ewah / ewah_io.con commit color: protect against out-of-bounds reads and writes (65bb21e)
   1/**
   2 * Copyright 2013, GitHub, Inc
   3 * Copyright 2009-2013, Daniel Lemire, Cliff Moon,
   4 *      David McIntosh, Robert Becho, Google Inc. and Veronika Zenz
   5 *
   6 * This program is free software; you can redistribute it and/or
   7 * modify it under the terms of the GNU General Public License
   8 * as published by the Free Software Foundation; either version 2
   9 * of the License, or (at your option) any later version.
  10 *
  11 * This program is distributed in the hope that it will be useful,
  12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14 * GNU General Public License for more details.
  15 *
  16 * You should have received a copy of the GNU General Public License
  17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
  18 */
  19#include "git-compat-util.h"
  20#include "ewok.h"
  21#include "strbuf.h"
  22
  23int ewah_serialize_native(struct ewah_bitmap *self, int fd)
  24{
  25        uint32_t write32;
  26        size_t to_write = self->buffer_size * 8;
  27
  28        /* 32 bit -- bit size for the map */
  29        write32 = (uint32_t)self->bit_size;
  30        if (write(fd, &write32, 4) != 4)
  31                return -1;
  32
  33        /** 32 bit -- number of compressed 64-bit words */
  34        write32 = (uint32_t)self->buffer_size;
  35        if (write(fd, &write32, 4) != 4)
  36                return -1;
  37
  38        if (write(fd, self->buffer, to_write) != to_write)
  39                return -1;
  40
  41        /** 32 bit -- position for the RLW */
  42        write32 = self->rlw - self->buffer;
  43        if (write(fd, &write32, 4) != 4)
  44                return -1;
  45
  46        return (3 * 4) + to_write;
  47}
  48
  49int ewah_serialize_to(struct ewah_bitmap *self,
  50                      int (*write_fun)(void *, const void *, size_t),
  51                      void *data)
  52{
  53        size_t i;
  54        eword_t dump[2048];
  55        const size_t words_per_dump = sizeof(dump) / sizeof(eword_t);
  56        uint32_t bitsize, word_count, rlw_pos;
  57
  58        const eword_t *buffer;
  59        size_t words_left;
  60
  61        /* 32 bit -- bit size for the map */
  62        bitsize =  htonl((uint32_t)self->bit_size);
  63        if (write_fun(data, &bitsize, 4) != 4)
  64                return -1;
  65
  66        /** 32 bit -- number of compressed 64-bit words */
  67        word_count =  htonl((uint32_t)self->buffer_size);
  68        if (write_fun(data, &word_count, 4) != 4)
  69                return -1;
  70
  71        /** 64 bit x N -- compressed words */
  72        buffer = self->buffer;
  73        words_left = self->buffer_size;
  74
  75        while (words_left >= words_per_dump) {
  76                for (i = 0; i < words_per_dump; ++i, ++buffer)
  77                        dump[i] = htonll(*buffer);
  78
  79                if (write_fun(data, dump, sizeof(dump)) != sizeof(dump))
  80                        return -1;
  81
  82                words_left -= words_per_dump;
  83        }
  84
  85        if (words_left) {
  86                for (i = 0; i < words_left; ++i, ++buffer)
  87                        dump[i] = htonll(*buffer);
  88
  89                if (write_fun(data, dump, words_left * 8) != words_left * 8)
  90                        return -1;
  91        }
  92
  93        /** 32 bit -- position for the RLW */
  94        rlw_pos = (uint8_t*)self->rlw - (uint8_t *)self->buffer;
  95        rlw_pos = htonl(rlw_pos / sizeof(eword_t));
  96
  97        if (write_fun(data, &rlw_pos, 4) != 4)
  98                return -1;
  99
 100        return (3 * 4) + (self->buffer_size * 8);
 101}
 102
 103static int write_helper(void *fd, const void *buf, size_t len)
 104{
 105        return write((intptr_t)fd, buf, len);
 106}
 107
 108int ewah_serialize(struct ewah_bitmap *self, int fd)
 109{
 110        return ewah_serialize_to(self, write_helper, (void *)(intptr_t)fd);
 111}
 112
 113static int write_strbuf(void *user_data, const void *data, size_t len)
 114{
 115        struct strbuf *sb = user_data;
 116        strbuf_add(sb, data, len);
 117        return len;
 118}
 119
 120int ewah_serialize_strbuf(struct ewah_bitmap *self, struct strbuf *sb)
 121{
 122        return ewah_serialize_to(self, write_strbuf, sb);
 123}
 124
 125ssize_t ewah_read_mmap(struct ewah_bitmap *self, const void *map, size_t len)
 126{
 127        const uint8_t *ptr = map;
 128        size_t data_len;
 129        size_t i;
 130
 131        if (len < sizeof(uint32_t))
 132                return error("corrupt ewah bitmap: eof before bit size");
 133        self->bit_size = get_be32(ptr);
 134        ptr += sizeof(uint32_t);
 135        len -= sizeof(uint32_t);
 136
 137        if (len < sizeof(uint32_t))
 138                return error("corrupt ewah bitmap: eof before length");
 139        self->buffer_size = self->alloc_size = get_be32(ptr);
 140        ptr += sizeof(uint32_t);
 141        len -= sizeof(uint32_t);
 142
 143        REALLOC_ARRAY(self->buffer, self->alloc_size);
 144
 145        /*
 146         * Copy the raw data for the bitmap as a whole chunk;
 147         * if we're in a little-endian platform, we'll perform
 148         * the endianness conversion in a separate pass to ensure
 149         * we're loading 8-byte aligned words.
 150         */
 151        data_len = st_mult(self->buffer_size, sizeof(eword_t));
 152        if (len < data_len)
 153                return error("corrupt ewah bitmap: eof in data "
 154                             "(%"PRIuMAX" bytes short)",
 155                             (uintmax_t)(data_len - len));
 156        memcpy(self->buffer, ptr, data_len);
 157        ptr += data_len;
 158        len -= data_len;
 159
 160        for (i = 0; i < self->buffer_size; ++i)
 161                self->buffer[i] = ntohll(self->buffer[i]);
 162
 163        if (len < sizeof(uint32_t))
 164                return error("corrupt ewah bitmap: eof before rlw");
 165        self->rlw = self->buffer + get_be32(ptr);
 166        ptr += sizeof(uint32_t);
 167        len -= sizeof(uint32_t);
 168
 169        return ptr - (const uint8_t *)map;
 170}
 171
 172int ewah_deserialize(struct ewah_bitmap *self, int fd)
 173{
 174        size_t i;
 175        eword_t dump[2048];
 176        const size_t words_per_dump = sizeof(dump) / sizeof(eword_t);
 177        uint32_t bitsize, word_count, rlw_pos;
 178
 179        eword_t *buffer = NULL;
 180        size_t words_left;
 181
 182        ewah_clear(self);
 183
 184        /* 32 bit -- bit size for the map */
 185        if (read(fd, &bitsize, 4) != 4)
 186                return -1;
 187
 188        self->bit_size = (size_t)ntohl(bitsize);
 189
 190        /** 32 bit -- number of compressed 64-bit words */
 191        if (read(fd, &word_count, 4) != 4)
 192                return -1;
 193
 194        self->buffer_size = self->alloc_size = (size_t)ntohl(word_count);
 195        REALLOC_ARRAY(self->buffer, self->alloc_size);
 196
 197        /** 64 bit x N -- compressed words */
 198        buffer = self->buffer;
 199        words_left = self->buffer_size;
 200
 201        while (words_left >= words_per_dump) {
 202                if (read(fd, dump, sizeof(dump)) != sizeof(dump))
 203                        return -1;
 204
 205                for (i = 0; i < words_per_dump; ++i, ++buffer)
 206                        *buffer = ntohll(dump[i]);
 207
 208                words_left -= words_per_dump;
 209        }
 210
 211        if (words_left) {
 212                if (read(fd, dump, words_left * 8) != words_left * 8)
 213                        return -1;
 214
 215                for (i = 0; i < words_left; ++i, ++buffer)
 216                        *buffer = ntohll(dump[i]);
 217        }
 218
 219        /** 32 bit -- position for the RLW */
 220        if (read(fd, &rlw_pos, 4) != 4)
 221                return -1;
 222
 223        self->rlw = self->buffer + ntohl(rlw_pos);
 224        return 0;
 225}