Bug Summary

File:builds/wireshark/wireshark/epan/tvbuff_zlib.c
Warning:line 311, column 15
Potential leak of memory pointed to by 'uncompr'

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name tvbuff_zlib.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -fno-delete-null-pointer-checks -mframe-pointer=all -relaxed-aliasing -fmath-errno -ffp-contract=on -fno-rounding-math -ffloat16-excess-precision=fast -fbfloat16-excess-precision=fast -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/builds/wireshark/wireshark/build -fcoverage-compilation-dir=/builds/wireshark/wireshark/build -resource-dir /usr/lib/llvm-18/lib/clang/18 -isystem /usr/include/glib-2.0 -isystem /usr/lib/x86_64-linux-gnu/glib-2.0/include -isystem /builds/wireshark/wireshark/epan -isystem /builds/wireshark/wireshark/build/epan -isystem /usr/include/libxml2 -isystem /usr/include/lua5.4 -D G_DISABLE_DEPRECATED -D G_DISABLE_SINGLE_INCLUDES -D WS_BUILD_DLL -D WS_DEBUG -D WS_DEBUG_UTF_8 -D epan_EXPORTS -I /builds/wireshark/wireshark/build -I /builds/wireshark/wireshark -I /builds/wireshark/wireshark/include -I /builds/wireshark/wireshark/wiretap -D _GLIBCXX_ASSERTIONS -internal-isystem /usr/lib/llvm-18/lib/clang/18/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -fmacro-prefix-map=/builds/wireshark/wireshark/= -fmacro-prefix-map=/builds/wireshark/wireshark/build/= -fmacro-prefix-map=../= -Wno-format-truncation -Wno-format-nonliteral -Wno-pointer-sign -std=gnu11 -ferror-limit 19 -fvisibility=hidden -fwrapv -fstrict-flex-arrays=3 -stack-protector 2 -fstack-clash-protection -fcf-protection=full -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fexceptions -fcolor-diagnostics -analyzer-output=html -dwarf-debug-flags /usr/lib/llvm-18/bin/clang -### --analyze -x c -D G_DISABLE_DEPRECATED -D G_DISABLE_SINGLE_INCLUDES -D WS_BUILD_DLL -D WS_DEBUG -D WS_DEBUG_UTF_8 -D epan_EXPORTS -I /builds/wireshark/wireshark/build -I /builds/wireshark/wireshark -I /builds/wireshark/wireshark/include -I /builds/wireshark/wireshark/wiretap -isystem /usr/include/glib-2.0 -isystem /usr/lib/x86_64-linux-gnu/glib-2.0/include -isystem /builds/wireshark/wireshark/epan -isystem /builds/wireshark/wireshark/build/epan -isystem /usr/include/libxml2 -isystem /usr/include/lua5.4 -fvisibility=hidden -fexcess-precision=fast -fstrict-flex-arrays=3 -fstack-clash-protection -fcf-protection=full -D _GLIBCXX_ASSERTIONS -fstack-protector-strong -fno-delete-null-pointer-checks -fno-strict-overflow -fno-strict-aliasing -fexceptions -Wno-format-truncation -Wno-format-nonliteral -fdiagnostics-color=always -Wno-pointer-sign -fmacro-prefix-map=/builds/wireshark/wireshark/= -fmacro-prefix-map=/builds/wireshark/wireshark/build/= -fmacro-prefix-map=../= -std=gnu11 -fPIC /builds/wireshark/wireshark/epan/tvbuff_zlib.c -o /builds/wireshark/wireshark/sbout/2024-11-20-100252-3912-1 -Xclang -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /builds/wireshark/wireshark/sbout/2024-11-20-100252-3912-1 -x c /builds/wireshark/wireshark/epan/tvbuff_zlib.c
1/* tvbuff_zlib.c
2 *
3 * Copyright (c) 2000 by Gilbert Ramirez <[email protected]>
4 *
5 * Wireshark - Network traffic analyzer
6 * By Gerald Combs <[email protected]>
7 * Copyright 1998 Gerald Combs
8 *
9 * SPDX-License-Identifier: GPL-2.0-or-later
10 */
11
12#include <config.h>
13#define WS_LOG_DOMAIN"Epan" LOG_DOMAIN_EPAN"Epan"
14
15#include <glib.h>
16
17#include <string.h>
18#include <wsutil/glib-compat.h>
19
20
21#ifdef HAVE_ZLIBNG
22#define ZLIB_PREFIX(x)x zng_ ## x
23#include <zlib-ng.h>
24typedef zng_stream zlib_stream;
25#else
26#ifdef HAVE_ZLIB1
27#define ZLIB_CONST
28#define ZLIB_PREFIX(x)x x
29#include <zlib.h>
30typedef z_stream zlib_stream;
31#endif /* HAVE_ZLIB */
32#endif
33
34#include "tvbuff.h"
35#include <wsutil/wslog.h>
36
37#if defined (HAVE_ZLIB1) || defined (HAVE_ZLIBNG)
38/*
39 * Uncompresses a zlib compressed packet inside a message of tvb at offset with
40 * length comprlen. Returns an uncompressed tvbuffer if uncompression
41 * succeeded or NULL if uncompression failed.
42 */
43#define TVB_Z_MIN_BUFSIZ32768 32768
44#define TVB_Z_MAX_BUFSIZ1048576 * 10 1048576 * 10
45
46tvbuff_t *
47tvb_uncompress_zlib(tvbuff_t *tvb, const int offset, int comprlen)
48{
49 int err;
50 unsigned bytes_out = 0;
51 uint8_t *compr;
52 uint8_t *uncompr = NULL((void*)0);
53 tvbuff_t *uncompr_tvb = NULL((void*)0);
54#ifdef HAVE_ZLIBNG
55 zng_streamp strm;
56#else
57 z_streamp strm;
58#endif
59 Bytef *strmbuf;
60 unsigned inits_done = 0;
61 int wbits = MAX_WBITS15;
62 uint8_t *next;
63 unsigned bufsiz;
64 unsigned inflate_passes = 0;
65 unsigned bytes_in = tvb_captured_length_remaining(tvb, offset);
66
67 if (tvb == NULL((void*)0) || comprlen <= 0) {
3
←
Assuming 'tvb' is not equal to NULL
→
4
←
Assuming 'comprlen' is > 0
→
5
←
Taking false branch
→
68 return NULL((void*)0);
69 }
70
71 compr = (uint8_t *)tvb_memdup(NULL((void*)0), tvb, offset, comprlen);
72 if (compr == NULL((void*)0)) {
6
←
Assuming 'compr' is not equal to NULL
→
7
←
Taking false branch
→
73 return NULL((void*)0);
74 }
75
76 /*
77 * Assume that the uncompressed data is at least twice as big as
78 * the compressed size.
79 */
80 bufsiz = tvb_captured_length_remaining(tvb, offset) * 2;
81 bufsiz = CLAMP(bufsiz, TVB_Z_MIN_BUFSIZ, TVB_Z_MAX_BUFSIZ)(((bufsiz) > (1048576 * 10)) ? (1048576 * 10) : (((bufsiz)
< (32768)) ? (32768) : (bufsiz)));
8
←
Assuming the condition is true
→
9
←
'?' condition is true
→
82
83 ws_debug("bufsiz: %u bytes\n", bufsiz)do { if (1) { ws_log_full("Epan", LOG_LEVEL_DEBUG, "epan/tvbuff_zlib.c"
, 83, __func__, "bufsiz: %u bytes\n", bufsiz); } } while (0);
10
←
Taking true branch
→
11
←
Loop condition is false. Exiting loop
→
84
85 next = compr;
86
87 strm = g_new0(zlib_stream, 1)((zlib_stream *) g_malloc0_n ((1), sizeof (zlib_stream)));
88 strm->next_in = next;
89 strm->avail_in = comprlen;
90
91 strmbuf = (Bytef *)g_malloc0(bufsiz);
92 strm->next_out = strmbuf;
93 strm->avail_out = bufsiz;
94
95 err = ZLIB_PREFIX(inflateInit2)(strm, wbits)inflateInit2_((strm), (wbits), "1.3", (int)sizeof(z_stream));
96 inits_done = 1;
97 if (err != Z_OK0) {
12
←
Assuming 'err' is equal to Z_OK
→
13
←
Taking false branch
→
98 ZLIB_PREFIX(inflateEnd)inflateEnd(strm);
99 g_free(strm);
100 wmem_free(NULL((void*)0), compr);
101 g_free(strmbuf);
102 return NULL((void*)0);
103 }
104
105 while (1) {
14
←
Loop condition is true. Entering loop body
→
18
←
Loop condition is true. Entering loop body
→
106 memset(strmbuf, '\0', bufsiz);
107 strm->next_out = strmbuf;
108 strm->avail_out = bufsiz;
109
110 err = ZLIB_PREFIX(inflate)inflate(strm, Z_SYNC_FLUSH2);
111
112 if (err == Z_OK0 || err == Z_STREAM_END1) {
15
←
Assuming 'err' is equal to Z_OK
→
19
←
Assuming 'err' is not equal to Z_OK
→
20
←
Assuming 'err' is equal to Z_STREAM_END
→
21
←
Taking true branch
→
113 unsigned bytes_pass = bufsiz - strm->avail_out;
114
115 ++inflate_passes;
116
117 if (uncompr
15.1
'uncompr' is equal to NULL
 == NULL((void*)0)) {
22
←
Assuming 'uncompr' is not equal to NULL
→
23
←
Taking false branch
→
118 /*
119 * This is ugly workaround for bug #6480
120 * (https://gitlab.com/wireshark/wireshark/-/issues/6480)
121 *
122 * g_memdup2(..., 0) returns NULL (g_malloc(0) also)
123 * when uncompr is NULL logic below doesn't create tvb
124 * which is later interpreted as decompression failed.
125 */
126 uncompr = (uint8_t *)((bytes_pass || err != Z_STREAM_END1) ?
16
←
Assuming 'bytes_pass' is not equal to 0
→
127 g_memdup2(strmbuf, bytes_pass) :
128 g_strdup("")g_strdup_inline (""));
129 } else {
130 uncompr = (uint8_t *)g_realloc(uncompr, bytes_out + bytes_pass);
24
←
Memory is allocated
→
131 memcpy(uncompr + bytes_out, strmbuf, bytes_pass);
132 }
133
134 bytes_out += bytes_pass;
135
136 if (err
16.1
'err' is not equal to Z_STREAM_END
24.1
'err' is equal to Z_STREAM_END
 == Z_STREAM_END1) {
17
←
Taking false branch
→
25
←
Taking true branch
→
137 ZLIB_PREFIX(inflateEnd)inflateEnd(strm);
138 g_free(strm);
139 g_free(strmbuf);
140 break;
141 }
142 } else if (err == Z_BUF_ERROR(-5)) {
143 /*
144 * It's possible that not enough frames were captured
145 * to decompress this fully, so return what we've done
146 * so far, if any.
147 */
148 ZLIB_PREFIX(inflateEnd)inflateEnd(strm);
149 g_free(strm);
150 g_free(strmbuf);
151
152 if (uncompr != NULL((void*)0)) {
153 break;
154 } else {
155 wmem_free(NULL((void*)0), compr);
156 return NULL((void*)0);
157 }
158
159 } else if (err == Z_DATA_ERROR(-3) && inits_done == 1
160 && uncompr == NULL((void*)0) && comprlen >= 2 &&
161 (*compr == 0x1f) && (*(compr + 1) == 0x8b)) {
162 /*
163 * inflate() is supposed to handle both gzip and deflate
164 * streams automatically, but in reality it doesn't
165 * seem to handle either (at least not within the
166 * context of an HTTP response.) We have to try
167 * several tweaks, depending on the type of data and
168 * version of the library installed.
169 */
170
171 /*
172 * Gzip file format. Skip past the header, since the
173 * fix to make it work (setting windowBits to 31)
174 * doesn't work with all versions of the library.
175 */
176 Bytef *c = compr + 2;
177 Bytef flags = 0;
178
179 /* we read two bytes already (0x1f, 0x8b) and
180 need at least Z_DEFLATED, 1 byte flags, 4
181 bytes MTIME, 1 byte XFL, 1 byte OS */
182 if (comprlen < 10 || *c != Z_DEFLATED8) {
183 ZLIB_PREFIX(inflateEnd)inflateEnd(strm);
184 g_free(strm);
185 wmem_free(NULL((void*)0), compr);
186 g_free(strmbuf);
187 return NULL((void*)0);
188 }
189
190 c++;
191 flags = *c;
192 c++;
193
194 /* Skip past the MTIME (4 bytes),
195 XFL, and OS fields (1 byte each). */
196 c += 6;
197
198 if (flags & (1 << 2)) {
199 /* An Extra field is present. It
200 consists of 2 bytes xsize and xsize
201 bytes of data.
202 Read byte-by-byte (least significant
203 byte first) to make sure we abort
204 cleanly when the xsize is truncated
205 after the first byte. */
206 uint16_t xsize = 0;
207
208 if (c-compr < comprlen) {
209 xsize += *c;
210 c++;
211 }
212 if (c-compr < comprlen) {
213 xsize += *c << 8;
214 c++;
215 }
216
217 c += xsize;
218 }
219
220 if (flags & (1 << 3)) {
221 /* A null terminated filename */
222
223 while ((c - compr) < comprlen && *c != '\0') {
224 c++;
225 }
226
227 c++;
228 }
229
230 if (flags & (1 << 4)) {
231 /* A null terminated comment */
232
233 while ((c - compr) < comprlen && *c != '\0') {
234 c++;
235 }
236
237 c++;
238 }
239
240
241 if (c - compr > comprlen) {
242 ZLIB_PREFIX(inflateEnd)inflateEnd(strm);
243 g_free(strm);
244 wmem_free(NULL((void*)0), compr);
245 g_free(strmbuf);
246 return NULL((void*)0);
247 }
248 /* Drop gzip header */
249 comprlen -= (int) (c - compr);
250 next = c;
251
252 ZLIB_PREFIX(inflateReset)inflateReset(strm);
253 strm->next_in = next;
254 strm->avail_in = comprlen;
255
256 ZLIB_PREFIX(inflateEnd)inflateEnd(strm);
257 ZLIB_PREFIX(inflateInit2)(strm, wbits)inflateInit2_((strm), (wbits), "1.3", (int)sizeof(z_stream));
258 inits_done++;
259 } else if (err == Z_DATA_ERROR(-3) && uncompr == NULL((void*)0) &&
260 inits_done <= 3) {
261
262 /*
263 * Re-init the stream with a negative
264 * MAX_WBITS. This is necessary due to
265 * some servers (Apache) not sending
266 * the deflate header with the
267 * content-encoded response.
268 */
269 wbits = -MAX_WBITS15;
270
271 ZLIB_PREFIX(inflateReset)inflateReset(strm);
272
273 strm->next_in = next;
274 strm->avail_in = comprlen;
275
276 ZLIB_PREFIX(inflateEnd)inflateEnd(strm);
277 memset(strmbuf, '\0', bufsiz);
278 strm->next_out = strmbuf;
279 strm->avail_out = bufsiz;
280
281 err = ZLIB_PREFIX(inflateInit2)(strm, wbits)inflateInit2_((strm), (wbits), "1.3", (int)sizeof(z_stream));
282
283 inits_done++;
284
285 if (err != Z_OK0) {
286 g_free(strm);
287 g_free(strmbuf);
288 wmem_free(NULL((void*)0), compr);
289 g_free(uncompr);
290
291 return NULL((void*)0);
292 }
293 } else {
294 ZLIB_PREFIX(inflateEnd)inflateEnd(strm);
295 g_free(strm);
296 g_free(strmbuf);
297
298 if (uncompr == NULL((void*)0)) {
299 wmem_free(NULL((void*)0), compr);
300 return NULL((void*)0);
301 }
302
303 break;
304 }
305 }
306
307 ws_debug("inflate() total passes: %u\n", inflate_passes)do { if (1) { ws_log_full("Epan", LOG_LEVEL_DEBUG, "epan/tvbuff_zlib.c"
, 307, __func__, "inflate() total passes: %u\n", inflate_passes
); } } while (0);
26
←
 Execution continues on line 307
→
27
←
Taking true branch
→
28
←
Loop condition is false. Exiting loop
→
308 ws_debug("bytes in: %u\nbytes out: %u\n\n", bytes_in, bytes_out)do { if (1) { ws_log_full("Epan", LOG_LEVEL_DEBUG, "epan/tvbuff_zlib.c"
, 308, __func__, "bytes in: %u\nbytes out: %u\n\n", bytes_in
, bytes_out); } } while (0);
29
←
Taking true branch
→
30
←
Loop condition is false. Exiting loop
→
309
310 if (uncompr
30.1
'uncompr' is not equal to NULL
 != NULL((void*)0)) {
31
←
Taking true branch
→
311 uncompr_tvb = tvb_new_real_data(uncompr, bytes_out, bytes_out);
32
←
Potential leak of memory pointed to by 'uncompr'
312 tvb_set_free_cb(uncompr_tvb, g_free);
313 }
314 wmem_free(NULL((void*)0), compr);
315 return uncompr_tvb;
316}
317#else
318tvbuff_t *
319tvb_uncompress_zlib(tvbuff_t *tvb _U___attribute__((unused)), const int offset _U___attribute__((unused)), int comprlen _U___attribute__((unused)))
320{
321 return NULL((void*)0);
322}
323#endif
324
325tvbuff_t *
326tvb_child_uncompress_zlib(tvbuff_t *parent, tvbuff_t *tvb, const int offset, int comprlen)
327{
328 tvbuff_t *new_tvb = tvb_uncompress_zlib(tvb, offset, comprlen);
2
←
Calling 'tvb_uncompress_zlib'
→
329 if (new_tvb)
330 tvb_set_child_real_data_tvbuff (parent, new_tvb);
331 return new_tvb;
332}
333
334tvbuff_t *
335tvb_uncompress(tvbuff_t *tvb, const int offset, int comprlen)
336{
337 return tvb_uncompress_zlib(tvb, offset, comprlen);
338}
339
340tvbuff_t *
341tvb_child_uncompress(tvbuff_t *parent, tvbuff_t *tvb, const int offset, int comprlen)
342{
343 return tvb_child_uncompress_zlib(parent, tvb, offset, comprlen);
1
Calling 'tvb_child_uncompress_zlib'
→
344}
345
346/*
347 * Editor modelines - https://www.wireshark.org/tools/modelines.html
348 *
349 * Local variables:
350 * c-basic-offset: 8
351 * tab-width: 8
352 * indent-tabs-mode: t
353 * End:
354 *
355 * vi: set shiftwidth=8 tabstop=8 noexpandtab:
356 * :indentSize=8:tabSize=8:noTabs=false:
357 */