub)

-- 
You are receiving this mail because:
You are watching the assignee of the bug.