epan/tvbuff_zlib.c

   1 /* tvbuff_zlib.c
   2  *
   3  * Copyright (c) 2000 by Gilbert Ramirez <gram@alumni.rice.edu>
   4  *
   5  * Wireshark - Network traffic analyzer
   6  * By Gerald Combs <gerald@wireshark.org>
   7  * Copyright 1998 Gerald Combs
   8  *
   9  * SPDX-License-Identifier: GPL-2.0-or-later
  10  */
  11
  12 #include <config.h>
  13 #define WS_LOG_DOMAIN LOG_DOMAIN_EPAN
  14
  15 #include <glib.h>
  16
  17 #include <string.h>
  18 #include <wsutil/glib-compat.h>
  19
  20
  21 #ifdef HAVE_ZLIBNG
  22 #define ZLIB_PREFIX(x) zng_ ## x
  23 #include <zlib-ng.h>
  24 typedef zng_stream zlib_stream;
  25 #else
  26 #ifdef HAVE_ZLIB
  27 #define ZLIB_CONST
  28 #define ZLIB_PREFIX(x) x
  29 #include <zlib.h>
  30 typedef z_stream zlib_stream;
  31 #endif /* HAVE_ZLIB */
  32 #endif
  33
  34 #include "tvbuff.h"
  35 #include <wsutil/wslog.h>
  36
  37 #if defined (HAVE_ZLIB) || defined (HAVE_ZLIBNG)
  38 /*
  39  * Uncompresses a zlib compressed packet inside a message of tvb at offset with
  40  * length comprlen.  Returns an uncompressed tvbuffer if uncompression
  41  * succeeded or NULL if uncompression failed.
  42  */
  43 #define TVB_Z_MIN_BUFSIZ 32768
  44 #define TVB_Z_MAX_BUFSIZ 1048576 * 10
  45
  46 tvbuff_t *
  47 tvb_uncompress_zlib(tvbuff_t *tvb, const int offset, int comprlen)
  48 {
  49         int        err;
  50         unsigned   bytes_out      = 0;
  51         uint8_t   *compr;
  52         uint8_t   *uncompr        = NULL;
  53         tvbuff_t  *uncompr_tvb    = NULL;
  54 #ifdef HAVE_ZLIBNG
  55         zng_streamp  strm;
  56 #else
  57         z_streamp  strm;
  58 #endif
  59         Bytef     *strmbuf;
  60         unsigned   inits_done     = 0;
  61         int        wbits          = MAX_WBITS;
  62         uint8_t   *next;
  63         unsigned   bufsiz;
  64         unsigned   inflate_passes = 0;
  65         unsigned   bytes_in       = tvb_captured_length_remaining(tvb, offset);
  66
  67         if (tvb == NULL || comprlen <= 0) {
  68                 return NULL;
  69         }
  70
  71         compr = (uint8_t *)tvb_memdup(NULL, tvb, offset, comprlen);
  72         if (compr == NULL) {
  73                 return NULL;
  74         }
  75
  76         /*
  77          * Assume that the uncompressed data is at least twice as big as
  78          * the compressed size.
  79          */
  80         bufsiz = tvb_captured_length_remaining(tvb, offset) * 2;
  81         bufsiz = CLAMP(bufsiz, TVB_Z_MIN_BUFSIZ, TVB_Z_MAX_BUFSIZ);
  82
  83         ws_debug("bufsiz: %u bytes\n", bufsiz);
  84
  85         next = compr;
  86
  87         strm            = g_new0(zlib_stream, 1);
  88         strm->next_in   = next;
  89         strm->avail_in  = comprlen;
  90
  91         strmbuf         = (Bytef *)g_malloc0(bufsiz);
  92         strm->next_out  = strmbuf;
  93         strm->avail_out = bufsiz;
  94
  95         err = ZLIB_PREFIX(inflateInit2)(strm, wbits);
  96         inits_done = 1;
  97         if (err != Z_OK) {
  98                 ZLIB_PREFIX(inflateEnd)(strm);
  99                 g_free(strm);
 100                 wmem_free(NULL, compr);
 101                 g_free(strmbuf);
 102                 return NULL;
 103         }
 104
 105         while (1) {
 106                 memset(strmbuf, '\0', bufsiz);
 107                 strm->next_out  = strmbuf;
 108                 strm->avail_out = bufsiz;
 109
 110                 err = ZLIB_PREFIX(inflate)(strm, Z_SYNC_FLUSH);
 111
 112                 if (err == Z_OK || err == Z_STREAM_END) {
 113                         unsigned bytes_pass = bufsiz - strm->avail_out;
 114
 115                         ++inflate_passes;
 116
 117                         if (uncompr == NULL) {
 118                                 /*
 119                                  * This is ugly workaround for bug #6480
 120                                  * (https://gitlab.com/wireshark/wireshark/-/issues/6480)
 121                                  *
 122                                  * g_memdup2(..., 0) returns NULL (g_malloc(0) also)
 123                                  * when uncompr is NULL logic below doesn't create tvb
 124                                  * which is later interpreted as decompression failed.
 125                                  */
 126                                 uncompr = (uint8_t *)((bytes_pass || err != Z_STREAM_END) ?
 127                                                 g_memdup2(strmbuf, bytes_pass) :
 128                                                 g_strdup(""));
 129                         } else {
 130                                 uncompr = (uint8_t *)g_realloc(uncompr, bytes_out + bytes_pass);
 131                                 memcpy(uncompr + bytes_out, strmbuf, bytes_pass);
 132                         }
 133
 134                         bytes_out += bytes_pass;
 135
 136                         if (err == Z_STREAM_END) {
 137                                 ZLIB_PREFIX(inflateEnd)(strm);
 138                                 g_free(strm);
 139                                 g_free(strmbuf);
 140                                 break;
 141                         }
 142                 } else if (err == Z_BUF_ERROR) {
 143                         /*
 144                          * It's possible that not enough frames were captured
 145                          * to decompress this fully, so return what we've done
 146                          * so far, if any.
 147                          */
 148                         ZLIB_PREFIX(inflateEnd)(strm);
 149                         g_free(strm);
 150                         g_free(strmbuf);
 151
 152                         if (uncompr != NULL) {
 153                                 break;
 154                         } else {
 155                                 wmem_free(NULL, compr);
 156                                 return NULL;
 157                         }
 158
 159                 } else if (err == Z_DATA_ERROR && inits_done == 1
 160                         && uncompr == NULL && comprlen >= 2 &&
 161                         (*compr  == 0x1f) && (*(compr + 1) == 0x8b)) {
 162                         /*
 163                          * inflate() is supposed to handle both gzip and deflate
 164                          * streams automatically, but in reality it doesn't
 165                          * seem to handle either (at least not within the
 166                          * context of an HTTP response.)  We have to try
 167                          * several tweaks, depending on the type of data and
 168                          * version of the library installed.
 169                          */
 170
 171                         /*
 172                          * Gzip file format.  Skip past the header, since the
 173                          * fix to make it work (setting windowBits to 31)
 174                          * doesn't work with all versions of the library.
 175                          */
 176                         Bytef *c = compr + 2;
 177                         Bytef  flags = 0;
 178
 179                         /* we read two bytes already (0x1f, 0x8b) and
 180                            need at least Z_DEFLATED, 1 byte flags, 4
 181                            bytes MTIME, 1 byte XFL, 1 byte OS */
 182                         if (comprlen < 10 || *c != Z_DEFLATED) {
 183                                 ZLIB_PREFIX(inflateEnd)(strm);
 184                                 g_free(strm);
 185                                 wmem_free(NULL, compr);
 186                                 g_free(strmbuf);
 187                                 return NULL;
 188                         }
 189
 190                         c++;
 191                         flags = *c;
 192                         c++;
 193
 194                         /* Skip past the MTIME (4 bytes),
 195                            XFL, and OS fields (1 byte each). */
 196                         c += 6;
 197
 198                         if (flags & (1 << 2)) {
 199                                 /* An Extra field is present. It
 200                                    consists of 2 bytes xsize and xsize
 201                                    bytes of data.
 202                                    Read byte-by-byte (least significant
 203                                    byte first) to make sure we abort
 204                                    cleanly when the xsize is truncated
 205                                    after the first byte. */
 206                                 uint16_t xsize = 0;
 207
 208                                 if (c-compr < comprlen) {
 209                                         xsize += *c;
 210                                         c++;
 211                                 }
 212                                 if (c-compr < comprlen) {
 213                                         xsize += *c << 8;
 214                                         c++;
 215                                 }
 216
 217                                 c += xsize;
 218                         }
 219
 220                         if (flags & (1 << 3)) {
 221                                 /* A null terminated filename */
 222
 223                                 while ((c - compr) < comprlen && *c != '\0') {
 224                                         c++;
 225                                 }
 226
 227                                 c++;
 228                         }
 229
 230                         if (flags & (1 << 4)) {
 231                                 /* A null terminated comment */
 232
 233                                 while ((c - compr) < comprlen && *c != '\0') {
 234                                         c++;
 235                                 }
 236
 237                                 c++;
 238                         }
 239
 240
 241                         if (c - compr > comprlen) {
 242                                 ZLIB_PREFIX(inflateEnd)(strm);
 243                                 g_free(strm);
 244                                 wmem_free(NULL, compr);
 245                                 g_free(strmbuf);
 246                                 return NULL;
 247                         }
 248                         /* Drop gzip header */
 249                         comprlen -= (int) (c - compr);
 250                         next = c;
 251
 252                         ZLIB_PREFIX(inflateReset)(strm);
 253                         strm->next_in   = next;
 254                         strm->avail_in  = comprlen;
 255
 256                         ZLIB_PREFIX(inflateEnd)(strm);
 257                         ZLIB_PREFIX(inflateInit2)(strm, wbits);
 258                         inits_done++;
 259                 } else if (err == Z_DATA_ERROR && uncompr == NULL &&
 260                         inits_done <= 3) {
 261
 262                         /*
 263                          * Re-init the stream with a negative
 264                          * MAX_WBITS. This is necessary due to
 265                          * some servers (Apache) not sending
 266                          * the deflate header with the
 267                          * content-encoded response.
 268                          */
 269                         wbits = -MAX_WBITS;
 270
 271                         ZLIB_PREFIX(inflateReset)(strm);
 272
 273                         strm->next_in   = next;
 274                         strm->avail_in  = comprlen;
 275
 276                         ZLIB_PREFIX(inflateEnd)(strm);
 277                         memset(strmbuf, '\0', bufsiz);
 278                         strm->next_out  = strmbuf;
 279                         strm->avail_out = bufsiz;
 280
 281                         err = ZLIB_PREFIX(inflateInit2)(strm, wbits);
 282
 283                         inits_done++;
 284
 285                         if (err != Z_OK) {
 286                                 g_free(strm);
 287                                 g_free(strmbuf);
 288                                 wmem_free(NULL, compr);
 289                                 g_free(uncompr);
 290
 291                                 return NULL;
 292                         }
 293                 } else {
 294                         ZLIB_PREFIX(inflateEnd)(strm);
 295                         g_free(strm);
 296                         g_free(strmbuf);
 297
 298                         if (uncompr == NULL) {
 299                                 wmem_free(NULL, compr);
 300                                 return NULL;
 301                         }
 302
 303                         break;
 304                 }
 305         }
 306
 307         ws_debug("inflate() total passes: %u\n", inflate_passes);
 308         ws_debug("bytes  in: %u\nbytes out: %u\n\n", bytes_in, bytes_out);
 309
 310         if (uncompr != NULL) {
 311                 uncompr_tvb =  tvb_new_real_data(uncompr, bytes_out, bytes_out);
 312                 tvb_set_free_cb(uncompr_tvb, g_free);
 313         }
 314         wmem_free(NULL, compr);
 315         return uncompr_tvb;
 316 }
 317 #else
 318 tvbuff_t *
 319 tvb_uncompress_zlib(tvbuff_t *tvb _U_, const int offset _U_, int comprlen _U_)
 320 {
 321         return NULL;
 322 }
 323 #endif
 324
 325 tvbuff_t *
 326 tvb_child_uncompress_zlib(tvbuff_t *parent, tvbuff_t *tvb, const int offset, int comprlen)
 327 {
 328         tvbuff_t *new_tvb = tvb_uncompress_zlib(tvb, offset, comprlen);
 329         if (new_tvb)
 330                 tvb_set_child_real_data_tvbuff (parent, new_tvb);
 331         return new_tvb;
 332 }
 333
 334 tvbuff_t *
 335 tvb_uncompress(tvbuff_t *tvb, const int offset, int comprlen)
 336 {
 337         return tvb_uncompress_zlib(tvb, offset, comprlen);
 338 }
 339
 340 tvbuff_t *
 341 tvb_child_uncompress(tvbuff_t *parent, tvbuff_t *tvb, const int offset, int comprlen)
 342 {
 343         return tvb_child_uncompress_zlib(parent, tvb, offset, comprlen);
 344 }
 345
 346 /*
 347  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 348  *
 349  * Local variables:
 350  * c-basic-offset: 8
 351  * tab-width: 8
 352  * indent-tabs-mode: t
 353  * End:
 354  *
 355  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
 356  * :indentSize=8:tabSize=8:noTabs=false:
 357  */