connio.c

Bug Summary

File:	d/connio.c
Warning:	line 1046, column 31 Access out-of-bound array element (buffer overflow)
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name connio.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/home/isvv/naviserver/nsd -resource-dir /usr/local/lib/clang/15.0.0 -D _FORTIFY_SOURCE=2 -D NDEBUG -D SYSTEM_MALLOC -I ../include -I /usr/include/tcl8.6 -D HAVE_CONFIG_H -internal-isystem /usr/local/lib/clang/15.0.0/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/11/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O2 -std=c99 -fdebug-compilation-dir=/home/isvv/naviserver/nsd -ferror-limit 19 -stack-protector 2 -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -analyzer-checker alpha -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/scan-build-2022-07-23-130959-11103-1 -x c connio.c
1/*
* The contents of this file are subject to the Mozilla Public License
* Version 1.1 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
* http://mozilla.org/.
*
* Software distributed under the License is distributed on an "AS IS"
* basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
* the License for the specific language governing rights and limitations
* under the License.
*
* The Original Code is AOLserver Code and related documentation
* distributed by AOL.
*
* The Initial Developer of the Original Code is America Online,
* Inc. Portions created by AOL are Copyright (C) 1999 America Online,
* Inc. All Rights Reserved.
*
* Alternatively, the contents of this file may be used under the terms
* of the GNU General Public License (the "GPL"), in which case the
* provisions of GPL are applicable instead of those above.  If you wish
* to allow use of your version of this file only under the terms of the
* GPL and not to allow others to use your version of this file under the
* License, indicate your decision by deleting the provisions above and
* replace them with the notice and other provisions required by the GPL.
* If you do not delete the provisions above, a recipient may use your
* version of this file under either the License or the GPL.
*/


31/*
* connio.c --
*
*      Handle connection I/O.
*/

37#include "nsd.h"

39/*
* The following is used to allocate a buffer on the stack for
* encoding character data and for transferring data from disk to the
* network, and so defines the chunk size of writes to the network.
*/

45#define IOBUFSZ8192 8192

47/*
* The chunked encoding header consists of a hex number followed by
* CRLF (see e.g. RFC 2616 section 3.6.1). It has to fit the maximum
* number of digits of a 64 byte number is 8, plus CRLF + NULL.
*/
52#define MAX_CHARS_CHUNK_HEADER12 12


55/*
* Local functions defined in this file
*/

59static Ns_ReturnCode ConnSend(Ns_Conn *conn, ssize_t nsend, Tcl_Channel chan,
                            FILE *fp, int fd)
  NS_GNUC_NONNULL(1)__attribute__((__nonnull__(1)));

63static Ns_ReturnCode ConnCopy(const Ns_Conn *conn, size_t toCopy, Tcl_Channel chan,
                            FILE *fp, int fd)
  NS_GNUC_NONNULL(1)__attribute__((__nonnull__(1)));

67static bool_Bool CheckKeep(const Conn *connPtr)
  NS_GNUC_NONNULL(1)__attribute__((__nonnull__(1)));

70static int CheckCompress(const Conn *connPtr, const struct iovec *bufs, int nbufs, unsigned int ioflags)
  NS_GNUC_NONNULL(1)__attribute__((__nonnull__(1)));

73static bool_Bool HdrEq(const Ns_Set *set, const char *name, const char *value)
  NS_GNUC_NONNULL(1)__attribute__((__nonnull__(1))) NS_GNUC_NONNULL(2)__attribute__((__nonnull__(2))) NS_GNUC_NONNULL(3)__attribute__((__nonnull__(3)));

76
77/*
*----------------------------------------------------------------------
*
* Ns_ConnWriteChars, Ns_ConnWriteVChars --
*
*      This will write a string buffer to the conn.  The distinction
*      being that the given data is explicitly a UTF8 character
*      string, and will be put out in an 'encoding-aware' manner.  It
*      promises to write all of it.
*
* Results:
*      NS_OK if all data written, NS_ERROR otherwise.
*
* Side effects:
*      See Ns_ConnWriteVData().
*
*----------------------------------------------------------------------
*/

96Ns_ReturnCode
97Ns_ConnWriteChars(Ns_Conn *conn, const char *buf, size_t toWrite, unsigned int flags)
98{
  struct iovec sbuf;

  sbuf.iov_base = (void *) buf;
  sbuf.iov_len  = toWrite;
  return Ns_ConnWriteVChars(conn, &sbuf, 1, flags);
104}

106Ns_ReturnCode
107Ns_ConnWriteVChars(Ns_Conn *conn, struct iovec *bufs, int nbufs, unsigned int flags)
108{
  Conn              *connPtr   = (Conn *) conn;
  Ns_DStringTcl_DString         encDs, gzDs;
  struct iovec       iov;
  Ns_ReturnCode      status;

  Ns_DStringInitTcl_DStringInit(&encDs);
  Ns_DStringInitTcl_DStringInit(&gzDs);

  /*
   * Transcode to charset if necessary. In earlier versions, the
   * transcoding was guarded by "!NsEncodingIsUtf8()", which was an
   * optimization. However, we cannot assume that the internal Tcl
   * UTF-8 is the same as an external, especially for emoji and
   * other multibyte characters.
   */

  if (connPtr->outputEncoding != NULL((void*)0)
      && nbufs > 0
      && bufs[0].iov_len > 0u) {
      int i;

      for (i = 0; i < nbufs; i++) {
          const char *utfBytes;
          size_t      utfLen;

          utfBytes = bufs[i].iov_base;
          utfLen   = bufs[i].iov_len;

          if (utfLen > 0u) {
              (void) Tcl_UtfToExternalDString(connPtr->outputEncoding,
                                              utfBytes, (int)utfLen, &encDs);
          }
      }
      (void)Ns_SetVec(&iov, 0, encDs.string, (size_t)encDs.length);
      bufs = &iov;
      nbufs = 1;
  }

  /*
   * Compress if possible.
   */

  if (connPtr->compress < 0) {
      connPtr->compress = CheckCompress(connPtr, bufs, nbufs, flags);
  }
  if (connPtr->compress > 0
      && (nbufs > 0 || (flags & NS_CONN_STREAM_CLOSE0x080u) != 0u)
      ) {
      bool_Bool flush = ((flags & NS_CONN_STREAM0x040u) == 0u);

      if (Ns_CompressBufsGzip(&connPtr->cStream, bufs, nbufs, &gzDs,
                              connPtr->compress, flush) == NS_OK) {
          /* NB: Compression will always succeed. */
          (void)Ns_SetVec(&iov, 0, gzDs.string, (size_t)gzDs.length);
          bufs = &iov;
          nbufs = 1;
      }
  }

  status = Ns_ConnWriteVData(conn, bufs, nbufs, flags);

  Ns_DStringFreeTcl_DStringFree(&encDs);
  Ns_DStringFreeTcl_DStringFree(&gzDs);

  return status;
174}


177
178/*
*----------------------------------------------------------------------
*
* CheckCompress --
*
*      Is compression enabled, and at what level.
*
* Results:
*      compress level 0-9
*
* Side effects:
*      May set the Content-Encoding and Vary headers.
*
*----------------------------------------------------------------------
*/

194static int
195CheckCompress(const Conn *connPtr, const struct iovec *bufs, int nbufs, unsigned int ioflags)
196{
  const Ns_Conn  *conn = (Ns_Conn *) connPtr;
  const NsServer *servPtr;
  int             configuredCompressionLevel, compressionLevel = 0;

  NS_NONNULL_ASSERT(connPtr != NULL)((void) (0));

  servPtr = connPtr->poolPtr->servPtr;

  /*
   * Check the default setting and explicit override.
   */
  configuredCompressionLevel = Ns_ConnGetCompression(conn);

  if (configuredCompressionLevel > 0) {
      /*
       * Make sure the length is above the minimum threshold, or
       * we're streaming (assume length is long enough for streams).
       */
      if (((ioflags & NS_CONN_STREAM0x040u) != 0u)
          || (bufs != NULL((void*)0) && Ns_SumVec(bufs, nbufs) >= (size_t)servPtr->compress.minsize)
          || connPtr->responseLength >= servPtr->compress.minsize) {
          /*
           * We won't be compressing if there are no headers or body.
           */
          if (((connPtr->flags & NS_CONN_SENTHDRS0x010u) == 0u)
              && ((connPtr->flags & NS_CONN_SKIPBODY0x004u) == 0u)) {
              Ns_ConnSetHeaders(conn, "Vary", "Accept-Encoding");

              if ((connPtr->flags & NS_CONN_ZIPACCEPTED0x10000u) != 0u) {
                  Ns_ConnSetHeaders(conn, "Content-Encoding", "gzip");
                  compressionLevel = configuredCompressionLevel;
              }
          }
      }
  }
  return compressionLevel;
233}

235
236/*
*----------------------------------------------------------------------
*
* Ns_ConnWriteData, Ns_ConnWriteVData --
*
*      Send zero or more buffers of raw bytes to the client, possibly
*      using the HTTP chunked encoding if flags includes
*      NS_CONN_STREAM.
*
*      Ns_ConnWriteVData() is called with (nbufs == 0) to flush
*      headers.
*
* Results:
*      NS_OK if all data written, NS_ERROR otherwise.
*
* Side effects:
*      HTTP headers are constructed and sent on first call.
*
*----------------------------------------------------------------------
*/

257Ns_ReturnCode
258Ns_ConnWriteData(Ns_Conn *conn, const void *buf, size_t toWrite, unsigned int flags)
259{
  struct iovec vbuf;

  vbuf.iov_base = (void *) buf;
  vbuf.iov_len  = toWrite;

  return Ns_ConnWriteVData(conn, &vbuf, 1, flags);
266}

268Ns_ReturnCode
269Ns_ConnWriteVData(Ns_Conn *conn, struct iovec *bufs, int nbufs, unsigned int flags)
270{
  Ns_DStringTcl_DString    ds;
  int           nsbufs, sbufIdx;
  size_t        bodyLength, toWrite, neededBufs;
  ssize_t       nwrote;
  struct iovec  sbufs[32], *sbufPtr;
  char          hdr[MAX_CHARS_CHUNK_HEADER12]; /* Address of this
                                                variable might be
                                                used in
                                                Ns_ConnSend(),
                                                therefore, we cannot
                                                reduce scope. */

  NS_NONNULL_ASSERT(conn != NULL)((void) (0));
  //NS_NONNULL_ASSERT(bufs != NULL);

  Ns_DStringInitTcl_DStringInit(&ds);

  /*
   * Make sure there's enough send buffers to contain the given
   * buffers, a set of optional HTTP headers, and an optional HTTP
   * chunked header/footer pair. Use the stack if possible.
   */

  neededBufs = (size_t)nbufs + 2u + 1u;
  if (neededBufs > (sizeof(sbufs) / sizeof(struct iovec))) {
      sbufPtr = ns_calloc(neededBufs, sizeof(struct iovec));
  } else {
      sbufPtr = sbufs;
  }
  nsbufs = 0;
  sbufIdx = 0;

  /*
   * Work out the body length for non-chunking case.
   */

  bodyLength = (bufs != NULL((void*)0)) ? Ns_SumVec(bufs, nbufs) : 0u;
  toWrite = 0u;

  if ((flags & NS_CONN_STREAM0x040u) != 0u) {
      conn->flags |= NS_CONN_STREAM0x040u;
  }

  /*
   * Send headers if not already sent.
   */

  if (((conn->flags & NS_CONN_SENTHDRS0x010u) == 0u)) {
      conn->flags |= NS_CONN_SENTHDRS0x010u;
      if (Ns_CompleteHeaders(conn, bodyLength, flags, &ds) == NS_TRUE1) {
          toWrite += Ns_SetVec(sbufPtr, sbufIdx++,
                               Ns_DStringValue(&ds)((&ds)->string),
                               (size_t)Ns_DStringLength(&ds)((&ds)->length));
          nsbufs++;
      }
  }

  /*
   * Send body.
   */

  if ((conn->flags & NS_CONN_SKIPBODY0x004u) == 0u) {

      if ((conn->flags & NS_CONN_CHUNK0x100u) == 0u) {

          /*
           * Output content without chunking header/trailers.
           */

          if (sbufIdx == 0) {
              sbufPtr = bufs;
              nsbufs = nbufs;
          } else if (nbufs > 0) {
              NS_NONNULL_ASSERT(bufs != NULL)((void) (0));
              (void) memcpy(sbufPtr + sbufIdx, bufs, (size_t)nbufs * sizeof(struct iovec));
              nsbufs += nbufs;
          }
          toWrite += bodyLength;

      } else {

          /*
           * Output content with chunking header/trailers.
           */

          if (bodyLength > 0u) {
              size_t len;

              assert(nbufs > 0)((void) (0));
              assert(bufs != NULL)((void) (0));

              /*
               * Output length header followed by content and then
               * trailer.
               */
              len = (size_t)snprintf(hdr, sizeof(hdr), "%lx\r\n", (unsigned long)bodyLength)__builtin___snprintf_chk (hdr, sizeof(hdr), 2 - 1, __builtin_object_size
 (hdr, 2 > 1), "%lx\r\n", (unsigned long)bodyLength);
              toWrite += Ns_SetVec(sbufPtr, sbufIdx++, hdr, len);

              (void) memcpy(sbufPtr + sbufIdx, bufs, (size_t)nbufs * sizeof(struct iovec));
              sbufIdx += nbufs;
              toWrite += bodyLength;

              toWrite += Ns_SetVec(sbufPtr, sbufIdx++, "\r\n", (size_t)2);

              nsbufs += nbufs + 2;
          }

          if ((flags & NS_CONN_STREAM_CLOSE0x080u) != 0u) {
              /*
               * Output end-of-content trailer for chunked encoding
               */

              toWrite += Ns_SetVec(sbufPtr, sbufIdx, "0\r\n\r\n", (size_t)5);

              nsbufs += 1;
              conn->flags &= ~NS_CONN_STREAM0x040u;
              conn->flags |= NS_CONN_SENT_LAST_CHUNK0x200u;
          }
      }
  }

  /*
   * Write the output buffer.
   */

  nwrote = Ns_ConnSend(conn, sbufPtr, nsbufs);

  Ns_DStringFreeTcl_DStringFree(&ds);
  if (sbufPtr != sbufs && sbufPtr != bufs) {
      ns_free(sbufPtr);
  }

  return (nwrote < (ssize_t)toWrite) ? NS_ERROR : NS_OK;
404}

406
407/*
*----------------------------------------------------------------------
*
* Ns_ConnSendChannel, Fp, Fd --
*
*      Send some number of bytes to an open channel, FILE or fd.
*      If the number is negative, send until EOF condition on source.
*
* Results:
*      NS_OK/NS_ERROR.
*
* Side effects:
*      See ConnSend().
*
*----------------------------------------------------------------------
*/

424Ns_ReturnCode
425Ns_ConnSendChannel(Ns_Conn *conn, Tcl_Channel chan, ssize_t nsend)
426{
  return ConnSend(conn, nsend, chan, NULL((void*)0), -1);
428}

430Ns_ReturnCode
431Ns_ConnSendFp(Ns_Conn *conn, FILE *fp, ssize_t nsend)
432{
  return ConnSend(conn, nsend, NULL((void*)0), fp, -1);
434}

436Ns_ReturnCode
437Ns_ConnSendFd(Ns_Conn *conn, int fd, ssize_t nsend)
438{
  return ConnSend(conn, nsend, NULL((void*)0), NULL((void*)0), fd);
440}

442
443/*
*----------------------------------------------------------------------
*
* ConnSend --
*
*      Send an open channel, FILE or fd. Read the content from the
*      various sources into a buffer and send the data to the client
*      via Ns_ConnWriteVData(). Stop transmission on error, when all
*      requested data was sent or EOF condition on channel/FILE/fd.
*
* Results:
*      NS_OK/NS_ERROR.
*
* Side effects:
*      Send data to client
*
*----------------------------------------------------------------------
*/
461static Ns_ReturnCode
462ConnSend(Ns_Conn *conn, ssize_t nsend, Tcl_Channel chan, FILE *fp, int fd)
463{
  Ns_ReturnCode status;
  unsigned int flags = 0;

  NS_NONNULL_ASSERT(conn != NULL)((void) (0));
  assert(chan != NULL || fp != NULL || fd > -1)((void) (0));

  if (nsend == 0) {
      /*
       * Even if no data to send, ensure HTTP response headers get written.
       */
      status = Ns_ConnWriteVData(conn, NULL((void*)0), 0, flags);

  } else {
      bool_Bool stream = NS_FALSE0, eod = NS_FALSE0;
      char buf[IOBUFSZ8192];
      struct iovec vbuf;

      vbuf.iov_base = (void *)buf;

      /*
       * Turn-on http-streaming for unknown content/data length
       */
      if (nsend == -1) {
          stream = NS_TRUE1;
          flags |= NS_CONN_STREAM0x040u;
      }

      /*
       * Read from disk and send in (max) IOBUFSZ chunks until
       * all requested data was sent or until EOF condition on source.
       */

      status = NS_OK;

      while (status == NS_OK && (nsend > 0 || (stream && !eod))) {
          ssize_t nread = 0;
          size_t  toRead = 0;

          if (stream) {
              toRead = sizeof(buf);
          } else {
              toRead = ((size_t)nsend > sizeof(buf)) ? sizeof(buf) : (size_t)nsend;
          }
          if (chan != NULL((void*)0)) {
              nread = Tcl_Read(chan, buf, (int)toRead);
              if (stream && Tcl_Eof(chan)) {
                  eod = NS_TRUE1;
              }
          } else if (fp != NULL((void*)0)) {
              nread = (int)fread(buf, 1u, toRead, fp);
              if (ferror(fp)) {
                  nread = -1;
              } else if (stream && feof(fp)) {
                  eod = NS_TRUE1;
              }
          } else if (fd > -1) {
              nread = ns_readread(fd, buf, toRead);
              if (stream && nread == 0) {
                  eod = NS_TRUE1;
              }
          } else {
              status = NS_ERROR; /* Should never be reached */
          }
          if (nread == -1 || (!stream && nread == 0) /* NB: truncated file */) {
              status = NS_ERROR;
          } else if (nread > 0) {
              vbuf.iov_len = (size_t)nread;
              status = Ns_ConnWriteVData(conn, &vbuf, 1, flags);
              if (status == NS_OK && !stream) {
                  nsend -= nread;
              }
          }
      }
  }

  return status;
540}

542
543/*
*----------------------------------------------------------------------
*
* Ns_ConnSendFileVec --
*
*      Send a vector of file buffers directly to the connection socket.
*      Promises to send all of the data.
*
* Results:
*      NS_OK if all data sent, NS_ERROR otherwise.
*
* Side effects:
*      Will update connPtr->nContentSent.
*
*----------------------------------------------------------------------
*/

560Ns_ReturnCode
561Ns_ConnSendFileVec(Ns_Conn *conn, Ns_FileVec *bufs, int nbufs)
562{
  Conn        *connPtr;
  Sock        *sockPtr;
  int          i;
  size_t       nwrote = 0u, towrite = 0u;
  Ns_Time      waitTimeout;

  NS_NONNULL_ASSERT(conn != NULL)((void) (0));
  NS_NONNULL_ASSERT(bufs != NULL)((void) (0));

  connPtr = (Conn *)conn;
  sockPtr = (Sock *)connPtr->sockPtr;

  NS_NONNULL_ASSERT(sockPtr != NULL)((void) (0));
  NS_NONNULL_ASSERT(sockPtr->drvPtr != NULL)((void) (0));

  waitTimeout.sec  = sockPtr->drvPtr->sendwait.sec;
  waitTimeout.usec = sockPtr->drvPtr->sendwait.usec;

  for (i = 0; i < nbufs; i++) {
      towrite += bufs[i].length;
  }

  while (nwrote < towrite) {
      ssize_t sent;

      sent = NsDriverSendFile(sockPtr, bufs, nbufs, 0u);
      if (sent == -1) {
          break;
      }
      nwrote += (size_t)sent;
      if (nwrote < towrite) {
          Ns_Sock *sock = (Ns_Sock *)sockPtr;

          if (sent > 0) {
              (void)Ns_ResetFileVec(bufs, nbufs, (size_t)sent);
          }
          if (Ns_SockTimedWait(sock->sock, NS_SOCK_WRITE,
                               &waitTimeout) != NS_OK) {
              break;
          }
      }
  }

  if (likely(nwrote > 0u)(__builtin_expect((nwrote > 0u), 1))) {
      connPtr->nContentSent += nwrote;
  }

  return (nwrote != towrite) ? NS_ERROR : NS_OK;
611}


614
615/*
*----------------------------------------------------------------------
*
* Ns_ConnPuts --
*
*      Write a null-terminated string directly to the conn; no
*      trailing newline will be appended despite the name.
*
* Results:
*      NS_OK or NS_ERROR.
*
* Side effects:
*      See Ns_ConnWriteVData().
*
*----------------------------------------------------------------------
*/

632Ns_ReturnCode
633Ns_ConnPuts(Ns_Conn *conn, const char *s)
634{
  struct iovec vbuf;

  NS_NONNULL_ASSERT(conn != NULL)((void) (0));
  NS_NONNULL_ASSERT(s != NULL)((void) (0));

  vbuf.iov_base = (void *) s;
  vbuf.iov_len  = strlen(s);

  return Ns_ConnWriteVData(conn, &vbuf, 1, NS_CONN_STREAM0x040u);
644}

646
647/*
*----------------------------------------------------------------------
*
* Ns_ConnSendDString --
*
*      Write contents of a DString directly to the conn.
*
* Results:
*      NS_OK or NS_ERROR.
*
* Side effects:
*      See Ns_ConnWriteVData().
*
*----------------------------------------------------------------------
*/

663Ns_ReturnCode
664Ns_ConnSendDString(Ns_Conn *conn, const Ns_DStringTcl_DString *dsPtr)
665{
  struct iovec vbuf;

  NS_NONNULL_ASSERT(conn != NULL)((void) (0));
  NS_NONNULL_ASSERT(dsPtr != NULL)((void) (0));

  vbuf.iov_base = dsPtr->string;
  vbuf.iov_len  = (size_t)dsPtr->length;

  return Ns_ConnWriteVData(conn, &vbuf, 1, NS_CONN_STREAM0x040u);
675}

677
678/*
*----------------------------------------------------------------------
*
* Ns_ConnSend --
*
*      Send buffers to the connection socket efficiently.
*      It promises to send all data.
*
* Results:
*      Number of bytes sent, -1 on error.
*
* Side effects:
*      Will update connPtr->nContentSent.
*
*----------------------------------------------------------------------
*/

695ssize_t
696Ns_ConnSend(Ns_Conn *conn, struct iovec *bufs, int nbufs)
697{
  ssize_t  sent;
  int      i;
  size_t   towrite = 0u;

  for (i = 0; i < nbufs; i++) {
      towrite += bufs[i].iov_len;
  }

  if (towrite == 0u) {
      sent = 0;

  } else if (NsWriterQueue(conn, towrite, NULL((void*)0), NULL((void*)0), NS_INVALID_FD(-1),
                           bufs, nbufs, NULL((void*)0), 0, NS_FALSE0) == NS_OK) {
      Ns_Log(Debug, "==== writer sent %" PRIuz"zu" " bytes\n", towrite);
      sent = (ssize_t)towrite;

  } else {
      Ns_Time  waitTimeout;
      Conn    *connPtr;
      Sock    *sockPtr;

      NS_NONNULL_ASSERT(conn != NULL)((void) (0));

      connPtr = (Conn *)conn;
      sockPtr = connPtr->sockPtr;

      NS_NONNULL_ASSERT(sockPtr != NULL)((void) (0));
      NS_NONNULL_ASSERT(sockPtr->drvPtr != NULL)((void) (0));

      waitTimeout.sec  = sockPtr->drvPtr->sendwait.sec;
      waitTimeout.usec = sockPtr->drvPtr->sendwait.usec;

      sent = Ns_SockSendBufs((Ns_Sock*)sockPtr, bufs, nbufs, &waitTimeout, 0u);

      if (likely(sent > 0)(__builtin_expect((sent > 0), 1))) {
          connPtr->nContentSent += (size_t)sent;
      }
      NsPoolAddBytesSent(((Conn *)conn)->poolPtr,  (Tcl_WideInt)connPtr->nContentSent);
  }

  return sent;
739}

741
742/*
*----------------------------------------------------------------------
*
* Ns_ConnFlushContent --
*
*      Finish reading waiting content.
*
* Results:
*      NS_OK.
*
* Side effects:
*      None.
*
*----------------------------------------------------------------------
*/

758Ns_ReturnCode
759Ns_ConnFlushContent(const Ns_Conn *conn)
760{
  const Conn   *connPtr = (const Conn *) conn;
  Request      *reqPtr = connPtr->reqPtr;
  Ns_ReturnCode status = NS_OK;

  if (connPtr->sockPtr == NULL((void*)0)) {
      status = NS_ERROR;
  } else {
      reqPtr->next  += reqPtr->avail;
      reqPtr->avail  = 0u;
  }
  return status;
772}

774
775/*
*-----------------------------------------------------------------
*
* Ns_ConnClose --
*
*      Return a connection to the driver thread for close or
*      keep-alive.
*
* Results:
*      Always NS_OK.
*
* Side effects:
*      May trigger writing http-chunked trailer.
*      Tcl at-close callbacks may run.
*
*-----------------------------------------------------------------
*/

793Ns_ReturnCode
794Ns_ConnClose(Ns_Conn *conn)
795{
  Conn *connPtr;

  NS_NONNULL_ASSERT(conn != NULL)((void) (0));

  connPtr = (Conn *) conn;
  Ns_Log(Debug, "Ns_ConnClose %p stream %.6x chunk %.6x via writer %.6x sockPtr %p",
         (void *)connPtr,
         connPtr->flags & NS_CONN_STREAM0x040u,
         connPtr->flags & NS_CONN_CHUNK0x100u,
         connPtr->flags & NS_CONN_SENT_VIA_WRITER0x400u,
         (void *)connPtr->sockPtr);

  if (connPtr->sockPtr != NULL((void*)0)) {

      if ((connPtr->flags & NS_CONN_STREAM0x040u) != 0u
          && ((connPtr->flags & NS_CONN_CHUNK0x100u) != 0u
              || (connPtr->compress > 0)
              )) {
          /*
           * Streaming:
           *   In chunked mode, write the end-of-content trailer.
           *   If compressing, write the gzip footer.
           */
          (void) Ns_ConnWriteVChars(conn, NULL((void*)0), 0, NS_CONN_STREAM_CLOSE0x080u);
      }

      /*
       * Close the connection to the client either here or in the
       * writer thread.
       */
      if ((connPtr->flags & NS_CONN_SENT_VIA_WRITER0x400u) == 0u) {
          NsSockClose(connPtr->sockPtr, connPtr->keep);
      }


      connPtr->sockPtr = NULL((void*)0);
      connPtr->flags |= NS_CONN_CLOSED0x001u;
      Ns_Log(Ns_LogRequestDebug, "connection closed");

      if (connPtr->itPtr != NULL((void*)0)) {
          NsTclRunAtClose(connPtr->itPtr);
      }
  }

  return NS_OK;
841}

843
844/*
*----------------------------------------------------------------------
*
* Ns_ConnWrite, Ns_WriteConn, Ns_WriteCharConn --
*
*      Deprecated.
*
* Results:
*      #bytes / NS_OK / NS_ERROR
*
* Side effects:
*      See Ns_ConnWrite*
*
*----------------------------------------------------------------------
*/

860int
861Ns_ConnWrite(Ns_Conn *conn, const void *buf, size_t toWrite)
862{
  const Conn   *connPtr = (const Conn *) conn;
  size_t        n;
  Ns_ReturnCode status;
  int           result;
  struct iovec  vbuf;

  vbuf.iov_base = (void *) buf;
  vbuf.iov_len  = toWrite;

  n = connPtr->nContentSent;
  status = Ns_ConnWriteVData(conn, &vbuf, 1, 0u);
  if (status == NS_OK) {
      result = (int)connPtr->nContentSent - (int)n;
  } else {
      result = -1;
  }
  return result;
880}

882Ns_ReturnCode
883Ns_WriteConn(Ns_Conn *conn, const char *buf, size_t toWrite)
884{
  struct iovec vbuf;

  /* Deprecated for Ns_ConnWriteVData */

  NS_NONNULL_ASSERT(conn != NULL)((void) (0));

  vbuf.iov_base = (void *) buf;
  vbuf.iov_len  = toWrite;

  return Ns_ConnWriteVData(conn, &vbuf, 1, NS_CONN_STREAM0x040u);
895}

897Ns_ReturnCode
898Ns_WriteCharConn(Ns_Conn *conn, const char *buf, size_t toWrite)
899{
  struct iovec sbuf;

  sbuf.iov_base = (void *)buf;
  sbuf.iov_len = toWrite;

  return Ns_ConnWriteVChars(conn, &sbuf, 1, NS_CONN_STREAM0x040u);
906}

908
909/*
*----------------------------------------------------------------------
*
* Ns_ConnGets --
*
*      Read in a string from a connection, stopping when either we've
*      run out of data, hit a newline, or had an error.
*
* Results:
*      Pointer to given buffer or NULL on error.
*
* Side effects:
*
*
*----------------------------------------------------------------------
*/

926char *
927Ns_ConnGets(char *buf, size_t bufsize, const Ns_Conn *conn)
928{
  char *p, *result = buf;

  NS_NONNULL_ASSERT(buf != NULL)((void) (0));
  NS_NONNULL_ASSERT(conn != NULL)((void) (0));

  p = buf;
  while (bufsize > 1u) {
      if (Ns_ConnRead(conn, p, 1u) != 0u) {
          result = NULL((void*)0);
          break;
      }
      if (*p++ == '\n') {
          break;
      }
      --bufsize;
  }
  if (likely(result != NULL)(__builtin_expect((result != ((void*)0)), 1))) {
      *p = '\0';
  }

  return result;
950}

952
953/*
*----------------------------------------------------------------------
*
* Ns_ConnRead --
*
*      Copy data from read-ahead buffers.
*
* Results:
*      Number of bytes copied.
*
* Side effects:
*      None.
*
*----------------------------------------------------------------------
*/

969size_t
970Ns_ConnRead(const Ns_Conn *conn, void *vbuf, size_t toRead)
971{
  const Conn *connPtr = (const Conn *) conn;
  Request    *reqPtr = connPtr->reqPtr;

  if (connPtr->sockPtr == NULL((void*)0)) {
      toRead = 0u;
  } else {
      if (toRead > reqPtr->avail) {
          toRead = reqPtr->avail;
      }
      memcpy(vbuf, reqPtr->next, toRead);
      reqPtr->next  += toRead;
      reqPtr->avail -= toRead;
  }

  return toRead;
987}

989
990/*
*----------------------------------------------------------------------
*
* Ns_ConnReadLine --
*
*      Read a line (\r\n or \n terminated) from the conn.
*
* Results:
*      NS_OK if a line was read.  NS_ERROR if no line ending
*      was found or the line would be too long.
*
* Side effects:
*      Stuff may be read
*
*----------------------------------------------------------------------
*/

1007Ns_ReturnCode
1008Ns_ConnReadLine(const Ns_Conn *conn, Ns_DStringTcl_DString *dsPtr, size_t *nreadPtr)
1009{
  const Conn   *connPtr;
  Request      *reqPtr;
  const Driver *drvPtr;
  const char   *eol;
  Ns_ReturnCode status;

  NS_NONNULL_ASSERT(conn != NULL)((void) (0));
  NS_NONNULL_ASSERT(dsPtr != NULL)((void) (0));

  connPtr = (const Conn *) conn;
  reqPtr = connPtr->reqPtr;
  assert(reqPtr != NULL)((void) (0));

  drvPtr = connPtr->drvPtr;
  eol = strchr(reqPtr->next, INTCHAR('\n')((int)((unsigned char)(('\n')))));

  if ((connPtr->sockPtr == NULL((void*)0)) || (eol == NULL((void*)0))) {
4
←
Assuming field 'sockPtr' is not equal to NULL→
5
←
Assuming 'eol' is not equal to NULL→
6
←
Taking false branch→
      status = NS_ERROR;
  } else {
      ptrdiff_t nread = eol - reqPtr->next;

      if (nread > drvPtr->maxline) {
7
←
Assuming 'nread' is <= field 'maxline'→
8
←
Taking false branch→
          status = NS_ERROR;
      } else {
          ptrdiff_t ncopy = nread;

          ++nread;
          if (nreadPtr8.1
'nreadPtr' is not equal to NULL
 != NULL((void*)0)) {
9
←
Taking true branch→
              *nreadPtr = (size_t)nread;
          }

          /*
           * Read from the end of the buffer until we either reach
           * ncopy == 0 (this means the start of the buffer), or
           * until we find a '\r'.
           */
          if (ncopy > 0u && *(eol-1) == '\r') {
10
←
Assuming 'ncopy' is > 0→
11
←
Access out-of-bound array element (buffer overflow)
              --ncopy;
          }
          Ns_DStringNAppendTcl_DStringAppend(dsPtr, reqPtr->next, (int)ncopy);
          reqPtr->next  += nread;
          reqPtr->avail -= (size_t)nread;

          status = NS_OK;
      }
  }
  return status;
1057}

1059
1060/*
*----------------------------------------------------------------------
*
* Ns_ConnReadHeaders --
*
*      Read the headers and insert them into the passed-in set.
*
* Results:
*      NS_OK/NS_ERROR
*
* Side effects:
*      Stuff will be read from the conn.
*
*----------------------------------------------------------------------
*/

1076Ns_ReturnCode
1077Ns_ConnReadHeaders(const Ns_Conn *conn, Ns_Set *set, size_t *nreadPtr)
1078{
  Ns_DStringTcl_DString      ds;
  const Conn     *connPtr = (const Conn *) conn;
  size_t          nread, maxhdr;
  Ns_ReturnCode   status = NS_OK;

  Ns_DStringInitTcl_DStringInit(&ds);
  nread = 0u;
  maxhdr = (size_t)connPtr->drvPtr->maxheaders;
  while (nread < maxhdr && status == NS_OK) {
1
Assuming 'nread' is < 'maxhdr'→
2
←
Loop condition is true.  Entering loop body→
      size_t nline;

      Ns_DStringSetLengthTcl_DStringSetLength(&ds, 0);
      status = Ns_ConnReadLine(conn, &ds, &nline);
3
←
Calling 'Ns_ConnReadLine'→
      if (status == NS_OK) {
          nread += nline;
          if (nread > maxhdr) {
              status = NS_ERROR;
          } else {
              if (ds.string[0] == '\0') {
                  break;
              }
              status = Ns_ParseHeader(set, ds.string, NULL((void*)0),
                                      connPtr->poolPtr->servPtr->opts.hdrcase,
                                      NULL((void*)0));
          }
      }
  }
  if (nreadPtr != NULL((void*)0)) {
      *nreadPtr = nread;
  }
  Ns_DStringFreeTcl_DStringFree(&ds);

  return status;
1112}

1114
1115/*
*----------------------------------------------------------------------
*
* Ns_ConnCopyToDString --
*
*      Copy data from a connection to a dstring.
*
* Results:
*      NS_OK or NS_ERROR
*
* Side effects:
*      None.
*
*----------------------------------------------------------------------
*/

1131Ns_ReturnCode
1132Ns_ConnCopyToDString(const Ns_Conn *conn, size_t toCopy, Ns_DStringTcl_DString *dsPtr)
1133{
  const Conn    *connPtr;
  Request       *reqPtr;
  Ns_ReturnCode  status = NS_OK;

  NS_NONNULL_ASSERT(conn != NULL)((void) (0));
  NS_NONNULL_ASSERT(dsPtr != NULL)((void) (0));

  connPtr = (const Conn *)conn;
  reqPtr = connPtr->reqPtr;

  if (connPtr->sockPtr == NULL((void*)0) || reqPtr->avail < toCopy) {
      status = NS_ERROR;
  } else {
      Ns_DStringNAppendTcl_DStringAppend(dsPtr, reqPtr->next, (int)toCopy);
      reqPtr->next  += toCopy;
      reqPtr->avail -= toCopy;
  }

  return status;
1153}

1155
1156/*
*----------------------------------------------------------------------
*
* Ns_ConnCopyToFile, Fd, Channel --
*
*      Copy data from a connection to a channel, FILE, or fd.
*
* Results:
*      NS_OK or NS_ERROR
*
* Side effects:
*      See ConnCopy().
*
*----------------------------------------------------------------------
*/

1172Ns_ReturnCode
1173Ns_ConnCopyToChannel(const Ns_Conn *conn, size_t ncopy, Tcl_Channel chan)
1174{
  return ConnCopy(conn, ncopy, chan, NULL((void*)0), -1);
1176}

1178Ns_ReturnCode
1179Ns_ConnCopyToFile(const Ns_Conn *conn, size_t ncopy, FILE *fp)
1180{
  return ConnCopy(conn, ncopy, NULL((void*)0), fp, -1);
1182}

1184Ns_ReturnCode
1185Ns_ConnCopyToFd(const Ns_Conn *conn, size_t ncopy, int fd)
1186{
  return ConnCopy(conn, ncopy, NULL((void*)0), NULL((void*)0), fd);
1188}

1190static Ns_ReturnCode
1191ConnCopy(const Ns_Conn *conn, size_t toCopy, Tcl_Channel chan, FILE *fp, int fd)
1192{
  const Conn   *connPtr;
  Request      *reqPtr;
  size_t        ncopy = toCopy;
  Ns_ReturnCode status = NS_OK;

  NS_NONNULL_ASSERT(conn != NULL)((void) (0));

  connPtr = (const Conn *) conn;
  reqPtr = connPtr->reqPtr;
  assert(reqPtr != NULL)((void) (0));

  if (connPtr->sockPtr == NULL((void*)0) || reqPtr->avail < toCopy) {
      status = NS_ERROR;
  } else {
      /*
       * There is data to copy.
       */
      while (ncopy > 0u) {
          ssize_t nwrote;

          /*
           * Write it to the chan, or fp, or fd, depending on what
           * was provided.
           */
          if (chan != NULL((void*)0)) {
              nwrote = Tcl_Write(chan, reqPtr->next, (int)ncopy);
          } else if (fp != NULL((void*)0)) {
              nwrote = (ssize_t)fwrite(reqPtr->next, 1u, ncopy, fp);
              if (ferror(fp) != 0) {
                  nwrote = -1;
              }
          } else {
              nwrote = ns_writewrite(fd, reqPtr->next, ncopy);
          }
          if (nwrote < 0) {
              status = NS_ERROR;
              break;
          } else {
              ncopy -= (size_t)nwrote;
              reqPtr->next  += nwrote;
              reqPtr->avail -= (size_t)nwrote;
          }
      }
  }
  return status;
1238}

1240
1241/*
*----------------------------------------------------------------------
*
* Ns_CompleteHeaders --
*
*      Construct a set of headers including length, connection and
*      transfer-encoding and then dump them to the dstring.
*
* Results:
*      1 if headers were dumped to dstring, 0 otherwise.
*
* Side effects:
*      The connections STREAM and/or CHUNK flags may be set.
*
*----------------------------------------------------------------------
*/

1258bool_Bool
1259Ns_CompleteHeaders(Ns_Conn *conn, size_t dataLength,
                 unsigned int flags, Ns_DStringTcl_DString *dsPtr)
1261{
  Conn       *connPtr = (Conn *) conn;
  bool_Bool        success;

  NS_NONNULL_ASSERT(conn != NULL)((void) (0));
  NS_NONNULL_ASSERT(dsPtr != NULL)((void) (0));

  if ((conn->flags & NS_CONN_SKIPHDRS0x002u) != 0u) {
      /*
       * Pre-HTTP/1.0 has no headers, and no keep-alive
       */
      if (conn->request.version < 1.0) {
          connPtr->keep = 0;
      }
      success = NS_FALSE0;
  } else {
      const char *keepString;

      /*
       * Check for streaming vs. non-streaming.
       */

      if ((flags & NS_CONN_STREAM0x040u) != 0u) {

          conn->flags |= NS_CONN_STREAM0x040u;

          if ((connPtr->responseLength < 0)
              && (conn->request.version > 1.0)
              && (connPtr->keep != 0)
              && (HdrEq(connPtr->outputheaders, "Content-Type",
                        "multipart/byteranges") == NS_FALSE0)) {
              conn->flags |= NS_CONN_CHUNK0x100u;
          }

      } else if (connPtr->responseLength < 0) {
          Ns_ConnSetLengthHeader(conn, dataLength, NS_FALSE0);
      }

      /*
       * Set and construct the headers.
       */

      connPtr->keep = (CheckKeep(connPtr) ? 1 : 0);
      if (connPtr->keep != 0) {
          keepString = "keep-alive";
      } else {
          keepString = "close";
      }
      Ns_ConnSetHeaders(conn, "Connection", keepString);

      if ((conn->flags & NS_CONN_CHUNK0x100u) != 0u) {
          Ns_ConnSetHeaders(conn, "Transfer-Encoding", "chunked");
      }
      Ns_ConnConstructHeaders(conn, dsPtr);
      success = NS_TRUE1;
  }

  return success;
1319}

1321
1322/*
*----------------------------------------------------------------------
*
* CheckKeep --
*
*      Should the Connection header be set to keep-alive or close.
*
* Results:
*      NS_TRUE if keep-alive is allowed, NS_FALSE otherwise.
*
* Side effects:
*      None.
*
*----------------------------------------------------------------------
*/

1338static bool_Bool
1339CheckKeep(const Conn *connPtr)
1340{
  bool_Bool result = NS_FALSE0;

  NS_NONNULL_ASSERT(connPtr != NULL)((void) (0));

  do {
      if (connPtr->drvPtr->keepwait.sec > 0 || connPtr->drvPtr->keepwait.usec > 0 ) {
          /*
           * Check for manual keep-alive override.
           */

          if (connPtr->keep > 0) {
              result = NS_TRUE1;
              break;
          }

          /*
           * Apply default rules.
           */
          if ((connPtr->keep == -1)
              && (connPtr->request.line != NULL((void*)0))) {

              /*
               * HTTP 1.0/1.1 keep-alive header checks.
               */
              if ((   (connPtr->request.version == 1.0)
                      && (HdrEq(connPtr->headers, "connection", "keep-alive") == NS_TRUE1) )
                  ||  (   (connPtr->request.version > 1.0)
                          && (HdrEq(connPtr->headers, "connection", "close") == NS_FALSE0) )
                  ) {

                  /*
                   * POST, PUT etc. require a content-length header
                   * to allow keep-alive.
                   */
                  if ((connPtr->contentLength > 0u)
                      && (Ns_SetIGet(connPtr->headers, "Content-Length") == NULL((void*)0))) {
                      /*
                       * No content length -> disallow.
                       */
                      break;
                  }

                  if ( (connPtr->drvPtr->keepmaxuploadsize > 0u)
                       && (connPtr->contentLength > connPtr->drvPtr->keepmaxuploadsize) ) {
                      Ns_Log(Notice,
                             "Disallow keep-alive: content-Length %" PRIdz"zd"
                             " larger keepmaxuploadsize %" PRIdz"zd" ": %s",
                             connPtr->contentLength, connPtr->drvPtr->keepmaxuploadsize,
                             connPtr->request.line);
                      break;
                  } else if ( (connPtr->drvPtr->keepmaxdownloadsize > 0u)
                              && (connPtr->responseLength > 0)
                              && ((size_t)connPtr->responseLength > connPtr->drvPtr->keepmaxdownloadsize) ) {
                      Ns_Log(Notice,
                             "Disallow keep-alive: response length %" PRIdz"zd" " "
                             "larger keepmaxdownloadsize %" PRIdz"zd" ": %s",
                             connPtr->responseLength, connPtr->drvPtr->keepmaxdownloadsize,
                             connPtr->request.line);
                      break;
                  }

                  /*
                   * We allow keep-alive for chunked encoding
                   * variants or a valid content-length header.
                   */
                  if (((connPtr->flags & NS_CONN_CHUNK0x100u) != 0u)
                      || (Ns_SetIGet(connPtr->outputheaders, "Content-Length") != NULL((void*)0))
                      || (HdrEq(connPtr->outputheaders, "Content-Type", "multipart/byteranges") == NS_TRUE1)) {

                      result = NS_TRUE1;
                      break;
                  }
              }
          }
      }
  } while (NS_FALSE0); /* loop construct just for breaks */

  /*
   * Don't allow keep-alive.
   */
  return result;
1422}

1424
1425/*
*----------------------------------------------------------------------
*
* HdrEq --
*
*      Test if given set contains a key which matches given value.
*      Value is matched at the beginning of the header value only.
*
* Results:
*      NS_TRUE if there is a match, NS_FALSE otherwise.
*
* Side effects:
*      None.
*
*----------------------------------------------------------------------
*/

1442static bool_Bool
1443HdrEq(const Ns_Set *set, const char *name, const char *value)
1444{
  const char *hdrvalue;

  NS_NONNULL_ASSERT(set != NULL)((void) (0));
  NS_NONNULL_ASSERT(name != NULL)((void) (0));
  NS_NONNULL_ASSERT(value != NULL)((void) (0));

  hdrvalue = Ns_SetIGet(set, name);

  return ((hdrvalue != NULL((void*)0)) && (strncasecmp(hdrvalue, value, strlen(value)) == 0));
1454}

1456/*
* Local Variables:
* mode: c
* c-basic-offset: 4
* fill-column: 70
* indent-tabs-mode: nil
* End:
*/