../deps/nghttp2/lib/nghttp2_buf.c

Bug Summary

File:	out/../deps/nghttp2/lib/nghttp2_buf.c
Warning:	line 402, column 24 Dereference of null pointer (loaded from field 'last')

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name nghttp2_buf.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/home/maurizio/node-v18.6.0/out -resource-dir /usr/local/lib/clang/16.0.0 -D _U_= -D V8_DEPRECATION_WARNINGS -D V8_IMMINENT_DEPRECATION_WARNINGS -D _GLIBCXX_USE_CXX11_ABI=1 -D NODE_OPENSSL_CONF_NAME=nodejs_conf -D NODE_OPENSSL_HAS_QUIC -D __STDC_FORMAT_MACROS -D OPENSSL_NO_PINSHARED -D OPENSSL_THREADS -D BUILDING_NGHTTP2 -D NGHTTP2_STATICLIB -D HAVE_CONFIG_H -I ../deps/nghttp2/lib/includes -internal-isystem /usr/local/lib/clang/16.0.0/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-redhat-linux/8/../../../../x86_64-redhat-linux/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -O3 -Wno-unused-parameter -fdebug-compilation-dir=/home/maurizio/node-v18.6.0/out -ferror-limit 19 -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/scan-build-2022-08-22-142216-507842-1 -x c ../deps/nghttp2/lib/nghttp2_buf.c

1/*
* nghttp2 - HTTP/2 C Library
*
* Copyright (c) 2014 Tatsuhiro Tsujikawa
*
* Permission is hereby granted, free of charge, to any person obtaining
* a copy of this software and associated documentation files (the
* "Software"), to deal in the Software without restriction, including
* without limitation the rights to use, copy, modify, merge, publish,
* distribute, sublicense, and/or sell copies of the Software, and to
* permit persons to whom the Software is furnished to do so, subject to
* the following conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
* OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
* WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
*/
25#include "nghttp2_buf.h"

27#include <stdio.h>

29#include "nghttp2_helper.h"
30#include "nghttp2_debug.h"

32void nghttp2_buf_init(nghttp2_buf *buf) {
buf->begin = NULL((void*)0);
buf->end = NULL((void*)0);
buf->pos = NULL((void*)0);
buf->last = NULL((void*)0);
buf->mark = NULL((void*)0);
38}

40int nghttp2_buf_init2(nghttp2_buf *buf, size_t initial, nghttp2_mem *mem) {
nghttp2_buf_init(buf);
return nghttp2_buf_reserve(buf, initial, mem);
13
←
Calling 'nghttp2_buf_reserve'→
17
←
Returning from 'nghttp2_buf_reserve'→
43}

45void nghttp2_buf_free(nghttp2_buf *buf, nghttp2_mem *mem) {
if (buf == NULL((void*)0)) {
  return;
}

nghttp2_mem_free(mem, buf->begin);
buf->begin = NULL((void*)0);
52}

54int nghttp2_buf_reserve(nghttp2_buf *buf, size_t new_cap, nghttp2_mem *mem) {
uint8_t *ptr;
size_t cap;

cap = nghttp2_buf_cap(buf)((size_t)((buf)->end - (buf)->begin));

if (cap >= new_cap) {
14
←
Assuming 'cap' is >= 'new_cap'→
15
←
Taking true branch→
  return 0;
16
←
Returning without writing to 'buf->last'→
}

new_cap = nghttp2_max(new_cap, cap * 2)((new_cap) > (cap * 2) ? (new_cap) : (cap * 2));

ptr = nghttp2_mem_realloc(mem, buf->begin, new_cap);
if (ptr == NULL((void*)0)) {
  return NGHTTP2_ERR_NOMEM;
}

buf->pos = ptr + (buf->pos - buf->begin);
buf->last = ptr + (buf->last - buf->begin);
buf->mark = ptr + (buf->mark - buf->begin);
buf->begin = ptr;
buf->end = ptr + new_cap;

return 0;
78}

80void nghttp2_buf_reset(nghttp2_buf *buf) {
buf->pos = buf->last = buf->mark = buf->begin;
82}

84void nghttp2_buf_wrap_init(nghttp2_buf *buf, uint8_t *begin, size_t len) {
buf->begin = buf->pos = buf->last = buf->mark = buf->end = begin;
if (len) {
  buf->end += len;
}
89}

91static int buf_chain_new(nghttp2_buf_chain **chain, size_t chunk_length,
                       nghttp2_mem *mem) {
int rv;

*chain = nghttp2_mem_malloc(mem, sizeof(nghttp2_buf_chain));
if (*chain == NULL((void*)0)) {
10
←
Assuming the condition is false→
11
←
Taking false branch→
  return NGHTTP2_ERR_NOMEM;
}

(*chain)->next = NULL((void*)0);

rv = nghttp2_buf_init2(&(*chain)->buf, chunk_length, mem);
12
←
Calling 'nghttp2_buf_init2'→
18
←
Returning from 'nghttp2_buf_init2'→
if (rv18.1
'rv' is equal to 0
 != 0) {
19
←
Taking false branch→
  nghttp2_mem_free(mem, *chain);
  return NGHTTP2_ERR_NOMEM;
}

return 0;
109}

111static void buf_chain_del(nghttp2_buf_chain *chain, nghttp2_mem *mem) {
nghttp2_buf_free(&chain->buf, mem);
nghttp2_mem_free(mem, chain);
114}

116int nghttp2_bufs_init(nghttp2_bufs *bufs, size_t chunk_length, size_t max_chunk,
                    nghttp2_mem *mem) {
return nghttp2_bufs_init2(bufs, chunk_length, max_chunk, 0, mem);
119}

121int nghttp2_bufs_init2(nghttp2_bufs *bufs, size_t chunk_length,
                     size_t max_chunk, size_t offset, nghttp2_mem *mem) {
return nghttp2_bufs_init3(bufs, chunk_length, max_chunk, max_chunk, offset,
                          mem);
125}

127int nghttp2_bufs_init3(nghttp2_bufs *bufs, size_t chunk_length,
                     size_t max_chunk, size_t chunk_keep, size_t offset,
                     nghttp2_mem *mem) {
int rv;
nghttp2_buf_chain *chain;

if (chunk_keep == 0 || max_chunk < chunk_keep || chunk_length < offset) {
  return NGHTTP2_ERR_INVALID_ARGUMENT;
}

rv = buf_chain_new(&chain, chunk_length, mem);
if (rv != 0) {
  return rv;
}

bufs->mem = mem;
bufs->offset = offset;

bufs->head = chain;
bufs->cur = bufs->head;

nghttp2_buf_shift_right(&bufs->cur->buf, offset)do { (&bufs->cur->buf)->pos += offset; (&bufs
->cur->buf)->last += offset; } while (0);

bufs->chunk_length = chunk_length;
bufs->chunk_used = 1;
bufs->max_chunk = max_chunk;
bufs->chunk_keep = chunk_keep;

return 0;
156}

158int nghttp2_bufs_realloc(nghttp2_bufs *bufs, size_t chunk_length) {
int rv;
nghttp2_buf_chain *chain;

if (chunk_length < bufs->offset) {
  return NGHTTP2_ERR_INVALID_ARGUMENT;
}

rv = buf_chain_new(&chain, chunk_length, bufs->mem);
if (rv != 0) {
  return rv;
}

nghttp2_bufs_free(bufs);

bufs->head = chain;
bufs->cur = bufs->head;

nghttp2_buf_shift_right(&bufs->cur->buf, bufs->offset)do { (&bufs->cur->buf)->pos += bufs->offset; (
&bufs->cur->buf)->last += bufs->offset; } while
 (0);

bufs->chunk_length = chunk_length;
bufs->chunk_used = 1;

return 0;
182}

184void nghttp2_bufs_free(nghttp2_bufs *bufs) {
nghttp2_buf_chain *chain, *next_chain;

if (bufs == NULL((void*)0)) {
  return;
}

for (chain = bufs->head; chain;) {
  next_chain = chain->next;

  buf_chain_del(chain, bufs->mem);

  chain = next_chain;
}

bufs->head = NULL((void*)0);
200}

202int nghttp2_bufs_wrap_init(nghttp2_bufs *bufs, uint8_t *begin, size_t len,
                         nghttp2_mem *mem) {
nghttp2_buf_chain *chain;

chain = nghttp2_mem_malloc(mem, sizeof(nghttp2_buf_chain));
if (chain == NULL((void*)0)) {
  return NGHTTP2_ERR_NOMEM;
}

chain->next = NULL((void*)0);

nghttp2_buf_wrap_init(&chain->buf, begin, len);

bufs->mem = mem;
bufs->offset = 0;

bufs->head = chain;
bufs->cur = bufs->head;

bufs->chunk_length = len;
bufs->chunk_used = 1;
bufs->max_chunk = 1;
bufs->chunk_keep = 1;

return 0;
227}

229int nghttp2_bufs_wrap_init2(nghttp2_bufs *bufs, const nghttp2_vec *vec,
                          size_t veclen, nghttp2_mem *mem) {
size_t i = 0;
nghttp2_buf_chain *cur_chain;
nghttp2_buf_chain *head_chain;
nghttp2_buf_chain **dst_chain = &head_chain;

if (veclen == 0) {
  return nghttp2_bufs_wrap_init(bufs, NULL((void*)0), 0, mem);
}

head_chain = nghttp2_mem_malloc(mem, sizeof(nghttp2_buf_chain) * veclen);
if (head_chain == NULL((void*)0)) {
  return NGHTTP2_ERR_NOMEM;
}

for (i = 0; i < veclen; ++i) {
  cur_chain = &head_chain[i];
  cur_chain->next = NULL((void*)0);
  nghttp2_buf_wrap_init(&cur_chain->buf, vec[i].base, vec[i].len);

  *dst_chain = cur_chain;
  dst_chain = &cur_chain->next;
}

bufs->mem = mem;
bufs->offset = 0;

bufs->head = head_chain;
bufs->cur = bufs->head;

/* We don't use chunk_length since no allocation is expected. */
bufs->chunk_length = 0;
bufs->chunk_used = veclen;
bufs->max_chunk = veclen;
bufs->chunk_keep = veclen;

return 0;
267}

269void nghttp2_bufs_wrap_free(nghttp2_bufs *bufs) {
if (bufs == NULL((void*)0)) {
  return;
}

if (bufs->head) {
  nghttp2_mem_free(bufs->mem, bufs->head);
}
277}

279void nghttp2_bufs_seek_last_present(nghttp2_bufs *bufs) {
nghttp2_buf_chain *ci;

for (ci = bufs->cur; ci; ci = ci->next) {
  if (nghttp2_buf_len(&ci->buf)((size_t)((&ci->buf)->last - (&ci->buf)->
pos)) == 0) {
    return;
  } else {
    bufs->cur = ci;
  }
}
289}

291size_t nghttp2_bufs_len(nghttp2_bufs *bufs) {
nghttp2_buf_chain *ci;
size_t len;

len = 0;
for (ci = bufs->head; ci; ci = ci->next) {
  len += nghttp2_buf_len(&ci->buf)((size_t)((&ci->buf)->last - (&ci->buf)->
pos));
}

return len;
301}

303static int bufs_alloc_chain(nghttp2_bufs *bufs) {
int rv;
nghttp2_buf_chain *chain;

if (bufs->cur->next) {
5
←
Assuming field 'next' is null→
6
←
Taking false branch→
  bufs->cur = bufs->cur->next;

  return 0;
}

if (bufs->max_chunk == bufs->chunk_used) {
7
←
Assuming field 'max_chunk' is not equal to field 'chunk_used'→
8
←
Taking false branch→
  return NGHTTP2_ERR_BUFFER_ERROR;
}

rv = buf_chain_new(&chain, bufs->chunk_length, bufs->mem);
9
←
Calling 'buf_chain_new'→
20
←
Returning from 'buf_chain_new'→
if (rv20.1
'rv' is equal to 0
 != 0) {
21
←
Taking false branch→
  return rv;
}

DEBUGF("new buffer %zu bytes allocated for bufs %p, used %zu\n",do { } while (0)
22
←
Loop condition is false.  Exiting loop→
       bufs->chunk_length, bufs, bufs->chunk_used)do { } while (0);

++bufs->chunk_used;

bufs->cur->next = chain;
bufs->cur = chain;

nghttp2_buf_shift_right(&bufs->cur->buf, bufs->offset)do { (&bufs->cur->buf)->pos += bufs->offset; (
&bufs->cur->buf)->last += bufs->offset; } while
 (0);
23
←
Null pointer value stored to field 'last'→
24
←
Loop condition is false.  Exiting loop→

return 0;
333}

335int nghttp2_bufs_add(nghttp2_bufs *bufs, const void *data, size_t len) {
int rv;
size_t nwrite;
nghttp2_buf *buf;
const uint8_t *p;

p = data;

while (len) {
  buf = &bufs->cur->buf;

  nwrite = nghttp2_min(nghttp2_buf_avail(buf), len)((((size_t)((buf)->end - (buf)->last))) < (len) ? ((
(size_t)((buf)->end - (buf)->last))) : (len));
  if (nwrite == 0) {
    rv = bufs_alloc_chain(bufs);
    if (rv != 0) {
      return rv;
    }
    continue;
  }

  buf->last = nghttp2_cpymem(buf->last, p, nwrite);
  p += nwrite;
  len -= nwrite;
}

return 0;
361}

363static int bufs_ensure_addb(nghttp2_bufs *bufs) {
int rv;
nghttp2_buf *buf;

buf = &bufs->cur->buf;

if (nghttp2_buf_avail(buf)((size_t)((buf)->end - (buf)->last)) > 0) {
2
←
Assuming the condition is false→
3
←
Taking false branch→
  return 0;
}

rv = bufs_alloc_chain(bufs);
4
←
Calling 'bufs_alloc_chain'→
25
←
Returning from 'bufs_alloc_chain'→
if (rv25.1
'rv' is equal to 0
 != 0) {
26
←
Taking false branch→
  return rv;
}

return 0;
379}

381int nghttp2_bufs_addb(nghttp2_bufs *bufs, uint8_t b) {
int rv;

rv = bufs_ensure_addb(bufs);
if (rv != 0) {
  return rv;
}

*bufs->cur->buf.last++ = b;

return 0;
392}

394int nghttp2_bufs_addb_hold(nghttp2_bufs *bufs, uint8_t b) {
int rv;

rv = bufs_ensure_addb(bufs);
1
Calling 'bufs_ensure_addb'→
27
←
Returning from 'bufs_ensure_addb'→
if (rv27.1
'rv' is equal to 0
 != 0) {
28
←
Taking false branch→
  return rv;
}

*bufs->cur->buf.last = b;
29
←
Dereference of null pointer (loaded from field 'last')

return 0;
405}

407int nghttp2_bufs_orb(nghttp2_bufs *bufs, uint8_t b) {
int rv;

rv = bufs_ensure_addb(bufs);
if (rv != 0) {
  return rv;
}

*bufs->cur->buf.last++ |= b;

return 0;
418}

420int nghttp2_bufs_orb_hold(nghttp2_bufs *bufs, uint8_t b) {
int rv;

rv = bufs_ensure_addb(bufs);
if (rv != 0) {
  return rv;
}

*bufs->cur->buf.last |= b;

return 0;
431}

433ssize_t nghttp2_bufs_remove(nghttp2_bufs *bufs, uint8_t **out) {
size_t len;
nghttp2_buf_chain *chain;
nghttp2_buf *buf;
uint8_t *res;
nghttp2_buf resbuf;

len = 0;

for (chain = bufs->head; chain; chain = chain->next) {
  len += nghttp2_buf_len(&chain->buf)((size_t)((&chain->buf)->last - (&chain->buf
)->pos));
}

if (len == 0) {
  res = NULL((void*)0);
  return 0;
}

res = nghttp2_mem_malloc(bufs->mem, len);
if (res == NULL((void*)0)) {
  return NGHTTP2_ERR_NOMEM;
}

nghttp2_buf_wrap_init(&resbuf, res, len);

for (chain = bufs->head; chain; chain = chain->next) {
  buf = &chain->buf;
  resbuf.last = nghttp2_cpymem(resbuf.last, buf->pos, nghttp2_buf_len(buf)((size_t)((buf)->last - (buf)->pos)));
}

*out = res;

return (ssize_t)len;
466}

468size_t nghttp2_bufs_remove_copy(nghttp2_bufs *bufs, uint8_t *out) {
size_t len;
nghttp2_buf_chain *chain;
nghttp2_buf *buf;
nghttp2_buf resbuf;

len = nghttp2_bufs_len(bufs);

nghttp2_buf_wrap_init(&resbuf, out, len);

for (chain = bufs->head; chain; chain = chain->next) {
  buf = &chain->buf;
  resbuf.last = nghttp2_cpymem(resbuf.last, buf->pos, nghttp2_buf_len(buf)((size_t)((buf)->last - (buf)->pos)));
}

return len;
484}

486void nghttp2_bufs_reset(nghttp2_bufs *bufs) {
nghttp2_buf_chain *chain, *ci;
size_t k;

k = bufs->chunk_keep;

for (ci = bufs->head; ci; ci = ci->next) {
  nghttp2_buf_reset(&ci->buf);
  nghttp2_buf_shift_right(&ci->buf, bufs->offset)do { (&ci->buf)->pos += bufs->offset; (&ci->
buf)->last += bufs->offset; } while (0);

  if (--k == 0) {
    break;
  }
}

if (ci) {
  chain = ci->next;
  ci->next = NULL((void*)0);

  for (ci = chain; ci;) {
    chain = ci->next;

    buf_chain_del(ci, bufs->mem);

    ci = chain;
  }

  bufs->chunk_used = bufs->chunk_keep;
}

bufs->cur = bufs->head;
517}

519int nghttp2_bufs_advance(nghttp2_bufs *bufs) { return bufs_alloc_chain(bufs); }

521int nghttp2_bufs_next_present(nghttp2_bufs *bufs) {
nghttp2_buf_chain *chain;

chain = bufs->cur->next;

return chain && nghttp2_buf_len(&chain->buf)((size_t)((&chain->buf)->last - (&chain->buf
)->pos));
527}