auth.c

Bug Summary

File:	d/auth.c
Warning:	line 337, column 33 Access out-of-bound array element (buffer overflow)

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name auth.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/home/isvv/naviserver/nsd -resource-dir /usr/local/lib/clang/15.0.0 -D _FORTIFY_SOURCE=2 -D NDEBUG -D SYSTEM_MALLOC -I ../include -I /usr/include/tcl8.6 -D HAVE_CONFIG_H -internal-isystem /usr/local/lib/clang/15.0.0/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/11/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O2 -std=c99 -fdebug-compilation-dir=/home/isvv/naviserver/nsd -ferror-limit 19 -stack-protector 2 -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -analyzer-checker alpha -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/scan-build-2022-07-23-130959-11103-1 -x c auth.c

1/*
* The contents of this file are subject to the Mozilla Public License
* Version 1.1 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
* http://mozilla.org/.
*
* Software distributed under the License is distributed on an "AS IS"
* basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
* the License for the specific language governing rights and limitations
* under the License.
*
* The Original Code is AOLserver Code and related documentation
* distributed by AOL.
*
* The Initial Developer of the Original Code is America Online,
* Inc. Portions created by AOL are Copyright (C) 1999 America Online,
* Inc. All Rights Reserved.
*
* Alternatively, the contents of this file may be used under the terms
* of the GNU General Public License (the "GPL"), in which case the
* provisions of GPL are applicable instead of those above.  If you wish
* to allow use of your version of this file only under the terms of the
* GPL and not to allow others to use your version of this file under the
* License, indicate your decision by deleting the provisions above and
* replace them with the notice and other provisions required by the GPL.
* If you do not delete the provisions above, a recipient may use your
* version of this file under either the License or the GPL.
*/

30/*
* auth.c --
*
*      URL level HTTP authorization support.
*/

36#include "nsd.h"

38/*
* The following proc is used for simple user authorization.  It
* could be useful for global modules (e.g., nscp).
*/

43static Ns_UserAuthorizeProc    *userProcPtr = NULL((void*)0);

45
46/*
*----------------------------------------------------------------------
*
* Ns_AuthorizeRequest --
*
*      Check for proper HTTP authorization of a request.
*
* Results:
*      User supplied routine is expected to return NS_OK if authorization
*      is allowed, NS_UNAUTHORIZED if a correct username/passwd could
*      allow authorization, NS_FORBIDDEN if no username/passwd would ever
*      allow access, or NS_ERROR on error.
*
* Side effects:
*      Depends on user supplied routine. "method" and "url" could be NULL in
*      case of non-HTTP requests.
*
*----------------------------------------------------------------------
*/

66Ns_ReturnCode
67Ns_AuthorizeRequest(const char *server, const char *method, const char *url,
                  const char *user, const char *passwd, const char *peer)
69{
  Ns_ReturnCode   status;
  const NsServer *servPtr;

  NS_NONNULL_ASSERT(server != NULL)((void) (0));
  NS_NONNULL_ASSERT(method != NULL)((void) (0));
  NS_NONNULL_ASSERT(url != NULL)((void) (0));

  servPtr = NsGetServer(server);
  if (unlikely(servPtr == NULL)(__builtin_expect((servPtr == ((void*)0)), 0)) || servPtr->request.authProc == NULL((void*)0)) {
      status = NS_OK;
  } else {
      status = (*servPtr->request.authProc)(server, method, url, user, passwd, peer);
  }
  return status;
84}

86
87/*
*----------------------------------------------------------------------
*
* Ns_SetRequestAuthorizeProc --
*
*      Set the proc to call when authorizing requests.
*
* Results:
*      None.
*
* Side effects:
*      None.
*
*----------------------------------------------------------------------
*/

103void
104Ns_SetRequestAuthorizeProc(const char *server, Ns_RequestAuthorizeProc *procPtr)
105{
  NsServer *servPtr;

  NS_NONNULL_ASSERT(server != NULL)((void) (0));
  NS_NONNULL_ASSERT(procPtr != NULL)((void) (0));

  servPtr = NsGetServer(server);
  if (servPtr != NULL((void*)0)) {
      servPtr->request.authProc = procPtr;
  }
115}

117
118/*
*----------------------------------------------------------------------
*
* NsTclRequestAuthorizeObjCmd --
*
*      Implements "ns_requestauthorize".
*
* Results:
*      Tcl result.
*
* Side effects:
*      See docs.
*
*----------------------------------------------------------------------
*/

134int
135NsTclRequestAuthorizeObjCmd(ClientData clientData, Tcl_Interp *interp, int objc, Tcl_Obj *const* objv)
136{
  const NsInterp *itPtr = clientData;
  int             result = TCL_OK0;
  char           *method, *url, *authuser, *authpasswd, *ipaddr = NULL((void*)0);
  Ns_ObjvSpec     args[] = {
      {"method",     Ns_ObjvString, &method,     NULL((void*)0)},
      {"url",        Ns_ObjvString, &url,        NULL((void*)0)},
      {"authuser",   Ns_ObjvString, &authuser,   NULL((void*)0)},
      {"authpasswd", Ns_ObjvString, &authpasswd, NULL((void*)0)},
      {"?ipaddr",    Ns_ObjvString, &ipaddr,     NULL((void*)0)},
      {NULL((void*)0), NULL((void*)0), NULL((void*)0), NULL((void*)0)}
  };

  if (Ns_ParseObjv(NULL((void*)0), args, interp, 1, objc, objv) != NS_OK) {
      result = TCL_ERROR1;

  } else {
      Ns_ReturnCode status;

      status = Ns_AuthorizeRequest(itPtr->servPtr->server, method, url,
                                   authuser, authpasswd, ipaddr);
      switch (status) {
      case NS_OK:
          Tcl_SetObjResult(interp, Tcl_NewStringObj("OK", 2));
          break;

      case NS_ERROR:
          Tcl_SetObjResult(interp, Tcl_NewStringObj("ERROR", 5));
          break;

      case NS_FORBIDDEN:
          Tcl_SetObjResult(interp, Tcl_NewStringObj("FORBIDDEN", -1));
          break;

      case NS_UNAUTHORIZED:
          Tcl_SetObjResult(interp, Tcl_NewStringObj("UNAUTHORIZED", -1));
          break;

      case NS_FILTER_BREAK:  NS_FALL_THROUGH((void)0); /* fall through */
      case NS_FILTER_RETURN: NS_FALL_THROUGH((void)0); /* fall through */
      case NS_TIMEOUT:
          Ns_TclPrintfResult(interp, "could not authorize \"%s %s\"",
                             Tcl_GetString(objv[1]), Tcl_GetString(objv[2]));
          result = TCL_ERROR1;
      }
  }
  return result;
183}

185
186/*
*----------------------------------------------------------------------
*
* Ns_AuthorizeUser --
*
*      Verify that a user's password matches his name.
*      passwd is the unencrypted password.
*
* Results:
*      NS_OK or NS_ERROR; if none registered, NS_ERROR.
*
* Side effects:
*      Depends on the supplied routine.
*
*----------------------------------------------------------------------
*/

203Ns_ReturnCode
204Ns_AuthorizeUser(const char *user, const char *passwd)
205{
  Ns_ReturnCode status;

  NS_NONNULL_ASSERT(user != NULL)((void) (0));
  NS_NONNULL_ASSERT(passwd != NULL)((void) (0));

  if (userProcPtr == NULL((void*)0)) {
      status = NS_ERROR;
  } else {
      status = (*userProcPtr)(user, passwd);
  }
  return status;
217}

219
220/*
*----------------------------------------------------------------------
*
* Ns_SetUserAuthorizeProc --
*
*      Set the proc to call when authorizing users.
*
* Results:
*      None.
*
* Side effects:
*      None.
*
*----------------------------------------------------------------------
*/

236void
237Ns_SetUserAuthorizeProc(Ns_UserAuthorizeProc *procPtr)
238{
  NS_NONNULL_ASSERT(procPtr != NULL)((void) (0));

  userProcPtr = procPtr;
242}

244/*
*----------------------------------------------------------------------
*
* NsParseAuth --
*
*      Parse an HTTP authorization string.
*
* Results:
*      None.
*
* Side effects:
*      May set the auth Passwd and User connection pointers.
*
*----------------------------------------------------------------------
*/

260void
261NsParseAuth(Conn *connPtr, const char *auth)
262{
  register char *p;
  Tcl_DString    authDs;

  NS_NONNULL_ASSERT(connPtr != NULL)((void) (0));
  NS_NONNULL_ASSERT(auth != NULL)((void) (0));

  if (connPtr->auth == NULL((void*)0)) {
1
Assuming field 'auth' is not equal to NULL→
2
←
Taking false branch→
      connPtr->auth = Ns_SetCreate(NS_SET_NAME_AUTH"auth");
  }

  Tcl_DStringInit(&authDs);
  Tcl_DStringAppend(&authDs, auth, -1);

  p = authDs.string;
  while (*p != '\0' && CHARTYPE(space, *p)(((*__ctype_b_loc ())[(int) (((int)((unsigned char)(*p))))] &
 (unsigned short int) _ISspace)) == 0) {
3
←
Assuming the condition is true→
4
←
Loop condition is false. Execution continues on line 280→
      ++p;
  }
  if (*p != '\0') {
5
←
Taking true branch→
      register char *q, *v;
      char           save;

      save = *p;
      *p = '\0';

      if (STRIEQ(authDs.string, "Basic")(strcasecmp((authDs.string),("Basic")) == 0)) {
6
←
Assuming the condition is false→
7
←
Taking false branch→
          size_t  size;
          ssize_t userLength;

          (void)Ns_SetPutSz(connPtr->auth, "AuthMethod", 10, "Basic", 5);

          /* Skip spaces */
          q = p + 1;
          while (*q != '\0' && CHARTYPE(space, *q)(((*__ctype_b_loc ())[(int) (((int)((unsigned char)(*q))))] &
 (unsigned short int) _ISspace)) != 0) {
              q++;
          }

          size = strlen(q) + 3u;
          v = ns_malloc(size);
          size = Ns_HtuuDecode(q, (unsigned char *) v, size);
          v[size] = '\0';

          q = strchr(v, INTCHAR(':')((int)((unsigned char)((':')))));
          if (q != NULL((void*)0)) {
              ssize_t pwLength;

              *q++ = '\0';
              pwLength = ((v+size) - q);
              (void)Ns_SetPutSz(connPtr->auth, "Password", 8, q, pwLength);
              userLength = (ssize_t)size - (pwLength + 1);
          } else {
              userLength = (ssize_t)size;
          }
          (void)Ns_SetPutSz(connPtr->auth, "Username", 8, v, userLength);
          ns_free(v);

      } else if (STRIEQ(authDs.string, "Digest")(strcasecmp((authDs.string),("Digest")) == 0)) {
8
←
Taking true branch→
          (void)Ns_SetPutSz(connPtr->auth, "AuthMethod", 10, "Digest", 6);

          /* Skip spaces */
          q = p + 1;
          while (*q != '\0' && CHARTYPE(space, *q)(((*__ctype_b_loc ())[(int) (((int)((unsigned char)(*q))))] &
 (unsigned short int) _ISspace)) != 0) {
9
←
Assuming the condition is true→
10
←
Loop condition is false. Execution continues on line 327→
              q++;
          }

          while (*q != '\0') {
11
←
Loop condition is true.  Entering loop body→
              size_t idx;
              char   save2;

              p = strchr(q, INTCHAR('=')((int)((unsigned char)(('=')))));
              if (p == NULL((void*)0)) {
12
←
Assuming 'p' is not equal to NULL→
13
←
Taking false branch→
                  break;
              }
              v = p - 1;
              /* Trim trailing spaces */
              while (v > q && CHARTYPE(space, *v)(((*__ctype_b_loc ())[(int) (((int)((unsigned char)(*v))))] &
 (unsigned short int) _ISspace)) != 0) {
14
←
Assuming 'v' is > 'q'→
15
←
Access out-of-bound array element (buffer overflow)
                  v--;
              }
              /* Remember position */
              save2 = *(++v);
              *v = '\0';
              idx = Ns_SetPutSz(connPtr->auth, q, (ssize_t)(v-q), NULL((void*)0), 0);
              /* Restore character */
              *v = save2;
              /* Skip = and optional spaces */
              p++;
              while (*p != '\0' && CHARTYPE(space, *p)(((*__ctype_b_loc ())[(int) (((int)((unsigned char)(*p))))] &
 (unsigned short int) _ISspace)) != 0) {
                  p++;
              }
              if (*p == '\0') {
                  break;
              }
              /* Find end of the value, deal with quotes strings */
              if (*p == '"') {
                  for (q = ++p; *q != '\0' && *q != '"'; q++) {
                      ;
                  }
              } else {
                  for (q = p; *q != '\0' && *q != ',' && CHARTYPE(space, *q)(((*__ctype_b_loc ())[(int) (((int)((unsigned char)(*q))))] &
 (unsigned short int) _ISspace)) == 0; q++) {
                      ;
                  }
              }
              save2 = *q;
              *q = '\0';
              /* Update with current value */
              Ns_SetPutValueSz(connPtr->auth, idx, p, -1);
              *q = save2;
              /* Advance to the end of the param value, can be end or next name*/
              while (*q != '\0' && (*q == ',' || *q == '"' || CHARTYPE(space, *q)(((*__ctype_b_loc ())[(int) (((int)((unsigned char)(*q))))] &
 (unsigned short int) _ISspace)) != 0)) {
                  q++;
              }
          }
      } else if (STRIEQ(authDs.string, "Bearer")(strcasecmp((authDs.string),("Bearer")) == 0)) {

          (void)Ns_SetPutSz(connPtr->auth, "AuthMethod", 10, "Bearer", 6);

          /* Skip spaces */
          q = p + 1;
          while (*q != '\0' && CHARTYPE(space, *q)(((*__ctype_b_loc ())[(int) (((int)((unsigned char)(*q))))] &
 (unsigned short int) _ISspace)) != 0) {
              q++;
          }
          (void)Ns_SetPutSz(connPtr->auth, "Token", 5, q, authDs.length - (q - authDs.string));
      }
      if (p != NULL((void*)0)) {
          *p = save;
      }
  }
  Tcl_DStringFree(&authDs);
390}

392/*
* Local Variables:
* mode: c
* c-basic-offset: 4
* fill-column: 78
* indent-tabs-mode: nil
* End:
*/