Game of Trees Repos

Blob

Date:: Tue Nov 8 20:14:11 2022 UTC
Message:: zero-initialize all of struct got_deflate_buf in got_deflate_init() Fixes a potential bogus free on error. got_deflate_end() relies on zb.flags to be initialized. It will try to free a bogus zb.outbuf pointer if zb.flags happens to set by uninitialized stack memory while we are calling got_deflate_end() in an error path.
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2019 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 
19 #include <errno.h>
20 #include <stdio.h>
21 #include <stdlib.h>
22 #include <string.h>
23 #include <zlib.h>
24 #include <time.h>
25 
26 #include "got_error.h"
27 #include "got_object.h"
28 #include "got_path.h"
29 
30 #include "got_lib_deflate.h"
31 #include "got_lib_poll.h"
32 
33 #ifndef MIN
34 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
35 #endif
36 
37 const struct got_error *
38 got_deflate_init(struct got_deflate_buf *zb, uint8_t *outbuf, size_t bufsize)
39 {
40 	const struct got_error *err = NULL;
41 	int zerr;
42 
43 	memset(zb, 0, sizeof(*zb));
44 
45 	zb->z.zalloc = Z_NULL;
46 	zb->z.zfree = Z_NULL;
47 	zerr = deflateInit(&zb->z, Z_DEFAULT_COMPRESSION);
48 	if (zerr != Z_OK) {
49 		if  (zerr == Z_ERRNO)
50 			return got_error_from_errno("deflateInit");
51 		if  (zerr == Z_MEM_ERROR) {
52 			errno = ENOMEM;
53 			return got_error_from_errno("deflateInit");
54 		}
55 		return got_error(GOT_ERR_COMPRESSION);
56 	}
57 
58 	zb->inlen = zb->outlen = bufsize;
59 
60 	zb->inbuf = calloc(1, zb->inlen);
61 	if (zb->inbuf == NULL) {
62 		err = got_error_from_errno("calloc");
63 		goto done;
64 	}
65 
66 	zb->flags = 0;
67 	if (outbuf == NULL) {
68 		zb->outbuf = calloc(1, zb->outlen);
69 		if (zb->outbuf == NULL) {
70 			err = got_error_from_errno("calloc");
71 			goto done;
72 		}
73 		zb->flags |= GOT_DEFLATE_F_OWN_OUTBUF;
74 	} else
75 		zb->outbuf = outbuf;
76 done:
77 	if (err)
78 		got_deflate_end(zb);
79 	return err;
80 }
81 
82 static void
83 csum_output(struct got_deflate_checksum *csum, const uint8_t *buf, size_t len)
84 {
85 	if (csum->output_crc)
86 		*csum->output_crc = crc32(*csum->output_crc, buf, len);
87 
88 	if (csum->output_sha1)
89 		SHA1Update(csum->output_sha1, buf, len);
90 }
91 
92 const struct got_error *
93 got_deflate_read(struct got_deflate_buf *zb, FILE *f, off_t len,
94     size_t *outlenp, off_t *consumed)
95 {
96 	size_t last_total_out = zb->z.total_out;
97 	z_stream *z = &zb->z;
98 	int ret = Z_ERRNO;
99 
100 	z->next_out = zb->outbuf;
101 	z->avail_out = zb->outlen;
102 
103 	*outlenp = 0;
104 	*consumed = 0;
105 	do {
106 		size_t last_total_in = z->total_in;
107 		if (z->avail_in == 0) {
108 			size_t n = 0;
109 			if (*consumed < len) {
110 				n = fread(zb->inbuf, 1,
111 				    MIN(zb->inlen, len - *consumed), f);
112 			}
113 			if (n == 0) {
114 				if (ferror(f))
115 					return got_ferror(f, GOT_ERR_IO);
116 				/* EOF */
117 				ret = deflate(z, Z_FINISH);
118 				break;
119 			}
120 			z->next_in = zb->inbuf;
121 			z->avail_in = n;
122 		}
123 		ret = deflate(z, Z_NO_FLUSH);
124 		*consumed += z->total_in - last_total_in;
125 	} while (ret == Z_OK && z->avail_out > 0);
126 
127 	if (ret == Z_OK) {
128 		zb->flags |= GOT_DEFLATE_F_HAVE_MORE;
129 	} else {
130 		if (ret != Z_STREAM_END)
131 			return got_error(GOT_ERR_COMPRESSION);
132 		zb->flags &= ~GOT_DEFLATE_F_HAVE_MORE;
133 	}
134 
135 	*outlenp = z->total_out - last_total_out;
136 	return NULL;
137 }
138 
139 static const struct got_error *
140 deflate_read_mmap(struct got_deflate_buf *zb, uint8_t *map, size_t offset,
141     size_t len, size_t *outlenp, size_t *consumed, int flush_on_eof)
142 {
143 	z_stream *z = &zb->z;
144 	size_t last_total_out = z->total_out;
145 	int ret = Z_ERRNO;
146 
147 	z->next_out = zb->outbuf;
148 	z->avail_out = zb->outlen;
149 
150 	*outlenp = 0;
151 	*consumed = 0;
152 	do {
153 		size_t last_total_in = z->total_in;
154 		if (z->avail_in == 0) {
155 			z->next_in = map + offset + *consumed;
156 			if (len - *consumed > UINT_MAX)
157 				z->avail_in = UINT_MAX;
158 			else
159 				z->avail_in = len - *consumed;
160 			if (z->avail_in == 0) {
161 				/* EOF */
162 				if (flush_on_eof)
163 					ret = deflate(z, Z_FINISH);
164 				break;
165 			}
166 		}
167 		ret = deflate(z, Z_NO_FLUSH);
168 		*consumed += z->total_in - last_total_in;
169 	} while (ret == Z_OK && z->avail_out > 0);
170 
171 	if (ret == Z_OK) {
172 		zb->flags |= GOT_DEFLATE_F_HAVE_MORE;
173 	} else {
174 		if (ret != Z_STREAM_END)
175 			return got_error(GOT_ERR_COMPRESSION);
176 		zb->flags &= ~GOT_DEFLATE_F_HAVE_MORE;
177 	}
178 
179 	*outlenp = z->total_out - last_total_out;
180 	return NULL;
181 }
182 
183 const struct got_error *
184 got_deflate_read_mmap(struct got_deflate_buf *zb, uint8_t *map, size_t offset,
185     size_t len, size_t *outlenp, size_t *consumed)
186 {
187 	return deflate_read_mmap(zb, map, offset, len, outlenp, consumed, 1);
188 }
189 
190 const struct got_error *
191 got_deflate_flush(struct got_deflate_buf *zb, FILE *outfile,
192     struct got_deflate_checksum *csum, off_t *outlenp)
193 {
194 	int ret;
195 	size_t n;
196 	z_stream *z = &zb->z;
197 
198 	if (z->avail_in != 0)
199 		return got_error_msg(GOT_ERR_COMPRESSION,
200 		    "cannot flush zb with pending input data");
201 
202 	do {
203 		size_t avail, last_total_out = zb->z.total_out;
204 
205 		z->next_out = zb->outbuf;
206 		z->avail_out = zb->outlen;
207 
208 		ret = deflate(z, Z_FINISH);
209 		if (ret != Z_STREAM_END && ret != Z_OK)
210 			return got_error(GOT_ERR_COMPRESSION);
211 
212 		avail = z->total_out - last_total_out;
213 		if (avail > 0) {
214 			n = fwrite(zb->outbuf, avail, 1, outfile);
215 			if (n != 1)
216 				return got_ferror(outfile, GOT_ERR_IO);
217 			if (csum)
218 				csum_output(csum, zb->outbuf, avail);
219 			if (outlenp)
220 				*outlenp += avail;
221 		}
222 	} while (ret != Z_STREAM_END);
223 
224 	zb->flags &= ~GOT_DEFLATE_F_HAVE_MORE;
225 	return NULL;
226 }
227 
228 void
229 got_deflate_end(struct got_deflate_buf *zb)
230 {
231 	free(zb->inbuf);
232 	if (zb->flags & GOT_DEFLATE_F_OWN_OUTBUF)
233 		free(zb->outbuf);
234 	deflateEnd(&zb->z);
235 }
236 
237 const struct got_error *
238 got_deflate_to_fd(off_t *outlen, FILE *infile, off_t len, int outfd,
239     struct got_deflate_checksum *csum)
240 {
241 	const struct got_error *err;
242 	size_t avail;
243 	off_t consumed;
244 	struct got_deflate_buf zb;
245 
246 	err = got_deflate_init(&zb, NULL, GOT_DEFLATE_BUFSIZE);
247 	if (err)
248 		goto done;
249 
250 	*outlen = 0;
251 
252 	do {
253 		err = got_deflate_read(&zb, infile, len, &avail, &consumed);
254 		if (err)
255 			goto done;
256 		len -= consumed;
257 		if (avail > 0) {
258 			err = got_poll_write_full(outfd, zb.outbuf, avail);
259 			if (err)
260 				goto done;
261 			if (csum)
262 				csum_output(csum, zb.outbuf, avail);
263 			*outlen += avail;
264 		}
265 	} while (zb.flags & GOT_DEFLATE_F_HAVE_MORE);
266 
267 done:
268 	got_deflate_end(&zb);
269 	return err;
270 }
271 
272 const struct got_error *
273 got_deflate_to_fd_mmap(off_t *outlen, uint8_t *map, size_t offset,
274     size_t len, int outfd, struct got_deflate_checksum *csum)
275 {
276 	const struct got_error *err;
277 	size_t avail, consumed;
278 	struct got_deflate_buf zb;
279 
280 	err = got_deflate_init(&zb, NULL, GOT_DEFLATE_BUFSIZE);
281 	if (err)
282 		goto done;
283 
284 	*outlen = 0;
285 	do {
286 		err = got_deflate_read_mmap(&zb, map, offset, len, &avail,
287 		    &consumed);
288 		if (err)
289 			goto done;
290 		offset += consumed;
291 		len -= consumed;
292 		if (avail > 0) {
293 			err = got_poll_write_full(outfd, zb.outbuf, avail);
294 			if (err)
295 				goto done;
296 			if (csum)
297 				csum_output(csum, zb.outbuf, avail);
298 			*outlen += avail;
299 		}
300 	} while (zb.flags & GOT_DEFLATE_F_HAVE_MORE);
301 
302 done:
303 	got_deflate_end(&zb);
304 	return err;
305 }
306 
307 const struct got_error *
308 got_deflate_to_file(off_t *outlen, FILE *infile, off_t len,
309     FILE *outfile, struct got_deflate_checksum *csum)
310 {
311 	const struct got_error *err;
312 	size_t avail;
313 	off_t consumed;
314 	struct got_deflate_buf zb;
315 
316 	err = got_deflate_init(&zb, NULL, GOT_DEFLATE_BUFSIZE);
317 	if (err)
318 		goto done;
319 
320 	*outlen = 0;
321 
322 	do {
323 		err = got_deflate_read(&zb, infile, len, &avail, &consumed);
324 		if (err)
325 			goto done;
326 		len -= consumed;
327 		if (avail > 0) {
328 			size_t n;
329 			n = fwrite(zb.outbuf, avail, 1, outfile);
330 			if (n != 1) {
331 				err = got_ferror(outfile, GOT_ERR_IO);
332 				goto done;
333 			}
334 			if (csum)
335 				csum_output(csum, zb.outbuf, avail);
336 			*outlen += avail;
337 		}
338 	} while (zb.flags & GOT_DEFLATE_F_HAVE_MORE);
339 
340 done:
341 	got_deflate_end(&zb);
342 	return err;
343 }
344 
345 const struct got_error *
346 got_deflate_to_file_mmap(off_t *outlen, uint8_t *map, size_t offset,
347     size_t len, FILE *outfile, struct got_deflate_checksum *csum)
348 {
349 	const struct got_error *err;
350 	size_t avail, consumed;
351 	struct got_deflate_buf zb;
352 
353 	err = got_deflate_init(&zb, NULL, GOT_DEFLATE_BUFSIZE);
354 	if (err)
355 		goto done;
356 
357 	*outlen = 0;
358 	do {
359 		err = got_deflate_read_mmap(&zb, map, offset, len, &avail,
360 		    &consumed);
361 		if (err)
362 			goto done;
363 		offset += consumed;
364 		len -= consumed;
365 		if (avail > 0) {
366 			size_t n;
367 			n = fwrite(zb.outbuf, avail, 1, outfile);
368 			if (n != 1) {
369 				err = got_ferror(outfile, GOT_ERR_IO);
370 				goto done;
371 			}
372 			if (csum)
373 				csum_output(csum, zb.outbuf, avail);
374 			*outlen += avail;
375 		}
376 	} while (zb.flags & GOT_DEFLATE_F_HAVE_MORE);
377 
378 done:
379 	got_deflate_end(&zb);
380 	return err;
381 }
382 
383 const struct got_error *
384 got_deflate_append_to_file_mmap(struct got_deflate_buf *zb, off_t *outlen,
385     uint8_t *map, size_t offset, size_t len, FILE *outfile,
386     struct got_deflate_checksum *csum)
387 {
388 	const struct got_error *err;
389 	size_t avail, consumed;
390 
391 	do {
392 		err = deflate_read_mmap(zb, map, offset, len, &avail,
393 		    &consumed, 0);
394 		if (err)
395 			break;
396 		offset += consumed;
397 		len -= consumed;
398 		if (avail > 0) {
399 			size_t n;
400 			n = fwrite(zb->outbuf, avail, 1, outfile);
401 			if (n != 1) {
402 				err = got_ferror(outfile, GOT_ERR_IO);
403 				break;
404 			}
405 			if (csum)
406 				csum_output(csum, zb->outbuf, avail);
407 			if (outlen)
408 				*outlen += avail;
409 		}
410 	} while ((zb->flags & GOT_DEFLATE_F_HAVE_MORE) && len > 0);
411 
412 	return err;
413 }
414 
415 const struct got_error *
416 got_deflate_to_mem_mmap(uint8_t **outbuf, size_t *outlen,
417     size_t *consumed_total, struct got_deflate_checksum *csum, uint8_t *map,
418     size_t offset, size_t len)
419 {
420 	const struct got_error *err;
421 	size_t avail, consumed;
422 	struct got_deflate_buf zb;
423 	void *newbuf;
424 	size_t nbuf = 1;
425 
426 	if (outbuf) {
427 		*outbuf = malloc(GOT_DEFLATE_BUFSIZE);
428 		if (*outbuf == NULL)
429 			return got_error_from_errno("malloc");
430 		err = got_deflate_init(&zb, *outbuf, GOT_DEFLATE_BUFSIZE);
431 		if (err) {
432 			free(*outbuf);
433 			*outbuf = NULL;
434 			return err;
435 		}
436 	} else {
437 		err = got_deflate_init(&zb, NULL, GOT_DEFLATE_BUFSIZE);
438 		if (err)
439 			return err;
440 	}
441 
442 	*outlen = 0;
443 	if (consumed_total)
444 		*consumed_total = 0;
445 	do {
446 		err = got_deflate_read_mmap(&zb, map, offset, len, &avail,
447 		    &consumed);
448 		if (err)
449 			goto done;
450 		offset += consumed;
451 		if (consumed_total)
452 			*consumed_total += consumed;
453 		len -= consumed;
454 		if (avail > 0 && csum)
455 			csum_output(csum, zb.outbuf, avail);
456 		*outlen += avail;
457 		if ((zb.flags & GOT_DEFLATE_F_HAVE_MORE) && outbuf != NULL) {
458 			newbuf = reallocarray(*outbuf, ++nbuf,
459 			    GOT_DEFLATE_BUFSIZE);
460 			if (newbuf == NULL) {
461 				err = got_error_from_errno("reallocarray");
462 				free(*outbuf);
463 				*outbuf = NULL;
464 				*outlen = 0;
465 				goto done;
466 			}
467 			*outbuf = newbuf;
468 			zb.outbuf = newbuf + *outlen;
469 			zb.outlen = (nbuf * GOT_DEFLATE_BUFSIZE) - *outlen;
470 		}
471 	} while (zb.flags & GOT_DEFLATE_F_HAVE_MORE);
472 done:
473 	got_deflate_end(&zb);
474 	return err;
475 }