uclient-http: fix freeing of stack allocated memory

[project/uclient.git] / uclient-http.c

diff --git a/uclient-http.c b/uclient-http.c
index ef8de988e81499ede0a7c3734879793fc274ebc1..7eb469221d7fdc5ae4cb80578aa1dabf0d8fee67 100644 (file)
--- a/uclient-http.c
+++ b/uclient-http.c
@@ -149,7 +149,8 @@ static void uclient_http_disconnect(struct uclient_http *uh)
        if (uh->ssl)
                ustream_free(&uh->ussl.stream);
        ustream_free(&uh->ufd.stream);
-       close(uh->ufd.fd.fd);
+       if(uh->ufd.fd.fd)
+               close(uh->ufd.fd.fd);
        uh->us = NULL;
 }
 
@@ -198,7 +199,8 @@ static void uclient_notify_eof(struct uclient_http *uh)
                        return;
        }
 
-       if (uh->content_length < 0 && uh->read_chunked >= 0)
+       if ((uh->content_length < 0 && uh->read_chunked >= 0) ||
+                       uh->content_length == 0)
                uh->uc.data_eof = true;
 
        uclient_backend_set_eof(&uh->uc);
@@ -299,7 +301,7 @@ static bool uclient_request_supports_body(enum request_type req_type)
        }
 }
 
-static void
+static int
 uclient_http_add_auth_basic(struct uclient_http *uh)
 {
        struct uclient_url *url = uh->uc.url;
@@ -307,11 +309,16 @@ uclient_http_add_auth_basic(struct uclient_http *uh)
        char *auth_buf;
 
        if (auth_len > 512)
-               return;
+               return -EINVAL;
 
        auth_buf = alloca(base64_len(auth_len) + 1);
+       if (!auth_buf)
+               return -ENOMEM;
+
        base64_encode(url->auth, auth_len, auth_buf);
        ustream_printf(uh->us, "Authorization: Basic %s\r\n", auth_buf);
+
+       return 0;
 }
 
 static char *digest_unquote_sep(char **str)
@@ -428,7 +435,7 @@ static void add_field(char **buf, int *ofs, int *len, const char *name, const ch
        *ofs = cur - *buf;
 }
 
-static void
+static int
 uclient_http_add_auth_digest(struct uclient_http *uh)
 {
        struct uclient_url *url = uh->uc.url;
@@ -436,6 +443,7 @@ uclient_http_add_auth_digest(struct uclient_http *uh)
        const char *user, *password;
        char *buf, *next;
        int len, ofs;
+       int err = 0;
 
        char cnonce_str[9];
        char nc_str[9];
@@ -449,10 +457,17 @@ uclient_http_add_auth_digest(struct uclient_http *uh)
        };
 
        len = strlen(uh->auth_str) + 1;
-       if (len > 512)
-               return;
+       if (len > 512) {
+               err = -EINVAL;
+               goto fail;
+       }
 
        buf = alloca(len);
+       if (!buf) {
+               err = -ENOMEM;
+               goto fail;
+       }
+
        strcpy(buf, uh->auth_str);
 
        /* skip auth type */
@@ -490,8 +505,10 @@ uclient_http_add_auth_digest(struct uclient_http *uh)
                *dest = digest_unquote_sep(&next);
        }
 
-       if (!realm || !data.qop || !data.nonce)
-               return;
+       if (!realm || !data.qop || !data.nonce) {
+               err = -EINVAL;
+               goto fail;
+       }
 
        sprintf(nc_str, "%08x", uh->nc++);
        get_cnonce(cnonce_str);
@@ -505,10 +522,17 @@ uclient_http_add_auth_digest(struct uclient_http *uh)
                char *user_buf;
 
                len = password - url->auth;
-               if (len > 256)
-                       return;
+               if (len > 256) {
+                       err = -EINVAL;
+                       goto fail;
+               }
 
                user_buf = alloca(len + 1);
+               if (!user_buf) {
+                       err = -ENOMEM;
+                       goto fail;
+               }
+
                strncpy(user_buf, url->auth, len);
                user_buf[len] = 0;
                user = user_buf;
@@ -535,39 +559,46 @@ uclient_http_add_auth_digest(struct uclient_http *uh)
                add_field(&buf, &ofs, &len, "opaque", opaque);
 
        ustream_printf(uh->us, "Authorization: Digest nc=%s, qop=%s%s\r\n", data.nc, data.qop, buf);
+
        free(buf);
+
+       return 0;
+
+fail:
+       return err;
 }
 
-static void
+static int
 uclient_http_add_auth_header(struct uclient_http *uh)
 {
        if (!uh->uc.url->auth)
-               return;
+               return 0;
 
        switch (uh->auth_type) {
        case AUTH_TYPE_UNKNOWN:
        case AUTH_TYPE_NONE:
                break;
        case AUTH_TYPE_BASIC:
-               uclient_http_add_auth_basic(uh);
-               break;
+               return uclient_http_add_auth_basic(uh);
        case AUTH_TYPE_DIGEST:
-               uclient_http_add_auth_digest(uh);
-               break;
+               return uclient_http_add_auth_digest(uh);
        }
+
+       return 0;
 }
 
-static void
+static int
 uclient_http_send_headers(struct uclient_http *uh)
 {
        struct uclient_url *url = uh->uc.url;
        struct blob_attr *cur;
        enum request_type req_type = uh->req_type;
        bool literal_ipv6;
-       int rem;
+       int err;
+       size_t rem;
 
        if (uh->state >= HTTP_STATE_HEADERS_SENT)
-               return;
+               return 0;
 
        if (uh->uc.proxy_url)
                url = uh->uc.proxy_url;
@@ -590,11 +621,15 @@ uclient_http_send_headers(struct uclient_http *uh)
        if (uclient_request_supports_body(uh->req_type))
                ustream_printf(uh->us, "Transfer-Encoding: chunked\r\n");
 
-       uclient_http_add_auth_header(uh);
+       err = uclient_http_add_auth_header(uh);
+       if (err)
+               return err;
 
        ustream_printf(uh->us, "\r\n");
 
        uh->state = HTTP_STATE_HEADERS_SENT;
+
+       return 0;
 }
 
 static void uclient_http_headers_complete(struct uclient_http *uh)
@@ -916,6 +951,9 @@ static struct uclient *uclient_http_alloc(void)
        struct uclient_http *uh;
 
        uh = calloc_a(sizeof(*uh));
+       if (!uh)
+               return NULL;
+
        uh->disconnect_t.cb = uclient_http_disconnect_cb;
        blob_buf_init(&uh->headers, 0);
 
@@ -943,7 +981,7 @@ int
 uclient_http_set_request_type(struct uclient *cl, const char *type)
 {
        struct uclient_http *uh = container_of(cl, struct uclient_http, uc);
-       int i;
+       unsigned int i;
 
        if (cl->backend != &uclient_backend_http)
                return -1;
@@ -991,11 +1029,14 @@ static int
 uclient_http_send_data(struct uclient *cl, const char *buf, unsigned int len)
 {
        struct uclient_http *uh = container_of(cl, struct uclient_http, uc);
+       int err;
 
        if (uh->state >= HTTP_STATE_REQUEST_DONE)
                return -1;
 
-       uclient_http_send_headers(uh);
+       err = uclient_http_send_headers(uh);
+       if (err)
+               return err;
 
        if (len > 0) {
                ustream_printf(uh->us, "%X\r\n", len);
@@ -1010,11 +1051,15 @@ static int
 uclient_http_request_done(struct uclient *cl)
 {
        struct uclient_http *uh = container_of(cl, struct uclient_http, uc);
+       int err;
 
        if (uh->state >= HTTP_STATE_REQUEST_DONE)
                return -1;
 
-       uclient_http_send_headers(uh);
+       err = uclient_http_send_headers(uh);
+       if (err)
+               return err;
+
        if (uclient_request_supports_body(uh->req_type))
                ustream_printf(uh->us, "0\r\n\r\n");
        uh->state = HTTP_STATE_REQUEST_DONE;
@@ -1129,8 +1174,15 @@ int uclient_http_redirect(struct uclient *cl)
        if (!url)
                return false;
 
-       free(cl->url);
-       cl->url = url;
+       if (cl->proxy_url) {
+               free(cl->proxy_url);
+               cl->proxy_url = url;
+       }
+       else {
+               free(cl->url);
+               cl->url = url;
+       }
+
        if (uclient_http_connect(cl))
                return -1;