../deps/uvwasi/src/path_resolver.c

Bug Summary

File:	out/../deps/uvwasi/src/path_resolver.c
Warning:	line 340, column 29 Array access (from variable 'stripped_path') results in a null pointer dereference

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name path_resolver.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/home/maurizio/node-v18.6.0/out -resource-dir /usr/local/lib/clang/16.0.0 -D V8_DEPRECATION_WARNINGS -D V8_IMMINENT_DEPRECATION_WARNINGS -D _GLIBCXX_USE_CXX11_ABI=1 -D NODE_OPENSSL_CONF_NAME=nodejs_conf -D NODE_OPENSSL_HAS_QUIC -D __STDC_FORMAT_MACROS -D OPENSSL_NO_PINSHARED -D OPENSSL_THREADS -D _GNU_SOURCE -D _POSIX_C_SOURCE=200112 -D _LARGEFILE_SOURCE -D _FILE_OFFSET_BITS=64 -I ../deps/uvwasi/include -I ../deps/uv/include -internal-isystem /usr/local/lib/clang/16.0.0/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-redhat-linux/8/../../../../x86_64-redhat-linux/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -O3 -Wno-unused-parameter -fdebug-compilation-dir=/home/maurizio/node-v18.6.0/out -ferror-limit 19 -fvisibility hidden -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/scan-build-2022-08-22-142216-507842-1 -x c ../deps/uvwasi/src/path_resolver.c

1#include <string.h>

3#include "uv.h"
4#include "uvwasi.h"
5#include "uvwasi_alloc.h"
6#include "uv_mapping.h"
7#include "path_resolver.h"

9#define UVWASI__MAX_SYMLINK_FOLLOWS32 32

11#ifndef _WIN32
12# define IS_SLASH(c)((c) == '/') ((c) == '/')
13#else
14# define IS_SLASH(c)((c) == '/') ((c) == '/' || (c) == '\\')
15#endif /* _WIN32 */


18static int uvwasi__is_absolute_path(const char* path, uvwasi_size_t path_len) {
/* It's expected that only Unix style paths will be generated by WASI. */
return path != NULL((void*)0) && path_len > 0 && path[0] == '/';
21}


24static char* uvwasi__strchr_slash(const char* s) {
/* strchr() that identifies /, as well as \ on Windows. */
do {
  if (IS_SLASH(*s)((*s) == '/'))
    return (char*) s;
} while (*s++);

return NULL((void*)0);
32}


35uvwasi_errno_t uvwasi__normalize_path(const char* path,
                                    uvwasi_size_t path_len,
                                    char* normalized_path,
                                    uvwasi_size_t normalized_len) {
const char* cur;
char* ptr;
char* next;
char* last;
size_t cur_len;
int is_absolute;

if (path_len > normalized_len)
  return UVWASI_ENOBUFS42;

is_absolute = uvwasi__is_absolute_path(path, path_len);
normalized_path[0] = '\0';
ptr = normalized_path;
for (cur = path; cur != NULL((void*)0); cur = next + 1) {
  next = uvwasi__strchr_slash(cur);
  cur_len = (next == NULL((void*)0)) ? strlen(cur) : (size_t) (next - cur);

  if (cur_len == 0) {
    if (ptr == normalized_path && next != NULL((void*)0) && is_absolute) {
      *ptr = '/';
      ptr++;
    }

    *ptr = '\0';
  } else if (cur_len == 1 && cur[0] == '.') {
    /* No-op. Just consume the '.' */
  } else if (cur_len == 2 && cur[0] == '.' && cur[1] == '.') {
    /* Identify the path segment that preceded the current one. */
    last = ptr;
    while (!IS_SLASH(*last)((*last) == '/') && last != normalized_path) {
      last--;
    }

    /* If the result is currently empty, or the last prior path is also '..'
       then output '..'. Otherwise, remove the last path segment. */
    if (ptr == normalized_path ||
        (last == ptr - 2 && last[0] == '.' && last[1] == '.') ||
        (last == ptr - 3 && last[0] == '/' &&
         last[1] == '.' && last[2] == '.')) {
      if (ptr != normalized_path && *(ptr - 1) != '/') {
        *ptr = '/';
        ptr++;
      }

      *ptr = '.';
      ptr++;
      *ptr = '.';
      ptr++;
    } else {
      /* Strip the last segment, but make sure not to strip the '/' if that
         is the entire path. */
      if (last == normalized_path && *last == '/')
        ptr = last + 1;
      else
        ptr = last;
    }

    *ptr = '\0';
  } else {
    if (ptr != normalized_path && *(ptr - 1) != '/') {
      *ptr = '/';
      ptr++;
    }

    memcpy(ptr, cur, cur_len);
    ptr += cur_len;
    *ptr = '\0';
  }

  if (next == NULL((void*)0))
    break;
}

/* Normalized the path to the empty string. Return either '/' or '.'. */
if (ptr == normalized_path) {
  if (1 == is_absolute)
    *ptr = '/';
  else
    *ptr = '.';

  ptr++;
  *ptr = '\0';
}

return UVWASI_ESUCCESS0;
124}


127static int uvwasi__is_path_sandboxed(const char* path,
                                   uvwasi_size_t path_len,
                                   const char* fd_path,
                                   uvwasi_size_t fd_path_len) {
char* ptr;
int remaining_len;

if (1 == uvwasi__is_absolute_path(fd_path, fd_path_len))
  return path == strstr(path, fd_path) ? 1 : 0;

/* Handle relative fds that normalized to '.' */
if (fd_path_len == 1 && fd_path[0] == '.') {
  /* If the fd's path is '.', then any path does not begin with '..' is OK. */
  if ((path_len == 2 && path[0] == '.' && path[1] == '.') ||
      (path_len > 2 && path[0] == '.' && path[1] == '.' && path[2] == '/')) {
    return 0;
  }

  return 1;
}

if (path != strstr(path, fd_path))
  return 0;

/* Fail if the remaining path starts with '..', '../', '/..', or '/../'. */
ptr = (char*) path + fd_path_len;
remaining_len = path_len - fd_path_len;
if (remaining_len < 2)
  return 1;

/* Strip a leading slash so the check is only for '..' and '../'. */
if (*ptr == '/') {
  ptr++;
  remaining_len--;
}

if ((remaining_len == 2 && ptr[0] == '.' && ptr[1] == '.') ||
    (remaining_len > 2 && ptr[0] == '.' && ptr[1] == '.' && ptr[2] == '/')) {
  return 0;
}

return 1;
169}


172static uvwasi_errno_t uvwasi__normalize_absolute_path(
                                            const uvwasi_t* uvwasi,
                                            const struct uvwasi_fd_wrap_t* fd,
                                            const char* path,
                                            uvwasi_size_t path_len,
                                            char** normalized_path,
                                            uvwasi_size_t* normalized_len
                                          ) {
/* This function resolves an absolute path to the provided file descriptor.
   If the file descriptor's path is relative, then this operation will fail
   with UVWASI_ENOTCAPABLE since it doesn't make sense to resolve an absolute
   path to a relative prefix. If the file desciptor's path is also absolute,
   then we just need to verify that the normalized path still starts with
   the file descriptor's path. */
uvwasi_errno_t err;
char* abs_path;
int abs_size;

*normalized_path = NULL((void*)0);
*normalized_len = 0;
abs_size = path_len + 1;
abs_path = uvwasi__malloc(uvwasi, abs_size);
if (abs_path == NULL((void*)0)) {
  err = UVWASI_ENOMEM48;
  goto exit;
}

/* Normalize the input path first. */
err = uvwasi__normalize_path(path, path_len, abs_path, path_len);
if (err != UVWASI_ESUCCESS0)
  goto exit;

/* Once the input is normalized, ensure that it is still sandboxed. */
if (0 == uvwasi__is_path_sandboxed(abs_path,
                                   path_len,
                                   fd->normalized_path,
                                   strlen(fd->normalized_path))) {
  err = UVWASI_ENOTCAPABLE76;
  goto exit;
}

*normalized_path = abs_path;
*normalized_len = abs_size - 1;
return UVWASI_ESUCCESS0;

217exit:
uvwasi__free(uvwasi, abs_path);
return err;
220}


223static uvwasi_errno_t uvwasi__normalize_relative_path(
                                            const uvwasi_t* uvwasi,
                                            const struct uvwasi_fd_wrap_t* fd,
                                            const char* path,
                                            uvwasi_size_t path_len,
                                            char** normalized_path,
                                            uvwasi_size_t* normalized_len
                                          ) {
/* This function resolves a relative path to the provided file descriptor.
   The relative path is concatenated to the file descriptor's path, and then
   normalized. */
uvwasi_errno_t err;
char* combined;
char* normalized;
int combined_size;
int fd_path_len;
int norm_len;
int r;

*normalized_path = NULL((void*)0);
3
←
Null pointer value stored to 'normalized_path'→
*normalized_len = 0;

/* The max combined size is the path length + the file descriptor's path
   length + 2 for a terminating NULL and a possible path separator. */
fd_path_len = strlen(fd->normalized_path);
combined_size = path_len + fd_path_len + 2;
combined = uvwasi__malloc(uvwasi, combined_size);
if (combined == NULL((void*)0))
4
←
Assuming 'combined' is not equal to NULL→
5
←
Taking false branch→
  return UVWASI_ENOMEM48;

normalized = uvwasi__malloc(uvwasi, combined_size);
if (normalized == NULL((void*)0)) {
6
←
Assuming 'normalized' is not equal to NULL→
7
←
Taking false branch→
  err = UVWASI_ENOMEM48;
  goto exit;
}

r = snprintf(combined, combined_size, "%s/%s", fd->normalized_path, path);
if (r <= 0) {
8
←
Assuming 'r' is <= 0→
9
←
Taking true branch→
  err = uvwasi__translate_uv_error(uv_translate_sys_error(errno(*__errno_location ())));
  goto exit;
10
←
Control jumps to line 289→
}

/* Normalize the input path. */
err = uvwasi__normalize_path(combined,
                             combined_size - 1,
                             normalized,
                             combined_size - 1);
if (err != UVWASI_ESUCCESS0)
  goto exit;

norm_len = strlen(normalized);

/* Once the path is normalized, ensure that it is still sandboxed. */
if (0 == uvwasi__is_path_sandboxed(normalized,
                                   norm_len,
                                   fd->normalized_path,
                                   fd_path_len)) {
  err = UVWASI_ENOTCAPABLE76;
  goto exit;
}

err = UVWASI_ESUCCESS0;
*normalized_path = normalized;
*normalized_len = norm_len;

288exit:
if (err != UVWASI_ESUCCESS0)
11
←
Assuming 'err' is equal to UVWASI_ESUCCESS→
12
←
Taking false branch→
  uvwasi__free(uvwasi, normalized);

uvwasi__free(uvwasi, combined);
return err;
294}


297static uvwasi_errno_t uvwasi__resolve_path_to_host(
                                            const uvwasi_t* uvwasi,
                                            const struct uvwasi_fd_wrap_t* fd,
                                            const char* path,
                                            uvwasi_size_t path_len,
                                            char** resolved_path,
                                            uvwasi_size_t* resolved_len
                                          ) {
/* Return the normalized path, but resolved to the host's real path. */
char* res_path;
char* stripped_path;
int real_path_len;
int fake_path_len;
int stripped_len;
311#ifdef _WIN32
uvwasi_size_t i;
313#endif /* _WIN32 */

real_path_len = strlen(fd->real_path);
fake_path_len = strlen(fd->normalized_path);

/* If the fake path is '.' just ignore it. */
if (fake_path_len == 1 && fd->normalized_path[0] == '.') {
17
←
Assuming 'fake_path_len' is not equal to 1→
  fake_path_len = 0;
}

stripped_len = path_len - fake_path_len;

/* The resolved path's length is calculated as: the length of the fd's real
   path, + 1 for a path separator, and the length of the input path (with the
   fake path stripped off). */
*resolved_len = stripped_len + real_path_len + 1;
*resolved_path = uvwasi__malloc(uvwasi, *resolved_len + 1);

if (*resolved_path == NULL((void*)0))
18
←
Assuming the condition is false→
19
←
Taking false branch→
  return UVWASI_ENOMEM48;

res_path = *resolved_path;
stripped_path = (char*) path + fake_path_len;
20
←
Null pointer value stored to 'stripped_path'→
memcpy(res_path, fd->real_path, real_path_len);
res_path += real_path_len;

if (stripped_len > 1 ||
21
←
Assuming 'stripped_len' is <= 1→
    (stripped_len == 1 && stripped_path[0] != '/')) {
22
←
Assuming 'stripped_len' is equal to 1→
23
←
Array access (from variable 'stripped_path') results in a null pointer dereference
  if (stripped_path[0] != '/') {
    *res_path = '/';
    res_path++;
  }

  memcpy(res_path, stripped_path, stripped_len);
  res_path += stripped_len;
}

*res_path = '\0';

352#ifdef _WIN32
/* Replace / with \ on Windows. */
res_path = *resolved_path;
for (i = real_path_len; i < *resolved_len; i++) {
  if (res_path[i] == '/')
    res_path[i] = '\\';
}
359#endif /* _WIN32 */

return UVWASI_ESUCCESS0;
362}


365uvwasi_errno_t uvwasi__resolve_path(const uvwasi_t* uvwasi,
                                  const struct uvwasi_fd_wrap_t* fd,
                                  const char* path,
                                  uvwasi_size_t path_len,
                                  char** resolved_path,
                                  uvwasi_lookupflags_t flags) {
uv_fs_t req;
uvwasi_errno_t err;
const char* input;
char* host_path;
char* normalized_path;
char* link_target;
uvwasi_size_t input_len;
uvwasi_size_t host_path_len;
uvwasi_size_t normalized_len;
int follow_count;
int r;

input = path;
input_len = path_len;
link_target = NULL((void*)0);
follow_count = 0;
host_path = NULL((void*)0);

389start:
normalized_path = NULL((void*)0);
err = UVWASI_ESUCCESS0;

if (1 == uvwasi__is_absolute_path(input, input_len)) {
1
Taking false branch→
  err = uvwasi__normalize_absolute_path(uvwasi,
                                        fd,
                                        input,
                                        input_len,
                                        &normalized_path,
                                        &normalized_len);
} else {
  err = uvwasi__normalize_relative_path(uvwasi,
2
←
Calling 'uvwasi__normalize_relative_path'→
13
←
Returning from 'uvwasi__normalize_relative_path'→
                                        fd,
                                        input,
                                        input_len,
                                        &normalized_path,
                                        &normalized_len);
}

if (err13.1
'err' is equal to UVWASI_ESUCCESS
 != UVWASI_ESUCCESS0)
14
←
Taking false branch→
  goto exit;

uvwasi__free(uvwasi, host_path);
err = uvwasi__resolve_path_to_host(uvwasi,
16
←
Calling 'uvwasi__resolve_path_to_host'→
                                   fd,
                                   normalized_path,
15
←
Passing null pointer value via 3rd parameter 'path'→
                                   normalized_len,
                                   &host_path,
                                   &host_path_len);
if (err != UVWASI_ESUCCESS0)
  goto exit;

if ((flags & UVWASI_LOOKUP_SYMLINK_FOLLOW(1 << 0)) == UVWASI_LOOKUP_SYMLINK_FOLLOW(1 << 0)) {
  r = uv_fs_readlink(NULL((void*)0), &req, host_path, NULL((void*)0));

  if (r != 0) {
426#ifdef _WIN32
    /* uv_fs_readlink() returns UV__UNKNOWN on Windows. Try to get a better
       error using uv_fs_stat(). */
    if (r == UV__UNKNOWN(-4094)) {
      uv_fs_req_cleanup(&req);
      r = uv_fs_stat(NULL((void*)0), &req, host_path, NULL((void*)0));

      if (r == 0) {
        if (uvwasi__stat_to_filetype(&req.statbuf) !=
            UVWASI_FILETYPE_SYMBOLIC_LINK7) {
          r = UV_EINVAL;
        }
      }

      /* Fall through. */
    }
442#endif /* _WIN32 */

    /* Don't report UV_EINVAL or UV_ENOENT. They mean that either the file
        does not exist, or it is not a symlink. Both are OK. */
    if (r != UV_EINVAL && r != UV_ENOENT)
      err = uvwasi__translate_uv_error(r);

    uv_fs_req_cleanup(&req);
    goto exit;
  }

  /* Clean up memory and follow the link, unless it's time to return ELOOP. */
  follow_count++;
  if (follow_count >= UVWASI__MAX_SYMLINK_FOLLOWS32) {
    uv_fs_req_cleanup(&req);
    err = UVWASI_ELOOP32;
    goto exit;
  }

  input_len = strlen(req.ptr);
  uvwasi__free(uvwasi, link_target);
  link_target = uvwasi__malloc(uvwasi, input_len + 1);
  if (link_target == NULL((void*)0)) {
    uv_fs_req_cleanup(&req);
    err = UVWASI_ENOMEM48;
    goto exit;
  }

  memcpy(link_target, req.ptr, input_len + 1);
  input = link_target;
  uvwasi__free(uvwasi, normalized_path);
  uv_fs_req_cleanup(&req);
  goto start;
}

477exit:
if (err == UVWASI_ESUCCESS0) {
  *resolved_path = host_path;
} else {
  *resolved_path = NULL((void*)0);
  uvwasi__free(uvwasi, host_path);
}

uvwasi__free(uvwasi, link_target);
uvwasi__free(uvwasi, normalized_path);
return err;
488}