Problem: application metadata not parsed correctly when using CURVE

Solution: create buffers large enough to contain arbitrary metadata

Author: bluca

src/curve_server.cpp

@@ -327,8 +327,12 @@ int zmq::curve_server_t::process_initiate (msg_t *msg_)
     const size_t clen = (size - 113) + crypto_box_BOXZEROBYTES;
 
     uint8_t initiate_nonce[crypto_box_NONCEBYTES];
-    uint8_t initiate_plaintext[crypto_box_ZEROBYTES + 128 + 256];
-    uint8_t initiate_box[crypto_box_BOXZEROBYTES + 144 + 256];
+    uint8_t *initiate_plaintext =
+      static_cast<uint8_t *> (malloc (crypto_box_ZEROBYTES + clen));
+    alloc_assert (initiate_plaintext);
+    uint8_t *initiate_box =
+      static_cast<uint8_t *> (malloc (crypto_box_BOXZEROBYTES + clen));
+    alloc_assert (initiate_box);
 
     //  Open Box [C + vouch + metadata](C'->S')
     memset (initiate_box, 0, crypto_box_BOXZEROBYTES);
@@ -339,18 +343,19 @@ int zmq::curve_server_t::process_initiate (msg_t *msg_)
     memcpy (initiate_nonce + 16, initiate + 105, 8);
     cn_peer_nonce = get_uint64 (initiate + 105);
 
+    const uint8_t *client_key = initiate_plaintext + crypto_box_ZEROBYTES;
+
     rc = crypto_box_open (initiate_plaintext, initiate_box, clen,
                           initiate_nonce, _cn_client, _cn_secret);
     if (rc != 0) {
         // CURVE I: cannot open client INITIATE
         session->get_socket ()->event_handshake_failed_protocol (
           session->get_endpoint (), ZMQ_PROTOCOL_ERROR_ZMTP_CRYPTOGRAPHIC);
         errno = EPROTO;
-        return -1;
+        rc = -1;
+        goto exit;
     }
 
-    const uint8_t *client_key = initiate_plaintext + crypto_box_ZEROBYTES;
-
     uint8_t vouch_nonce[crypto_box_NONCEBYTES];
     uint8_t vouch_plaintext[crypto_box_ZEROBYTES + 64];
     uint8_t vouch_box[crypto_box_BOXZEROBYTES + 80];
@@ -371,7 +376,8 @@ int zmq::curve_server_t::process_initiate (msg_t *msg_)
         session->get_socket ()->event_handshake_failed_protocol (
           session->get_endpoint (), ZMQ_PROTOCOL_ERROR_ZMTP_CRYPTOGRAPHIC);
         errno = EPROTO;
-        return -1;
+        rc = -1;
+        goto exit;
     }
 
     //  What we decrypted must be the client's short-term public key
@@ -383,7 +389,8 @@ int zmq::curve_server_t::process_initiate (msg_t *msg_)
         session->get_socket ()->event_handshake_failed_protocol (
           session->get_endpoint (), ZMQ_PROTOCOL_ERROR_ZMTP_KEY_EXCHANGE);
         errno = EPROTO;
-        return -1;
+        rc = -1;
+        goto exit;
     }
 
     //  Precompute connection secret from client key
@@ -405,23 +412,29 @@ int zmq::curve_server_t::process_initiate (msg_t *msg_)
             //  is attempted)
             rc = receive_and_process_zap_reply ();
             if (rc == -1)
-                return -1;
+                goto exit;
         } else if (!options.zap_enforce_domain) {
             //  This supports the Stonehouse pattern (encryption without
             //  authentication) in legacy mode (domain set but no handler).
             state = sending_ready;
         } else {
             session->get_socket ()->event_handshake_failed_no_detail (
               session->get_endpoint (), EFAULT);
-            return -1;
+            rc = -1;
+            goto exit;
         }
     } else {
         //  This supports the Stonehouse pattern (encryption without authentication).
         state = sending_ready;
     }
 
-    return parse_metadata (initiate_plaintext + crypto_box_ZEROBYTES + 128,
-                           clen - crypto_box_ZEROBYTES - 128);
+    rc = parse_metadata (initiate_plaintext + crypto_box_ZEROBYTES + 128,
+                         clen - crypto_box_ZEROBYTES - 128);
+
+exit:
+    free (initiate_plaintext);
+    free (initiate_box);
+    return rc;
 }
 
 int zmq::curve_server_t::produce_ready (msg_t *msg_)