Bug Summary

File:asn1/asn1c/per_support.c
Warning:line 83, column 19
Array access (from variable 'buf') results in a null pointer dereference

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name per_support.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -mthread-model posix -mframe-pointer=all -fmath-errno -fno-rounding-math -masm-verbose -mconstructor-aliases -munwind-tables -target-cpu x86-64 -dwarf-column-info -fno-split-dwarf-inlining -debugger-tuning=gdb -resource-dir /usr/lib64/clang/10.0.0 -D HAVE_CONFIG_H -I . -I ../.. -I ../../util -I /usr/include/nspr4 -I /usr/include/nss3 -I /usr/include/nspr4 -D __STDC_WANT_LIB_EXT1__=1 -D _DEFAULT_SOURCE=1 -D _POSIX_C_SOURCE=200809L -D PIC -internal-isystem /usr/local/include -internal-isystem /usr/lib64/clang/10.0.0/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -fdebug-compilation-dir /home/heimes/redhat/freeipa/asn1/asn1c -ferror-limit 19 -fmessage-length 0 -fgnuc-version=4.2.1 -fobjc-runtime=gcc -fdiagnostics-show-option -analyzer-output=html -faddrsig -o /home/heimes/redhat/freeipa/report/2020-06-05-101548-295465-1 -x c per_support.c
1/*
2 * Copyright (c) 2005-2014 Lev Walkin <vlm@lionet.info>.
3 * All rights reserved.
4 * Redistribution and modifications are permitted subject to BSD license.
5 */
6#include <asn_system.h>
7#include <asn_internal.h>
8#include <per_support.h>
9
10char *
11per_data_string(asn_per_data_t *pd) {
12 static char buf[2][32];
13 static int n;
14 n = (n+1) % 2;
15 snprintf(buf[n], sizeof(buf[n]),
16 "{m=%ld span %+ld[%d..%d] (%d)}",
17 (long)pd->moved,
18 (((long)pd->buffer) & 0xf),
19 (int)pd->nboff, (int)pd->nbits,
20 (int)(pd->nbits - pd->nboff));
21 return buf[n];
22}
23
24void
25per_get_undo(asn_per_data_t *pd, int nbits) {
26 if((ssize_t)pd->nboff < nbits) {
27 assert((ssize_t)pd->nboff < nbits)((void) sizeof (((ssize_t)pd->nboff < nbits) ? 1 : 0), __extension__
({ if ((ssize_t)pd->nboff < nbits) ; else __assert_fail
("(ssize_t)pd->nboff < nbits", "per_support.c", 27, __extension__
__PRETTY_FUNCTION__); }));
28 } else {
29 pd->nboff -= nbits;
30 pd->moved -= nbits;
31 }
32}
33
34/*
35 * Extract a small number of bits (<= 31) from the specified PER data pointer.
36 */
37int32_t
38per_get_few_bits(asn_per_data_t *pd, int nbits) {
39 size_t off; /* Next after last bit offset */
40 ssize_t nleft; /* Number of bits left in this stream */
41 uint32_t accum;
42 const uint8_t *buf;
43
44 if(nbits
5.1
'nbits' is >= 0
25.1
'nbits' is >= 0
 < 0)
6
←
Taking false branch
→
26
←
Taking false branch
→
45 return -1;
46
47 nleft = pd->nbits - pd->nboff;
48 if(nbits > nleft) {
7
←
Assuming 'nbits' is <= 'nleft'
→
8
←
Taking false branch
→
27
←
Assuming 'nbits' is <= 'nleft'
→
28
←
Taking false branch
→
49 int32_t tailv, vhead;
50 if(!pd->refill || nbits > 31) return -1;
51 /* Accumulate unused bytes before refill */
52 ASN_DEBUG("Obtain the rest %d bits (want %d)",
53 (int)nleft, (int)nbits);
54 tailv = per_get_few_bits(pd, nleft);
55 if(tailv < 0) return -1;
56 /* Refill (replace pd contents with new data) */
57 if(pd->refill(pd))
58 return -1;
59 nbits -= nleft;
60 vhead = per_get_few_bits(pd, nbits);
61 /* Combine the rest of previous pd with the head of new one */
62 tailv = (tailv << nbits) | vhead; /* Could == -1 */
63 return tailv;
64 }
65
66 /*
67 * Normalize position indicator.
68 */
69 if(pd->nboff
28.1
Field 'nboff' is >= 8
 >= 8) {
9
←
Assuming field 'nboff' is < 8
→
10
←
Taking false branch
→
29
←
Taking true branch
→
70 pd->buffer += (pd->nboff >> 3);
30
←
Null pointer value stored to field 'buffer'
→
71 pd->nbits -= (pd->nboff & ~0x07);
72 pd->nboff &= 0x07;
73 }
74 pd->moved += nbits;
75 pd->nboff += nbits;
76 off = pd->nboff;
77 buf = pd->buffer;
31
←
Null pointer value stored to 'buf'
→
78
79 /*
80 * Extract specified number of bits.
81 */
82 if(off
10.1
'off' is > 8
 <= 8)
11
←
Taking false branch
→
32
←
Assuming 'off' is <= 8
→
33
←
Taking true branch
→
83 accum = nbits ? (buf[0]) >> (8 - off) : 0;
34
←
Assuming 'nbits' is not equal to 0
→
35
←
'?' condition is true
→
36
←
Array access (from variable 'buf') results in a null pointer dereference
84 else if(off
11.1
'off' is > 16
 <= 16)
12
←
Taking false branch
→
85 accum = ((buf[0] << 8) + buf[1]) >> (16 - off);
86 else if(off
12.1
'off' is > 24
 <= 24)
13
←
Taking false branch
→
87 accum = ((buf[0] << 16) + (buf[1] << 8) + buf[2]) >> (24 - off);
88 else if(off <= 31)
14
←
Assuming 'off' is > 31
→
15
←
Taking false branch
→
89 accum = ((buf[0] << 24) + (buf[1] << 16)
90 + (buf[2] << 8) + (buf[3])) >> (32 - off);
91 else if(nbits
15.1
'nbits' is <= 31
 <= 31) {
16
←
Taking true branch
→
92 asn_per_data_t tpd = *pd;
93 /* Here are we with our 31-bits limit plus 1..7 bits offset. */
94 per_get_undo(&tpd, nbits);
95 /* The number of available bits in the stream allow
96 * for the following operations to take place without
97 * invoking the ->refill() function */
98 accum = per_get_few_bits(&tpd, nbits - 24) << 24;
99 accum |= per_get_few_bits(&tpd, 24);
100 } else {
101 per_get_undo(pd, nbits);
102 return -1;
103 }
104
105 accum &= (((uint32_t)1 << nbits) - 1);
106
107 ASN_DEBUG(" [PER got %2d<=%2d bits => span %d %+ld[%d..%d]:%02x (%d) => 0x%x]",
108 (int)nbits, (int)nleft,
109 (int)pd->moved,
110 (((long)pd->buffer) & 0xf),
111 (int)pd->nboff, (int)pd->nbits,
112 ((pd->buffer != NULL((void*)0))?pd->buffer[0]:0),
17
←
Assuming field 'buffer' is equal to NULL
→
18
←
'?' condition is false
→
113 (int)(pd->nbits - pd->nboff),
114 (int)accum);
115
116 return accum;
19
←
Returning without writing to 'pd->buffer'
→
117}
118
119/*
120 * Extract a large number of bits from the specified PER data pointer.
121 */
122int
123per_get_many_bits(asn_per_data_t *pd, uint8_t *dst, int alright, int nbits) {
124 int32_t value;
125
126 if(alright && (nbits & 7)) {
127 /* Perform right alignment of a first few bits */
128 value = per_get_few_bits(pd, nbits & 0x07);
129 if(value < 0) return -1;
130 *dst++ = value; /* value is already right-aligned */
131 nbits &= ~7;
132 }
133
134 while(nbits) {
135 if(nbits >= 24) {
136 value = per_get_few_bits(pd, 24);
137 if(value < 0) return -1;
138 *(dst++) = value >> 16;
139 *(dst++) = value >> 8;
140 *(dst++) = value;
141 nbits -= 24;
142 } else {
143 value = per_get_few_bits(pd, nbits);
144 if(value < 0) return -1;
145 if(nbits & 7) { /* implies left alignment */
146 value <<= 8 - (nbits & 7),
147 nbits += 8 - (nbits & 7);
148 if(nbits > 24)
149 *dst++ = value >> 24;
150 }
151 if(nbits > 16)
152 *dst++ = value >> 16;
153 if(nbits > 8)
154 *dst++ = value >> 8;
155 *dst++ = value;
156 break;
157 }
158 }
159
160 return 0;
161}
162
163/*
164 * Get the length "n" from the stream.
165 */
166ssize_t
167uper_get_length(asn_per_data_t *pd, int ebits, int *repeat) {
168 ssize_t value;
169
170 *repeat = 0;
171
172 if(ebits >= 0) return per_get_few_bits(pd, ebits);
173
174 value = per_get_few_bits(pd, 8);
175 if(value < 0) return -1;
176 if((value & 128) == 0) /* #10.9.3.6 */
177 return (value & 0x7F);
178 if((value & 64) == 0) { /* #10.9.3.7 */
179 value = ((value & 63) << 8) | per_get_few_bits(pd, 8);
180 if(value < 0) return -1;
181 return value;
182 }
183 value &= 63; /* this is "m" from X.691, #10.9.3.8 */
184 if(value < 1 || value > 4)
185 return -1;
186 *repeat = 1;
187 return (16384 * value);
188}
189
190/*
191 * Get the normally small length "n".
192 * This procedure used to decode length of extensions bit-maps
193 * for SET and SEQUENCE types.
194 */
195ssize_t
196uper_get_nslength(asn_per_data_t *pd) {
197 ssize_t length;
198
199 ASN_DEBUG("Getting normally small length");
200
201 if(per_get_few_bits(pd, 1) == 0) {
202 length = per_get_few_bits(pd, 6) + 1;
203 if(length <= 0) return -1;
204 ASN_DEBUG("l=%d", (int)length);
205 return length;
206 } else {
207 int repeat;
208 length = uper_get_length(pd, -1, &repeat);
209 if(length >= 0 && !repeat) return length;
210 return -1; /* Error, or do not support >16K extensions */
211 }
212}
213
214/*
215 * Get the normally small non-negative whole number.
216 * X.691, #10.6
217 */
218ssize_t
219uper_get_nsnnwn(asn_per_data_t *pd) {
220 ssize_t value;
221
222 value = per_get_few_bits(pd, 7);
223 if(value & 64) { /* implicit (value < 0) */
224 value &= 63;
225 value <<= 2;
226 value |= per_get_few_bits(pd, 2);
227 if(value & 128) /* implicit (value < 0) */
228 return -1;
229 if(value == 0)
230 return 0;
231 if(value >= 3)
232 return -1;
233 value = per_get_few_bits(pd, 8 * value);
234 return value;
235 }
236
237 return value;
238}
239
240/*
241 * X.691-11/2008, #11.6
242 * Encoding of a normally small non-negative whole number
243 */
244int
245uper_put_nsnnwn(asn_per_outp_t *po, int n) {
246 int bytes;
247
248 if(n <= 63) {
249 if(n < 0) return -1;
250 return per_put_few_bits(po, n, 7);
251 }
252 if(n < 256)
253 bytes = 1;
254 else if(n < 65536)
255 bytes = 2;
256 else if(n < 256 * 65536)
257 bytes = 3;
258 else
259 return -1; /* This is not a "normally small" value */
260 if(per_put_few_bits(po, bytes, 8))
261 return -1;
262
263 return per_put_few_bits(po, n, 8 * bytes);
264}
265
266
267/* X.691-2008/11, #11.5.6 -> #11.3 */
268int uper_get_constrained_whole_number(asn_per_data_t *pd, unsigned long *out_value, int nbits) {
269 unsigned long lhalf; /* Lower half of the number*/
270 long half;
271
272 if(nbits <= 31) {
1
Assuming 'nbits' is > 31
→
2
←
Taking false branch
→
23
←
Assuming 'nbits' is <= 31
→
24
←
Taking true branch
→
273 half = per_get_few_bits(pd, nbits);
25
←
Calling 'per_get_few_bits'
→
274 if(half < 0) return -1;
275 *out_value = half;
276 return 0;
277 }
278
279 if((size_t)nbits > 8 * sizeof(*out_value))
3
←
Assuming the condition is false
→
4
←
Taking false branch
→
280 return -1; /* RANGE */
281
282 half = per_get_few_bits(pd, 31);
5
←
Calling 'per_get_few_bits'
→
20
←
Returning from 'per_get_few_bits'
→
283 if(half
20.1
'half' is >= 0
 < 0) return -1;
21
←
Taking false branch
→
284
285 if(uper_get_constrained_whole_number(pd, &lhalf, nbits - 31))
22
←
Calling 'uper_get_constrained_whole_number'
→
286 return -1;
287
288 *out_value = ((unsigned long)half << (nbits - 31)) | lhalf;
289 return 0;
290}
291
292
293/* X.691-2008/11, #11.5.6 -> #11.3 */
294int uper_put_constrained_whole_number_s(asn_per_outp_t *po, long v, int nbits) {
295 /*
296 * Assume signed number can be safely coerced into
297 * unsigned of the same range.
298 * The following testing code will likely be optimized out
299 * by compiler if it is true.
300 */
301 unsigned long uvalue1 = ULONG_MAX(9223372036854775807L *2UL+1UL);
302 long svalue = uvalue1;
303 unsigned long uvalue2 = svalue;
304 assert(uvalue1 == uvalue2)((void) sizeof ((uvalue1 == uvalue2) ? 1 : 0), __extension__ (
{ if (uvalue1 == uvalue2) ; else __assert_fail ("uvalue1 == uvalue2"
, "per_support.c", 304, __extension__ __PRETTY_FUNCTION__); }
));
305 return uper_put_constrained_whole_number_u(po, v, nbits);
306}
307
308int uper_put_constrained_whole_number_u(asn_per_outp_t *po, unsigned long v, int nbits) {
309 if(nbits <= 31) {
310 return per_put_few_bits(po, v, nbits);
311 } else {
312 /* Put higher portion first, followed by lower 31-bit */
313 if(uper_put_constrained_whole_number_u(po, v >> 31, nbits - 31))
314 return -1;
315 return per_put_few_bits(po, v, 31);
316 }
317}
318
319/*
320 * Put a small number of bits (<= 31).
321 */
322int
323per_put_few_bits(asn_per_outp_t *po, uint32_t bits, int obits) {
324 size_t off; /* Next after last bit offset */
325 size_t omsk; /* Existing last byte meaningful bits mask */
326 uint8_t *buf;
327
328 if(obits <= 0 || obits >= 32) return obits ? -1 : 0;
329
330 ASN_DEBUG("[PER put %d bits %x to %p+%d bits]",
331 obits, (int)bits, po->buffer, (int)po->nboff);
332
333 /*
334 * Normalize position indicator.
335 */
336 if(po->nboff >= 8) {
337 po->buffer += (po->nboff >> 3);
338 po->nbits -= (po->nboff & ~0x07);
339 po->nboff &= 0x07;
340 }
341
342 /*
343 * Flush whole-bytes output, if necessary.
344 */
345 if(po->nboff + obits > po->nbits) {
346 int complete_bytes = (po->buffer - po->tmpspace);
347 ASN_DEBUG("[PER output %ld complete + %ld]",
348 (long)complete_bytes, (long)po->flushed_bytes);
349 if(po->outper(po->tmpspace, complete_bytes, po->op_key) < 0)
350 return -1;
351 if(po->nboff)
352 po->tmpspace[0] = po->buffer[0];
353 po->buffer = po->tmpspace;
354 po->nbits = 8 * sizeof(po->tmpspace);
355 po->flushed_bytes += complete_bytes;
356 }
357
358 /*
359 * Now, due to sizeof(tmpspace), we are guaranteed large enough space.
360 */
361 buf = po->buffer;
362 omsk = ~((1 << (8 - po->nboff)) - 1);
363 off = (po->nboff + obits);
364
365 /* Clear data of debris before meaningful bits */
366 bits &= (((uint32_t)1 << obits) - 1);
367
368 ASN_DEBUG("[PER out %d %u/%x (t=%d,o=%d) %x&%x=%x]", obits,
369 (int)bits, (int)bits,
370 (int)po->nboff, (int)off,
371 buf[0], (int)(omsk&0xff),
372 (int)(buf[0] & omsk));
373
374 if(off <= 8) /* Completely within 1 byte */
375 po->nboff = off,
376 bits <<= (8 - off),
377 buf[0] = (buf[0] & omsk) | bits;
378 else if(off <= 16)
379 po->nboff = off,
380 bits <<= (16 - off),
381 buf[0] = (buf[0] & omsk) | (bits >> 8),
382 buf[1] = bits;
383 else if(off <= 24)
384 po->nboff = off,
385 bits <<= (24 - off),
386 buf[0] = (buf[0] & omsk) | (bits >> 16),
387 buf[1] = bits >> 8,
388 buf[2] = bits;
389 else if(off <= 31)
390 po->nboff = off,
391 bits <<= (32 - off),
392 buf[0] = (buf[0] & omsk) | (bits >> 24),
393 buf[1] = bits >> 16,
394 buf[2] = bits >> 8,
395 buf[3] = bits;
396 else {
397 per_put_few_bits(po, bits >> (obits - 24), 24);
398 per_put_few_bits(po, bits, obits - 24);
399 }
400
401 ASN_DEBUG("[PER out %u/%x => %02x buf+%ld]",
402 (int)bits, (int)bits, buf[0],
403 (long)(po->buffer - po->tmpspace));
404
405 return 0;
406}
407
408
409/*
410 * Output a large number of bits.
411 */
412int
413per_put_many_bits(asn_per_outp_t *po, const uint8_t *src, int nbits) {
414
415 while(nbits) {
416 uint32_t value;
417
418 if(nbits >= 24) {
419 value = (src[0] << 16) | (src[1] << 8) | src[2];
420 src += 3;
421 nbits -= 24;
422 if(per_put_few_bits(po, value, 24))
423 return -1;
424 } else {
425 value = src[0];
426 if(nbits > 8)
427 value = (value << 8) | src[1];
428 if(nbits > 16)
429 value = (value << 8) | src[2];
430 if(nbits & 0x07)
431 value >>= (8 - (nbits & 0x07));
432 if(per_put_few_bits(po, value, nbits))
433 return -1;
434 break;
435 }
436 }
437
438 return 0;
439}
440
441/*
442 * Put the length "n" (or part of it) into the stream.
443 */
444ssize_t
445uper_put_length(asn_per_outp_t *po, size_t length) {
446
447 if(length <= 127) /* #10.9.3.6 */
448 return per_put_few_bits(po, length, 8)
449 ? -1 : (ssize_t)length;
450 else if(length < 16384) /* #10.9.3.7 */
451 return per_put_few_bits(po, length|0x8000, 16)
452 ? -1 : (ssize_t)length;
453
454 length >>= 14;
455 if(length > 4) length = 4;
456
457 return per_put_few_bits(po, 0xC0 | length, 8)
458 ? -1 : (ssize_t)(length << 14);
459}
460
461
462/*
463 * Put the normally small length "n" into the stream.
464 * This procedure used to encode length of extensions bit-maps
465 * for SET and SEQUENCE types.
466 */
467int
468uper_put_nslength(asn_per_outp_t *po, size_t length) {
469
470 if(length <= 64) {
471 /* #10.9.3.4 */
472 if(length == 0) return -1;
473 return per_put_few_bits(po, length-1, 7) ? -1 : 0;
474 } else {
475 if(uper_put_length(po, length) != (ssize_t)length) {
476 /* This might happen in case of >16K extensions */
477 return -1;
478 }
479 }
480
481 return 0;
482}
483