form.c

Bug Summary

File:	d/form.c
Warning:	line 617, column 22 Access out-of-bound array element (buffer overflow)

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name form.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/home/isvv/naviserver/nsd -resource-dir /usr/local/lib/clang/15.0.0 -D _FORTIFY_SOURCE=2 -D NDEBUG -D SYSTEM_MALLOC -I ../include -I /usr/include/tcl8.6 -D HAVE_CONFIG_H -internal-isystem /usr/local/lib/clang/15.0.0/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/11/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O2 -std=c99 -fdebug-compilation-dir=/home/isvv/naviserver/nsd -ferror-limit 19 -stack-protector 2 -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -analyzer-checker alpha -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/scan-build-2022-07-23-130959-11103-1 -x c form.c

1/*
* The contents of this file are subject to the Mozilla Public License
* Version 1.1 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
* http://mozilla.org/.
*
* Software distributed under the License is distributed on an "AS IS"
* basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
* the License for the specific language governing rights and limitations
* under the License.
*
* The Original Code is AOLserver Code and related documentation
* distributed by AOL.
*
* The Initial Developer of the Original Code is America Online,
* Inc. Portions created by AOL are Copyright (C) 1999 America Online,
* Inc. All Rights Reserved.
*
* Alternatively, the contents of this file may be used under the terms
* of the GNU General Public License (the "GPL"), in which case the
* provisions of GPL are applicable instead of those above.  If you wish
* to allow use of your version of this file only under the terms of the
* GPL and not to allow others to use your version of this file under the
* License, indicate your decision by deleting the provisions above and
* replace them with the notice and other provisions required by the GPL.
* If you do not delete the provisions above, a recipient may use your
* version of this file under either the License or the GPL.
*/

30/*
* form.c --
*
*      Routines for dealing with HTML FORM's.
*/

36#include "nsd.h"

38/*
* Local functions defined in this file.
*/

42static Ns_ReturnCode ParseQuery(char *form, Ns_Set *set, Tcl_Encoding encoding, bool_Bool translate)
  NS_GNUC_NONNULL(1)__attribute__((__nonnull__(1))) NS_GNUC_NONNULL(2)__attribute__((__nonnull__(2)));

45static Ns_ReturnCode ParseQueryWithFallback(Tcl_Interp *interp, NsServer *servPtr,
                                          char *toParse, Ns_Set *set,
                                          Tcl_Encoding encoding, bool_Bool translate,
                                          Tcl_Obj *fallbackCharsetObj)
  NS_GNUC_NONNULL(1)__attribute__((__nonnull__(1))) NS_GNUC_NONNULL(3)__attribute__((__nonnull__(3))) NS_GNUC_NONNULL(4)__attribute__((__nonnull__(4)));

51static Ns_ReturnCode ParseMultipartEntry(Conn *connPtr, Tcl_Encoding valueEncoding, const char *start, char *end)
  NS_GNUC_NONNULL(1)__attribute__((__nonnull__(1))) NS_GNUC_NONNULL(3)__attribute__((__nonnull__(3))) NS_GNUC_NONNULL(4)__attribute__((__nonnull__(4)));

54static char *Ext2utf(Tcl_DString *dsPtr, const char *start, size_t len, Tcl_Encoding encoding, char unescape)
  NS_GNUC_NONNULL(1)__attribute__((__nonnull__(1))) NS_GNUC_NONNULL(2)__attribute__((__nonnull__(2)));

57static bool_Bool GetBoundary(Tcl_DString *dsPtr, const char *contentType)
  NS_GNUC_NONNULL(1)__attribute__((__nonnull__(1))) NS_GNUC_NONNULL(2)__attribute__((__nonnull__(2)));

60static char *NextBoundary(const Tcl_DString *dsPtr, char *s, const char *e)
  NS_GNUC_NONNULL(1)__attribute__((__nonnull__(1))) NS_GNUC_NONNULL(2)__attribute__((__nonnull__(2))) NS_GNUC_PURE;

63static bool_Bool GetValue(const char *hdr, const char *att, const char **vsPtr, const char **vePtr, char *uPtr)
  NS_GNUC_NONNULL(1)__attribute__((__nonnull__(1))) NS_GNUC_NONNULL(2)__attribute__((__nonnull__(2))) NS_GNUC_NONNULL(3)__attribute__((__nonnull__(3))) NS_GNUC_NONNULL(4)__attribute__((__nonnull__(4))) NS_GNUC_NONNULL(5)__attribute__((__nonnull__(5)));


67
68/*
*----------------------------------------------------------------------
*
* Ns_ConnGetQuery --
*
*      Return the connection query data in form of an Ns_Set. This function
*      parses the either the query (of the request URL) or the form content
*      (in POST requests with content type "www-form-urlencoded" or
*      "multipart/form-data"). In case the Ns_Set for the query is already
*      set, it is treated as cached result and is returned untouched.
*
* Results:
*      Query data or NULL if no form data is available.
*
* Side effects:
*      None.
*
*----------------------------------------------------------------------
*/

88Ns_Set *
89Ns_ConnGetQuery(Tcl_Interp *interp, Ns_Conn *conn, Tcl_Obj *fallbackCharsetObj, Ns_ReturnCode *rcPtr)
90{
  Conn *connPtr;

  NS_NONNULL_ASSERT(conn != NULL)((void) (0));
  connPtr = (Conn *) conn;

  /*
   * connPtr->query is used to cache the result, in case this function is
   * called multiple times during a single request.
   */
  if (connPtr->query == NULL((void*)0)) {
1
Assuming field 'query' is equal to NULL→
2
←
Taking true branch→
      const char   *contentType, *charset = NULL((void*)0);
      char         *content = NULL((void*)0), *toParse = NULL((void*)0);
      size_t        charsetOffset;
      bool_Bool          haveFormData = NS_FALSE0;
      Ns_ReturnCode status = NS_OK;

      /*
       * We are called the first time, so create an ns_set named (slightly
       * misleading "connPtr->query")
       */
      if (connPtr->formData == NULL((void*)0)) {
3
←
Assuming field 'formData' is not equal to NULL→
4
←
Taking false branch→
          connPtr->formData = Ns_SetCreate(NS_SET_NAME_QUERY"query");
      }
      connPtr->query = connPtr->formData;
      contentType = Ns_SetIGet(connPtr->headers, "content-type");

      if (contentType != NULL((void*)0)) {
5
←
Assuming 'contentType' is not equal to NULL→
6
←
Taking true branch→
          charset = NsFindCharset(contentType, &charsetOffset);
          if (strncmp(contentType, "application/x-www-form-urlencoded", 33u) == 0) {
7
←
Assuming the condition is false→
8
←
Taking false branch→
              haveFormData = NS_TRUE1;
          } else if (strncmp(contentType, "multipart/form-data", 19u) == 0) {
9
←
Taking true branch→
              haveFormData = NS_TRUE1;
          }
      }

      if (haveFormData9.1
'haveFormData' is true
) {
10
←
Taking true branch→
          /*
           * It is unsafe to access the content when the
           * connection is already closed due to potentially
           * unmmapped memory.
           */
          if ((connPtr->flags & NS_CONN_CLOSED0x001u) == 0u) {
11
←
Assuming the condition is true→
12
←
Taking true branch→
              content = connPtr->reqPtr->content;
          } else {
              /*
               * Formdata is unavailable, but do not fall back to the
               * query-as-formdata tradition. We should keep a consistent
               * behavior.
               */
          }
      } else if (connPtr->request.query != NULL((void*)0)) {
          /*
           * The content has none of the "FORM" content types, so get it
           * in good old AOLserver tradition from the query variables.
           */
          toParse = connPtr->request.query;
          status = ParseQueryWithFallback(interp, connPtr->poolPtr->servPtr,
                                          toParse, connPtr->query, connPtr->urlEncoding,
                                          NS_FALSE0, fallbackCharsetObj);
      }

      if (content != NULL((void*)0)) {
13
←
Assuming 'content' is not equal to NULL→
14
←
Taking true branch→
          Tcl_DString boundaryDs;
          /*
           * We have one of the accepted content types AND the data is
           * provided via content string.
           */
          Tcl_DStringInit(&boundaryDs);

          if (*contentType == 'a') {
15
←
Assuming the condition is false→
16
←
Taking false branch→
              /*
               * The content-type is "application/x-www-form-urlencoded"
               */
              bool_Bool         translate;
              Tcl_Encoding encoding;
166#ifdef _WIN32
              /*
               * Keep CRLF
               */
              translate = NS_FALSE0;
171#else
              /*
               * Translate CRLF -> LF, since browsers translate all
               * LF to CRLF in the body of POST requests.
               */
              translate = NS_TRUE1;
177#endif
              if (charset != NULL((void*)0)) {
                  encoding = Ns_GetCharsetEncoding(charset);
              } else {
                  encoding = connPtr->urlEncoding;
              }
              toParse = content;
              status = ParseQueryWithFallback(interp, connPtr->poolPtr->servPtr,
                                              content, connPtr->query, encoding,
                                              translate, fallbackCharsetObj);

          } else if (GetBoundary(&boundaryDs, contentType)) {
17
←
Taking true branch→
              /*
               * GetBoundary cares for "multipart/form-data; boundary=...".
               */
              const char  *formEndPtr = content + connPtr->reqPtr->length;
              char        *firstBoundary = NextBoundary(&boundaryDs, content, formEndPtr), *s;
              Tcl_Encoding valueEncoding = connPtr->urlEncoding;

              s = firstBoundary;
              for (;;) {
18
←
Loop condition is true.  Entering loop body→
                  const char *defaultCharset;

                  while (s18.1
's' is not equal to NULL
 != NULL((void*)0)) {
19
←
Loop condition is true.  Entering loop body→
                      char  *e;

                      s += boundaryDs.length;
                      if (*s == '\r') {
20
←
Assuming the condition is false→
21
←
Taking false branch→
                          ++s;
                      }
                      if (*s == '\n') {
22
←
Assuming the condition is false→
23
←
Taking false branch→
                          ++s;
                      }
                      e = NextBoundary(&boundaryDs, s, formEndPtr);
                      if (e23.1
'e' is not equal to NULL
 != NULL((void*)0)) {
24
←
Taking true branch→
                          status = ParseMultipartEntry(connPtr, valueEncoding, s, e);
25
←
Calling 'ParseMultipartEntry'→
                          if (status == NS_ERROR) {
                              toParse = s;
                          }
                      }
                      s = e;
                  }
                  /*
                   * We have now parsed all form fields into
                   * connPtr->query. According to the HTML5 standard, we
                   * have to check for a form entry named "_charset_"
                   * specifying the "default charset".
                   * https://datatracker.ietf.org/doc/html/rfc7578#section-4.6
                   */
                  defaultCharset = Ns_SetGet(connPtr->query, "_charset_");
                  if (defaultCharset != NULL((void*)0) && strcmp(defaultCharset, "utf-8") != 0) {
                      /*
                       * We got an explicit charset different from UTF-8. We
                       * have to reparse the input data.
                       */
                      Tcl_Encoding defaultEncoding = Ns_GetCharsetEncoding(defaultCharset);

                      if (valueEncoding != NULL((void*)0)) {
                          if (valueEncoding != defaultEncoding) {
                              valueEncoding = defaultEncoding;
                              s = firstBoundary;
                              Ns_SetTrunc(connPtr->query, 0u);
                              Ns_Log(Debug, "form: retry with default charset %s", defaultCharset);
                              continue;
                          }
                      } else {
                          Ns_Log(Error, "multipart form: invalid charset specified"
                                 " inside of form '%s'", defaultCharset);
                          status = NS_ERROR;
                      }
                  }
                  break;
              }
          }
          Tcl_DStringFree(&boundaryDs);
      }

      if (status == NS_ERROR) {
          Ns_Log(Warning, "formdata: could not parse '%s'", toParse);
          Ns_ConnClearQuery(conn);
          if (rcPtr != NULL((void*)0)) {
              *rcPtr = status;
              if (interp != NULL((void*)0)) {
                  Ns_TclPrintfResult(interp,
                                     "cannot decode '%s'; contains invalid UTF-8",
                                     toParse);
                  Tcl_SetErrorCode(interp, "NS_INVALID_UTF8", NULL((void*)0));
              }
          }
          return NULL((void*)0);
      }
  }

  return connPtr->query;
271}


274
275/*
*----------------------------------------------------------------------
*
* Ns_ConnClearQuery --
*
*      Release the any query set cached up from a previous call
*      to Ns_ConnGetQuery.  Useful if the query data requires
*      reparsing, as when the encoding changes.
*
* Results:
*      None
*
* Side effects:
*      None.
*
*----------------------------------------------------------------------
*/

293void
294Ns_ConnClearQuery(Ns_Conn *conn)
295{
  Conn *connPtr;

  NS_NONNULL_ASSERT(conn != NULL)((void) (0));
  connPtr = (Conn *) conn;

  if (connPtr->query != NULL((void*)0)) {
      const Tcl_HashEntry *hPtr;
      Tcl_HashSearch       search;

      Ns_SetTrunc(connPtr->query, 0);
      connPtr->query = NULL((void*)0);

      hPtr = Tcl_FirstHashEntry(&connPtr->files, &search);
      while (hPtr != NULL((void*)0)) {
          FormFile *filePtr = Tcl_GetHashValue(hPtr)((hPtr)->clientData);

          if (filePtr->hdrObj != NULL((void*)0)) {
              Tcl_DecrRefCount(filePtr->hdrObj)do { Tcl_Obj *_objPtr = (filePtr->hdrObj); if (_objPtr->
refCount-- <= 1) { TclFreeObj(_objPtr); } } while(0);
          }
          if (filePtr->offObj != NULL((void*)0)) {
              Tcl_DecrRefCount(filePtr->offObj)do { Tcl_Obj *_objPtr = (filePtr->offObj); if (_objPtr->
refCount-- <= 1) { TclFreeObj(_objPtr); } } while(0);
          }
          if (filePtr->sizeObj != NULL((void*)0)) {
              Tcl_DecrRefCount(filePtr->sizeObj)do { Tcl_Obj *_objPtr = (filePtr->sizeObj); if (_objPtr->
refCount-- <= 1) { TclFreeObj(_objPtr); } } while(0);
          }
          ns_free(filePtr);

          hPtr = Tcl_NextHashEntry(&search);
      }
      Tcl_DeleteHashTable(&connPtr->files);
      Tcl_InitHashTable(&connPtr->files, TCL_STRING_KEYS(0));
  }
328}

330
331/*
*----------------------------------------------------------------------
*
* Ns_QueryToSet --
*
*      Parse query data into a given Ns_Set.
*
* Results:
*      NS_OK.
*
* Side effects:
*      Will add data to set.
*
*----------------------------------------------------------------------
*/

347Ns_ReturnCode
348Ns_QueryToSet(char *query, Ns_Set *set, Tcl_Encoding encoding)
349{
  NS_NONNULL_ASSERT(query != NULL)((void) (0));
  NS_NONNULL_ASSERT(set != NULL)((void) (0));

  return ParseQuery(query, set, encoding, NS_FALSE0);
354}

356
357/*
*----------------------------------------------------------------------
*
* NsTclParseQueryObjCmd --
*
*      Implements "ns_parsequery".
*
* Results:
*      The Tcl result is a Tcl set with the parsed name-value pairs from
*      the querystring argument
*
* Side effects:
*      None.
*
*----------------------------------------------------------------------
*/

374int
375NsTclParseQueryObjCmd(ClientData clientData, Tcl_Interp *interp, int objc, Tcl_Obj *const* objv)
376{
  int       result;
  NsInterp *itPtr = clientData;
  char     *charset = NULL((void*)0), *chars = (char *)NS_EMPTY_STRING;
  Tcl_Obj  *fallbackCharsetObj = NULL((void*)0);
  Ns_ObjvSpec lopts[] = {
      {"-charset",         Ns_ObjvString, &charset, NULL((void*)0)},
      {"-fallbackcharset", Ns_ObjvObj,    &fallbackCharsetObj, NULL((void*)0)},
      {"--",               Ns_ObjvBreak,  NULL((void*)0),     NULL((void*)0)},
      {NULL((void*)0), NULL((void*)0), NULL((void*)0), NULL((void*)0)}
  };
  Ns_ObjvSpec  args[] = {
      {"querystring", Ns_ObjvString, &chars, NULL((void*)0)},
      {NULL((void*)0), NULL((void*)0), NULL((void*)0), NULL((void*)0)}
  };

  if (Ns_ParseObjv(lopts, args, interp, 1, objc, objv) != NS_OK) {
      result = TCL_ERROR1;

  } else {
      Tcl_Encoding encoding;
      Ns_Set      *set = Ns_SetCreate(NS_SET_NAME_PARSEQ"parseq");

      if (charset != NULL((void*)0)) {
          encoding = Ns_GetCharsetEncoding(charset);
      } else {
          encoding = Ns_GetUrlEncoding(NULL((void*)0));
      }

      if (ParseQueryWithFallback(interp, itPtr->servPtr,
                                 chars, set, encoding,
                                 NS_FALSE0, fallbackCharsetObj)) {
          Ns_TclPrintfResult(interp, "could not parse query: \"%s\"", chars);
          Tcl_SetErrorCode(interp, "NS_INVALID_UTF8", NULL((void*)0));
          Ns_SetFree(set);
          result = TCL_ERROR1;
      } else {
          result = Ns_TclEnterSet(interp, set, NS_TCL_SET_DYNAMIC);
      }
  }
  return result;
417}

419
420/*
*----------------------------------------------------------------------
*
* ParseQuery --
*
*      Parse the given form string for URL encoded key=value pairs,
*      converting to UTF8 if given encoding is not NULL.
*
* Results:
*      TCL_OK or TCL_ERROR in case parsing was not possible.
*
* Side effects:
*      None.
*
*----------------------------------------------------------------------
*/

437static Ns_ReturnCode
438ParseQuery(char *form, Ns_Set *set, Tcl_Encoding encoding, bool_Bool translate)
439{
  Tcl_DString   kds, vds, vds2;
  char         *p;
  Ns_ReturnCode result = NS_OK;

  NS_NONNULL_ASSERT(form != NULL)((void) (0));
  NS_NONNULL_ASSERT(set != NULL)((void) (0));

  Tcl_DStringInit(&kds);
  Tcl_DStringInit(&vds);
  Tcl_DStringInit(&vds2);
  p = form;

  while (p != NULL((void*)0)) {
      char       *v;
      const char *k;

      k = p;
      p = strchr(p, INTCHAR('&')((int)((unsigned char)(('&')))));
      if (p != NULL((void*)0)) {
          *p = '\0';
      }
      v = strchr(k, INTCHAR('=')((int)((unsigned char)(('=')))));
      if (v != NULL((void*)0)) {
          *v = '\0';
      }
      Ns_DStringSetLengthTcl_DStringSetLength(&kds, 0);
      k = Ns_UrlQueryDecode(&kds, k, encoding, &result);
      if (v != NULL((void*)0)) {
          Ns_DStringSetLengthTcl_DStringSetLength(&vds, 0);

          (void) Ns_UrlQueryDecode(&vds, v+1, encoding, &result);
          *v = '=';
          v = vds.string;
          if (translate) {
              char *q = strchr(v, INTCHAR('\r')((int)((unsigned char)(('\r')))));

              if (q != NULL((void*)0)) {
                  /*
                   * We have one or more CR in the field content.
                   * Remove these.
                   */
                  Ns_DStringSetLengthTcl_DStringSetLength(&vds2, 0);
                  do {
                      Tcl_DStringAppend(&vds2, v, (int)(q - v));
                      v = q +1;
                      q = strchr(v, INTCHAR('\r')((int)((unsigned char)(('\r')))));
                  } while (q != NULL((void*)0));
                  /*
                   * Append the remaining string.
                   */
                  Tcl_DStringAppend(&vds2, v, -1);
                  v = vds2.string;
              }
          }
      }
      if (result == TCL_OK0) {
          (void) Ns_SetPut(set, k, v);
      }
      if (p != NULL((void*)0)) {
          *p++ = '&';
      }
  }
  Tcl_DStringFree(&kds);
  Tcl_DStringFree(&vds);
  Tcl_DStringFree(&vds2);

  return result;
507}

509/*
*----------------------------------------------------------------------
*
* ParseQueryWithFallback --
*
*      Helper function for ParseQuery(), which handles fallback charset for
*      cases, where converting to UTF8 fails (due to invalid UTF-8).
*
* Results:
*      TCL_OK or TCL_ERROR in case parsing was not possible.
*
* Side effects:
*      None.
*
*----------------------------------------------------------------------
*/
525static Ns_ReturnCode
526ParseQueryWithFallback(Tcl_Interp *interp, NsServer *servPtr, char *toParse,
                     Ns_Set *set, Tcl_Encoding encoding,
                     bool_Bool translate, Tcl_Obj *fallbackCharsetObj)
529{
  Ns_ReturnCode status;

  NS_NONNULL_ASSERT(interp != NULL)((void) (0));
  NS_NONNULL_ASSERT(toParse != NULL)((void) (0));
  NS_NONNULL_ASSERT(set != NULL)((void) (0));

  status = ParseQuery(toParse, set, encoding,  translate);
  if (status == NS_ERROR) {
      Tcl_Encoding fallbackEncoding = NULL((void*)0);
      Ns_ReturnCode rc;

      /*
       * ParseQuery failed. This might be due to invalid UTF-8. Retry with
       * fallbackCharset if specified.
       */
      rc = NsGetFallbackEncoding(interp, servPtr, fallbackCharsetObj, NS_TRUE1, &fallbackEncoding);
      if (rc == NS_OK && fallbackEncoding != NULL((void*)0) && fallbackEncoding != encoding) {
          Ns_Log(Notice, "Retry ParseQuery with encoding %s",
                 Ns_GetEncodingCharset(fallbackEncoding));
          Ns_SetTrunc(set, 0u);
          status = ParseQuery(toParse, set, fallbackEncoding,  translate);
      }
  }
  return status;
554}

556
557/*
*----------------------------------------------------------------------
*
* ParseMultipartEntry --
*
*      Parse a single part of a multipart form.
*
* Results:
*      Ns_ReturnCode (NS_OK or NS_ERROR).
*
* Side effects:
*      Records offset, lengths for files.  After execution, connPtr->query
*      contains the parsed form in form of an Ns_Set.
*
*----------------------------------------------------------------------
*/

574static Ns_ReturnCode
575ParseMultipartEntry(Conn *connPtr, Tcl_Encoding valueEncoding, const char *start, char *end)
576{
  Tcl_Encoding  encoding;
  Tcl_DString   kds, vds;
  char         *e, saveend, unescape;
  const char   *ks = NULL((void*)0), *ke, *disp;
  Ns_Set       *set;
  int           isNew;
  Ns_ReturnCode status = NS_OK;

  NS_NONNULL_ASSERT(connPtr != NULL)((void) (0));
  NS_NONNULL_ASSERT(start != NULL)((void) (0));
  NS_NONNULL_ASSERT(end != NULL)((void) (0));

  encoding = connPtr->urlEncoding;

  Tcl_DStringInit(&kds);
  Tcl_DStringInit(&vds);
  set = Ns_SetCreate(NS_SET_NAME_MP"mp");

  /*
   * Trim off the trailing \r\n and null terminate the input.
   */

  if (end25.1
'end' is <= 'start'
 > start && *(end-1) == '\n') {
      --end;
  }
  if (end25.2
'end' is <= 'start'
 > start && *(end-1) == '\r') {
      --end;
  }
  saveend = *end;
  *end = '\0';

  /*
   * Parse header lines
   */

  while ((e = strchr(start, INTCHAR('\n')((int)((unsigned char)(('\n')))))) != NULL((void*)0)) {
26
←
Assuming the condition is true→
27
←
Loop condition is true.  Entering loop body→
      const char *s = start;
      char        save;

      start = e + 1;
      if (e > s && *(e-1) == '\r') {
28
←
Assuming 'e' is > 's'→
29
←
Access out-of-bound array element (buffer overflow)
          --e;
      }
      if (s == e) {
          /*
           * Reached empty line, end of header.
           */
          break;
      }
      save = *e;
      *e = '\0';
      (void) Ns_ParseHeader(set, s, NULL((void*)0), ToLower, NULL((void*)0));
      *e = save;
  }

  /*
   * Look for valid disposition header.
   */

  disp = Ns_SetGet(set, "content-disposition");
  if (disp != NULL((void*)0) && GetValue(disp, "name=", &ks, &ke, &unescape) == NS_TRUE1) {
      const char *key = Ext2utf(&kds, ks, (size_t)(ke - ks), encoding, unescape);
      const char *value, *fs = NULL((void*)0), *fe = NULL((void*)0);

      if (key == NULL((void*)0)) {
          status = NS_ERROR;
          goto bailout;
      }
      Ns_Log(Debug, "ParseMultipartEntry disp '%s'", disp);

      if (GetValue(disp, "filename=", &fs, &fe, &unescape) == NS_FALSE0) {
          /*
           * Plain (non-file) entry.
           */
          if (valueEncoding == NULL((void*)0)) {
              valueEncoding = encoding;
          }
          Ns_Log(Debug, "ParseMultipartEntry LINE '%s'", start);
          value = Ext2utf(&vds, start, (size_t)(end - start), valueEncoding, unescape);
          if (value == NULL((void*)0)) {
              status = NS_ERROR;
              goto bailout;
          }
      } else {
          Tcl_HashEntry *hPtr;
          FormFile      *filePtr;
          Tcl_Interp    *interp = connPtr->itPtr->interp;

          assert(fs != NULL)((void) (0));
          value = Ext2utf(&vds, fs, (size_t)(fe - fs), encoding, unescape);
          if (value == NULL((void*)0)) {
              status = NS_ERROR;
              goto bailout;
          }

          hPtr = Tcl_CreateHashEntry(&connPtr->files, key, &isNew)(*((&connPtr->files)->createProc))(&connPtr->
files, (const char *)(key), &isNew);
          if (isNew != 0) {

              filePtr = ns_malloc(sizeof(FormFile));
              Tcl_SetHashValue(hPtr, filePtr)((hPtr)->clientData = (ClientData) (filePtr));

              filePtr->hdrObj = Tcl_NewListObj(0, NULL((void*)0));
              filePtr->offObj = Tcl_NewListObj(0, NULL((void*)0));
              filePtr->sizeObj = Tcl_NewListObj(0, NULL((void*)0));

              Tcl_IncrRefCount(filePtr->hdrObj)++(filePtr->hdrObj)->refCount;
              Tcl_IncrRefCount(filePtr->offObj)++(filePtr->offObj)->refCount;
              Tcl_IncrRefCount(filePtr->sizeObj)++(filePtr->sizeObj)->refCount;
          } else {
              filePtr = Tcl_GetHashValue(hPtr)((hPtr)->clientData);
          }

          (void) Ns_TclEnterSet(interp, set, NS_TCL_SET_DYNAMIC);
          (void) Tcl_ListObjAppendElement(interp, filePtr->hdrObj,
                                          Tcl_GetObjResult(interp));
          Tcl_ResetResult(connPtr->itPtr->interp);

          (void) Tcl_ListObjAppendElement(interp, filePtr->offObj,
                                          Tcl_NewIntObj((int)(start - connPtr->reqPtr->content)));

          (void) Tcl_ListObjAppendElement(interp, filePtr->sizeObj,
                                          Tcl_NewWideIntObj((Tcl_WideInt)(end - start)));
          set = NULL((void*)0);
      }
      Ns_Log(Debug, "ParseMultipartEntry sets '%s': '%s'", key, value);
      (void) Ns_SetPut(connPtr->query, key, value);
  }

  /*
   * Restore the end marker.
   */
bailout:
  *end = saveend;
  Tcl_DStringFree(&kds);
  Tcl_DStringFree(&vds);
  if (set != NULL((void*)0)) {
      Ns_SetFree(set);
  }

  return status;
717}

719
720/*
*----------------------------------------------------------------------
*
* GetBoundary --
*
*      Copy multipart/form-data boundary string, if any.
*
* Results:
*      NS_TRUE if boundary copied, NS_FALSE otherwise.
*
* Side effects:
*      Copies boundary string to given dstring.
*
*----------------------------------------------------------------------
*/

736static bool_Bool
737GetBoundary(Tcl_DString *dsPtr, const char *contentType)
738{
  const char *bs;
  bool_Bool        success = NS_FALSE0;

  NS_NONNULL_ASSERT(dsPtr != NULL)((void) (0));
  NS_NONNULL_ASSERT(contentType != NULL)((void) (0));

  if ((Ns_StrCaseFind(contentType, "multipart/form-data") != NULL((void*)0))
      && ((bs = Ns_StrCaseFind(contentType, "boundary=")) != NULL((void*)0))) {
      const char *be;

      bs += 9;
      be = bs;
      while ((*be != '\0') && (CHARTYPE(space, *be)(((*__ctype_b_loc ())[(int) (((int)((unsigned char)(*be))))] &
 (unsigned short int) _ISspace)) == 0)) {
          ++be;
      }
      Tcl_DStringAppend(dsPtr, "--", 2);
      Tcl_DStringAppend(dsPtr, bs, (int)(be - bs));
      success = NS_TRUE1;
  }
  return success;
759}

761
762/*
*----------------------------------------------------------------------
*
* NextBoundary --
*
*      Locate the next form boundary.
*
* Results:
*      Pointer to start of next input field or NULL on end of fields.
*
* Side effects:
*      None.
*
*----------------------------------------------------------------------
*/

778static char *
779NextBoundary(const Tcl_DString *dsPtr, char *s, const char *e)
780{
  char c, sc;
  const char *find;
  size_t len;

  NS_NONNULL_ASSERT(dsPtr != NULL)((void) (0));
  NS_NONNULL_ASSERT(s != NULL)((void) (0));
  NS_NONNULL_ASSERT(e != NULL)((void) (0));

  find = dsPtr->string;
  c = *find++;
  len = (size_t)(dsPtr->length - 1);
  e -= len;
  do {
      do {
          sc = *s++;
          if (s > e) {
              return NULL((void*)0);
          }
      } while (sc != c);
  } while (strncmp(s, find, len) != 0);
  s--;

  return s;
804}

806
807/*
*----------------------------------------------------------------------
*
* GetValue --
*
*      Determine start and end of a multipart form input value.
*
* Results:
*      NS_TRUE if attribute found and value parsed, NS_FALSE otherwise.
*
* Side effects:
*      Start and end are stored in given pointers, quoted character,
*      when it was preceded by a backslash.
*
*----------------------------------------------------------------------
*/

824static bool_Bool
825GetValue(const char *hdr, const char *att, const char **vsPtr, const char **vePtr, char *uPtr)
826{
  const char *s;
  bool_Bool        success = NS_TRUE1;

  NS_NONNULL_ASSERT(hdr != NULL)((void) (0));
  NS_NONNULL_ASSERT(att != NULL)((void) (0));
  NS_NONNULL_ASSERT(vsPtr != NULL)((void) (0));
  NS_NONNULL_ASSERT(vePtr != NULL)((void) (0));
  NS_NONNULL_ASSERT(uPtr != NULL)((void) (0));

  s = Ns_StrCaseFind(hdr, att);
  if (s == NULL((void*)0)) {
      success = NS_FALSE0;
  } else {
      const char *e;

      s += strlen(att);
      e = s;
      if (*s != '"' && *s != '\'') {
          /*
           * End of unquoted att=value is next space.
           */
          while (*e != '\0' && CHARTYPE(space, *e)(((*__ctype_b_loc ())[(int) (((int)((unsigned char)(*e))))] &
 (unsigned short int) _ISspace)) == 0) {
              ++e;
          }
          *uPtr = '\0';
      } else {
          bool_Bool escaped = NS_FALSE0;

          *uPtr = '\0';
          /*
           * End of quoted att="value" is next quote.  A quote within
           * the quoted string could be escaped with a backslash. In
           * case, an escaped quote was detected, report the quote
           * character as result.
           */
          ++e;
          while (*e != '\0' && (escaped || *e != *s)) {
              if (escaped) {
                  escaped = NS_FALSE0;
              } else if (*e == '\\') {
                  *uPtr = *s;
                  escaped = NS_TRUE1;
              }
              ++e;
          }
          ++s;
      }
      *vsPtr = s;
      *vePtr = e;
  }

  return success;
879}

881
882/*
*----------------------------------------------------------------------
*
* Ext2utf --
*
*      Convert input string to UTF.
*
* Results:
*      Pointer to converted string or NULL, when conversion to UTF-8 fails.
*
* Side effects:
*      Converted string is copied to given dString, overwriting
*      any previous content.
*
*----------------------------------------------------------------------
*/

899static char *
900Ext2utf(Tcl_DString *dsPtr, const char *start, size_t len, Tcl_Encoding encoding, char unescape)
901{
  char *buffer;

  NS_NONNULL_ASSERT(dsPtr != NULL)((void) (0));
  NS_NONNULL_ASSERT(start != NULL)((void) (0));

  if (encoding == NULL((void*)0)) {
      Tcl_DStringSetLength(dsPtr, 0);
      Tcl_DStringAppend(dsPtr, start, (int)len);
      buffer = dsPtr->string;
  } else {
      Tcl_DString ds;
      /*
       * Actual to UTF conversion.
       */
      if (NsEncodingIsUtf8(encoding) && !Ns_Valid_UTF8((const unsigned char *)start, len, &ds)) {
          Ns_Log(Warning, "form: multipart contains invalid UTF8: %s", ds.string);
          Tcl_DStringFree(&ds);
          buffer = NULL((void*)0);
      } else {
          /*
           * ExternalToUtfDString will re-init dstring.
           */
          Tcl_DStringFree(dsPtr);
          (void) Tcl_ExternalToUtfDString(encoding, start, (int)len, dsPtr);
          buffer = dsPtr->string;
      }
  }

  /*
   * In case the string contains backslash escaped characters, the
   * backslashes have to be removed. This will shorten the resulting
   * string.
   */
  if (buffer != NULL((void*)0) && unescape != '\0') {
    int i, j, l = (int)len;

    for (i = 0; i<l; i++) {
      if (buffer[i] == '\\' && buffer[i+1] == unescape) {
        for (j = i; j < l; j++) {
          buffer[j] = buffer[j+1];
        }
        l --;
      }
    }
    Tcl_DStringSetLength(dsPtr, l);
    buffer = dsPtr->string;
  }

  return buffer;
951}

953/*
* Local Variables:
* mode: c
* c-basic-offset: 4
* fill-column: 78
* indent-tabs-mode: nil
* End:
*/