/usr/src/lib/libz/gzread.c

Bug Summary

File:	src/lib/libz/gzread.c
Warning:	line 439, column 43 Division by zero

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name gzread.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/lib/libz/obj -resource-dir /usr/local/lib/clang/13.0.0 -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/lib/libz/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/lib/libz/gzread.c

1/*	$OpenBSD: gzread.c,v 1.1 2021/07/04 14:24:49 tb Exp $ */
2/* gzread.c -- zlib functions for reading gzip files
* Copyright (C) 2004, 2005, 2010, 2011, 2012, 2013, 2016 Mark Adler
* For conditions of distribution and use, see copyright notice in zlib.h
*/

7#include "gzguts.h"

9/* Local functions */
10localstatic int gz_load OF((gz_statep, unsigned char *, unsigned, unsigned *))(gz_statep, unsigned char *, unsigned, unsigned *);
11localstatic int gz_avail OF((gz_statep))(gz_statep);
12localstatic int gz_look OF((gz_statep))(gz_statep);
13localstatic int gz_decomp OF((gz_statep))(gz_statep);
14localstatic int gz_fetch OF((gz_statep))(gz_statep);
15localstatic int gz_skip OF((gz_statep, z_off64_t))(gz_statep, off_t);
16localstatic z_size_t gz_read OF((gz_statep, voidp, z_size_t))(gz_statep, voidp, z_size_t);

18/* Use read() to load a buffer -- return -1 on error, otherwise 0.  Read from
 state->fd, and update state->eof, state->err, and state->msg as appropriate.
 This function needs to loop on read(), since read() is not guaranteed to
 read the number of bytes requested, depending on the type of descriptor. */
22localstatic int gz_load(state, buf, len, have)
  gz_statep state;
  unsigned char *buf;
  unsigned len;
  unsigned *have;
27{
  int ret;
  unsigned get, max = ((unsigned)-1 >> 2) + 1;

  *have = 0;
  do {
      get = len - *have;
      if (get > max)
          get = max;
      ret = read(state->fd, buf + *have, get);
      if (ret <= 0)
          break;
      *have += (unsigned)ret;
  } while (*have < len);
  if (ret < 0) {
      gz_error(state, Z_ERRNO(-1), zstrerror()strerror((*__errno())));
      return -1;
  }
  if (ret == 0)
      state->eof = 1;
  return 0;
48}

50/* Load up input buffer and set eof flag if last data loaded -- return -1 on
 error, 0 otherwise.  Note that the eof flag is set when the end of the input
 file is reached, even though there may be unused data in the buffer.  Once
 that data has been used, no more attempts will be made to read the file.
 If strm->avail_in != 0, then the current data is moved to the beginning of
 the input buffer, and then the remainder of the buffer is loaded with the
 available data from the input file. */
57localstatic int gz_avail(state)
  gz_statep state;
59{
  unsigned got;
  z_streamp strm = &(state->strm);

  if (state->err != Z_OK0 && state->err != Z_BUF_ERROR(-5))
      return -1;
  if (state->eof == 0) {
      if (strm->avail_in) {       /* copy what's there to the start */
          unsigned char *p = state->in;
          unsigned const char *q = strm->next_in;
          unsigned n = strm->avail_in;
          do {
              *p++ = *q++;
          } while (--n);
      }
      if (gz_load(state, state->in + strm->avail_in,
                  state->size - strm->avail_in, &got) == -1)
          return -1;
      strm->avail_in += got;
      strm->next_in = state->in;
  }
  return 0;
81}

83/* Look for gzip header, set up for inflate or copy.  state->x.have must be 0.
 If this is the first time in, allocate required memory.  state->how will be
 left unchanged if there is no more input data available, will be set to COPY
 if there is no gzip header and direct copying will be performed, or it will
 be set to GZIP for decompression.  If direct copying, then leftover input
 data from the input buffer will be copied to the output buffer.  In that
 case, all further file reads will be directly to either the output buffer or
 a user buffer.  If decompressing, the inflate state will be initialized.
 gz_look() will return 0 on success or -1 on failure. */
92localstatic int gz_look(state)
  gz_statep state;
94{
  z_streamp strm = &(state->strm);

  /* allocate read buffers and inflate memory */
  if (state->size == 0) {
      /* allocate buffers */
      state->in = (unsigned char *)malloc(state->want);
      state->out = (unsigned char *)malloc(state->want << 1);
      if (state->in == NULL((void*)0) || state->out == NULL((void*)0)) {
          free(state->out);
          free(state->in);
          gz_error(state, Z_MEM_ERROR(-4), "out of memory");
          return -1;
      }
      state->size = state->want;

      /* allocate inflate memory */
      state->strm.zalloc = Z_NULL0;
      state->strm.zfree = Z_NULL0;
      state->strm.opaque = Z_NULL0;
      state->strm.avail_in = 0;
      state->strm.next_in = Z_NULL0;
      if (inflateInit2(&(state->strm), 15 + 16)inflateInit2_((&(state->strm)), (15 + 16), "1.2.11", (
int)sizeof(z_stream)) != Z_OK0) {    /* gunzip */
          free(state->out);
          free(state->in);
          state->size = 0;
          gz_error(state, Z_MEM_ERROR(-4), "out of memory");
          return -1;
      }
  }

  /* get at least the magic bytes in the input buffer */
  if (strm->avail_in < 2) {
      if (gz_avail(state) == -1)
          return -1;
      if (strm->avail_in == 0)
          return 0;
  }

  /* look for gzip magic bytes -- if there, do gzip decoding (note: there is
     a logical dilemma here when considering the case of a partially written
     gzip file, to wit, if a single 31 byte is written, then we cannot tell
     whether this is a single-byte file, or just a partially written gzip
     file -- for here we assume that if a gzip file is being written, then
     the header will be written in a single operation, so that reading a
     single byte is sufficient indication that it is not a gzip file) */
  if (strm->avail_in > 1 &&
          strm->next_in[0] == 31 && strm->next_in[1] == 139) {
      inflateReset(strm);
      state->how = GZIP2;
      state->direct = 0;
      return 0;
  }

  /* no gzip header -- if we were decoding gzip before, then this is trailing
     garbage.  Ignore the trailing garbage and finish. */
  if (state->direct == 0) {
      strm->avail_in = 0;
      state->eof = 1;
      state->x.have = 0;
      return 0;
  }

  /* doing raw i/o, copy any leftover input to output -- this assumes that
     the output buffer is larger than the input buffer, which also assures
     space for gzungetc() */
  state->x.next = state->out;
  if (strm->avail_in) {
      memcpy(state->x.next, strm->next_in, strm->avail_in);
      state->x.have = strm->avail_in;
      strm->avail_in = 0;
  }
  state->how = COPY1;
  state->direct = 1;
  return 0;
169}

171/* Decompress from input to the provided next_out and avail_out in the state.
 On return, state->x.have and state->x.next point to the just decompressed
 data.  If the gzip stream completes, state->how is reset to LOOK to look for
 the next gzip stream or raw data, once state->x.have is depleted.  Returns 0
 on success, -1 on failure. */
176localstatic int gz_decomp(state)
  gz_statep state;
178{
  int ret = Z_OK0;
  unsigned had;
  z_streamp strm = &(state->strm);

  /* fill output buffer up to end of deflate stream */
  had = strm->avail_out;
  do {
      /* get more input for inflate() */
      if (strm->avail_in == 0 && gz_avail(state) == -1)
          return -1;
      if (strm->avail_in == 0) {
          gz_error(state, Z_BUF_ERROR(-5), "unexpected end of file");
          break;
      }

      /* decompress and handle errors */
      ret = inflate(strm, Z_NO_FLUSH0);
      if (ret == Z_STREAM_ERROR(-2) || ret == Z_NEED_DICT2) {
          gz_error(state, Z_STREAM_ERROR(-2),
                   "internal error: inflate stream corrupt");
          return -1;
      }
      if (ret == Z_MEM_ERROR(-4)) {
          gz_error(state, Z_MEM_ERROR(-4), "out of memory");
          return -1;
      }
      if (ret == Z_DATA_ERROR(-3)) {              /* deflate stream invalid */
          gz_error(state, Z_DATA_ERROR(-3),
                   strm->msg == NULL((void*)0) ? "compressed data error" : strm->msg);
          return -1;
      }
  } while (strm->avail_out && ret != Z_STREAM_END1);

  /* update available output */
  state->x.have = had - strm->avail_out;
  state->x.next = strm->next_out - state->x.have;

  /* if the gzip stream completed successfully, look for another */
  if (ret == Z_STREAM_END1)
      state->how = LOOK0;

  /* good decompression */
  return 0;
222}

224/* Fetch data and put it in the output buffer.  Assumes state->x.have is 0.
 Data is either copied from the input file or decompressed from the input
 file depending on state->how.  If state->how is LOOK, then a gzip header is
 looked for to determine whether to copy or decompress.  Returns -1 on error,
 otherwise 0.  gz_fetch() will leave state->how as COPY or GZIP unless the
 end of the input file has been reached and all data has been processed.  */
230localstatic int gz_fetch(state)
  gz_statep state;
232{
  z_streamp strm = &(state->strm);

  do {
      switch(state->how) {
      case LOOK0:      /* -> LOOK, COPY (only if never GZIP), or GZIP */
          if (gz_look(state) == -1)
              return -1;
          if (state->how == LOOK0)
              return 0;
          break;
      case COPY1:      /* -> COPY */
          if (gz_load(state, state->out, state->size << 1, &(state->x.have))
                  == -1)
              return -1;
          state->x.next = state->out;
          return 0;
      case GZIP2:      /* -> GZIP or LOOK (if end of gzip stream) */
          strm->avail_out = state->size << 1;
          strm->next_out = state->out;
          if (gz_decomp(state) == -1)
              return -1;
      }
  } while (state->x.have == 0 && (!state->eof || strm->avail_in));
  return 0;
257}

259/* Skip len uncompressed bytes of output.  Return -1 on error, 0 on success. */
260localstatic int gz_skip(state, len)
  gz_statep state;
  z_off64_toff_t len;
263{
  unsigned n;

  /* skip over len bytes or reach end-of-file, whichever comes first */
  while (len)
      /* skip over whatever is in output buffer */
      if (state->x.have) {
          n = GT_OFF(state->x.have)(sizeof(int) == sizeof(off_t) && (state->x.have) >
 2147483647) || (z_off64_toff_t)state->x.have > len ?
              (unsigned)len : state->x.have;
          state->x.have -= n;
          state->x.next += n;
          state->x.pos += n;
          len -= n;
      }

      /* output buffer empty -- return if we're at the end of the input */
      else if (state->eof && state->strm.avail_in == 0)
          break;

      /* need more data to skip -- load up output buffer */
      else {
          /* get more output, looking for header if required */
          if (gz_fetch(state) == -1)
              return -1;
      }
  return 0;
289}

291/* Read len bytes into buf from file, or less than len up to the end of the
 input.  Return the number of bytes read.  If zero is returned, either the
 end of file was reached, or there was an error.  state->err must be
 consulted in that case to determine which. */
295localstatic z_size_t gz_read(state, buf, len)
  gz_statep state;
  voidp buf;
  z_size_t len;
299{
  z_size_t got;
  unsigned n;

  /* if len is zero, avoid unnecessary operations */
  if (len == 0)
      return 0;

  /* process a skip request */
  if (state->seek) {
      state->seek = 0;
      if (gz_skip(state, state->skip) == -1)
          return 0;
  }

  /* get len bytes to buf, or less than len if at the end */
  got = 0;
  do {
      /* set n to the maximum amount of len that fits in an unsigned int */
      n = -1;
      if (n > len)
          n = len;

      /* first just try copying data from the output buffer */
      if (state->x.have) {
          if (state->x.have < n)
              n = state->x.have;
          memcpy(buf, state->x.next, n);
          state->x.next += n;
          state->x.have -= n;
      }

      /* output buffer empty -- return if we're at the end of the input */
      else if (state->eof && state->strm.avail_in == 0) {
          state->past = 1;        /* tried to read past end */
          break;
      }

      /* need output data -- for small len or new stream load up our output
         buffer */
      else if (state->how == LOOK0 || n < (state->size << 1)) {
          /* get more output, looking for header if required */
          if (gz_fetch(state) == -1)
              return 0;
          continue;       /* no progress yet -- go back to copy above */
          /* the copy above assures that we will leave with space in the
             output buffer, allowing at least one gzungetc() to succeed */
      }

      /* large len -- read directly into user buffer */
      else if (state->how == COPY1) {      /* read directly */
          if (gz_load(state, (unsigned char *)buf, n, &n) == -1)
              return 0;
      }

      /* large len -- decompress directly into user buffer */
      else {  /* state->how == GZIP */
          state->strm.avail_out = n;
          state->strm.next_out = (unsigned char *)buf;
          if (gz_decomp(state) == -1)
              return 0;
          n = state->x.have;
          state->x.have = 0;
      }

      /* update progress */
      len -= n;
      buf = (char *)buf + n;
      got += n;
      state->x.pos += n;
  } while (len);

  /* return number of bytes read into user buffer */
  return got;
373}

375/* -- see zlib.h -- */
376int ZEXPORT gzread(file, buf, len)
  gzFile file;
  voidp buf;
  unsigned len;
380{
  gz_statep state;

  /* get internal structure */
  if (file == NULL((void*)0))
      return -1;
  state = (gz_statep)file;

  /* check that we're reading and that there's no (serious) error */
  if (state->mode != GZ_READ7247 ||
          (state->err != Z_OK0 && state->err != Z_BUF_ERROR(-5)))
      return -1;

  /* since an int is returned, make sure len fits in one, otherwise return
     with an error (this avoids a flaw in the interface) */
  if ((int)len < 0) {
      gz_error(state, Z_STREAM_ERROR(-2), "request does not fit in an int");
      return -1;
  }

  /* read len or fewer bytes to buf */
  len = gz_read(state, buf, len);

  /* check for an error */
  if (len == 0 && state->err != Z_OK0 && state->err != Z_BUF_ERROR(-5))
      return -1;

  /* return the number of bytes read (this is assured to fit in an int) */
  return (int)len;
409}

411/* -- see zlib.h -- */
412z_size_t ZEXPORT gzfread(buf, size, nitems, file)
  voidp buf;
  z_size_t size;
  z_size_t nitems;
  gzFile file;
417{
  z_size_t len;
  gz_statep state;

  /* get internal structure */
  if (file == NULL((void*)0))
1
Assuming 'file' is not equal to NULL→
2
←
Taking false branch→
      return 0;
  state = (gz_statep)file;

  /* check that we're reading and that there's no (serious) error */
  if (state->mode != GZ_READ7247 ||
3
←
Assuming field 'mode' is equal to GZ_READ→
          (state->err != Z_OK0 && state->err != Z_BUF_ERROR(-5)))
4
←
Assuming field 'err' is equal to Z_OK→
      return 0;

  /* compute bytes to read -- error on overflow */
  len = nitems * size;
  if (size && len / size != nitems) {
5
←
Assuming 'size' is 0→
      gz_error(state, Z_STREAM_ERROR(-2), "request does not fit in a size_t");
      return 0;
  }

  /* read len or fewer bytes to buf, return the number of full items read */
  return len ? gz_read(state, buf, len) / size : 0;
6
←
Assuming 'len' is not equal to 0→
7
←
'?' condition is true→
8
←
Division by zero
440}

442/* -- see zlib.h -- */
443#ifdef Z_PREFIX_SET
444#  undef z_gzgetc
445#else
446#  undef gzgetc
447#endif
448int ZEXPORT gzgetc(file)
  gzFile file;
450{
  int ret;
  unsigned char buf[1];
  gz_statep state;

  /* get internal structure */
  if (file == NULL((void*)0))
      return -1;
  state = (gz_statep)file;

  /* check that we're reading and that there's no (serious) error */
  if (state->mode != GZ_READ7247 ||
      (state->err != Z_OK0 && state->err != Z_BUF_ERROR(-5)))
      return -1;

  /* try output buffer (no need to check for skip request) */
  if (state->x.have) {
      state->x.have--;
      state->x.pos++;
      return *(state->x.next)++;
  }

  /* nothing there -- try gz_read() */
  ret = gz_read(state, buf, 1);
  return ret < 1 ? -1 : buf[0];
475}

477int ZEXPORT gzgetc_(file)
478gzFile file;
479{
  return gzgetc(file);
481}

483/* -- see zlib.h -- */
484int ZEXPORT gzungetc(c, file)
  int c;
  gzFile file;
487{
  gz_statep state;

  /* get internal structure */
  if (file == NULL((void*)0))
      return -1;
  state = (gz_statep)file;

  /* check that we're reading and that there's no (serious) error */
  if (state->mode != GZ_READ7247 ||
      (state->err != Z_OK0 && state->err != Z_BUF_ERROR(-5)))
      return -1;

  /* process a skip request */
  if (state->seek) {
      state->seek = 0;
      if (gz_skip(state, state->skip) == -1)
          return -1;
  }

  /* can't push EOF */
  if (c < 0)
      return -1;

  /* if output buffer empty, put byte at end (allows more pushing) */
  if (state->x.have == 0) {
      state->x.have = 1;
      state->x.next = state->out + (state->size << 1) - 1;
      state->x.next[0] = (unsigned char)c;
      state->x.pos--;
      state->past = 0;
      return c;
  }

  /* if no room, give up (must have already done a gzungetc()) */
  if (state->x.have == (state->size << 1)) {
      gz_error(state, Z_DATA_ERROR(-3), "out of room to push characters");
      return -1;
  }

  /* slide output data if needed and insert byte before existing data */
  if (state->x.next == state->out) {
      unsigned char *src = state->out + state->x.have;
      unsigned char *dest = state->out + (state->size << 1);
      while (src > state->out)
          *--dest = *--src;
      state->x.next = dest;
  }
  state->x.have++;
  state->x.next--;
  state->x.next[0] = (unsigned char)c;
  state->x.pos--;
  state->past = 0;
  return c;
541}

543/* -- see zlib.h -- */
544char * ZEXPORT gzgets(file, buf, len)
  gzFile file;
  char *buf;
  int len;
548{
  unsigned left, n;
  char *str;
  unsigned char *eol;
  gz_statep state;

  /* check parameters and get internal structure */
  if (file == NULL((void*)0) || buf == NULL((void*)0) || len < 1)
      return NULL((void*)0);
  state = (gz_statep)file;

  /* check that we're reading and that there's no (serious) error */
  if (state->mode != GZ_READ7247 ||
      (state->err != Z_OK0 && state->err != Z_BUF_ERROR(-5)))
      return NULL((void*)0);

  /* process a skip request */
  if (state->seek) {
      state->seek = 0;
      if (gz_skip(state, state->skip) == -1)
          return NULL((void*)0);
  }

  /* copy output bytes up to new line or len - 1, whichever comes first --
     append a terminating zero to the string (we don't check for a zero in
     the contents, let the user worry about that) */
  str = buf;
  left = (unsigned)len - 1;
  if (left) do {
      /* assure that something is in the output buffer */
      if (state->x.have == 0 && gz_fetch(state) == -1)
          return NULL((void*)0);                /* error */
      if (state->x.have == 0) {       /* end of file */
          state->past = 1;            /* read past end */
          break;                      /* return what we have */
      }

      /* look for end-of-line in current output buffer */
      n = state->x.have > left ? left : state->x.have;
      eol = (unsigned char *)memchr(state->x.next, '\n', n);
      if (eol != NULL((void*)0))
          n = (unsigned)(eol - state->x.next) + 1;

      /* copy through end-of-line, or remainder if not found */
      memcpy(buf, state->x.next, n);
      state->x.have -= n;
      state->x.next += n;
      state->x.pos += n;
      left -= n;
      buf += n;
  } while (left && eol == NULL((void*)0));

  /* return terminated string, or if nothing, end of file */
  if (buf == str)
      return NULL((void*)0);
  buf[0] = 0;
  return str;
605}

607/* -- see zlib.h -- */
608int ZEXPORT gzdirect(file)
  gzFile file;
610{
  gz_statep state;

  /* get internal structure */
  if (file == NULL((void*)0))
      return 0;
  state = (gz_statep)file;

  /* if the state is not known, but we can find out, then do so (this is
     mainly for right after a gzopen() or gzdopen()) */
  if (state->mode == GZ_READ7247 && state->how == LOOK0 && state->x.have == 0)
      (void)gz_look(state);

  /* return 1 if transparent, 0 if processing a gzip stream */
  return state->direct;
625}

627/* -- see zlib.h -- */
628int ZEXPORT gzclose_r(file)
  gzFile file;
630{
  int ret, err;
  gz_statep state;

  /* get internal structure */
  if (file == NULL((void*)0))
      return Z_STREAM_ERROR(-2);
  state = (gz_statep)file;

  /* check that we're reading */
  if (state->mode != GZ_READ7247)
      return Z_STREAM_ERROR(-2);

  /* free memory and close file */
  if (state->size) {
      inflateEnd(&(state->strm));
      free(state->out);
      free(state->in);
  }
  err = state->err == Z_BUF_ERROR(-5) ? Z_BUF_ERROR(-5) : Z_OK0;
  gz_error(state, Z_OK0, NULL((void*)0));
  free(state->path);
  ret = close(state->fd);
  free(state);
  return ret ? Z_ERRNO(-1) : err;
655}