client: protect against possible NULL deref path
[platform/upstream/libwebsockets.git] / lib / output.c
index 5af0e26..0d850eb 100644 (file)
 static int
 lws_0405_frame_mask_generate(struct lws *wsi)
 {
+#if 0
+       wsi->u.ws.mask[0] = 0;
+       wsi->u.ws.mask[1] = 0;
+       wsi->u.ws.mask[2] = 0;
+       wsi->u.ws.mask[3] = 0;
+#else
        int n;
-
        /* fetch the per-frame nonce */
 
-       n = lws_get_random(lws_get_context(wsi), wsi->u.ws.mask_nonce, 4);
+       n = lws_get_random(lws_get_context(wsi), wsi->u.ws.mask, 4);
        if (n != 4) {
                lwsl_parser("Unable to read from random device %s %d\n",
                            SYSTEM_RANDOM_FILEPATH, n);
                return 1;
        }
-
+#endif
        /* start masking from first byte of masking key buffer */
-       wsi->u.ws.frame_mask_index = 0;
+       wsi->u.ws.mask_idx = 0;
 
        return 0;
 }
@@ -107,8 +112,7 @@ int lws_issue_raw(struct lws *wsi, unsigned char *buf, size_t len)
                assert(0);
        }
 
-       m = lws_ext_cb_wsi_active_exts(wsi,
-                       LWS_EXT_CALLBACK_PACKET_TX_DO_SEND, &buf, len);
+       m = lws_ext_cb_active(wsi, LWS_EXT_CB_PACKET_TX_DO_SEND, &buf, len);
        if (m < 0)
                return -1;
        if (m) /* handled */ {
@@ -127,8 +131,6 @@ int lws_issue_raw(struct lws *wsi, unsigned char *buf, size_t len)
 
        switch (n) {
        case LWS_SSL_CAPABLE_ERROR:
-               lwsl_err("%s: wsi %p: LWS_SSL_CAPABLE_ERROR\n", __func__,
-                        (void *)wsi);
                /* we're going to close, let close know sends aren't possible */
                wsi->socket_is_permanently_unusable = 1;
                return -1;
@@ -166,16 +168,6 @@ handle_truncated_send:
                /* what we just sent went out cleanly */
                return n;
 
-       if (n && wsi->u.ws.clean_buffer)
-               /*
-                * This buffer unaffected by extension rewriting.
-                * It means the user code is expected to deal with
-                * partial sends.  (lws knows the header was already
-                * sent, so on next send will just resume sending
-                * payload)
-                */
-                return n;
-
        /*
         * Newly truncated send.  Buffer the remainder (it will get
         * first priority next time the socket is writable)
@@ -213,7 +205,7 @@ handle_truncated_send:
  * @wsi:       Websocket instance (available from user callback)
  * @buf:       The data to send.  For data being sent on a websocket
  *             connection (ie, not default http), this buffer MUST have
- *             LWS_SEND_BUFFER_PRE_PADDING bytes valid BEFORE the pointer.
+ *             LWS_PRE bytes valid BEFORE the pointer.
  *             This is so the protocol header data can be added in-situ.
  * @len:       Count of the data bytes in the payload starting from buf
  * @protocol:  Use LWS_WRITE_HTTP to reply to an http connection, and one
@@ -236,51 +228,110 @@ handle_truncated_send:
  *     pressure at any given time.
  */
 
-LWS_VISIBLE int lws_write(struct lws *wsi, unsigned char *buf,
-                         size_t len, enum lws_write_protocol protocol)
+LWS_VISIBLE int lws_write(struct lws *wsi, unsigned char *buf, size_t len,
+                         enum lws_write_protocol wp)
 {
-       int masked7 = wsi->mode == LWSCM_WS_CLIENT;
+       struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+       int masked7 = (wsi->mode == LWSCM_WS_CLIENT);
        unsigned char is_masked_bit = 0;
        unsigned char *dropmask = NULL;
        struct lws_tokens eff_buf;
        int pre = 0, n;
        size_t orig_len = len;
 
-       if (protocol == LWS_WRITE_HTTP ||
-           protocol == LWS_WRITE_HTTP_FINAL ||
-           protocol == LWS_WRITE_HTTP_HEADERS)
+       if (wsi->state == LWSS_ESTABLISHED && wsi->u.ws.tx_draining_ext) {
+               /* remove us from the list */
+               struct lws **w = &pt->tx_draining_ext_list;
+               lwsl_debug("%s: TX EXT DRAINING: Remove from list\n", __func__);
+               wsi->u.ws.tx_draining_ext = 0;
+               /* remove us from context draining ext list */
+               while (*w) {
+                       if (*w == wsi) {
+                               *w = wsi->u.ws.tx_draining_ext_list;
+                               break;
+                       }
+                       w = &((*w)->u.ws.tx_draining_ext_list);
+               }
+               wsi->u.ws.tx_draining_ext_list = NULL;
+               wp = (wsi->u.ws.tx_draining_stashed_wp & 0xc0) |
+                               LWS_WRITE_CONTINUATION;
+
+               lwsl_ext("FORCED draining wp to 0x%02X\n", wp);
+       }
+
+       if (wp == LWS_WRITE_HTTP ||
+           wp == LWS_WRITE_HTTP_FINAL ||
+           wp == LWS_WRITE_HTTP_HEADERS)
                goto send_raw;
 
-       /* websocket protocol, either binary or text */
+       /* if not in a state to send stuff, then just send nothing */
 
        if (wsi->state != LWSS_ESTABLISHED &&
-           !(wsi->state == LWSS_RETURNED_CLOSE_ALREADY &&
-             protocol == LWS_WRITE_CLOSE))
-               return -1;
+           ((wsi->state != LWSS_RETURNED_CLOSE_ALREADY &&
+             wsi->state != LWSS_AWAITING_CLOSE_ACK) ||
+                           wp != LWS_WRITE_CLOSE))
+               return 0;
 
        /* if we are continuing a frame that already had its header done */
 
-       if (wsi->u.ws.inside_frame)
+       if (wsi->u.ws.inside_frame) {
+               lwsl_debug("INSIDE FRAME\n");
                goto do_more_inside_frame;
+       }
 
        wsi->u.ws.clean_buffer = 1;
 
        /*
         * give a chance to the extensions to modify payload
-        * pre-TX mangling is not allowed to truncate
+        * the extension may decide to produce unlimited payload erratically
+        * (eg, compression extension), so we require only that if he produces
+        * something, it will be a complete fragment of the length known at
+        * the time (just the fragment length known), and if he has
+        * more we will come back next time he is writeable and allow him to
+        * produce more fragments until he's drained.
+        *
+        * This allows what is sent each time it is writeable to be limited to
+        * a size that can be sent without partial sends or blocking, allows
+        * interleaving of control frames and other connection service.
         */
        eff_buf.token = (char *)buf;
        eff_buf.token_len = len;
 
-       switch ((int)protocol) {
+       switch ((int)wp) {
        case LWS_WRITE_PING:
        case LWS_WRITE_PONG:
        case LWS_WRITE_CLOSE:
                break;
        default:
-               if (lws_ext_cb_wsi_active_exts(wsi, LWS_EXT_CALLBACK_PAYLOAD_TX,
-                                              &eff_buf, 0) < 0)
+               n = lws_ext_cb_active(wsi, LWS_EXT_CB_PAYLOAD_TX, &eff_buf, wp);
+               if (n < 0)
                        return -1;
+
+               if (n && eff_buf.token_len) {
+                       /* extension requires further draining */
+                       wsi->u.ws.tx_draining_ext = 1;
+                       wsi->u.ws.tx_draining_ext_list = pt->tx_draining_ext_list;
+                       pt->tx_draining_ext_list = wsi;
+                       /* we must come back to do more */
+                       lws_callback_on_writable(wsi);
+                       /*
+                        * keep a copy of the write type for the overall
+                        * action that has provoked generation of these
+                        * fragments, so the last guy can use its FIN state.
+                        */
+                       wsi->u.ws.tx_draining_stashed_wp = wp;
+                       /* this is definitely not actually the last fragment
+                        * because the extension asserted he has more coming
+                        * So make sure this intermediate one doesn't go out
+                        * with a FIN.
+                        */
+                       wp |= LWS_WRITE_NO_FIN;
+               }
+
+               if (eff_buf.token_len && wsi->u.ws.stashed_write_pending) {
+                       wsi->u.ws.stashed_write_pending = 0;
+                       wp = (wp &0xc0) | (int)wsi->u.ws.stashed_write_type;
+               }
        }
 
        /*
@@ -288,12 +339,24 @@ LWS_VISIBLE int lws_write(struct lws *wsi, unsigned char *buf,
         * compression extension, it has already updated its state according
         * to this being issued
         */
-       if ((char *)buf != eff_buf.token)
+       if ((char *)buf != eff_buf.token) {
+               /*
+                * ext might eat it, but no have anything to issue yet
+                * in that case we have to follow his lead, but stash and
+                * replace the write type that was lost here the first time.
+                */
+               if (len && !eff_buf.token_len) {
+                       if (!wsi->u.ws.stashed_write_pending)
+                               wsi->u.ws.stashed_write_type = (char)wp & 0x3f;
+                       wsi->u.ws.stashed_write_pending = 1;
+                       return len;
+               }
                /*
                 * extension recreated it:
                 * need to buffer this if not all sent
                 */
                wsi->u.ws.clean_buffer = 0;
+       }
 
        buf = (unsigned char *)eff_buf.token;
        len = eff_buf.token_len;
@@ -306,7 +369,7 @@ LWS_VISIBLE int lws_write(struct lws *wsi, unsigned char *buf,
                        is_masked_bit = 0x80;
                }
 
-               switch (protocol & 0xf) {
+               switch (wp & 0xf) {
                case LWS_WRITE_TEXT:
                        n = LWSWSOPC_TEXT_FRAME;
                        break;
@@ -327,11 +390,11 @@ LWS_VISIBLE int lws_write(struct lws *wsi, unsigned char *buf,
                        n = LWSWSOPC_PONG;
                        break;
                default:
-                       lwsl_warn("lws_write: unknown write opc / protocol\n");
+                       lwsl_warn("lws_write: unknown write opc / wp\n");
                        return -1;
                }
 
-               if (!(protocol & LWS_WRITE_NO_FIN))
+               if (!(wp & LWS_WRITE_NO_FIN))
                        n |= 1 << 7;
 
                if (len < 126) {
@@ -373,10 +436,10 @@ do_more_inside_frame:
 
        /*
         * Deal with masking if we are in client -> server direction and
-        * the protocol demands it
+        * the wp demands it
         */
 
-       if (wsi->mode == LWSCM_WS_CLIENT) {
+       if (masked7) {
                if (!wsi->u.ws.inside_frame)
                        if (lws_0405_frame_mask_generate(wsi)) {
                                lwsl_err("frame mask generation failed\n");
@@ -388,17 +451,16 @@ do_more_inside_frame:
                 */
                if (dropmask) { /* never set if already inside frame */
                        for (n = 4; n < (int)len + 4; n++)
-                               dropmask[n] = dropmask[n] ^
-                               wsi->u.ws.mask_nonce[
-                                       (wsi->u.ws.frame_mask_index++) & 3];
+                               dropmask[n] = dropmask[n] ^ wsi->u.ws.mask[
+                                       (wsi->u.ws.mask_idx++) & 3];
 
                        /* copy the frame nonce into place */
-                       memcpy(dropmask, wsi->u.ws.mask_nonce, 4);
+                       memcpy(dropmask, wsi->u.ws.mask, 4);
                }
        }
 
 send_raw:
-       switch ((int)protocol) {
+       switch ((int)wp) {
        case LWS_WRITE_CLOSE:
 /*             lwsl_hexdump(&buf[-pre], len); */
        case LWS_WRITE_HTTP:
@@ -411,26 +473,26 @@ send_raw:
                        unsigned char flags = 0;
 
                        n = LWS_HTTP2_FRAME_TYPE_DATA;
-                       if (protocol == LWS_WRITE_HTTP_HEADERS) {
+                       if (wp == LWS_WRITE_HTTP_HEADERS) {
                                n = LWS_HTTP2_FRAME_TYPE_HEADERS;
                                flags = LWS_HTTP2_FLAG_END_HEADERS;
                                if (wsi->u.http2.send_END_STREAM)
                                        flags |= LWS_HTTP2_FLAG_END_STREAM;
                        }
 
-                       if ((protocol == LWS_WRITE_HTTP ||
-                            protocol == LWS_WRITE_HTTP_FINAL) &&
+                       if ((wp == LWS_WRITE_HTTP ||
+                            wp == LWS_WRITE_HTTP_FINAL) &&
                            wsi->u.http.content_length) {
                                wsi->u.http.content_remain -= len;
                                lwsl_info("%s: content_remain = %lu\n", __func__,
                                          wsi->u.http.content_remain);
                                if (!wsi->u.http.content_remain) {
                                        lwsl_info("%s: selecting final write mode\n", __func__);
-                                       protocol = LWS_WRITE_HTTP_FINAL;
+                                       wp = LWS_WRITE_HTTP_FINAL;
                                }
                        }
 
-                       if (protocol == LWS_WRITE_HTTP_FINAL && wsi->u.http2.END_STREAM) {
+                       if (wp == LWS_WRITE_HTTP_FINAL && wsi->u.http2.END_STREAM) {
                                lwsl_info("%s: setting END_STREAM\n", __func__);
                                flags |= LWS_HTTP2_FLAG_END_STREAM;
                        }
@@ -444,8 +506,6 @@ send_raw:
                break;
        }
 
-       wsi->u.ws.inside_frame = 1;
-
        /*
         * give any active extensions a chance to munge the buffer
         * before send.  We pass in a pointer to an lws_tokens struct
@@ -466,6 +526,7 @@ send_raw:
         */
 
        n = lws_issue_raw_ext_access(wsi, buf - pre, len + pre);
+       wsi->u.ws.inside_frame = 1;
        if (n <= 0)
                return n;
 
@@ -488,6 +549,7 @@ send_raw:
 LWS_VISIBLE int lws_serve_http_file_fragment(struct lws *wsi)
 {
        struct lws_context *context = wsi->context;
+       struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
        unsigned long amount;
        int n, m;
 
@@ -506,16 +568,16 @@ LWS_VISIBLE int lws_serve_http_file_fragment(struct lws *wsi)
                        goto all_sent;
 
                if (lws_plat_file_read(wsi, wsi->u.http.fd, &amount,
-                                      context->serv_buf,
-                                      sizeof(context->serv_buf)) < 0)
+                                      pt->serv_buf,
+                                      LWS_MAX_SOCKET_IO_BUF) < 0)
                        return -1; /* caller will close */
 
                n = (int)amount;
                if (n) {
                        lws_set_timeout(wsi, PENDING_TIMEOUT_HTTP_CONTENT,
-                                       AWAITING_TIMEOUT);
+                                       context->timeout_secs);
                        wsi->u.http.filepos += n;
-                       m = lws_write(wsi, context->serv_buf, n,
+                       m = lws_write(wsi, pt->serv_buf, n,
                                      wsi->u.http.filepos == wsi->u.http.filelen ?
                                        LWS_WRITE_HTTP_FINAL : LWS_WRITE_HTTP);
                        if (m < 0)
@@ -538,10 +600,11 @@ all_sent:
 
                        if (wsi->protocol->callback)
                                /* ignore callback returned value */
-                               user_callback_handle_rxflow(
-                                       wsi->protocol->callback, wsi,
-                                       LWS_CALLBACK_HTTP_FILE_COMPLETION,
-                                       wsi->user_space, NULL, 0);
+                               if (user_callback_handle_rxflow(
+                                    wsi->protocol->callback, wsi,
+                                    LWS_CALLBACK_HTTP_FILE_COMPLETION,
+                                    wsi->user_space, NULL, 0) < 0)
+                                       return -1;
                        return 1;  /* >0 indicates completed */
                }
        }
@@ -578,6 +641,7 @@ lws_ssl_capable_write_no_ssl(struct lws *wsi, unsigned char *buf, int len)
 
 #if LWS_POSIX
        n = send(wsi->sock, (char *)buf, len, MSG_NOSIGNAL);
+//     lwsl_info("%s: sent len %d result %d", __func__, len, n);
        if (n >= 0)
                return n;
 
@@ -597,7 +661,7 @@ lws_ssl_capable_write_no_ssl(struct lws *wsi, unsigned char *buf, int len)
        // !!!
 #endif
 
-       lwsl_debug("ERROR writing len %d to skt %d\n", len, n);
+       lwsl_debug("ERROR writing len %d to skt fd %d err %d / errno %d\n", len, wsi->sock, n, LWS_ERRNO);
        return LWS_SSL_CAPABLE_ERROR;
 }
 #endif