Coverage Report

Created: 2026-10-16 06:12

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/hostap/src/utils/wpabuf.c
Line
Count
Source
1
/*
2
 * Dynamic data buffer
3
 * Copyright (c) 2007-2012, Jouni Malinen <j@w1.fi>
4
 *
5
 * This software may be distributed under the terms of the BSD license.
6
 * See README for more details.
7
 */
8
9
#include "includes.h"
10
11
#include "common.h"
12
#include "trace.h"
13
#include "wpabuf.h"
14
15
#ifdef WPA_TRACE
16
#define WPABUF_MAGIC 0x51a974e3
17
18
struct wpabuf_trace {
19
  unsigned int magic;
20
} __attribute__((aligned(8)));
21
22
static struct wpabuf_trace * wpabuf_get_trace(const struct wpabuf *buf)
23
{
24
  return (struct wpabuf_trace *)
25
    ((const u8 *) buf - sizeof(struct wpabuf_trace));
26
}
27
#endif /* WPA_TRACE */
28
29
30
static void wpabuf_overflow(const struct wpabuf *buf, size_t len)
31
0
{
32
#ifdef WPA_TRACE
33
  struct wpabuf_trace *trace = wpabuf_get_trace(buf);
34
  if (trace->magic != WPABUF_MAGIC) {
35
    wpa_printf(MSG_ERROR, "wpabuf: invalid magic %x",
36
         trace->magic);
37
  }
38
#endif /* WPA_TRACE */
39
0
  wpa_printf(MSG_ERROR, "wpabuf %p (size=%lu used=%lu) overflow len=%lu",
40
0
       buf, (unsigned long) buf->size, (unsigned long) buf->used,
41
0
       (unsigned long) len);
42
0
  wpa_trace_show("wpabuf overflow");
43
0
  abort();
44
0
}
45
46
47
int wpabuf_resize(struct wpabuf **_buf, size_t add_len)
48
0
{
49
0
  struct wpabuf *buf = *_buf;
50
#ifdef WPA_TRACE
51
  struct wpabuf_trace *trace;
52
#endif /* WPA_TRACE */
53
54
0
  if (buf == NULL) {
55
0
    *_buf = wpabuf_alloc(add_len);
56
0
    return *_buf == NULL ? -1 : 0;
57
0
  }
58
59
#ifdef WPA_TRACE
60
  trace = wpabuf_get_trace(buf);
61
  if (trace->magic != WPABUF_MAGIC) {
62
    wpa_printf(MSG_ERROR, "wpabuf: invalid magic %x",
63
         trace->magic);
64
    wpa_trace_show("wpabuf_resize invalid magic");
65
    abort();
66
  }
67
#endif /* WPA_TRACE */
68
69
0
  if (buf->used + add_len > buf->size) {
70
0
    unsigned char *nbuf;
71
0
    if (buf->flags & WPABUF_FLAG_EXT_DATA) {
72
0
      nbuf = os_realloc(buf->buf, buf->used + add_len);
73
0
      if (nbuf == NULL)
74
0
        return -1;
75
0
      os_memset(nbuf + buf->used, 0, add_len);
76
0
      buf->buf = nbuf;
77
0
    } else {
78
#ifdef WPA_TRACE
79
      nbuf = os_realloc(trace, sizeof(struct wpabuf_trace) +
80
            sizeof(struct wpabuf) +
81
            buf->used + add_len);
82
      if (nbuf == NULL)
83
        return -1;
84
      trace = (struct wpabuf_trace *) nbuf;
85
      buf = (struct wpabuf *) (trace + 1);
86
      os_memset(nbuf + sizeof(struct wpabuf_trace) +
87
          sizeof(struct wpabuf) + buf->used, 0,
88
          add_len);
89
#else /* WPA_TRACE */
90
0
      nbuf = os_realloc(buf, sizeof(struct wpabuf) +
91
0
            buf->used + add_len);
92
0
      if (nbuf == NULL)
93
0
        return -1;
94
0
      buf = (struct wpabuf *) nbuf;
95
0
      os_memset(nbuf + sizeof(struct wpabuf) + buf->used, 0,
96
0
          add_len);
97
0
#endif /* WPA_TRACE */
98
0
      buf->buf = (u8 *) (buf + 1);
99
0
      *_buf = buf;
100
0
    }
101
0
    buf->size = buf->used + add_len;
102
0
  }
103
104
0
  return 0;
105
0
}
106
107
108
/**
109
 * wpabuf_alloc - Allocate a wpabuf of the given size
110
 * @len: Length for the allocated buffer
111
 * Returns: Buffer to the allocated wpabuf or %NULL on failure
112
 */
113
struct wpabuf * wpabuf_alloc(size_t len)
114
1.97k
{
115
#ifdef WPA_TRACE
116
  struct wpabuf_trace *trace = os_zalloc(sizeof(struct wpabuf_trace) +
117
                 sizeof(struct wpabuf) + len);
118
  struct wpabuf *buf;
119
  if (trace == NULL)
120
    return NULL;
121
  trace->magic = WPABUF_MAGIC;
122
  buf = (struct wpabuf *) (trace + 1);
123
#else /* WPA_TRACE */
124
1.97k
  struct wpabuf *buf = os_zalloc(sizeof(struct wpabuf) + len);
125
1.97k
  if (buf == NULL)
126
0
    return NULL;
127
1.97k
#endif /* WPA_TRACE */
128
129
1.97k
  buf->size = len;
130
1.97k
  buf->buf = (u8 *) (buf + 1);
131
1.97k
  return buf;
132
1.97k
}
133
134
135
struct wpabuf * wpabuf_alloc_ext_data(u8 *data, size_t len)
136
0
{
137
#ifdef WPA_TRACE
138
  struct wpabuf_trace *trace = os_zalloc(sizeof(struct wpabuf_trace) +
139
                 sizeof(struct wpabuf));
140
  struct wpabuf *buf;
141
  if (trace == NULL)
142
    return NULL;
143
  trace->magic = WPABUF_MAGIC;
144
  buf = (struct wpabuf *) (trace + 1);
145
#else /* WPA_TRACE */
146
0
  struct wpabuf *buf = os_zalloc(sizeof(struct wpabuf));
147
0
  if (buf == NULL)
148
0
    return NULL;
149
0
#endif /* WPA_TRACE */
150
151
0
  buf->size = len;
152
0
  buf->used = len;
153
0
  buf->buf = data;
154
0
  buf->flags |= WPABUF_FLAG_EXT_DATA;
155
156
0
  return buf;
157
0
}
158
159
160
struct wpabuf * wpabuf_alloc_copy(const void *data, size_t len)
161
917
{
162
917
  struct wpabuf *buf = wpabuf_alloc(len);
163
917
  if (buf)
164
917
    wpabuf_put_data(buf, data, len);
165
917
  return buf;
166
917
}
167
168
169
struct wpabuf * wpabuf_dup(const struct wpabuf *src)
170
0
{
171
0
  struct wpabuf *buf;
172
173
0
  if (!src)
174
0
    return NULL;
175
0
  buf = wpabuf_alloc(wpabuf_len(src));
176
0
  if (buf)
177
0
    wpabuf_put_data(buf, wpabuf_head(src), wpabuf_len(src));
178
0
  return buf;
179
0
}
180
181
182
/**
183
 * wpabuf_free - Free a wpabuf
184
 * @buf: wpabuf buffer
185
 */
186
void wpabuf_free(struct wpabuf *buf)
187
2.72k
{
188
#ifdef WPA_TRACE
189
  struct wpabuf_trace *trace;
190
  if (buf == NULL)
191
    return;
192
  trace = wpabuf_get_trace(buf);
193
  if (trace->magic != WPABUF_MAGIC) {
194
    wpa_printf(MSG_ERROR, "wpabuf_free: invalid magic %x",
195
         trace->magic);
196
    wpa_trace_show("wpabuf_free magic mismatch");
197
    abort();
198
  }
199
  if (buf->flags & WPABUF_FLAG_EXT_DATA)
200
    os_free(buf->buf);
201
  os_free(trace);
202
#else /* WPA_TRACE */
203
2.72k
  if (buf == NULL)
204
752
    return;
205
1.97k
  if (buf->flags & WPABUF_FLAG_EXT_DATA)
206
0
    os_free(buf->buf);
207
1.97k
  os_free(buf);
208
1.97k
#endif /* WPA_TRACE */
209
1.97k
}
210
211
212
void wpabuf_clear_free(struct wpabuf *buf)
213
0
{
214
0
  if (buf) {
215
0
    os_memset(wpabuf_mhead(buf), 0, wpabuf_len(buf));
216
0
    wpabuf_free(buf);
217
0
  }
218
0
}
219
220
221
void * wpabuf_put(struct wpabuf *buf, size_t len)
222
7.91k
{
223
7.91k
  void *tmp = wpabuf_mhead_u8(buf) + wpabuf_len(buf);
224
7.91k
  buf->used += len;
225
7.91k
  if (buf->used > buf->size) {
226
0
    wpabuf_overflow(buf, len);
227
0
  }
228
7.91k
  return tmp;
229
7.91k
}
230
231
232
/**
233
 * wpabuf_concat - Concatenate two buffers into a newly allocated one
234
 * @a: First buffer
235
 * @b: Second buffer
236
 * Returns: wpabuf with concatenated a + b data or %NULL on failure
237
 *
238
 * Both buffers a and b will be freed regardless of the return value. Input
239
 * buffers can be %NULL which is interpreted as an empty buffer.
240
 */
241
struct wpabuf * wpabuf_concat(struct wpabuf *a, struct wpabuf *b)
242
0
{
243
0
  struct wpabuf *n = NULL;
244
0
  size_t len = 0;
245
246
0
  if (b == NULL)
247
0
    return a;
248
249
0
  if (a)
250
0
    len += wpabuf_len(a);
251
0
  len += wpabuf_len(b);
252
253
0
  n = wpabuf_alloc(len);
254
0
  if (n) {
255
0
    if (a)
256
0
      wpabuf_put_buf(n, a);
257
0
    wpabuf_put_buf(n, b);
258
0
  }
259
260
0
  wpabuf_free(a);
261
0
  wpabuf_free(b);
262
263
0
  return n;
264
0
}
265
266
267
/**
268
 * wpabuf_zeropad - Pad buffer with 0x00 octets (prefix) to specified length
269
 * @buf: Buffer to be padded
270
 * @len: Length for the padded buffer
271
 * Returns: wpabuf padded to len octets or %NULL on failure
272
 *
273
 * If buf is longer than len octets or of same size, it will be returned as-is.
274
 * Otherwise a new buffer is allocated and prefixed with 0x00 octets followed
275
 * by the source data. The source buffer will be freed on error, i.e., caller
276
 * will only be responsible on freeing the returned buffer. If buf is %NULL,
277
 * %NULL will be returned.
278
 */
279
struct wpabuf * wpabuf_zeropad(struct wpabuf *buf, size_t len)
280
0
{
281
0
  struct wpabuf *ret;
282
0
  size_t blen;
283
284
0
  if (buf == NULL)
285
0
    return NULL;
286
287
0
  blen = wpabuf_len(buf);
288
0
  if (blen >= len)
289
0
    return buf;
290
291
0
  ret = wpabuf_alloc(len);
292
0
  if (ret) {
293
0
    os_memset(wpabuf_put(ret, len - blen), 0, len - blen);
294
0
    wpabuf_put_buf(ret, buf);
295
0
  }
296
0
  wpabuf_free(buf);
297
298
0
  return ret;
299
0
}
300
301
302
void wpabuf_printf(struct wpabuf *buf, char *fmt, ...)
303
0
{
304
0
  va_list ap;
305
0
  void *tmp = wpabuf_mhead_u8(buf) + wpabuf_len(buf);
306
0
  int res;
307
308
0
  va_start(ap, fmt);
309
0
  res = vsnprintf(tmp, buf->size - buf->used, fmt, ap);
310
0
  va_end(ap);
311
0
  if (res < 0 || (size_t) res >= buf->size - buf->used)
312
0
    wpabuf_overflow(buf, res);
313
0
  buf->used += res;
314
0
}
315
316
317
/**
318
 * wpabuf_parse_bin - Parse a null terminated string of binary data to a wpabuf
319
 * @buf: Buffer with null terminated string (hexdump) of binary data
320
 * Returns: wpabuf or %NULL on failure
321
 *
322
 * The string len must be a multiple of two and contain only hexadecimal digits.
323
 */
324
struct wpabuf * wpabuf_parse_bin(const char *buf)
325
0
{
326
0
  size_t len;
327
0
  struct wpabuf *ret;
328
329
0
  len = os_strlen(buf);
330
0
  if (len & 0x01)
331
0
    return NULL;
332
0
  len /= 2;
333
334
0
  ret = wpabuf_alloc(len);
335
0
  if (ret == NULL)
336
0
    return NULL;
337
338
0
  if (hexstr2bin(buf, wpabuf_put(ret, len), len)) {
339
0
    wpabuf_free(ret);
340
0
    return NULL;
341
0
  }
342
343
0
  return ret;
344
0
}
345
346
347
struct wpabuf_array * wpabuf_array_alloc(void)
348
0
{
349
0
  struct wpabuf_array *wa;
350
351
0
  wa = os_zalloc(sizeof(*wa));
352
0
  return wa;
353
0
}
354
355
356
void wpabuf_array_free(struct wpabuf_array *wa)
357
0
{
358
0
  unsigned int idx;
359
360
0
  if (!wa)
361
0
    return;
362
0
  for (idx = 0; idx < wa->num; idx++)
363
0
    wpabuf_free(wa->buf[idx]);
364
0
  os_free(wa->buf);
365
0
  os_free(wa);
366
0
}
367
368
369
int wpabuf_array_add(struct wpabuf_array *wa, struct wpabuf *buf)
370
0
{
371
0
  struct wpabuf **n;
372
373
0
  if (!wa || !buf)
374
0
    return -1;
375
0
  n = os_realloc(wa->buf, (wa->num + 1) * sizeof(struct wpabuf *));
376
0
  if (!n)
377
0
    return -1;
378
0
  wa->buf = n;
379
0
  wa->buf[wa->num++] = buf;
380
0
  return 0;
381
0
}
382
383
384
void wpabuf_array_remove(struct wpabuf_array *wa, unsigned int idx)
385
0
{
386
0
  if (!wa || wa->num == 0 || idx >= wa->num)
387
0
    return;
388
0
  wpabuf_free(wa->buf[idx]);
389
0
  while (idx + 1 < wa->num) {
390
0
    wa->buf[idx] = wa->buf[idx + 1];
391
0
    idx++;
392
0
  }
393
0
  wa->num--;
394
  wa->buf[wa->num] = NULL;
395
0
}