per_support.c

Bug Summary

File:	asn1/asn1c/per_support.c
Warning:	line 89, column 13 Array access (from variable 'buf') results in a null pointer dereference

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name per_support.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -mthread-model posix -mframe-pointer=all -fmath-errno -fno-rounding-math -masm-verbose -mconstructor-aliases -munwind-tables -target-cpu x86-64 -dwarf-column-info -fno-split-dwarf-inlining -debugger-tuning=gdb -resource-dir /usr/lib64/clang/10.0.0 -D HAVE_CONFIG_H -I . -I ../.. -I ../../util -I /usr/include/nspr4 -I /usr/include/nss3 -I /usr/include/nspr4 -D __STDC_WANT_LIB_EXT1__=1 -D _DEFAULT_SOURCE=1 -D _POSIX_C_SOURCE=200809L -D PIC -internal-isystem /usr/local/include -internal-isystem /usr/lib64/clang/10.0.0/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -fdebug-compilation-dir /home/heimes/redhat/freeipa/asn1/asn1c -ferror-limit 19 -fmessage-length 0 -fgnuc-version=4.2.1 -fobjc-runtime=gcc -fdiagnostics-show-option -analyzer-output=html -faddrsig -o /home/heimes/redhat/freeipa/report/2020-06-05-101548-295465-1 -x c per_support.c

1/*
2 * Copyright (c) 2005-2014 Lev Walkin <vlm@lionet.info>.
3 * All rights reserved.
4 * Redistribution and modifications are permitted subject to BSD license.
5 */
6#include <asn_system.h>
7#include <asn_internal.h>
8#include <per_support.h>
9 
10char *
11per_data_string(asn_per_data_t *pd) {
12	static char buf[2][32];
13	static int n;
14	n = (n+1) % 2;
15	snprintf(buf[n], sizeof(buf[n]),
16		"{m=%ld span %+ld[%d..%d] (%d)}",
17		(long)pd->moved,
18		(((long)pd->buffer) & 0xf),
19		(int)pd->nboff, (int)pd->nbits,
20		(int)(pd->nbits - pd->nboff));
21	return buf[n];
22}
23 
24void
25per_get_undo(asn_per_data_t *pd, int nbits) {
26	if((ssize_t)pd->nboff < nbits) {
27		assert((ssize_t)pd->nboff < nbits)((void) sizeof (((ssize_t)pd->nboff < nbits) ? 1 : 0), __extension__
 ({ if ((ssize_t)pd->nboff < nbits) ; else __assert_fail
 ("(ssize_t)pd->nboff < nbits", "per_support.c", 27, __extension__
 __PRETTY_FUNCTION__); }));
28	} else {
29		pd->nboff -= nbits;
30		pd->moved -= nbits;
31	}
32}
33 
34/*
35 * Extract a small number of bits (<= 31) from the specified PER data pointer.
36 */
37int32_t
38per_get_few_bits(asn_per_data_t *pd, int nbits) {
39	size_t off;	/* Next after last bit offset */
40	ssize_t nleft;	/* Number of bits left in this stream */
41	uint32_t accum;
42	const uint8_t *buf;
43 
44	if(nbits5.1
'nbits' is >= 0
26.1
'nbits' is >= 0
 < 0)
6
←
Taking false branch→
27
←
Taking false branch→
45		return -1;
46 
47	nleft = pd->nbits - pd->nboff;
48	if(nbits > nleft) {
7
←
Assuming 'nbits' is <= 'nleft'→
8
←
Taking false branch→
28
←
Assuming 'nbits' is <= 'nleft'→
29
←
Taking false branch→
49		int32_t tailv, vhead;
50		if(!pd->refill || nbits > 31) return -1;
51		/* Accumulate unused bytes before refill */
52		ASN_DEBUG("Obtain the rest %d bits (want %d)",
53			(int)nleft, (int)nbits);
54		tailv = per_get_few_bits(pd, nleft);
55		if(tailv < 0) return -1;
56		/* Refill (replace pd contents with new data) */
57		if(pd->refill(pd))
58			return -1;
59		nbits -= nleft;
60		vhead = per_get_few_bits(pd, nbits);
61		/* Combine the rest of previous pd with the head of new one */
62		tailv = (tailv << nbits) | vhead;  /* Could == -1 */
63		return tailv;
64	}
65 
66	/*
67	 * Normalize position indicator.
68	 */
69	if(pd->nboff29.1
Field 'nboff' is >= 8
 >= 8) {
9
←
Assuming field 'nboff' is < 8→
10
←
Taking false branch→
30
←
Taking true branch→
70		pd->buffer += (pd->nboff >> 3);
31
←
Null pointer value stored to field 'buffer'→
71		pd->nbits  -= (pd->nboff & ~0x07);
72		pd->nboff  &= 0x07;
73	}
74	pd->moved += nbits;
75	pd->nboff += nbits;
76	off = pd->nboff;
77	buf = pd->buffer;
32
←
Null pointer value stored to 'buf'→
78 
79	/*
80	 * Extract specified number of bits.
81	 */
82	if(off10.1
'off' is > 8
32.1
'off' is > 8
 <= 8)
11
←
Taking false branch→
33
←
Taking false branch→
83		accum = nbits ? (buf[0]) >> (8 - off) : 0;
84	else if(off11.1
'off' is > 16
33.1
'off' is > 16
 <= 16)
12
←
Taking false branch→
34
←
Taking false branch→
85		accum = ((buf[0] << 8) + buf[1]) >> (16 - off);
86	else if(off12.1
'off' is > 24
34.1
'off' is > 24
 <= 24)
13
←
Taking false branch→
35
←
Taking false branch→
87		accum = ((buf[0] << 16) + (buf[1] << 8) + buf[2]) >> (24 - off);
88	else if(off <= 31)
14
←
Assuming 'off' is > 31→
15
←
Taking false branch→
36
←
Assuming 'off' is <= 31→
37
←
Taking true branch→
89		accum = ((buf[0] << 24) + (buf[1] << 16)
38
←
Array access (from variable 'buf') results in a null pointer dereference
90			+ (buf[2] << 8) + (buf[3])) >> (32 - off);
91	else if(nbits15.1
'nbits' is <= 31
 <= 31) {
16
←
Taking true branch→
92		asn_per_data_t tpd = *pd;
93		/* Here are we with our 31-bits limit plus 1..7 bits offset. */
94		per_get_undo(&tpd, nbits);
95		/* The number of available bits in the stream allow
96		 * for the following operations to take place without
97		 * invoking the ->refill() function */
98		accum  = per_get_few_bits(&tpd, nbits - 24) << 24;
99		accum |= per_get_few_bits(&tpd, 24);
100	} else {
101		per_get_undo(pd, nbits);
102		return -1;
103	}
104 
105	accum &= (((uint32_t)1 << nbits) - 1);
106 
107	ASN_DEBUG("  [PER got %2d<=%2d bits => span %d %+ld[%d..%d]:%02x (%d) => 0x%x]",
108		(int)nbits, (int)nleft,
109		(int)pd->moved,
110		(((long)pd->buffer) & 0xf),
111		(int)pd->nboff, (int)pd->nbits,
112		((pd->buffer != NULL((void*)0))?pd->buffer[0]:0),
17
←
Assuming field 'buffer' is equal to NULL→
18
←
'?' condition is false→
113		(int)(pd->nbits - pd->nboff),
114		(int)accum);
115 
116	return accum;
19
←
Returning without writing to 'pd->buffer'→
117}
118 
119/*
120 * Extract a large number of bits from the specified PER data pointer.
121 */
122int
123per_get_many_bits(asn_per_data_t *pd, uint8_t *dst, int alright, int nbits) {
124	int32_t value;
125 
126	if(alright && (nbits & 7)) {
127		/* Perform right alignment of a first few bits */
128		value = per_get_few_bits(pd, nbits & 0x07);
129		if(value < 0) return -1;
130		*dst++ = value;	/* value is already right-aligned */
131		nbits &= ~7;
132	}
133 
134	while(nbits) {
135		if(nbits >= 24) {
136			value = per_get_few_bits(pd, 24);
137			if(value < 0) return -1;
138			*(dst++) = value >> 16;
139			*(dst++) = value >> 8;
140			*(dst++) = value;
141			nbits -= 24;
142		} else {
143			value = per_get_few_bits(pd, nbits);
144			if(value < 0) return -1;
145			if(nbits & 7) {	/* implies left alignment */
146				value <<= 8 - (nbits & 7),
147				nbits += 8 - (nbits & 7);
148				if(nbits > 24)
149					*dst++ = value >> 24;
150			}
151			if(nbits > 16)
152				*dst++ = value >> 16;
153			if(nbits > 8)
154				*dst++ = value >> 8;
155			*dst++ = value;
156			break;
157		}
158	}
159 
160	return 0;
161}
162 
163/*
164 * Get the length "n" from the stream.
165 */
166ssize_t
167uper_get_length(asn_per_data_t *pd, int ebits, int *repeat) {
168	ssize_t value;
169 
170	*repeat = 0;
171 
172	if(ebits >= 0) return per_get_few_bits(pd, ebits);
173 
174	value = per_get_few_bits(pd, 8);
175	if(value < 0) return -1;
176	if((value & 128) == 0)	/* #10.9.3.6 */
177		return (value & 0x7F);
178	if((value & 64) == 0) {	/* #10.9.3.7 */
179		value = ((value & 63) << 8) | per_get_few_bits(pd, 8);
180		if(value < 0) return -1;
181		return value;
182	}
183	value &= 63;	/* this is "m" from X.691, #10.9.3.8 */
184	if(value < 1 || value > 4)
185		return -1;
186	*repeat = 1;
187	return (16384 * value);
188}
189 
190/*
191 * Get the normally small length "n".
192 * This procedure used to decode length of extensions bit-maps
193 * for SET and SEQUENCE types.
194 */
195ssize_t
196uper_get_nslength(asn_per_data_t *pd) {
197	ssize_t length;
198 
199	ASN_DEBUG("Getting normally small length");
200 
201	if(per_get_few_bits(pd, 1) == 0) {
202		length = per_get_few_bits(pd, 6) + 1;
203		if(length <= 0) return -1;
204		ASN_DEBUG("l=%d", (int)length);
205		return length;
206	} else {
207		int repeat;
208		length = uper_get_length(pd, -1, &repeat);
209		if(length >= 0 && !repeat) return length;
210		return -1; /* Error, or do not support >16K extensions */
211	}
212}
213 
214/*
215 * Get the normally small non-negative whole number.
216 * X.691, #10.6
217 */
218ssize_t
219uper_get_nsnnwn(asn_per_data_t *pd) {
220	ssize_t value;
221 
222	value = per_get_few_bits(pd, 7);
223	if(value & 64) {	/* implicit (value < 0) */
224		value &= 63;
225		value <<= 2;
226		value |= per_get_few_bits(pd, 2);
227		if(value & 128)	/* implicit (value < 0) */
228			return -1;
229		if(value == 0)
230			return 0;
231		if(value >= 3)
232			return -1;
233		value = per_get_few_bits(pd, 8 * value);
234		return value;
235	}
236 
237	return value;
238}
239 
240/*
241 * X.691-11/2008, #11.6
242 * Encoding of a normally small non-negative whole number
243 */
244int
245uper_put_nsnnwn(asn_per_outp_t *po, int n) {
246	int bytes;
247 
248	if(n <= 63) {
249		if(n < 0) return -1;
250		return per_put_few_bits(po, n, 7);
251	}
252	if(n < 256)
253		bytes = 1;
254	else if(n < 65536)
255		bytes = 2;
256	else if(n < 256 * 65536)
257		bytes = 3;
258	else
259		return -1;	/* This is not a "normally small" value */
260	if(per_put_few_bits(po, bytes, 8))
261		return -1;
262 
263	return per_put_few_bits(po, n, 8 * bytes);
264}
265 
266 
267/* X.691-2008/11, #11.5.6 -> #11.3 */
268int uper_get_constrained_whole_number(asn_per_data_t *pd, unsigned long *out_value, int nbits) {
269	unsigned long lhalf;    /* Lower half of the number*/
270	long half;
271 
272	if(nbits <= 31) {
1
Assuming 'nbits' is > 31→
2
←
Taking false branch→
23
←
Assuming 'nbits' is > 31→
24
←
Taking false branch→
273		half = per_get_few_bits(pd, nbits);
274		if(half < 0) return -1;
275		*out_value = half;
276		return 0;
277	}
278 
279	if((size_t)nbits > 8 * sizeof(*out_value))
3
←
Assuming the condition is false→
4
←
Taking false branch→
25
←
Taking false branch→
280		return -1;  /* RANGE */
281 
282	half = per_get_few_bits(pd, 31);
5
←
Calling 'per_get_few_bits'→
20
←
Returning from 'per_get_few_bits'→
26
←
Calling 'per_get_few_bits'→
283	if(half20.1
'half' is >= 0
 < 0) return -1;
21
←
Taking false branch→
284 
285	if(uper_get_constrained_whole_number(pd, &lhalf, nbits - 31))
22
←
Calling 'uper_get_constrained_whole_number'→
286		return -1;
287 
288	*out_value = ((unsigned long)half << (nbits - 31)) | lhalf;
289	return 0;
290}
291 
292 
293/* X.691-2008/11, #11.5.6 -> #11.3 */
294int uper_put_constrained_whole_number_s(asn_per_outp_t *po, long v, int nbits) {
295	/*
296	 * Assume signed number can be safely coerced into
297	 * unsigned of the same range.
298	 * The following testing code will likely be optimized out
299	 * by compiler if it is true.
300	 */
301	unsigned long uvalue1 = ULONG_MAX(9223372036854775807L *2UL+1UL);
302	         long svalue  = uvalue1;
303	unsigned long uvalue2 = svalue;
304	assert(uvalue1 == uvalue2)((void) sizeof ((uvalue1 == uvalue2) ? 1 : 0), __extension__ (
{ if (uvalue1 == uvalue2) ; else __assert_fail ("uvalue1 == uvalue2"
, "per_support.c", 304, __extension__ __PRETTY_FUNCTION__); }
));
305	return uper_put_constrained_whole_number_u(po, v, nbits);
306}
307 
308int uper_put_constrained_whole_number_u(asn_per_outp_t *po, unsigned long v, int nbits) {
309	if(nbits <= 31) {
310		return per_put_few_bits(po, v, nbits);
311	} else {
312		/* Put higher portion first, followed by lower 31-bit */
313		if(uper_put_constrained_whole_number_u(po, v >> 31, nbits - 31))
314			return -1;
315		return per_put_few_bits(po, v, 31);
316	}
317}
318 
319/*
320 * Put a small number of bits (<= 31).
321 */
322int
323per_put_few_bits(asn_per_outp_t *po, uint32_t bits, int obits) {
324	size_t off;	/* Next after last bit offset */
325	size_t omsk;	/* Existing last byte meaningful bits mask */
326	uint8_t *buf;
327 
328	if(obits <= 0 || obits >= 32) return obits ? -1 : 0;
329 
330	ASN_DEBUG("[PER put %d bits %x to %p+%d bits]",
331			obits, (int)bits, po->buffer, (int)po->nboff);
332 
333	/*
334	 * Normalize position indicator.
335	 */
336	if(po->nboff >= 8) {
337		po->buffer += (po->nboff >> 3);
338		po->nbits  -= (po->nboff & ~0x07);
339		po->nboff  &= 0x07;
340	}
341 
342	/*
343	 * Flush whole-bytes output, if necessary.
344	 */
345	if(po->nboff + obits > po->nbits) {
346		int complete_bytes = (po->buffer - po->tmpspace);
347		ASN_DEBUG("[PER output %ld complete + %ld]",
348			(long)complete_bytes, (long)po->flushed_bytes);
349		if(po->outper(po->tmpspace, complete_bytes, po->op_key) < 0)
350			return -1;
351		if(po->nboff)
352			po->tmpspace[0] = po->buffer[0];
353		po->buffer = po->tmpspace;
354		po->nbits = 8 * sizeof(po->tmpspace);
355		po->flushed_bytes += complete_bytes;
356	}
357 
358	/*
359	 * Now, due to sizeof(tmpspace), we are guaranteed large enough space.
360	 */
361	buf = po->buffer;
362	omsk = ~((1 << (8 - po->nboff)) - 1);
363	off = (po->nboff + obits);
364 
365	/* Clear data of debris before meaningful bits */
366	bits &= (((uint32_t)1 << obits) - 1);
367 
368	ASN_DEBUG("[PER out %d %u/%x (t=%d,o=%d) %x&%x=%x]", obits,
369		(int)bits, (int)bits,
370		(int)po->nboff, (int)off,
371		buf[0], (int)(omsk&0xff),
372		(int)(buf[0] & omsk));
373 
374	if(off <= 8)	/* Completely within 1 byte */
375		po->nboff = off,
376		bits <<= (8 - off),
377		buf[0] = (buf[0] & omsk) | bits;
378	else if(off <= 16)
379		po->nboff = off,
380		bits <<= (16 - off),
381		buf[0] = (buf[0] & omsk) | (bits >> 8),
382		buf[1] = bits;
383	else if(off <= 24)
384		po->nboff = off,
385		bits <<= (24 - off),
386		buf[0] = (buf[0] & omsk) | (bits >> 16),
387		buf[1] = bits >> 8,
388		buf[2] = bits;
389	else if(off <= 31)
390		po->nboff = off,
391		bits <<= (32 - off),
392		buf[0] = (buf[0] & omsk) | (bits >> 24),
393		buf[1] = bits >> 16,
394		buf[2] = bits >> 8,
395		buf[3] = bits;
396	else {
397		per_put_few_bits(po, bits >> (obits - 24), 24);
398		per_put_few_bits(po, bits, obits - 24);
399	}
400 
401	ASN_DEBUG("[PER out %u/%x => %02x buf+%ld]",
402		(int)bits, (int)bits, buf[0],
403		(long)(po->buffer - po->tmpspace));
404 
405	return 0;
406}
407 
408 
409/*
410 * Output a large number of bits.
411 */
412int
413per_put_many_bits(asn_per_outp_t *po, const uint8_t *src, int nbits) {
414 
415	while(nbits) {
416		uint32_t value;
417 
418		if(nbits >= 24) {
419			value = (src[0] << 16) | (src[1] << 8) | src[2];
420			src += 3;
421			nbits -= 24;
422			if(per_put_few_bits(po, value, 24))
423				return -1;
424		} else {
425			value = src[0];
426			if(nbits > 8)
427				value = (value << 8) | src[1];
428			if(nbits > 16)
429				value = (value << 8) | src[2];
430			if(nbits & 0x07)
431				value >>= (8 - (nbits & 0x07));
432			if(per_put_few_bits(po, value, nbits))
433				return -1;
434			break;
435		}
436	}
437 
438	return 0;
439}
440 
441/*
442 * Put the length "n" (or part of it) into the stream.
443 */
444ssize_t
445uper_put_length(asn_per_outp_t *po, size_t length) {
446 
447	if(length <= 127)	/* #10.9.3.6 */
448		return per_put_few_bits(po, length, 8)
449			? -1 : (ssize_t)length;
450	else if(length < 16384)	/* #10.9.3.7 */
451		return per_put_few_bits(po, length|0x8000, 16)
452			? -1 : (ssize_t)length;
453 
454	length >>= 14;
455	if(length > 4) length = 4;
456 
457	return per_put_few_bits(po, 0xC0 | length, 8)
458			? -1 : (ssize_t)(length << 14);
459}
460 
461 
462/*
463 * Put the normally small length "n" into the stream.
464 * This procedure used to encode length of extensions bit-maps
465 * for SET and SEQUENCE types.
466 */
467int
468uper_put_nslength(asn_per_outp_t *po, size_t length) {
469 
470	if(length <= 64) {
471		/* #10.9.3.4 */
472		if(length == 0) return -1;
473		return per_put_few_bits(po, length-1, 7) ? -1 : 0;
474	} else {
475		if(uper_put_length(po, length) != (ssize_t)length) {
476			/* This might happen in case of >16K extensions */
477			return -1;
478		}
479	}
480 
481	return 0;
482}
483 