1 /***************************************************************************
2  *                                  _   _ ____  _
3  *  Project                     ___| | | |  _ \| |
4  *                             / __| | | | |_) | |
5  *                            | (__| |_| |  _ <| |___
6  *                             \___|\___/|_| \_\_____|
7  *
8  * Copyright (C) 1998 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
9  *
10  * This software is licensed as described in the file COPYING, which
11  * you should have received as part of this distribution. The terms
12  * are also available at http://curl.haxx.se/docs/copyright.html.
13  *
14  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
15  * copies of the Software, and permit persons to whom the Software is
16  * furnished to do so, under the terms of the COPYING file.
17  *
18  * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
19  * KIND, either express or implied.
20  *
21  ***************************************************************************/
22 
23 #include "curl_setup.h"
24 
25 #ifndef CURL_DISABLE_HTTP
26 
27 #include "urldata.h" /* it includes http_chunks.h */
28 #include "sendf.h"   /* for the client write stuff */
29 
30 #include "content_encoding.h"
31 #include "http.h"
32 #include "non-ascii.h" /* for Curl_convert_to_network prototype */
33 #include "strtoofft.h"
34 #include "warnless.h"
35 
36 /* The last #include files should be: */
37 #include "curl_memory.h"
38 #include "memdebug.h"
39 
40 /*
41  * Chunk format (simplified):
42  *
43  * <HEX SIZE>[ chunk extension ] CRLF
44  * <DATA> CRLF
45  *
46  * Highlights from RFC2616 section 3.6 say:
47 
48    The chunked encoding modifies the body of a message in order to
49    transfer it as a series of chunks, each with its own size indicator,
50    followed by an OPTIONAL trailer containing entity-header fields. This
51    allows dynamically produced content to be transferred along with the
52    information necessary for the recipient to verify that it has
53    received the full message.
54 
55        Chunked-Body   = *chunk
56                         last-chunk
57                         trailer
58                         CRLF
59 
60        chunk          = chunk-size [ chunk-extension ] CRLF
61                         chunk-data CRLF
62        chunk-size     = 1*HEX
63        last-chunk     = 1*("0") [ chunk-extension ] CRLF
64 
65        chunk-extension= *( ";" chunk-ext-name [ "=" chunk-ext-val ] )
66        chunk-ext-name = token
67        chunk-ext-val  = token | quoted-string
68        chunk-data     = chunk-size(OCTET)
69        trailer        = *(entity-header CRLF)
70 
71    The chunk-size field is a string of hex digits indicating the size of
72    the chunk. The chunked encoding is ended by any chunk whose size is
73    zero, followed by the trailer, which is terminated by an empty line.
74 
75  */
76 
77 /* Check for an ASCII hex digit.
78  We avoid the use of isxdigit to accommodate non-ASCII hosts. */
Curl_isxdigit(char digit)79 static bool Curl_isxdigit(char digit)
80 {
81   return ( (digit >= 0x30 && digit <= 0x39) /* 0-9 */
82         || (digit >= 0x41 && digit <= 0x46) /* A-F */
83         || (digit >= 0x61 && digit <= 0x66) /* a-f */ ) ? TRUE : FALSE;
84 }
85 
Curl_httpchunk_init(struct connectdata * conn)86 void Curl_httpchunk_init(struct connectdata *conn)
87 {
88   struct Curl_chunker *chunk = &conn->chunk;
89   chunk->hexindex=0;        /* start at 0 */
90   chunk->dataleft=0;        /* no data left yet! */
91   chunk->state = CHUNK_HEX; /* we get hex first! */
92 }
93 
94 /*
95  * chunk_read() returns a OK for normal operations, or a positive return code
96  * for errors. STOP means this sequence of chunks is complete.  The 'wrote'
97  * argument is set to tell the caller how many bytes we actually passed to the
98  * client (for byte-counting and whatever).
99  *
100  * The states and the state-machine is further explained in the header file.
101  *
102  * This function always uses ASCII hex values to accommodate non-ASCII hosts.
103  * For example, 0x0d and 0x0a are used instead of '\r' and '\n'.
104  */
Curl_httpchunk_read(struct connectdata * conn,char * datap,ssize_t datalen,ssize_t * wrotep)105 CHUNKcode Curl_httpchunk_read(struct connectdata *conn,
106                               char *datap,
107                               ssize_t datalen,
108                               ssize_t *wrotep)
109 {
110   CURLcode result=CURLE_OK;
111   struct SessionHandle *data = conn->data;
112   struct Curl_chunker *ch = &conn->chunk;
113   struct SingleRequest *k = &data->req;
114   size_t piece;
115   curl_off_t length = (curl_off_t)datalen;
116   size_t *wrote = (size_t *)wrotep;
117 
118   *wrote = 0; /* nothing's written yet */
119 
120   /* the original data is written to the client, but we go on with the
121      chunk read process, to properly calculate the content length*/
122   if(data->set.http_te_skip && !k->ignorebody) {
123     result = Curl_client_write(conn, CLIENTWRITE_BODY, datap, datalen);
124     if(result)
125       return CHUNKE_WRITE_ERROR;
126   }
127 
128   while(length) {
129     switch(ch->state) {
130     case CHUNK_HEX:
131       if(Curl_isxdigit(*datap)) {
132         if(ch->hexindex < MAXNUM_SIZE) {
133           ch->hexbuffer[ch->hexindex] = *datap;
134           datap++;
135           length--;
136           ch->hexindex++;
137         }
138         else {
139           return CHUNKE_TOO_LONG_HEX; /* longer hex than we support */
140         }
141       }
142       else {
143         char *endptr;
144         if(0 == ch->hexindex)
145           /* This is illegal data, we received junk where we expected
146              a hexadecimal digit. */
147           return CHUNKE_ILLEGAL_HEX;
148 
149         /* length and datap are unmodified */
150         ch->hexbuffer[ch->hexindex]=0;
151 
152         /* convert to host encoding before calling strtoul */
153         result = Curl_convert_from_network(conn->data, ch->hexbuffer,
154                                            ch->hexindex);
155         if(result) {
156           /* Curl_convert_from_network calls failf if unsuccessful */
157           /* Treat it as a bad hex character */
158           return CHUNKE_ILLEGAL_HEX;
159         }
160 
161         ch->datasize=curlx_strtoofft(ch->hexbuffer, &endptr, 16);
162         if((ch->datasize == CURL_OFF_T_MAX) && (errno == ERANGE))
163           /* overflow is an error */
164           return CHUNKE_ILLEGAL_HEX;
165         ch->state = CHUNK_LF; /* now wait for the CRLF */
166       }
167       break;
168 
169     case CHUNK_LF:
170       /* waiting for the LF after a chunk size */
171       if(*datap == 0x0a) {
172         /* we're now expecting data to come, unless size was zero! */
173         if(0 == ch->datasize) {
174           ch->state = CHUNK_TRAILER; /* now check for trailers */
175           conn->trlPos=0;
176         }
177         else
178           ch->state = CHUNK_DATA;
179       }
180 
181       datap++;
182       length--;
183       break;
184 
185     case CHUNK_DATA:
186       /* We expect 'datasize' of data. We have 'length' right now, it can be
187          more or less than 'datasize'. Get the smallest piece.
188       */
189       piece = curlx_sotouz((ch->datasize >= length)?length:ch->datasize);
190 
191       /* Write the data portion available */
192 #ifdef HAVE_LIBZ
193       switch (conn->data->set.http_ce_skip?
194               IDENTITY : data->req.auto_decoding) {
195       case IDENTITY:
196 #endif
197         if(!k->ignorebody) {
198           if(!data->set.http_te_skip)
199             result = Curl_client_write(conn, CLIENTWRITE_BODY, datap,
200                                        piece);
201           else
202             result = CURLE_OK;
203         }
204 #ifdef HAVE_LIBZ
205         break;
206 
207       case DEFLATE:
208         /* update data->req.keep.str to point to the chunk data. */
209         data->req.str = datap;
210         result = Curl_unencode_deflate_write(conn, &data->req,
211                                              (ssize_t)piece);
212         break;
213 
214       case GZIP:
215         /* update data->req.keep.str to point to the chunk data. */
216         data->req.str = datap;
217         result = Curl_unencode_gzip_write(conn, &data->req,
218                                           (ssize_t)piece);
219         break;
220 
221       case COMPRESS:
222       default:
223         failf (conn->data,
224                "Unrecognized content encoding type. "
225                "libcurl understands `identity', `deflate' and `gzip' "
226                "content encodings.");
227         return CHUNKE_BAD_ENCODING;
228       }
229 #endif
230 
231       if(result)
232         return CHUNKE_WRITE_ERROR;
233 
234       *wrote += piece;
235 
236       ch->datasize -= piece; /* decrease amount left to expect */
237       datap += piece;    /* move read pointer forward */
238       length -= piece;   /* decrease space left in this round */
239 
240       if(0 == ch->datasize)
241         /* end of data this round, we now expect a trailing CRLF */
242         ch->state = CHUNK_POSTLF;
243       break;
244 
245     case CHUNK_POSTLF:
246       if(*datap == 0x0a) {
247         /* The last one before we go back to hex state and start all over. */
248         Curl_httpchunk_init(conn); /* sets state back to CHUNK_HEX */
249       }
250       else if(*datap != 0x0d)
251         return CHUNKE_BAD_CHUNK;
252       datap++;
253       length--;
254       break;
255 
256     case CHUNK_TRAILER:
257       if((*datap == 0x0d) || (*datap == 0x0a)) {
258         /* this is the end of a trailer, but if the trailer was zero bytes
259            there was no trailer and we move on */
260 
261         if(conn->trlPos) {
262           /* we allocate trailer with 3 bytes extra room to fit this */
263           conn->trailer[conn->trlPos++]=0x0d;
264           conn->trailer[conn->trlPos++]=0x0a;
265           conn->trailer[conn->trlPos]=0;
266 
267           /* Convert to host encoding before calling Curl_client_write */
268           result = Curl_convert_from_network(conn->data, conn->trailer,
269                                              conn->trlPos);
270           if(result)
271             /* Curl_convert_from_network calls failf if unsuccessful */
272             /* Treat it as a bad chunk */
273             return CHUNKE_BAD_CHUNK;
274 
275           if(!data->set.http_te_skip) {
276             result = Curl_client_write(conn, CLIENTWRITE_HEADER,
277                                        conn->trailer, conn->trlPos);
278             if(result)
279               return CHUNKE_WRITE_ERROR;
280           }
281           conn->trlPos=0;
282           ch->state = CHUNK_TRAILER_CR;
283           if(*datap == 0x0a)
284             /* already on the LF */
285             break;
286         }
287         else {
288           /* no trailer, we're on the final CRLF pair */
289           ch->state = CHUNK_TRAILER_POSTCR;
290           break; /* don't advance the pointer */
291         }
292       }
293       else {
294         /* conn->trailer is assumed to be freed in url.c on a
295            connection basis */
296         if(conn->trlPos >= conn->trlMax) {
297           /* we always allocate three extra bytes, just because when the full
298              header has been received we append CRLF\0 */
299           char *ptr;
300           if(conn->trlMax) {
301             conn->trlMax *= 2;
302             ptr = realloc(conn->trailer, conn->trlMax + 3);
303           }
304           else {
305             conn->trlMax=128;
306             ptr = malloc(conn->trlMax + 3);
307           }
308           if(!ptr)
309             return CHUNKE_OUT_OF_MEMORY;
310           conn->trailer = ptr;
311         }
312         conn->trailer[conn->trlPos++]=*datap;
313       }
314       datap++;
315       length--;
316       break;
317 
318     case CHUNK_TRAILER_CR:
319       if(*datap == 0x0a) {
320         ch->state = CHUNK_TRAILER_POSTCR;
321         datap++;
322         length--;
323       }
324       else
325         return CHUNKE_BAD_CHUNK;
326       break;
327 
328     case CHUNK_TRAILER_POSTCR:
329       /* We enter this state when a CR should arrive so we expect to
330          have to first pass a CR before we wait for LF */
331       if((*datap != 0x0d) && (*datap != 0x0a)) {
332         /* not a CR then it must be another header in the trailer */
333         ch->state = CHUNK_TRAILER;
334         break;
335       }
336       if(*datap == 0x0d) {
337         /* skip if CR */
338         datap++;
339         length--;
340       }
341       /* now wait for the final LF */
342       ch->state = CHUNK_STOP;
343       break;
344 
345     case CHUNK_STOP:
346       if(*datap == 0x0a) {
347         length--;
348 
349         /* Record the length of any data left in the end of the buffer
350            even if there's no more chunks to read */
351         ch->dataleft = curlx_sotouz(length);
352 
353         return CHUNKE_STOP; /* return stop */
354       }
355       else
356         return CHUNKE_BAD_CHUNK;
357     }
358   }
359   return CHUNKE_OK;
360 }
361 
Curl_chunked_strerror(CHUNKcode code)362 const char *Curl_chunked_strerror(CHUNKcode code)
363 {
364   switch (code) {
365   default:
366     return "OK";
367   case CHUNKE_TOO_LONG_HEX:
368     return "Too long hexadecimal number";
369   case CHUNKE_ILLEGAL_HEX:
370     return "Illegal or missing hexadecimal sequence";
371   case CHUNKE_BAD_CHUNK:
372     return "Malformed encoding found";
373   case CHUNKE_WRITE_ERROR:
374     return "Write error";
375   case CHUNKE_BAD_ENCODING:
376     return "Bad content-encoding found";
377   case CHUNKE_OUT_OF_MEMORY:
378     return "Out of memory";
379   }
380 }
381 
382 #endif /* CURL_DISABLE_HTTP */
383