Got Mirror

Blob

Date:: Sun Nov 11 10:10:11 2018 UTC
Message:: bounds checks before memcpy in got_delta_apply_in_mem()
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2018 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 
19 #include <stdio.h>
20 #include <stdlib.h>
21 #include <string.h>
22 #include <zlib.h>
23 #include <sha1.h>
24 #include <time.h>
25 
26 #include "got_error.h"
27 #include "got_repository.h"
28 #include "got_object.h"
29 
30 #include "got_lib_delta.h"
31 #include "got_lib_path.h"
32 #include "got_lib_inflate.h"
33 
34 #ifndef MIN
35 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
36 #endif
37 
38 struct got_delta *
39 got_delta_open(off_t offset, size_t tslen, int type, size_t size,
40     off_t data_offset, uint8_t *delta_buf, size_t delta_len)
41 {
42 	struct got_delta *delta;
43 
44 	delta = malloc(sizeof(*delta));
45 	if (delta == NULL)
46 		return NULL;
47 
48 	delta->type = type;
49 	delta->offset = offset;
50 	delta->tslen = tslen;
51 	delta->size = size;
52 	delta->data_offset = data_offset;
53 	delta->delta_buf = delta_buf;
54 	delta->delta_len = delta_len;
55 	return delta;
56 }
57 
58 void
59 got_delta_close(struct got_delta *delta)
60 {
61 	free(delta->delta_buf);
62 	free(delta);
63 }
64 
65 const struct got_error *
66 got_delta_chain_get_base_type(int *type, struct got_delta_chain *deltas)
67 {
68 	struct got_delta *delta;
69 
70 	/* The first delta in the chain should represent the base object. */
71 	delta = SIMPLEQ_FIRST(&deltas->entries);
72 	if (delta->type == GOT_OBJ_TYPE_COMMIT ||
73 	    delta->type == GOT_OBJ_TYPE_TREE ||
74 	    delta->type == GOT_OBJ_TYPE_BLOB ||
75 	    delta->type == GOT_OBJ_TYPE_TAG) {
76 		*type = delta->type;
77 		return NULL;
78 	}
79 
80 	return got_error(GOT_ERR_BAD_DELTA_CHAIN);
81 }
82 
83 /* Fetch another (required) byte from the delta stream. */
84 static const struct got_error *
85 next_delta_byte(const uint8_t **p, size_t *remain)
86 {
87 	if (--(*remain) == 0)
88 		return got_error(GOT_ERR_BAD_DELTA);
89 	(*p)++;
90 	return NULL;
91 }
92 
93 static const struct got_error *
94 parse_size(uint64_t *size, const uint8_t **p, size_t *remain)
95 {
96 	const struct got_error *err = NULL;
97 	int i = 0;
98 
99 	*size = 0;
100 	do {
101 		/* We do not support size values which don't fit in 64 bit. */
102 		if (i > 9)
103 			return got_error(GOT_ERR_NO_SPACE);
104 
105 		if (i == 0)
106 			*size = ((**p) & GOT_DELTA_SIZE_VAL_MASK);
107 		else {
108 			size_t shift = GOT_DELTA_SIZE_SHIFT * i;
109 			*size |= (((**p) & GOT_DELTA_SIZE_VAL_MASK) << shift);
110 		}
111 
112 		if (((**p) & GOT_DELTA_SIZE_MORE) == 0)
113 			break;
114 		i++;
115 		err = next_delta_byte(p, remain);
116 	} while (err == NULL);
117 
118 	return err;
119 }
120 
121 static const struct got_error *
122 parse_opcode(off_t *offset, size_t *len, const uint8_t **p, size_t *remain)
123 {
124 	const struct got_error *err = NULL;
125 	off_t o = 0;
126 	size_t l = 0;
127 	uint8_t opcode = **p;
128 
129 	if (opcode & GOT_DELTA_COPY_OFF1) {
130 		err = next_delta_byte(p, remain);
131 		if (err)
132 			return err;
133 		o = (off_t)(**p);
134 	}
135 	if (opcode & GOT_DELTA_COPY_OFF2) {
136 		err = next_delta_byte(p, remain);
137 		if (err)
138 			return err;
139 		o |= ((off_t)(**p)) << 8;
140 	}
141 	if (opcode & GOT_DELTA_COPY_OFF3) {
142 		err = next_delta_byte(p, remain);
143 		if (err)
144 			return err;
145 		o |= ((off_t)(**p)) << 16;
146 	}
147 	if (opcode & GOT_DELTA_COPY_OFF4) {
148 		err = next_delta_byte(p, remain);
149 		if (err)
150 			return err;
151 		o |= ((off_t)(**p)) << 24;
152 	}
153 
154 	if (opcode & GOT_DELTA_COPY_LEN1) {
155 		err = next_delta_byte(p, remain);
156 		if (err)
157 			return err;
158 		l = (off_t)(**p);
159 	}
160 	if (opcode & GOT_DELTA_COPY_LEN2) {
161 		err = next_delta_byte(p, remain);
162 		if (err)
163 			return err;
164 		l |= ((off_t)(**p)) << 8;
165 	}
166 	if (opcode & GOT_DELTA_COPY_LEN3) {
167 		err = next_delta_byte(p, remain);
168 		if (err)
169 			return err;
170 		l |= ((off_t)(**p)) << 16;
171 	}
172 
173 	if (o == 0)
174 		o = GOT_DELTA_COPY_DEFAULT_OFF;
175 	if (l == 0)
176 		l = GOT_DELTA_COPY_DEFAULT_LEN;
177 
178 	*offset = o;
179 	*len = l;
180 	return NULL;
181 }
182 
183 static const struct got_error *
184 copy_from_base(FILE *base_file, off_t offset, size_t size, FILE *outfile)
185 {
186 	if (fseeko(base_file, offset, SEEK_SET) != 0)
187 		return got_error_from_errno();
188 
189 	while (size > 0) {
190 		uint8_t data[2048];
191 		size_t len = MIN(size, sizeof(data));
192 		size_t n;
193 
194 		n = fread(data, len, 1, base_file);
195 		if (n != 1)
196 			return got_ferror(base_file, GOT_ERR_IO);
197 
198 		n = fwrite(data, len, 1, outfile);
199 		if (n != 1)
200 			return got_ferror(outfile, GOT_ERR_IO);
201 
202 		size -= len;
203 	}
204 
205 	return NULL;
206 }
207 
208 static const struct got_error *
209 copy_from_delta(const uint8_t **p, size_t *remain, size_t len, FILE *outfile)
210 {
211 	size_t n;
212 
213 	if (*remain < len)
214 		return got_error(GOT_ERR_BAD_DELTA);
215 
216 	n = fwrite(*p, len, 1, outfile);
217 	if (n != 1)
218 		return got_ferror(outfile, GOT_ERR_IO);
219 
220 	*p += len;
221 	*remain -= len;
222 	return NULL;
223 }
224 
225 static const struct got_error *
226 parse_delta_sizes(uint64_t *base_size, uint64_t *result_size,
227     const uint8_t **p, size_t *remain)
228 {
229 	const struct got_error *err;
230 
231 	/* Read the two size fields at the beginning of the stream. */
232 	err = parse_size(base_size, p, remain);
233 	if (err)
234 		return err;
235 	err = next_delta_byte(p, remain);
236 	if (err)
237 		return err;
238 	err = parse_size(result_size, p, remain);
239 	if (err)
240 		return err;
241 
242 	return NULL;
243 }
244 
245 const struct got_error *
246 got_delta_get_sizes(uint64_t *base_size, uint64_t *result_size,
247     const uint8_t *delta_buf, size_t delta_len)
248 {
249 	size_t remain;
250 	const uint8_t *p;
251 
252 	if (delta_len < GOT_DELTA_STREAM_LENGTH_MIN)
253 		return got_error(GOT_ERR_BAD_DELTA);
254 
255 	p = delta_buf;
256 	remain = delta_len;
257 	return parse_delta_sizes(base_size, result_size, &p, &remain);
258 }
259 
260 const struct got_error *
261 got_delta_apply_in_mem(uint8_t *base_buf, size_t base_bufsz,
262     const uint8_t *delta_buf, size_t delta_len, uint8_t *outbuf,
263     size_t *outsize, size_t maxoutsize)
264 {
265 	const struct got_error *err = NULL;
266 	uint64_t base_size, result_size;
267 	size_t remain;
268 	const uint8_t *p;
269 
270 	*outsize= 0;
271 
272 	if (delta_len < GOT_DELTA_STREAM_LENGTH_MIN)
273 		return got_error(GOT_ERR_BAD_DELTA);
274 
275 	p = delta_buf;
276 	remain = delta_len;
277 	err = parse_delta_sizes(&base_size, &result_size, &p, &remain);
278 	if (err)
279 		return err;
280 
281 	/* Decode and execute copy instructions from the delta stream. */
282 	err = next_delta_byte(&p, &remain);
283 	while (err == NULL && remain > 0) {
284 		if (*p & GOT_DELTA_BASE_COPY) {
285 			off_t offset = 0;
286 			size_t len = 0;
287 			err = parse_opcode(&offset, &len, &p, &remain);
288 			if (err)
289 				break;
290 			if (base_bufsz < offset + len ||
291 			    *outsize + len > maxoutsize)
292 				return got_error(GOT_ERR_BAD_DELTA);
293 			memcpy(outbuf + *outsize, base_buf + offset, len);
294 			if (err == NULL) {
295 				*outsize += len;
296 				if (remain > 0) {
297 					p++;
298 					remain--;
299 				}
300 			}
301 		} else {
302 			size_t len = (size_t)*p;
303 			if (len == 0) {
304 				err = got_error(GOT_ERR_BAD_DELTA);
305 				break;
306 			}
307 			err = next_delta_byte(&p, &remain);
308 			if (err)
309 				break;
310 			if (remain < len || *outsize + len > maxoutsize)
311 				return got_error(GOT_ERR_BAD_DELTA);
312 			memcpy(outbuf + *outsize, p, len);
313 			p += len;
314 			remain -= len;
315 			*outsize += len;
316 		}
317 	}
318 
319 	if (*outsize != result_size)
320 		err = got_error(GOT_ERR_BAD_DELTA);
321 	return err;
322 }
323 
324 const struct got_error *
325 got_delta_apply(FILE *base_file, const uint8_t *delta_buf,
326     size_t delta_len, FILE *outfile, size_t *outsize)
327 {
328 	const struct got_error *err = NULL;
329 	uint64_t base_size, result_size;
330 	size_t remain = 0;
331 	const uint8_t *p;
332 	FILE *memstream = NULL;
333 	char *memstream_buf = NULL;
334 	size_t memstream_size = 0;
335 
336 	*outsize = 0;
337 
338 	if (delta_len < GOT_DELTA_STREAM_LENGTH_MIN)
339 		return got_error(GOT_ERR_BAD_DELTA);
340 
341 	p = delta_buf;
342 	remain = delta_len;
343 	err = parse_delta_sizes(&base_size, &result_size, &p, &remain);
344 	if (err)
345 		return err;
346 
347 	if (result_size < GOT_DELTA_RESULT_SIZE_CACHED_MAX)
348 		memstream = open_memstream(&memstream_buf, &memstream_size);
349 
350 	/* Decode and execute copy instructions from the delta stream. */
351 	err = next_delta_byte(&p, &remain);
352 	while (err == NULL && remain > 0) {
353 		if (*p & GOT_DELTA_BASE_COPY) {
354 			off_t offset = 0;
355 			size_t len = 0;
356 			err = parse_opcode(&offset, &len, &p, &remain);
357 			if (err)
358 				break;
359 			err = copy_from_base(base_file, offset, len,
360 			    memstream ? memstream : outfile);
361 			if (err == NULL) {
362 				*outsize += len;
363 				if (remain > 0) {
364 					p++;
365 					remain--;
366 				}
367 			}
368 		} else {
369 			size_t len = (size_t)*p;
370 			if (len == 0) {
371 				err = got_error(GOT_ERR_BAD_DELTA);
372 				break;
373 			}
374 			err = next_delta_byte(&p, &remain);
375 			if (err)
376 				break;
377 			err = copy_from_delta(&p, &remain, len,
378 			    memstream ? memstream : outfile);
379 			if (err == NULL)
380 				*outsize += len;
381 		}
382 	}
383 
384 	if (*outsize != result_size)
385 		err = got_error(GOT_ERR_BAD_DELTA);
386 
387 	if (memstream != NULL) {
388 		fclose(memstream);
389 		if (err == NULL) {
390 			size_t n;
391 			n = fwrite(memstream_buf, 1, memstream_size, outfile);
392 			if (n != memstream_size)
393 				err = got_ferror(outfile, GOT_ERR_IO);
394 		}
395 		free(memstream_buf);
396 	}
397 	if (err == NULL)
398 		rewind(outfile);
399 	return err;
400 }