Gotweb

Blob

Date:: Tue Nov 8 20:14:11 2022 UTC
Message:: zero-initialize all of struct got_inflate_buf in got_inflate_init() Fixes a potential bogus free on error. got_inflate_end() relies on zb.flags to be initialized. It will try to free a bogus zb.outbuf pointer if zb.flags happens to set by uninitialized stack memory while we are calling got_inflate_end() in an error path.
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2018 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 
19 #include <errno.h>
20 #include <stdio.h>
21 #include <stdlib.h>
22 #include <string.h>
23 #include <poll.h>
24 #include <unistd.h>
25 #include <zlib.h>
26 #include <time.h>
27 
28 #include "got_error.h"
29 #include "got_object.h"
30 #include "got_path.h"
31 
32 #include "got_lib_inflate.h"
33 #include "got_lib_poll.h"
34 
35 #ifndef MIN
36 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
37 #endif
38 
39 const struct got_error *
40 got_inflate_init(struct got_inflate_buf *zb, uint8_t *outbuf, size_t bufsize,
41     struct got_inflate_checksum *csum)
42 {
43 	const struct got_error *err = NULL;
44 	int zerr;
45 
46 	memset(zb, 0, sizeof(*zb));
47 
48 	zb->z.zalloc = Z_NULL;
49 	zb->z.zfree = Z_NULL;
50 	zerr = inflateInit(&zb->z);
51 	if (zerr != Z_OK) {
52 		if  (zerr == Z_ERRNO)
53 			return got_error_from_errno("inflateInit");
54 		if  (zerr == Z_MEM_ERROR) {
55 			errno = ENOMEM;
56 			return got_error_from_errno("inflateInit");
57 		}
58 		return got_error(GOT_ERR_DECOMPRESSION);
59 	}
60 
61 	zb->inlen = zb->outlen = bufsize;
62 
63 	zb->inbuf = calloc(1, zb->inlen);
64 	if (zb->inbuf == NULL) {
65 		err = got_error_from_errno("calloc");
66 		goto done;
67 	}
68 
69 	zb->flags = 0;
70 	if (outbuf == NULL) {
71 		zb->outbuf = calloc(1, zb->outlen);
72 		if (zb->outbuf == NULL) {
73 			err = got_error_from_errno("calloc");
74 			goto done;
75 		}
76 		zb->flags |= GOT_INFLATE_F_OWN_OUTBUF;
77 	} else
78 		zb->outbuf = outbuf;
79 
80 	zb->csum = csum;
81 done:
82 	if (err)
83 		got_inflate_end(zb);
84 	return err;
85 }
86 
87 static void
88 csum_input(struct got_inflate_checksum *csum, const uint8_t *buf, size_t len)
89 {
90 	if (csum->input_crc)
91 		*csum->input_crc = crc32(*csum->input_crc, buf, len);
92 
93 	if (csum->input_sha1)
94 		SHA1Update(csum->input_sha1, buf, len);
95 }
96 
97 static void
98 csum_output(struct got_inflate_checksum *csum, const uint8_t *buf, size_t len)
99 {
100 	if (csum->output_crc)
101 		*csum->output_crc = crc32(*csum->output_crc, buf, len);
102 
103 	if (csum->output_sha1)
104 		SHA1Update(csum->output_sha1, buf, len);
105 }
106 
107 const struct got_error *
108 got_inflate_read(struct got_inflate_buf *zb, FILE *f, size_t *outlenp,
109     size_t *consumed)
110 {
111 	size_t last_total_out = zb->z.total_out;
112 	size_t last_total_in = zb->z.total_in;
113 	z_stream *z = &zb->z;
114 	int ret = Z_ERRNO;
115 
116 	z->next_out = zb->outbuf;
117 	z->avail_out = zb->outlen;
118 
119 	*outlenp = 0;
120 	if (consumed)
121 		*consumed = 0;
122 	do {
123 		uint8_t *csum_in = NULL, *csum_out = NULL;
124 		size_t csum_avail_in = 0, csum_avail_out = 0;
125 
126 		if (z->avail_in == 0) {
127 			size_t n = fread(zb->inbuf, 1, zb->inlen, f);
128 			if (n == 0) {
129 				if (ferror(f))
130 					return got_ferror(f, GOT_ERR_IO);
131 				/* EOF */
132 				ret = Z_STREAM_END;
133 				break;
134 			}
135 			z->next_in = zb->inbuf;
136 			z->avail_in = n;
137 		}
138 		if (zb->csum) {
139 			csum_in = z->next_in;
140 			csum_avail_in = z->avail_in;
141 			csum_out = z->next_out;
142 			csum_avail_out = z->avail_out;
143 		}
144 		ret = inflate(z, Z_SYNC_FLUSH);
145 		if (zb->csum) {
146 			csum_input(zb->csum, csum_in,
147 			    csum_avail_in - z->avail_in);
148 			csum_output(zb->csum, csum_out,
149 			    csum_avail_out - z->avail_out);
150 		}
151 	} while (ret == Z_OK && z->avail_out > 0);
152 
153 	if (ret == Z_OK || ret == Z_BUF_ERROR) {
154 		zb->flags |= GOT_INFLATE_F_HAVE_MORE;
155 	} else {
156 		if (ret != Z_STREAM_END)
157 			return got_error(GOT_ERR_DECOMPRESSION);
158 		zb->flags &= ~GOT_INFLATE_F_HAVE_MORE;
159 	}
160 
161 	*outlenp = z->total_out - last_total_out;
162 	if (consumed)
163 		*consumed += z->total_in - last_total_in;
164 	return NULL;
165 }
166 
167 const struct got_error *
168 got_inflate_read_fd(struct got_inflate_buf *zb, int fd, size_t *outlenp,
169     size_t *consumed)
170 {
171 	const struct got_error *err = NULL;
172 	size_t last_total_out = zb->z.total_out;
173 	size_t last_total_in = zb->z.total_in;
174 	z_stream *z = &zb->z;
175 	int ret = Z_ERRNO;
176 
177 	z->next_out = zb->outbuf;
178 	z->avail_out = zb->outlen;
179 
180 	*outlenp = 0;
181 	if (consumed)
182 		*consumed = 0;
183 	do {
184 		uint8_t *csum_in = NULL, *csum_out = NULL;
185 		size_t csum_avail_in = 0, csum_avail_out = 0;
186 
187 		if (z->avail_in == 0) {
188 			ssize_t n;
189 			err = got_poll_fd(fd, POLLIN, INFTIM);
190 			if (err) {
191 				if (err->code == GOT_ERR_EOF) {
192 					ret = Z_STREAM_END;
193 					break;
194 				}
195 				return err;
196 			}
197 			n = read(fd, zb->inbuf, zb->inlen);
198 			if (n < 0)
199 				return got_error_from_errno("read");
200 			else if (n == 0) {
201 				/* EOF */
202 				ret = Z_STREAM_END;
203 				break;
204 			}
205 			z->next_in = zb->inbuf;
206 			z->avail_in = n;
207 		}
208 		if (zb->csum) {
209 			csum_in = z->next_in;
210 			csum_avail_in = z->avail_in;
211 			csum_out = z->next_out;
212 			csum_avail_out = z->avail_out;
213 		}
214 		ret = inflate(z, Z_SYNC_FLUSH);
215 		if (zb->csum) {
216 			csum_input(zb->csum, csum_in,
217 			    csum_avail_in - z->avail_in);
218 			csum_output(zb->csum, csum_out,
219 			    csum_avail_out - z->avail_out);
220 		}
221 	} while (ret == Z_OK && z->avail_out > 0);
222 
223 	if (ret == Z_OK || ret == Z_BUF_ERROR) {
224 		zb->flags |= GOT_INFLATE_F_HAVE_MORE;
225 	} else {
226 		if (ret != Z_STREAM_END)
227 			return got_error(GOT_ERR_DECOMPRESSION);
228 		zb->flags &= ~GOT_INFLATE_F_HAVE_MORE;
229 	}
230 
231 	*outlenp = z->total_out - last_total_out;
232 	if (consumed)
233 		*consumed += z->total_in - last_total_in;
234 	return NULL;
235 }
236 
237 const struct got_error *
238 got_inflate_read_mmap(struct got_inflate_buf *zb, uint8_t *map, size_t offset,
239     size_t len, size_t *outlenp, size_t *consumed)
240 {
241 	size_t last_total_out = zb->z.total_out;
242 	z_stream *z = &zb->z;
243 	int ret = Z_ERRNO;
244 
245 	z->next_out = zb->outbuf;
246 	z->avail_out = zb->outlen;
247 
248 	*outlenp = 0;
249 	*consumed = 0;
250 
251 	do {
252 		uint8_t *csum_in = NULL, *csum_out = NULL;
253 		size_t csum_avail_in = 0, csum_avail_out = 0;
254 		size_t last_total_in = zb->z.total_in;
255 
256 		if (z->avail_in == 0) {
257 			if (len == 0) {
258 				/* EOF */
259 				ret = Z_STREAM_END;
260 				break;
261 			}
262 			z->next_in = map + offset + *consumed;
263 			if (len - *consumed > UINT_MAX)
264 				z->avail_in = UINT_MAX;
265 			else
266 				z->avail_in = len - *consumed;
267 		}
268 		if (zb->csum) {
269 			csum_in = z->next_in;
270 			csum_avail_in = z->avail_in;
271 			csum_out = z->next_out;
272 			csum_avail_out = z->avail_out;
273 		}
274 		ret = inflate(z, Z_SYNC_FLUSH);
275 		if (zb->csum) {
276 			csum_input(zb->csum, csum_in,
277 			    csum_avail_in - z->avail_in);
278 			csum_output(zb->csum, csum_out,
279 			    csum_avail_out - z->avail_out);
280 		}
281 		*consumed += z->total_in - last_total_in;
282 	} while (ret == Z_OK && z->avail_out > 0);
283 
284 	if (ret == Z_OK || ret == Z_BUF_ERROR) {
285 		zb->flags |= GOT_INFLATE_F_HAVE_MORE;
286 	} else {
287 		if (ret != Z_STREAM_END)
288 			return got_error(GOT_ERR_DECOMPRESSION);
289 		zb->flags &= ~GOT_INFLATE_F_HAVE_MORE;
290 	}
291 
292 	*outlenp = z->total_out - last_total_out;
293 	return NULL;
294 }
295 
296 void
297 got_inflate_end(struct got_inflate_buf *zb)
298 {
299 	free(zb->inbuf);
300 	if (zb->flags & GOT_INFLATE_F_OWN_OUTBUF)
301 		free(zb->outbuf);
302 	inflateEnd(&zb->z);
303 }
304 
305 const struct got_error *
306 got_inflate_to_mem(uint8_t **outbuf, size_t *outlen,
307     size_t *consumed_total, struct got_inflate_checksum *csum, FILE *f)
308 {
309 	const struct got_error *err;
310 	size_t avail, consumed;
311 	struct got_inflate_buf zb;
312 	void *newbuf;
313 	int nbuf = 1;
314 
315 	if (outbuf) {
316 		*outbuf = malloc(GOT_INFLATE_BUFSIZE);
317 		if (*outbuf == NULL)
318 			return got_error_from_errno("malloc");
319 		err = got_inflate_init(&zb, *outbuf, GOT_INFLATE_BUFSIZE, csum);
320 	} else
321 		err = got_inflate_init(&zb, NULL, GOT_INFLATE_BUFSIZE, csum);
322 	if (err)
323 		return err;
324 
325 	*outlen = 0;
326 	if (consumed_total)
327 		*consumed_total = 0;
328 
329 	do {
330 		err = got_inflate_read(&zb, f, &avail, &consumed);
331 		if (err)
332 			goto done;
333 		*outlen += avail;
334 		if (consumed_total)
335 			*consumed_total += consumed;
336 		if (zb.flags & GOT_INFLATE_F_HAVE_MORE) {
337 			if (outbuf == NULL)
338 				continue;
339 			newbuf = reallocarray(*outbuf, ++nbuf,
340 			    GOT_INFLATE_BUFSIZE);
341 			if (newbuf == NULL) {
342 				err = got_error_from_errno("reallocarray");
343 				free(*outbuf);
344 				*outbuf = NULL;
345 				*outlen = 0;
346 				goto done;
347 			}
348 			*outbuf = newbuf;
349 			zb.outbuf = newbuf + *outlen;
350 			zb.outlen = (nbuf * GOT_INFLATE_BUFSIZE) - *outlen;
351 		}
352 	} while (zb.flags & GOT_INFLATE_F_HAVE_MORE);
353 
354 done:
355 	got_inflate_end(&zb);
356 	return err;
357 }
358 
359 const struct got_error *
360 got_inflate_to_mem_fd(uint8_t **outbuf, size_t *outlen,
361     size_t *consumed_total, struct got_inflate_checksum *csum,
362     size_t expected_size, int infd)
363 {
364 	const struct got_error *err;
365 	size_t avail, consumed;
366 	struct got_inflate_buf zb;
367 	void *newbuf;
368 	int nbuf = 1;
369 	size_t bufsize = GOT_INFLATE_BUFSIZE;
370 
371 	/* Optimize buffer size in case short reads should suffice. */
372 	if (expected_size > 0 && expected_size < bufsize)
373 		bufsize = expected_size;
374 
375 	if (outbuf) {
376 		*outbuf = malloc(bufsize);
377 		if (*outbuf == NULL)
378 			return got_error_from_errno("malloc");
379 		err = got_inflate_init(&zb, *outbuf, GOT_INFLATE_BUFSIZE, csum);
380 	} else
381 		err = got_inflate_init(&zb, NULL, bufsize, csum);
382 	if (err)
383 		goto done;
384 
385 	*outlen = 0;
386 	if (consumed_total)
387 		*consumed_total = 0;
388 
389 	do {
390 		err = got_inflate_read_fd(&zb, infd, &avail, &consumed);
391 		if (err)
392 			goto done;
393 		*outlen += avail;
394 		if (consumed_total)
395 			*consumed_total += consumed;
396 		if (zb.flags & GOT_INFLATE_F_HAVE_MORE) {
397 			if (outbuf == NULL)
398 				continue;
399 			newbuf = reallocarray(*outbuf, ++nbuf,
400 			    GOT_INFLATE_BUFSIZE);
401 			if (newbuf == NULL) {
402 				err = got_error_from_errno("reallocarray");
403 				free(*outbuf);
404 				*outbuf = NULL;
405 				*outlen = 0;
406 				goto done;
407 			}
408 			*outbuf = newbuf;
409 			zb.outbuf = newbuf + *outlen;
410 			zb.outlen = (nbuf * GOT_INFLATE_BUFSIZE) - *outlen;
411 		}
412 	} while (zb.flags & GOT_INFLATE_F_HAVE_MORE);
413 
414 done:
415 	got_inflate_end(&zb);
416 	return err;
417 }
418 
419 const struct got_error *
420 got_inflate_to_mem_mmap(uint8_t **outbuf, size_t *outlen,
421     size_t *consumed_total, struct got_inflate_checksum *csum, uint8_t *map,
422     size_t offset, size_t len)
423 {
424 	const struct got_error *err;
425 	size_t avail, consumed;
426 	struct got_inflate_buf zb;
427 	void *newbuf;
428 	int nbuf = 1;
429 
430 	if (outbuf) {
431 		*outbuf = malloc(GOT_INFLATE_BUFSIZE);
432 		if (*outbuf == NULL)
433 			return got_error_from_errno("malloc");
434 		err = got_inflate_init(&zb, *outbuf, GOT_INFLATE_BUFSIZE, csum);
435 		if (err) {
436 			free(*outbuf);
437 			*outbuf = NULL;
438 			return err;
439 		}
440 	} else {
441 		err = got_inflate_init(&zb, NULL, GOT_INFLATE_BUFSIZE, csum);
442 		if (err)
443 			return err;
444 	}
445 
446 	*outlen = 0;
447 	if (consumed_total)
448 		*consumed_total = 0;
449 	do {
450 		err = got_inflate_read_mmap(&zb, map, offset, len, &avail,
451 		    &consumed);
452 		if (err)
453 			goto done;
454 		offset += consumed;
455 		if (consumed_total)
456 			*consumed_total += consumed;
457 		len -= consumed;
458 		*outlen += avail;
459 		if (len == 0)
460 			break;
461 		if (zb.flags & GOT_INFLATE_F_HAVE_MORE) {
462 			if (outbuf == NULL)
463 				continue;
464 			newbuf = reallocarray(*outbuf, ++nbuf,
465 			    GOT_INFLATE_BUFSIZE);
466 			if (newbuf == NULL) {
467 				err = got_error_from_errno("reallocarray");
468 				free(*outbuf);
469 				*outbuf = NULL;
470 				*outlen = 0;
471 				goto done;
472 			}
473 			*outbuf = newbuf;
474 			zb.outbuf = newbuf + *outlen;
475 			zb.outlen = (nbuf * GOT_INFLATE_BUFSIZE) - *outlen;
476 		}
477 	} while (zb.flags & GOT_INFLATE_F_HAVE_MORE);
478 done:
479 	got_inflate_end(&zb);
480 	return err;
481 }
482 
483 const struct got_error *
484 got_inflate_to_fd(size_t *outlen, FILE *infile,
485     struct got_inflate_checksum *csum, int outfd)
486 {
487 	const struct got_error *err = NULL;
488 	size_t avail;
489 	struct got_inflate_buf zb;
490 
491 	err = got_inflate_init(&zb, NULL, GOT_INFLATE_BUFSIZE, csum);
492 	if (err)
493 		goto done;
494 
495 	*outlen = 0;
496 
497 	do {
498 		err = got_inflate_read(&zb, infile, &avail, NULL);
499 		if (err)
500 			goto done;
501 		if (avail > 0) {
502 			ssize_t n;
503 			n = write(outfd, zb.outbuf, avail);
504 			if (n != avail) {
505 				err = got_error_from_errno("write");
506 				goto done;
507 			}
508 			*outlen += avail;
509 		}
510 	} while (zb.flags & GOT_INFLATE_F_HAVE_MORE);
511 
512 done:
513 	if (err == NULL) {
514 		if (lseek(outfd, SEEK_SET, 0) == -1)
515 			err = got_error_from_errno("lseek");
516 	}
517 	got_inflate_end(&zb);
518 	return err;
519 }
520 
521 const struct got_error *
522 got_inflate_to_file(size_t *outlen, FILE *infile,
523     struct got_inflate_checksum *csum, FILE *outfile)
524 {
525 	const struct got_error *err;
526 	size_t avail;
527 	struct got_inflate_buf zb;
528 
529 	err = got_inflate_init(&zb, NULL, GOT_INFLATE_BUFSIZE, csum);
530 	if (err)
531 		goto done;
532 
533 	*outlen = 0;
534 
535 	do {
536 		err = got_inflate_read(&zb, infile, &avail, NULL);
537 		if (err)
538 			goto done;
539 		if (avail > 0) {
540 			size_t n;
541 			n = fwrite(zb.outbuf, avail, 1, outfile);
542 			if (n != 1) {
543 				err = got_ferror(outfile, GOT_ERR_IO);
544 				goto done;
545 			}
546 			*outlen += avail;
547 		}
548 	} while (zb.flags & GOT_INFLATE_F_HAVE_MORE);
549 
550 done:
551 	if (err == NULL)
552 		rewind(outfile);
553 	got_inflate_end(&zb);
554 	return err;
555 }
556 
557 const struct got_error *
558 got_inflate_to_file_fd(size_t *outlen, size_t *consumed_total,
559     struct got_inflate_checksum *csum, int infd, FILE *outfile)
560 {
561 	const struct got_error *err;
562 	size_t avail, consumed;
563 	struct got_inflate_buf zb;
564 
565 	err = got_inflate_init(&zb, NULL, GOT_INFLATE_BUFSIZE, csum);
566 	if (err)
567 		goto done;
568 
569 	*outlen = 0;
570 	if (consumed_total)
571 		*consumed_total = 0;
572 	do {
573 		err = got_inflate_read_fd(&zb, infd, &avail, &consumed);
574 		if (err)
575 			goto done;
576 		if (avail > 0) {
577 			size_t n;
578 			n = fwrite(zb.outbuf, avail, 1, outfile);
579 			if (n != 1) {
580 				err = got_ferror(outfile, GOT_ERR_IO);
581 				goto done;
582 			}
583 			*outlen += avail;
584 			if (consumed_total)
585 				*consumed_total += consumed;
586 		}
587 	} while (zb.flags & GOT_INFLATE_F_HAVE_MORE);
588 
589 done:
590 	if (err == NULL)
591 		rewind(outfile);
592 	got_inflate_end(&zb);
593 	return err;
594 }
595 
596 const struct got_error *
597 got_inflate_to_file_mmap(size_t *outlen, size_t *consumed_total,
598     struct got_inflate_checksum *csum, uint8_t *map, size_t offset,
599     size_t len, FILE *outfile)
600 {
601 	const struct got_error *err;
602 	size_t avail, consumed;
603 	struct got_inflate_buf zb;
604 
605 	err = got_inflate_init(&zb, NULL, GOT_INFLATE_BUFSIZE, csum);
606 	if (err)
607 		goto done;
608 
609 	*outlen = 0;
610 	if (consumed_total)
611 		*consumed_total = 0;
612 	do {
613 		err = got_inflate_read_mmap(&zb, map, offset, len, &avail,
614 		    &consumed);
615 		if (err)
616 			goto done;
617 		offset += consumed;
618 		if (consumed_total)
619 			*consumed_total += consumed;
620 		len -= consumed;
621 		if (avail > 0) {
622 			size_t n;
623 			n = fwrite(zb.outbuf, avail, 1, outfile);
624 			if (n != 1) {
625 				err = got_ferror(outfile, GOT_ERR_IO);
626 				goto done;
627 			}
628 			*outlen += avail;
629 		}
630 	} while (zb.flags & GOT_INFLATE_F_HAVE_MORE);
631 
632 done:
633 	if (err == NULL)
634 		rewind(outfile);
635 	got_inflate_end(&zb);
636 	return err;
637 }