Coverage Report

Created: 2026-09-04 07:16

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/curl/lib/bufq.c
Line
Count
Source
1
/***************************************************************************
2
 *                                  _   _ ____  _
3
 *  Project                     ___| | | |  _ \| |
4
 *                             / __| | | | |_) | |
5
 *                            | (__| |_| |  _ <| |___
6
 *                             \___|\___/|_| \_\_____|
7
 *
8
 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
9
 *
10
 * This software is licensed as described in the file COPYING, which
11
 * you should have received as part of this distribution. The terms
12
 * are also available at https://curl.se/docs/copyright.html.
13
 *
14
 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
15
 * copies of the Software, and permit persons to whom the Software is
16
 * furnished to do so, under the terms of the COPYING file.
17
 *
18
 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
19
 * KIND, either express or implied.
20
 *
21
 * SPDX-License-Identifier: curl
22
 *
23
 ***************************************************************************/
24
#include "curl_setup.h"
25
26
#include "bufq.h"
27
28
static bool chunk_is_empty(const struct buf_chunk *chunk)
29
584
{
30
584
  return chunk->r_offset >= chunk->w_offset;
31
584
}
32
33
static bool chunk_is_full(const struct buf_chunk *chunk)
34
122
{
35
122
  return chunk->w_offset >= chunk->dlen;
36
122
}
37
38
static size_t chunk_len(const struct buf_chunk *chunk)
39
182
{
40
182
  return chunk->w_offset - chunk->r_offset;
41
182
}
42
43
static void chunk_reset(struct buf_chunk *chunk)
44
133
{
45
133
  chunk->next = NULL;
46
133
  chunk->r_offset = chunk->w_offset = 0;
47
133
}
48
49
static size_t chunk_append(struct buf_chunk *chunk,
50
                           const uint8_t *buf, size_t len)
51
175
{
52
175
  uint8_t *p = &chunk->x.data[chunk->w_offset];
53
175
  size_t n = chunk->dlen - chunk->w_offset;
54
175
  DEBUGASSERT(chunk->dlen >= chunk->w_offset);
55
175
  if(n) {
56
175
    n = CURLMIN(n, len);
57
175
    memcpy(p, buf, n);
58
175
    chunk->w_offset += n;
59
175
  }
60
175
  return n;
61
175
}
62
63
static size_t chunk_read(struct buf_chunk *chunk,
64
                         uint8_t *buf, size_t len)
65
0
{
66
0
  uint8_t *p = &chunk->x.data[chunk->r_offset];
67
0
  size_t n = chunk->w_offset - chunk->r_offset;
68
0
  DEBUGASSERT(chunk->w_offset >= chunk->r_offset);
69
0
  if(!n) {
70
0
    return 0;
71
0
  }
72
0
  else if(n <= len) {
73
0
    memcpy(buf, p, n);
74
0
    chunk->r_offset = chunk->w_offset = 0;
75
0
    return n;
76
0
  }
77
0
  else {
78
0
    memcpy(buf, p, len);
79
0
    chunk->r_offset += len;
80
0
    return len;
81
0
  }
82
0
}
83
84
static CURLcode chunk_slurpn(struct buf_chunk *chunk, size_t max_len,
85
                             Curl_bufq_reader *reader,
86
                             void *reader_ctx, size_t *pnread)
87
131
{
88
131
  uint8_t *p = &chunk->x.data[chunk->w_offset];
89
131
  size_t n = chunk->dlen - chunk->w_offset; /* free amount */
90
131
  CURLcode result;
91
92
131
  *pnread = 0;
93
131
  DEBUGASSERT(chunk->dlen >= chunk->w_offset);
94
131
  if(!n)
95
0
    return CURLE_AGAIN;
96
131
  if(max_len && n > max_len)
97
131
    n = max_len;
98
131
  result = reader(reader_ctx, p, n, pnread);
99
131
  if(!result) {
100
110
    DEBUGASSERT(*pnread <= n);
101
110
    chunk->w_offset += *pnread;
102
110
  }
103
131
  return result;
104
131
}
105
106
static void chunk_peek(const struct buf_chunk *chunk,
107
                       const uint8_t **pbuf, size_t *plen)
108
177
{
109
177
  DEBUGASSERT(chunk->w_offset >= chunk->r_offset);
110
177
  *pbuf = &chunk->x.data[chunk->r_offset];
111
177
  *plen = chunk->w_offset - chunk->r_offset;
112
177
}
113
114
static void chunk_peek_at(const struct buf_chunk *chunk, size_t offset,
115
                          const uint8_t **pbuf, size_t *plen)
116
0
{
117
0
  offset += chunk->r_offset;
118
0
  DEBUGASSERT(chunk->w_offset >= offset);
119
0
  *pbuf = &chunk->x.data[offset];
120
0
  *plen = chunk->w_offset - offset;
121
0
}
122
123
static size_t chunk_skip(struct buf_chunk *chunk, size_t amount)
124
138
{
125
138
  size_t n = chunk->w_offset - chunk->r_offset;
126
138
  DEBUGASSERT(chunk->w_offset >= chunk->r_offset);
127
138
  if(n) {
128
138
    n = CURLMIN(n, amount);
129
138
    chunk->r_offset += n;
130
138
    if(chunk->r_offset == chunk->w_offset)
131
138
      chunk->r_offset = chunk->w_offset = 0;
132
138
  }
133
138
  return n;
134
138
}
135
136
static void chunk_list_free(struct buf_chunk **anchor)
137
16.2k
{
138
16.2k
  struct buf_chunk *chunk;
139
16.3k
  while(*anchor) {
140
51
    chunk = *anchor;
141
51
    *anchor = chunk->next;
142
51
    curlx_free(chunk);
143
51
  }
144
16.2k
}
145
146
void Curl_bufcp_init(struct bufc_pool *pool,
147
                     size_t chunk_size, size_t spare_max)
148
0
{
149
0
  DEBUGASSERT(chunk_size > 0);
150
0
  DEBUGASSERT(spare_max > 0);
151
0
  memset(pool, 0, sizeof(*pool));
152
0
  pool->chunk_size = chunk_size;
153
0
  pool->spare_max = spare_max;
154
0
}
155
156
static CURLcode bufcp_take(struct bufc_pool *pool,
157
                           struct buf_chunk **pchunk)
158
0
{
159
0
  struct buf_chunk *chunk = NULL;
160
161
0
  if(pool->spare) {
162
0
    chunk = pool->spare;
163
0
    pool->spare = chunk->next;
164
0
    --pool->spare_count;
165
0
    chunk_reset(chunk);
166
0
    *pchunk = chunk;
167
0
    return CURLE_OK;
168
0
  }
169
170
  /* Check for integer overflow before allocation */
171
0
  if(pool->chunk_size > SIZE_MAX - sizeof(*chunk)) {
172
0
    *pchunk = NULL;
173
0
    return CURLE_OUT_OF_MEMORY;
174
0
  }
175
176
0
  chunk = curlx_calloc(1, sizeof(*chunk) + pool->chunk_size);
177
0
  if(!chunk) {
178
0
    *pchunk = NULL;
179
0
    return CURLE_OUT_OF_MEMORY;
180
0
  }
181
0
  chunk->dlen = pool->chunk_size;
182
0
  *pchunk = chunk;
183
0
  return CURLE_OK;
184
0
}
185
186
static void bufcp_put(struct bufc_pool *pool,
187
                      struct buf_chunk *chunk)
188
0
{
189
0
  if(pool->spare_count >= pool->spare_max) {
190
0
    curlx_free(chunk);
191
0
  }
192
0
  else {
193
0
    chunk_reset(chunk);
194
0
    chunk->next = pool->spare;
195
0
    pool->spare = chunk;
196
0
    ++pool->spare_count;
197
0
  }
198
0
}
199
200
void Curl_bufcp_free(struct bufc_pool *pool)
201
0
{
202
0
  chunk_list_free(&pool->spare);
203
0
  pool->spare_count = 0;
204
0
}
205
206
static void bufq_init(struct bufq *q, struct bufc_pool *pool,
207
                      size_t chunk_size, size_t max_chunks, int opts)
208
8.14k
{
209
8.14k
  DEBUGASSERT(chunk_size > 0);
210
8.14k
  DEBUGASSERT(max_chunks > 0);
211
8.14k
  memset(q, 0, sizeof(*q));
212
8.14k
  q->chunk_size = chunk_size;
213
8.14k
  q->max_chunks = max_chunks;
214
8.14k
  q->pool = pool;
215
8.14k
  q->opts = opts;
216
8.14k
}
217
218
void Curl_bufq_init2(struct bufq *q, size_t chunk_size, size_t max_chunks,
219
                     int opts)
220
8.14k
{
221
8.14k
  bufq_init(q, NULL, chunk_size, max_chunks, opts);
222
8.14k
}
223
224
void Curl_bufq_init(struct bufq *q, size_t chunk_size, size_t max_chunks)
225
0
{
226
0
  bufq_init(q, NULL, chunk_size, max_chunks, BUFQ_OPT_NONE);
227
0
}
228
229
void Curl_bufq_initp(struct bufq *q, struct bufc_pool *pool,
230
                     size_t max_chunks, int opts)
231
0
{
232
0
  bufq_init(q, pool, pool->chunk_size, max_chunks, opts);
233
0
}
234
235
void Curl_bufq_free(struct bufq *q)
236
8.14k
{
237
8.14k
  chunk_list_free(&q->head);
238
8.14k
  chunk_list_free(&q->spare);
239
8.14k
  q->tail = NULL;
240
8.14k
  q->chunk_count = 0;
241
8.14k
}
242
243
void Curl_bufq_reset(struct bufq *q)
244
23
{
245
23
  struct buf_chunk *chunk;
246
23
  while(q->head) {
247
0
    chunk = q->head;
248
0
    q->head = chunk->next;
249
0
    chunk->next = q->spare;
250
0
    q->spare = chunk;
251
0
  }
252
23
  q->tail = NULL;
253
23
}
254
255
size_t Curl_bufq_len(const struct bufq *q)
256
366
{
257
366
  const struct buf_chunk *chunk = q->head;
258
366
  size_t len = 0;
259
548
  while(chunk) {
260
182
    len += chunk_len(chunk);
261
182
    chunk = chunk->next;
262
182
  }
263
366
  return len;
264
366
}
265
266
bool Curl_bufq_is_empty(const struct bufq *q)
267
3.51k
{
268
3.51k
  return !q->head || chunk_is_empty(q->head);
269
3.51k
}
270
271
bool Curl_bufq_is_full(const struct bufq *q)
272
0
{
273
0
  if(!q->tail || q->spare)
274
0
    return FALSE;
275
0
  if(q->chunk_count < q->max_chunks)
276
0
    return FALSE;
277
0
  if(q->chunk_count > q->max_chunks)
278
0
    return TRUE;
279
  /* we have no spares and cannot make more, is the tail full? */
280
0
  return chunk_is_full(q->tail);
281
0
}
282
283
static struct buf_chunk *get_spare(struct bufq *q)
284
184
{
285
184
  struct buf_chunk *chunk = NULL;
286
287
184
  if(q->spare) {
288
133
    chunk = q->spare;
289
133
    q->spare = chunk->next;
290
133
    chunk_reset(chunk);
291
133
    return chunk;
292
133
  }
293
294
51
  if(q->chunk_count >= q->max_chunks && (!(q->opts & BUFQ_OPT_SOFT_LIMIT)))
295
0
    return NULL;
296
297
51
  if(q->pool) {
298
0
    if(bufcp_take(q->pool, &chunk))
299
0
      return NULL;
300
0
    ++q->chunk_count;
301
0
    return chunk;
302
0
  }
303
51
  else {
304
    /* Check for integer overflow before allocation */
305
51
    if(q->chunk_size > SIZE_MAX - sizeof(*chunk)) {
306
0
      return NULL;
307
0
    }
308
309
51
    chunk = curlx_calloc(1, sizeof(*chunk) + q->chunk_size);
310
51
    if(!chunk)
311
0
      return NULL;
312
51
    chunk->dlen = q->chunk_size;
313
51
    ++q->chunk_count;
314
51
    return chunk;
315
51
  }
316
51
}
317
318
static void prune_head(struct bufq *q)
319
138
{
320
138
  struct buf_chunk *chunk;
321
322
276
  while(q->head && chunk_is_empty(q->head)) {
323
138
    chunk = q->head;
324
138
    q->head = chunk->next;
325
138
    if(q->tail == chunk)
326
138
      q->tail = q->head;
327
138
    if(q->pool) {
328
0
      bufcp_put(q->pool, chunk);
329
0
      --q->chunk_count;
330
0
    }
331
138
    else if((q->chunk_count > q->max_chunks) ||
332
138
            (q->opts & BUFQ_OPT_NO_SPARES)) {
333
      /* SOFT_LIMIT allowed us more than max. free spares until
334
       * we are at max again. Or free them if we are configured
335
       * to not use spares. */
336
0
      curlx_free(chunk);
337
0
      --q->chunk_count;
338
0
    }
339
138
    else {
340
138
      chunk->next = q->spare;
341
138
      q->spare = chunk;
342
138
    }
343
138
  }
344
138
}
345
346
static struct buf_chunk *get_non_full_tail(struct bufq *q)
347
306
{
348
306
  struct buf_chunk *chunk;
349
350
306
  if(q->tail && !chunk_is_full(q->tail))
351
122
    return q->tail;
352
184
  chunk = get_spare(q);
353
184
  if(chunk) {
354
    /* new tail, and possibly new head */
355
184
    if(q->tail) {
356
0
      q->tail->next = chunk;
357
0
      q->tail = chunk;
358
0
    }
359
184
    else {
360
184
      DEBUGASSERT(!q->head);
361
184
      q->head = q->tail = chunk;
362
184
    }
363
184
  }
364
184
  return chunk;
365
184
}
366
367
CURLcode Curl_bufq_write(struct bufq *q,
368
                         const uint8_t *buf, size_t len,
369
                         size_t *pnwritten)
370
175
{
371
175
  struct buf_chunk *tail;
372
175
  size_t n;
373
374
175
  DEBUGASSERT(q->max_chunks > 0);
375
175
  *pnwritten = 0;
376
350
  while(len) {
377
175
    tail = get_non_full_tail(q);
378
175
    if(!tail) {
379
0
      if((q->chunk_count < q->max_chunks) || (q->opts & BUFQ_OPT_SOFT_LIMIT))
380
        /* should have gotten a tail, but did not */
381
0
        return CURLE_OUT_OF_MEMORY;
382
0
      break;
383
0
    }
384
175
    n = chunk_append(tail, buf, len);
385
175
    if(!n)
386
0
      break;
387
175
    *pnwritten += n;
388
175
    buf += n;
389
175
    len -= n;
390
175
  }
391
175
  return (!*pnwritten && len) ? CURLE_AGAIN : CURLE_OK;
392
175
}
393
394
CURLcode Curl_bufq_cwrite(struct bufq *q,
395
                          const char *buf, size_t len,
396
                          size_t *pnwritten)
397
0
{
398
0
  return Curl_bufq_write(q, (const uint8_t *)buf, len, pnwritten);
399
0
}
400
401
CURLcode Curl_bufq_read(struct bufq *q, uint8_t *buf, size_t len,
402
                        size_t *pnread)
403
0
{
404
0
  *pnread = 0;
405
0
  while(len && q->head) {
406
0
    size_t n = chunk_read(q->head, buf, len);
407
0
    if(n) {
408
0
      *pnread += n;
409
0
      buf += n;
410
0
      len -= n;
411
0
    }
412
0
    prune_head(q);
413
0
  }
414
0
  return (!*pnread) ? CURLE_AGAIN : CURLE_OK;
415
0
}
416
417
CURLcode Curl_bufq_cread(struct bufq *q, char *buf, size_t len,
418
                         size_t *pnread)
419
0
{
420
0
  return Curl_bufq_read(q, (uint8_t *)buf, len, pnread);
421
0
}
422
423
bool Curl_bufq_peek(struct bufq *q,
424
                    const uint8_t **pbuf, size_t *plen)
425
269
{
426
269
  if(q->head && chunk_is_empty(q->head)) {
427
0
    prune_head(q);
428
0
  }
429
269
  if(q->head && !chunk_is_empty(q->head)) {
430
177
    chunk_peek(q->head, pbuf, plen);
431
177
    return TRUE;
432
177
  }
433
92
  *pbuf = NULL;
434
92
  *plen = 0;
435
92
  return FALSE;
436
269
}
437
438
bool Curl_bufq_peek_at(struct bufq *q, size_t offset,
439
                       const uint8_t **pbuf, size_t *plen)
440
0
{
441
0
  struct buf_chunk *c = q->head;
442
0
  size_t clen;
443
444
0
  while(c) {
445
0
    clen = chunk_len(c);
446
0
    if(!clen)
447
0
      break;
448
0
    if(offset >= clen) {
449
0
      offset -= clen;
450
0
      c = c->next;
451
0
      continue;
452
0
    }
453
0
    chunk_peek_at(c, offset, pbuf, plen);
454
0
    return TRUE;
455
0
  }
456
0
  *pbuf = NULL;
457
0
  *plen = 0;
458
0
  return FALSE;
459
0
}
460
461
void Curl_bufq_skip(struct bufq *q, size_t amount)
462
138
{
463
138
  size_t n;
464
465
276
  while(amount && q->head) {
466
138
    n = chunk_skip(q->head, amount);
467
138
    amount -= n;
468
138
    prune_head(q);
469
138
  }
470
138
}
471
472
CURLcode Curl_bufq_pass(struct bufq *q, Curl_bufq_writer *writer,
473
                        void *writer_ctx, size_t *pwritten)
474
92
{
475
92
  const uint8_t *buf;
476
92
  size_t blen;
477
92
  CURLcode result = CURLE_OK;
478
479
92
  *pwritten = 0;
480
184
  while(Curl_bufq_peek(q, &buf, &blen)) {
481
92
    size_t chunk_written;
482
483
92
    result = writer(writer_ctx, buf, blen, &chunk_written);
484
92
    if(result) {
485
0
      if((result == CURLE_AGAIN) && *pwritten) {
486
        /* blocked on subsequent write, report success */
487
0
        result = CURLE_OK;
488
0
      }
489
0
      break;
490
0
    }
491
92
    if(!chunk_written) {
492
0
      if(!*pwritten) {
493
        /* treat as blocked */
494
0
        result = CURLE_AGAIN;
495
0
      }
496
0
      break;
497
0
    }
498
92
    *pwritten += chunk_written;
499
92
    Curl_bufq_skip(q, chunk_written);
500
92
  }
501
92
  return result;
502
92
}
503
504
CURLcode Curl_bufq_write_pass(struct bufq *q,
505
                              const uint8_t *buf, size_t len,
506
                              Curl_bufq_writer *writer, void *writer_ctx,
507
                              size_t *pwritten)
508
0
{
509
0
  CURLcode result = CURLE_OK;
510
0
  size_t n;
511
512
0
  *pwritten = 0;
513
0
  while(len) {
514
0
    if(Curl_bufq_is_full(q)) {
515
      /* try to make room in case we are full */
516
0
      result = Curl_bufq_pass(q, writer, writer_ctx, &n);
517
0
      if(result) {
518
0
        if(result != CURLE_AGAIN) {
519
          /* real error, fail */
520
0
          return result;
521
0
        }
522
        /* would block, bufq is full, give up */
523
0
        break;
524
0
      }
525
0
    }
526
527
    /* Add to bufq as much as there is room for */
528
0
    result = Curl_bufq_write(q, buf, len, &n);
529
0
    if(result) {
530
0
      if(result != CURLE_AGAIN)
531
        /* real error, fail */
532
0
        return result;
533
      /* result == CURLE_AGAIN */
534
0
      if(*pwritten)
535
        /* we did write successfully before */
536
0
        result = CURLE_OK;
537
0
      return result;
538
0
    }
539
0
    else if(n == 0)
540
      /* edge case of writer returning 0 (and len is >0)
541
       * break or we might enter an infinite loop here */
542
0
      break;
543
544
    /* Track what we added to bufq */
545
0
    buf += n;
546
0
    len -= n;
547
0
    *pwritten += n;
548
0
  }
549
550
0
  return (!*pwritten && len) ? CURLE_AGAIN : CURLE_OK;
551
0
}
552
553
CURLcode Curl_bufq_sipn(struct bufq *q, size_t max_len,
554
                        Curl_bufq_reader *reader, void *reader_ctx,
555
                        size_t *pnread)
556
131
{
557
131
  struct buf_chunk *tail = NULL;
558
559
131
  *pnread = 0;
560
131
  tail = get_non_full_tail(q);
561
131
  if(!tail) {
562
0
    if(q->chunk_count < q->max_chunks)
563
0
      return CURLE_OUT_OF_MEMORY;
564
    /* full, blocked */
565
0
    return CURLE_AGAIN;
566
0
  }
567
568
131
  return chunk_slurpn(tail, max_len, reader, reader_ctx, pnread);
569
131
}
570
571
/**
572
 * Read up to `max_len` bytes and append it to the end of the buffer queue.
573
 * if `max_len` is 0, no limit is imposed and the call behaves exactly
574
 * the same as `Curl_bufq_slurp()`.
575
 * Returns the total amount of buf read (may be 0) in `pnread` or error
576
 * Note that even in case of an error chunks may have been read and
577
 * the buffer queue will have different length than before.
578
 */
579
static CURLcode bufq_slurpn(struct bufq *q, size_t max_len,
580
                            Curl_bufq_reader *reader, void *reader_ctx,
581
                            size_t *pnread)
582
0
{
583
0
  CURLcode result;
584
585
0
  *pnread = 0;
586
0
  while(1) {
587
0
    size_t n;
588
0
    result = Curl_bufq_sipn(q, max_len, reader, reader_ctx, &n);
589
0
    if(result) {
590
0
      if(!*pnread || result != CURLE_AGAIN) {
591
        /* blocked on first read or real error, fail */
592
0
        return result;
593
0
      }
594
0
      result = CURLE_OK;
595
0
      break;
596
0
    }
597
0
    else if(n == 0) {
598
      /* eof, result remains CURLE_OK */
599
0
      break;
600
0
    }
601
0
    *pnread += n;
602
0
    if(max_len) {
603
0
      DEBUGASSERT(n <= max_len);
604
0
      max_len -= n;
605
0
      if(!max_len)
606
0
        break;
607
0
    }
608
    /* give up slurping when we get less bytes than we asked for */
609
0
    if(q->tail && !chunk_is_full(q->tail))
610
0
      break;
611
0
  }
612
0
  return result;
613
0
}
614
615
CURLcode Curl_bufq_slurp(struct bufq *q, Curl_bufq_reader *reader,
616
                         void *reader_ctx, size_t *pnread)
617
0
{
618
0
  return bufq_slurpn(q, 0, reader, reader_ctx, pnread);
619
0
}