der_encoder.c

Bug Summary

File:	asn1/asn1c/der_encoder.c
Warning:	line 141, column 13 1st function call argument is an uninitialized value

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name der_encoder.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -mthread-model posix -mframe-pointer=all -fmath-errno -fno-rounding-math -masm-verbose -mconstructor-aliases -munwind-tables -target-cpu x86-64 -dwarf-column-info -fno-split-dwarf-inlining -debugger-tuning=gdb -resource-dir /usr/lib64/clang/10.0.0 -D HAVE_CONFIG_H -I . -I ../.. -I ../../util -I /usr/include/nspr4 -I /usr/include/nss3 -I /usr/include/nspr4 -D __STDC_WANT_LIB_EXT1__=1 -D _DEFAULT_SOURCE=1 -D _POSIX_C_SOURCE=200809L -D PIC -internal-isystem /usr/local/include -internal-isystem /usr/lib64/clang/10.0.0/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -fdebug-compilation-dir /home/heimes/redhat/freeipa/asn1/asn1c -ferror-limit 19 -fmessage-length 0 -fgnuc-version=4.2.1 -fobjc-runtime=gcc -fdiagnostics-show-option -analyzer-output=html -faddrsig -o /home/heimes/redhat/freeipa/report/2020-06-05-101548-295465-1 -x c der_encoder.c

1/*-
2 * Copyright (c) 2003, 2004 Lev Walkin <vlm@lionet.info>. All rights reserved.
3 * Redistribution and modifications are permitted subject to BSD license.
4 */
5#include <asn_internal.h>
6#include <errno(*__errno_location ()).h>
7 
8static ssize_t der_write_TL(ber_tlv_tag_t tag, ber_tlv_len_t len,
9	asn_app_consume_bytes_f *cb, void *app_key, int constructed);
10 
11/*
12 * The DER encoder of any type.
13 */
14asn_enc_rval_t
15der_encode(asn_TYPE_descriptor_t *type_descriptor, void *struct_ptr,
16	asn_app_consume_bytes_f *consume_bytes, void *app_key) {
17 
18	ASN_DEBUG("DER encoder invoked for %s",
19		type_descriptor->name);
20 
21	/*
22	 * Invoke type-specific encoder.
23	 */
24	return type_descriptor->der_encoder(type_descriptor,
25		struct_ptr,	/* Pointer to the destination structure */
26		0, 0,
27		consume_bytes, app_key);
28}
29 
30/*
31 * Argument type and callback necessary for der_encode_to_buffer().
32 */
33typedef struct enc_to_buf_arg {
34	void *buffer;
35	size_t left;
36} enc_to_buf_arg;
37static int encode_to_buffer_cb(const void *buffer, size_t size, void *key) {
38	enc_to_buf_arg *arg = (enc_to_buf_arg *)key;
39 
40	if(arg->left < size)
41		return -1;	/* Data exceeds the available buffer size */
42 
43	memcpy(arg->buffer, buffer, size);
44	arg->buffer = ((char *)arg->buffer) + size;
45	arg->left -= size;
46 
47	return 0;
48}
49 
50/*
51 * A variant of the der_encode() which encodes the data into the provided buffer
52 */
53asn_enc_rval_t
54der_encode_to_buffer(asn_TYPE_descriptor_t *type_descriptor, void *struct_ptr,
55	void *buffer, size_t buffer_size) {
56	enc_to_buf_arg arg;
57	asn_enc_rval_t ec;
58 
59	arg.buffer = buffer;
60	arg.left = buffer_size;
61 
62	ec = type_descriptor->der_encoder(type_descriptor,
63		struct_ptr,	/* Pointer to the destination structure */
64		0, 0, encode_to_buffer_cb, &arg);
65	if(ec.encoded != -1) {
66		assert(ec.encoded == (ssize_t)(buffer_size - arg.left))((void) sizeof ((ec.encoded == (ssize_t)(buffer_size - arg.left
)) ? 1 : 0), __extension__ ({ if (ec.encoded == (ssize_t)(buffer_size
 - arg.left)) ; else __assert_fail ("ec.encoded == (ssize_t)(buffer_size - arg.left)"
, "der_encoder.c", 66, __extension__ __PRETTY_FUNCTION__); })
);
67		/* Return the encoded contents size */
68	}
69	return ec;
70}
71 
72 
73/*
74 * Write out leading TL[v] sequence according to the type definition.
75 */
76ssize_t
77der_write_tags(asn_TYPE_descriptor_t *sd,
78		size_t struct_length,
79		int tag_mode, int last_tag_form,
80		ber_tlv_tag_t tag,	/* EXPLICIT or IMPLICIT tag */
81		asn_app_consume_bytes_f *cb,
82		void *app_key) {
83	const ber_tlv_tag_t *tags;	/* Copy of tags stream */
84	int tags_count;			/* Number of tags */
85	size_t overall_length;
86	ssize_t *lens;
87	int i;
88 
89	ASN_DEBUG("Writing tags (%s, tm=%d, tc=%d, tag=%s, mtc=%d)",
90		sd->name, tag_mode, sd->tags_count,
91		ber_tlv_tag_string(tag),
92		tag_mode
1
Assuming 'tag_mode' is not equal to 0→
2
←
'?' condition is true→
93			?(sd->tags_count+1
94				-((tag_mode == -1) && sd->tags_count))
3
←
Assuming the condition is false→
95			:sd->tags_count
96	);
97 
98	if(tag_mode3.1
'tag_mode' is not equal to 0
) {
4
←
Taking true branch→
99		/*
100		 * Instead of doing shaman dance like we do in ber_check_tags(),
101		 * allocate a small array on the stack
102		 * and initialize it appropriately.
103		 */
104		int stag_offset;
105		ber_tlv_tag_t *tags_buf;
106		tags_buf = (ber_tlv_tag_t *)alloca((sd->tags_count + 1) * sizeof(ber_tlv_tag_t))__builtin_alloca ((sd->tags_count + 1) * sizeof(ber_tlv_tag_t
));
107		if(!tags_buf4.1
'tags_buf' is non-null
) {	/* Can fail on !x86 */
5
←
Taking false branch→
108			errno(*__errno_location ()) = ENOMEM12;
109			return -1;
110		}
111		tags_count = sd->tags_count
112			+ 1	/* EXPLICIT or IMPLICIT tag is given */
113			- ((tag_mode == -1) && sd->tags_count);
114		/* Copy tags over */
115		tags_buf[0] = tag;
116		stag_offset = -1 + ((tag_mode == -1) && sd->tags_count);
117		for(i = 1; i < tags_count; i++)
6
←
Assuming 'i' is >= 'tags_count'→
7
←
Loop condition is false. Execution continues on line 119→
118			tags_buf[i] = sd->tags[i + stag_offset];
119		tags = tags_buf;
120	} else {
121		tags = sd->tags;
122		tags_count = sd->tags_count;
123	}
124 
125	/* No tags to write */
126	if(tags_count == 0)
8
←
Assuming 'tags_count' is not equal to 0→
9
←
Taking false branch→
127		return 0;
128 
129	lens = (ssize_t *)alloca(tags_count * sizeof(lens[0]))__builtin_alloca (tags_count * sizeof(lens[0]));
130	if(!lens9.1
'lens' is non-null
) {
10
←
Taking false branch→
131		errno(*__errno_location ()) = ENOMEM12;
132		return -1;
133	}
134 
135	/*
136	 * Array of tags is initialized.
137	 * Now, compute the size of the TLV pairs, from right to left.
138	 */
139	overall_length = struct_length;
140	for(i = tags_count - 1; i >= 0; --i) {
11
←
Assuming 'i' is >= 0→
12
←
Loop condition is true.  Entering loop body→
14
←
Assuming 'i' is >= 0→
15
←
Loop condition is true.  Entering loop body→
17
←
The value 2147483645 is assigned to 'i'→
18
←
Loop condition is true.  Entering loop body→
141		lens[i] = der_write_TL(tags[i], overall_length, 0, 0, 0);
19
←
1st function call argument is an uninitialized value
142		if(lens[i] == -1) return -1;
13
←
Taking false branch→
16
←
Taking false branch→
143		overall_length += lens[i];
144		lens[i] = overall_length - lens[i];
145	}
146 
147	if(!cb) return overall_length - struct_length;
148 
149	ASN_DEBUG("%s %s TL sequence (%d elements)",
150		cb?"Encoding":"Estimating", sd->name, tags_count);
151 
152	/*
153	 * Encode the TL sequence for real.
154	 */
155	for(i = 0; i < tags_count; i++) {
156		ssize_t len;
157		int _constr;
158 
159		/* Check if this tag happens to be constructed */
160		_constr = (last_tag_form || i < (tags_count - 1));
161 
162		len = der_write_TL(tags[i], lens[i], cb, app_key, _constr);
163		if(len == -1) return -1;
164	}
165 
166	return overall_length - struct_length;
167}
168 
169static ssize_t
170der_write_TL(ber_tlv_tag_t tag, ber_tlv_len_t len,
171		asn_app_consume_bytes_f *cb, void *app_key,
172		int constructed) {
173	uint8_t buf[32];
174	size_t size = 0;
175	int buf_size = cb?sizeof(buf):0;
176	ssize_t tmp;
177 
178	/* Serialize tag (T from TLV) into possibly zero-length buffer */
179	tmp = ber_tlv_tag_serialize(tag, buf, buf_size);
180	if(tmp == -1 || tmp > (ssize_t)sizeof(buf)) return -1;
181	size += tmp;
182 
183	/* Serialize length (L from TLV) into possibly zero-length buffer */
184	tmp = der_tlv_length_serialize(len, buf+size, buf_size?buf_size-size:0);
185	if(tmp == -1) return -1;
186	size += tmp;
187 
188	if(size > sizeof(buf))
189		return -1;
190 
191	/*
192	 * If callback is specified, invoke it, and check its return value.
193	 */
194	if(cb) {
195		if(constructed) *buf |= 0x20;
196		if(cb(buf, size, app_key) < 0)
197			return -1;
198	}
199 
200	return size;
201}