/usr/src/lib/libz/gzwrite.c

Bug Summary

File:	src/lib/libz/gzwrite.c
Warning:	line 301, column 44 Division by zero

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name gzwrite.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -fhalf-no-semantic-interposition -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/lib/libz/obj -resource-dir /usr/local/lib/clang/13.0.0 -D PIC -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/lib/libz/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/lib/libz/gzwrite.c

1/*	$OpenBSD: gzwrite.c,v 1.1 2021/07/04 14:24:49 tb Exp $ */
2/* gzwrite.c -- zlib functions for writing gzip files
* Copyright (C) 2004-2017 Mark Adler
* For conditions of distribution and use, see copyright notice in zlib.h
*/

7#include "gzguts.h"

9/* Local functions */
10localstatic int gz_init OF((gz_statep))(gz_statep);
11localstatic int gz_comp OF((gz_statep, int))(gz_statep, int);
12localstatic int gz_zero OF((gz_statep, z_off64_t))(gz_statep, off_t);
13localstatic z_size_t gz_write OF((gz_statep, voidpc, z_size_t))(gz_statep, voidpc, z_size_t);

15/* Initialize state for writing a gzip file.  Mark initialization by setting
 state->size to non-zero.  Return -1 on a memory allocation failure, or 0 on
 success. */
18localstatic int gz_init(state)
  gz_statep state;
20{
  int ret;
  z_streamp strm = &(state->strm);

  /* allocate input buffer (double size for gzprintf) */
  state->in = (unsigned char *)malloc(state->want << 1);
  if (state->in == NULL((void*)0)) {
      gz_error(state, Z_MEM_ERROR(-4), "out of memory");
      return -1;
  }

  /* only need output buffer and deflate state if compressing */
  if (!state->direct) {
      /* allocate output buffer */
      state->out = (unsigned char *)malloc(state->want);
      if (state->out == NULL((void*)0)) {
          free(state->in);
          gz_error(state, Z_MEM_ERROR(-4), "out of memory");
          return -1;
      }

      /* allocate deflate memory, set up for gzip compression */
      strm->zalloc = Z_NULL0;
      strm->zfree = Z_NULL0;
      strm->opaque = Z_NULL0;
      ret = deflateInit2(strm, state->level, Z_DEFLATED,deflateInit2_((strm),(state->level),(8),(15 + 16),(8), (state
->strategy), "1.2.11", (int)sizeof(z_stream))
                         MAX_WBITS + 16, DEF_MEM_LEVEL, state->strategy)deflateInit2_((strm),(state->level),(8),(15 + 16),(8), (state
->strategy), "1.2.11", (int)sizeof(z_stream));
      if (ret != Z_OK0) {
          free(state->out);
          free(state->in);
          gz_error(state, Z_MEM_ERROR(-4), "out of memory");
          return -1;
      }
      strm->next_in = NULL((void*)0);
  }

  /* mark state as initialized */
  state->size = state->want;

  /* initialize write buffer if compressing */
  if (!state->direct) {
      strm->avail_out = state->size;
      strm->next_out = state->out;
      state->x.next = strm->next_out;
  }
  return 0;
66}

68/* Compress whatever is at avail_in and next_in and write to the output file.
 Return -1 if there is an error writing to the output file or if gz_init()
 fails to allocate memory, otherwise 0.  flush is assumed to be a valid
 deflate() flush value.  If flush is Z_FINISH, then the deflate() state is
 reset to start a new gzip stream.  If gz->direct is true, then simply write
 to the output file without compressing, and ignore flush. */
74localstatic int gz_comp(state, flush)
  gz_statep state;
  int flush;
77{
  int ret, writ;
  unsigned have, put, max = ((unsigned)-1 >> 2) + 1;
  z_streamp strm = &(state->strm);

  /* allocate memory if this is the first time through */
  if (state->size == 0 && gz_init(state) == -1)
      return -1;

  /* write directly if requested */
  if (state->direct) {
      while (strm->avail_in) {
          put = strm->avail_in > max ? max : strm->avail_in;
          writ = write(state->fd, strm->next_in, put);
          if (writ < 0) {
              gz_error(state, Z_ERRNO(-1), zstrerror()strerror((*__errno())));
              return -1;
          }
          strm->avail_in -= (unsigned)writ;
          strm->next_in += writ;
      }
      return 0;
  }

  /* run deflate() on provided input until it produces no more output */
  ret = Z_OK0;
  do {
      /* write out current buffer contents if full, or if flushing, but if
         doing Z_FINISH then don't write until we get to Z_STREAM_END */
      if (strm->avail_out == 0 || (flush != Z_NO_FLUSH0 &&
          (flush != Z_FINISH4 || ret == Z_STREAM_END1))) {
          while (strm->next_out > state->x.next) {
              put = strm->next_out - state->x.next > (int)max ? max :
                    (unsigned)(strm->next_out - state->x.next);
              writ = write(state->fd, state->x.next, put);
              if (writ < 0) {
                  gz_error(state, Z_ERRNO(-1), zstrerror()strerror((*__errno())));
                  return -1;
              }
              state->x.next += writ;
          }
          if (strm->avail_out == 0) {
              strm->avail_out = state->size;
              strm->next_out = state->out;
              state->x.next = state->out;
          }
      }

      /* compress */
      have = strm->avail_out;
      ret = deflate(strm, flush);
      if (ret == Z_STREAM_ERROR(-2)) {
          gz_error(state, Z_STREAM_ERROR(-2),
                    "internal error: deflate stream corrupt");
          return -1;
      }
      have -= strm->avail_out;
  } while (have);

  /* if that completed a deflate stream, allow another to start */
  if (flush == Z_FINISH4)
      deflateReset(strm);

  /* all done, no errors */
  return 0;
142}

144/* Compress len zeros to output.  Return -1 on a write error or memory
 allocation failure by gz_comp(), or 0 on success. */
146localstatic int gz_zero(state, len)
  gz_statep state;
  z_off64_toff_t len;
149{
  int first;
  unsigned n;
  z_streamp strm = &(state->strm);

  /* consume whatever's left in the input buffer */
  if (strm->avail_in && gz_comp(state, Z_NO_FLUSH0) == -1)
      return -1;

  /* compress len zeros (len guaranteed > 0) */
  first = 1;
  while (len) {
      n = GT_OFF(state->size)(sizeof(int) == sizeof(off_t) && (state->size) >
 2147483647) || (z_off64_toff_t)state->size > len ?
          (unsigned)len : state->size;
      if (first) {
          memset(state->in, 0, n);
          first = 0;
      }
      strm->avail_in = n;
      strm->next_in = state->in;
      state->x.pos += n;
      if (gz_comp(state, Z_NO_FLUSH0) == -1)
          return -1;
      len -= n;
  }
  return 0;
175}

177/* Write len bytes from buf to file.  Return the number of bytes written.  If
 the returned value is less than len, then there was an error. */
179localstatic z_size_t gz_write(state, buf, len)
  gz_statep state;
  voidpc buf;
  z_size_t len;
183{
  z_size_t put = len;

  /* if len is zero, avoid unnecessary operations */
  if (len == 0)
      return 0;

  /* allocate memory if this is the first time through */
  if (state->size == 0 && gz_init(state) == -1)
      return 0;

  /* check for seek request */
  if (state->seek) {
      state->seek = 0;
      if (gz_zero(state, state->skip) == -1)
          return 0;
  }

  /* for small len, copy to input buffer, otherwise compress directly */
  if (len < state->size) {
      /* copy to input buffer, compress when full */
      do {
          unsigned have, copy;

          if (state->strm.avail_in == 0)
              state->strm.next_in = state->in;
          have = (unsigned)((state->strm.next_in + state->strm.avail_in) -
                            state->in);
          copy = state->size - have;
          if (copy > len)
              copy = len;
          memcpy(state->in + have, buf, copy);
          state->strm.avail_in += copy;
          state->x.pos += copy;
          buf = (const char *)buf + copy;
          len -= copy;
          if (len && gz_comp(state, Z_NO_FLUSH0) == -1)
              return 0;
      } while (len);
  }
  else {
      /* consume whatever's left in the input buffer */
      if (state->strm.avail_in && gz_comp(state, Z_NO_FLUSH0) == -1)
          return 0;

      /* directly compress user buffer to file */
      state->strm.next_in = (z_const Bytef *)buf;
      do {
          unsigned n = (unsigned)-1;
          if (n > len)
              n = len;
          state->strm.avail_in = n;
          state->x.pos += n;
          if (gz_comp(state, Z_NO_FLUSH0) == -1)
              return 0;
          len -= n;
      } while (len);
  }

  /* input was all buffered or compressed */
  return put;
244}

246/* -- see zlib.h -- */
247int ZEXPORT gzwrite(file, buf, len)
  gzFile file;
  voidpc buf;
  unsigned len;
251{
  gz_statep state;

  /* get internal structure */
  if (file == NULL((void*)0))
      return 0;
  state = (gz_statep)file;

  /* check that we're writing and that there's no error */
  if (state->mode != GZ_WRITE31153 || state->err != Z_OK0)
      return 0;

  /* since an int is returned, make sure len fits in one, otherwise return
     with an error (this avoids a flaw in the interface) */
  if ((int)len < 0) {
      gz_error(state, Z_DATA_ERROR(-3), "requested length does not fit in int");
      return 0;
  }

  /* write len bytes from buf (the return value will fit in an int) */
  return (int)gz_write(state, buf, len);
272}

274/* -- see zlib.h -- */
275z_size_t ZEXPORT gzfwrite(buf, size, nitems, file)
  voidpc buf;
  z_size_t size;
  z_size_t nitems;
  gzFile file;
280{
  z_size_t len;
  gz_statep state;

  /* get internal structure */
  if (file == NULL((void*)0))
1
Assuming 'file' is not equal to NULL→
2
←
Taking false branch→
      return 0;
  state = (gz_statep)file;

  /* check that we're writing and that there's no error */
  if (state->mode != GZ_WRITE31153 || state->err != Z_OK0)
3
←
Assuming field 'mode' is equal to GZ_WRITE→
4
←
Assuming field 'err' is equal to Z_OK→
5
←
Taking false branch→
      return 0;

  /* compute bytes to read -- error on overflow */
  len = nitems * size;
  if (size && len / size != nitems) {
6
←
Assuming 'size' is 0→
      gz_error(state, Z_STREAM_ERROR(-2), "request does not fit in a size_t");
      return 0;
  }

  /* write len bytes to buf, return the number of full items written */
  return len ? gz_write(state, buf, len) / size : 0;
7
←
Assuming 'len' is not equal to 0→
8
←
'?' condition is true→
9
←
Division by zero
302}

304/* -- see zlib.h -- */
305int ZEXPORT gzputc(file, c)
  gzFile file;
  int c;
308{
  unsigned have;
  unsigned char buf[1];
  gz_statep state;
  z_streamp strm;

  /* get internal structure */
  if (file == NULL((void*)0))
      return -1;
  state = (gz_statep)file;
  strm = &(state->strm);

  /* check that we're writing and that there's no error */
  if (state->mode != GZ_WRITE31153 || state->err != Z_OK0)
      return -1;

  /* check for seek request */
  if (state->seek) {
      state->seek = 0;
      if (gz_zero(state, state->skip) == -1)
          return -1;
  }

  /* try writing to input buffer for speed (state->size == 0 if buffer not
     initialized) */
  if (state->size) {
      if (strm->avail_in == 0)
          strm->next_in = state->in;
      have = (unsigned)((strm->next_in + strm->avail_in) - state->in);
      if (have < state->size) {
          state->in[have] = (unsigned char)c;
          strm->avail_in++;
          state->x.pos++;
          return c & 0xff;
      }
  }

  /* no room in buffer or not initialized, use gz_write() */
  buf[0] = (unsigned char)c;
  if (gz_write(state, buf, 1) != 1)
      return -1;
  return c & 0xff;
350}

352/* -- see zlib.h -- */
353int ZEXPORT gzputs(file, str)
  gzFile file;
  const char *str;
356{
  int ret;
  z_size_t len;
  gz_statep state;

  /* get internal structure */
  if (file == NULL((void*)0))
      return -1;
  state = (gz_statep)file;

  /* check that we're writing and that there's no error */
  if (state->mode != GZ_WRITE31153 || state->err != Z_OK0)
      return -1;

  /* write string */
  len = strlen(str);
  ret = gz_write(state, str, len);
  return ret == 0 && len != 0 ? -1 : ret;
374}

376#if defined(STDC) || defined(Z_HAVE_STDARG_H)
377#include <stdarg.h>

379/* -- see zlib.h -- */
380int ZEXPORTVA gzvprintf(gzFile file, const char *format, va_list va)
381{
  int len;
  unsigned left;
  char *next;
  gz_statep state;
  z_streamp strm;

  /* get internal structure */
  if (file == NULL((void*)0))
      return Z_STREAM_ERROR(-2);
  state = (gz_statep)file;
  strm = &(state->strm);

  /* check that we're writing and that there's no error */
  if (state->mode != GZ_WRITE31153 || state->err != Z_OK0)
      return Z_STREAM_ERROR(-2);

  /* make sure we have some buffer space */
  if (state->size == 0 && gz_init(state) == -1)
      return state->err;

  /* check for seek request */
  if (state->seek) {
      state->seek = 0;
      if (gz_zero(state, state->skip) == -1)
          return state->err;
  }

  /* do the printf() into the input buffer, put length in len -- the input
     buffer is double-sized just for this function, so there is guaranteed to
     be state->size bytes available after the current contents */
  if (strm->avail_in == 0)
      strm->next_in = state->in;
  next = (char *)(state->in + (strm->next_in - state->in) + strm->avail_in);
  next[state->size - 1] = 0;
416#ifdef NO_vsnprintf
417#  ifdef HAS_vsprintf_void
  (void)vsprintf(next, format, va);
  for (len = 0; len < state->size; len++)
      if (next[len] == 0) break;
421#  else
  len = vsprintf(next, format, va);
423#  endif
424#else
425#  ifdef HAS_vsnprintf_void
  (void)vsnprintf(next, state->size, format, va);
  len = strlen(next);
428#  else
  len = vsnprintf(next, state->size, format, va);
430#  endif
431#endif

  /* check that printf() results fit in buffer */
  if (len == 0 || (unsigned)len >= state->size || next[state->size - 1] != 0)
      return 0;

  /* update buffer and position, compress first half if past that */
  strm->avail_in += (unsigned)len;
  state->x.pos += len;
  if (strm->avail_in >= state->size) {
      left = strm->avail_in - state->size;
      strm->avail_in = state->size;
      if (gz_comp(state, Z_NO_FLUSH0) == -1)
          return state->err;
      memcpy(state->in, state->in + state->size, left);
      strm->next_in = state->in;
      strm->avail_in = left;
  }
  return len;
450}

452int ZEXPORTVA gzprintf(gzFile file, const char *format, ...)
453{
  va_list va;
  int ret;

  va_start(va, format)__builtin_va_start(va, format);
  ret = gzvprintf(file, format, va);
  va_end(va)__builtin_va_end(va);
  return ret;
461}

463#else /* !STDC && !Z_HAVE_STDARG_H */

465/* -- see zlib.h -- */
466int ZEXPORTVA gzprintf (file, format, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10,
                     a11, a12, a13, a14, a15, a16, a17, a18, a19, a20)
  gzFile file;
  const char *format;
  int a1, a2, a3, a4, a5, a6, a7, a8, a9, a10,
      a11, a12, a13, a14, a15, a16, a17, a18, a19, a20;
472{
  unsigned len, left;
  char *next;
  gz_statep state;
  z_streamp strm;

  /* get internal structure */
  if (file == NULL((void*)0))
      return Z_STREAM_ERROR(-2);
  state = (gz_statep)file;
  strm = &(state->strm);

  /* check that can really pass pointer in ints */
  if (sizeof(int) != sizeof(void *))
      return Z_STREAM_ERROR(-2);

  /* check that we're writing and that there's no error */
  if (state->mode != GZ_WRITE31153 || state->err != Z_OK0)
      return Z_STREAM_ERROR(-2);

  /* make sure we have some buffer space */
  if (state->size == 0 && gz_init(state) == -1)
      return state->error;

  /* check for seek request */
  if (state->seek) {
      state->seek = 0;
      if (gz_zero(state, state->skip) == -1)
          return state->error;
  }

  /* do the printf() into the input buffer, put length in len -- the input
     buffer is double-sized just for this function, so there is guaranteed to
     be state->size bytes available after the current contents */
  if (strm->avail_in == 0)
      strm->next_in = state->in;
  next = (char *)(strm->next_in + strm->avail_in);
  next[state->size - 1] = 0;
510#ifdef NO_snprintf
511#  ifdef HAS_sprintf_void
  sprintf(next, format, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11, a12,
          a13, a14, a15, a16, a17, a18, a19, a20);
  for (len = 0; len < size; len++)
      if (next[len] == 0)
          break;
517#  else
  len = sprintf(next, format, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11,
                a12, a13, a14, a15, a16, a17, a18, a19, a20);
520#  endif
521#else
522#  ifdef HAS_snprintf_void
  snprintf(next, state->size, format, a1, a2, a3, a4, a5, a6, a7, a8, a9,
           a10, a11, a12, a13, a14, a15, a16, a17, a18, a19, a20);
  len = strlen(next);
526#  else
  len = snprintf(next, state->size, format, a1, a2, a3, a4, a5, a6, a7, a8,
                 a9, a10, a11, a12, a13, a14, a15, a16, a17, a18, a19, a20);
529#  endif
530#endif

  /* check that printf() results fit in buffer */
  if (len == 0 || len >= state->size || next[state->size - 1] != 0)
      return 0;

  /* update buffer and position, compress first half if past that */
  strm->avail_in += len;
  state->x.pos += len;
  if (strm->avail_in >= state->size) {
      left = strm->avail_in - state->size;
      strm->avail_in = state->size;
      if (gz_comp(state, Z_NO_FLUSH0) == -1)
          return state->err;
      memcpy(state->in, state->in + state->size, left);
      strm->next_in = state->in;
      strm->avail_in = left;
  }
  return (int)len;
549}

551#endif

553/* -- see zlib.h -- */
554int ZEXPORT gzflush(file, flush)
  gzFile file;
  int flush;
557{
  gz_statep state;

  /* get internal structure */
  if (file == NULL((void*)0))
      return Z_STREAM_ERROR(-2);
  state = (gz_statep)file;

  /* check that we're writing and that there's no error */
  if (state->mode != GZ_WRITE31153 || state->err != Z_OK0)
      return Z_STREAM_ERROR(-2);

  /* check flush parameter */
  if (flush < 0 || flush > Z_FINISH4)
      return Z_STREAM_ERROR(-2);

  /* check for seek request */
  if (state->seek) {
      state->seek = 0;
      if (gz_zero(state, state->skip) == -1)
          return state->err;
  }

  /* compress remaining data with requested flush */
  (void)gz_comp(state, flush);
  return state->err;
583}

585/* -- see zlib.h -- */
586int ZEXPORT gzsetparams(file, level, strategy)
  gzFile file;
  int level;
  int strategy;
590{
  gz_statep state;
  z_streamp strm;

  /* get internal structure */
  if (file == NULL((void*)0))
      return Z_STREAM_ERROR(-2);
  state = (gz_statep)file;
  strm = &(state->strm);

  /* check that we're writing and that there's no error */
  if (state->mode != GZ_WRITE31153 || state->err != Z_OK0)
      return Z_STREAM_ERROR(-2);

  /* if no change is requested, then do nothing */
  if (level == state->level && strategy == state->strategy)
      return Z_OK0;

  /* check for seek request */
  if (state->seek) {
      state->seek = 0;
      if (gz_zero(state, state->skip) == -1)
          return state->err;
  }

  /* change compression parameters for subsequent input */
  if (state->size) {
      /* flush previous input with previous parameters before changing */
      if (strm->avail_in && gz_comp(state, Z_BLOCK5) == -1)
          return state->err;
      deflateParams(strm, level, strategy);
  }
  state->level = level;
  state->strategy = strategy;
  return Z_OK0;
625}

627/* -- see zlib.h -- */
628int ZEXPORT gzclose_w(file)
  gzFile file;
630{
  int ret = Z_OK0;
  gz_statep state;

  /* get internal structure */
  if (file == NULL((void*)0))
      return Z_STREAM_ERROR(-2);
  state = (gz_statep)file;

  /* check that we're writing */
  if (state->mode != GZ_WRITE31153)
      return Z_STREAM_ERROR(-2);

  /* check for seek request */
  if (state->seek) {
      state->seek = 0;
      if (gz_zero(state, state->skip) == -1)
          ret = state->err;
  }

  /* flush, free memory, and close file */
  if (gz_comp(state, Z_FINISH4) == -1)
      ret = state->err;
  if (state->size) {
      if (!state->direct) {
          (void)deflateEnd(&(state->strm));
          free(state->out);
      }
      free(state->in);
  }
  gz_error(state, Z_OK0, NULL((void*)0));
  free(state->path);
  if (close(state->fd) == -1)
      ret = Z_ERRNO(-1);
  free(state);
  return ret;
666}