diff --git a/libhtp/htp/dslib.c b/libhtp/htp/dslib.c index 01606db107..507094bc1c 100644 --- a/libhtp/htp/dslib.c +++ b/libhtp/htp/dslib.c @@ -530,7 +530,8 @@ size_t table_size(table_t *table) { */ void table_clear(table_t *table) { // TODO Clear table by removing the existing elements - + if (table == NULL) + return; size_t size = list_size(table->list); list_destroy(table->list); diff --git a/libhtp/htp/htp_connection_parser.c b/libhtp/htp/htp_connection_parser.c index b349837386..f8b995b86f 100644 --- a/libhtp/htp/htp_connection_parser.c +++ b/libhtp/htp/htp_connection_parser.c @@ -152,6 +152,9 @@ htp_connp_t *htp_connp_create_copycfg(htp_cfg_t *cfg) { * @param connp */ void htp_connp_destroy(htp_connp_t *connp) { + if (connp == NULL) + return; + if (connp->out_decompressor != NULL) { connp->out_decompressor->destroy(connp->out_decompressor); connp->out_decompressor = NULL; @@ -181,9 +184,8 @@ void htp_connp_destroy(htp_connp_t *connp) { // Destroy the configuration structure, but only // if it is our private copy - if (connp->is_cfg_private) { - if (connp->cfg != NULL) - htp_config_destroy(connp->cfg); + if ((connp->is_cfg_private) && (connp->cfg != NULL)) { + htp_config_destroy(connp->cfg); } free(connp); @@ -196,6 +198,9 @@ void htp_connp_destroy(htp_connp_t *connp) { * @param connp */ void htp_connp_destroy_all(htp_connp_t *connp) { + if (connp == NULL) + return; + if (connp->conn != NULL) { // Destroy connection htp_conn_destroy(connp->conn); diff --git a/libhtp/htp/htp_request_apache_2_2.c b/libhtp/htp/htp_request_apache_2_2.c index c06f1b02cc..e8e0f30cc7 100644 --- a/libhtp/htp/htp_request_apache_2_2.c +++ b/libhtp/htp/htp_request_apache_2_2.c @@ -238,7 +238,13 @@ int htp_parse_request_header_apache_2_2(htp_connp_t *connp, htp_header_t *h, uns // Now extract the name and the value h->name = bstr_memdup((char *) data + name_start, name_end - name_start); + if (h->name == NULL) + return HTP_ERROR; h->value = bstr_memdup((char *) data + value_start, value_end - value_start); + if (h->value == NULL) { + bstr_free(h->name); + return HTP_ERROR; + } return HTP_OK; } @@ -270,6 +276,9 @@ int htp_parse_request_line_apache_2_2(htp_connp_t *connp) { // No, we don't care if the method is empty. tx->request_method = bstr_memdup((char *) data, pos); + if (tx->request_method == NULL) { + return HTP_ERROR; + } #ifdef HTP_DEBUG fprint_raw_data(stderr, __FUNCTION__, (unsigned char *)bstr_ptr(tx->request_method), bstr_len(tx->request_method)); @@ -315,6 +324,8 @@ int htp_parse_request_line_apache_2_2(htp_connp_t *connp) { // The protocol information spreads until the end of the line. tx->request_protocol = bstr_memdup((char *) data + pos, len - pos); + if (tx->request_protocol == NULL) + return HTP_ERROR; tx->request_protocol_number = htp_parse_protocol(tx->request_protocol); #ifdef HTP_DEBUG diff --git a/libhtp/htp/htp_util.c b/libhtp/htp/htp_util.c index f2849221fd..42a68b8c10 100644 --- a/libhtp/htp/htp_util.c +++ b/libhtp/htp/htp_util.c @@ -659,6 +659,9 @@ uint8_t bestfit_codepoint(htp_cfg_t *cfg, uint32_t codepoint) { * @param path */ void htp_utf8_decode_path_inplace(htp_cfg_t *cfg, htp_tx_t *tx, bstr *path) { + if (path == NULL) + return; + uint8_t *data = (unsigned char *) bstr_ptr(path); size_t len = bstr_len(path); size_t rpos = 0; @@ -1198,17 +1201,23 @@ int htp_normalize_parsed_uri(htp_connp_t *connp, htp_uri_t *incomplete, htp_uri_ if (incomplete->scheme != NULL) { // Duplicate and convert to lowercase normalized->scheme = bstr_dup_lower(incomplete->scheme); + if (normalized->scheme == NULL) + return HTP_ERROR; } // Username if (incomplete->username != NULL) { normalized->username = bstr_strdup(incomplete->username); + if (normalized->username == NULL) + return HTP_ERROR; htp_uriencoding_normalize_inplace(normalized->username); } // Password if (incomplete->password != NULL) { normalized->password = bstr_strdup(incomplete->password); + if (normalized->password == NULL) + return HTP_ERROR; htp_uriencoding_normalize_inplace(normalized->password); } @@ -1217,6 +1226,8 @@ int htp_normalize_parsed_uri(htp_connp_t *connp, htp_uri_t *incomplete, htp_uri_ // We know that incomplete->hostname does not contain // port information, so no need to check for it here normalized->hostname = bstr_strdup(incomplete->hostname); + if (normalized->hostname == NULL) + return HTP_ERROR; htp_uriencoding_normalize_inplace(normalized->hostname); htp_normalize_hostname_inplace(normalized->hostname); } @@ -1250,6 +1261,8 @@ int htp_normalize_parsed_uri(htp_connp_t *connp, htp_uri_t *incomplete, htp_uri_ // RFC normalization htp_normalize_uri_path_inplace(normalized->path); + } else { + return HTP_ERROR; } } @@ -1258,11 +1271,15 @@ int htp_normalize_parsed_uri(htp_connp_t *connp, htp_uri_t *incomplete, htp_uri_ // We cannot URL-decode the query string here; it needs to be // parsed into individual key-value pairs first. normalized->query = bstr_strdup(incomplete->query); + if (normalized->query == NULL) + return HTP_ERROR; } // Fragment if (incomplete->fragment != NULL) { normalized->fragment = bstr_strdup(incomplete->fragment); + if (normalized->fragment == NULL) + return HTP_ERROR; htp_uriencoding_normalize_inplace(normalized->fragment); } @@ -1277,6 +1294,8 @@ int htp_normalize_parsed_uri(htp_connp_t *connp, htp_uri_t *incomplete, htp_uri_ * @return normalized hostnanme */ bstr *htp_normalize_hostname_inplace(bstr *hostname) { + if (hostname == NULL) + return NULL; bstr_tolowercase(hostname); char *data = bstr_ptr(hostname); @@ -1301,6 +1320,8 @@ bstr *htp_normalize_hostname_inplace(bstr *hostname) { * @param hostname */ void htp_replace_hostname(htp_connp_t *connp, htp_uri_t *parsed_uri, bstr *hostname) { + if (hostname == NULL) + return; int colon = bstr_chr(hostname, ':'); if (colon == -1) { // Hostname alone @@ -1355,6 +1376,7 @@ int htp_is_uri_unreserved(unsigned char c) { * @param s */ void htp_uriencoding_normalize_inplace(bstr *s) { + if (s == NULL) return; unsigned char *data = (unsigned char *) bstr_ptr(s); size_t len = bstr_len(s); @@ -1481,6 +1503,7 @@ int htp_prenormalize_uri_path_inplace(bstr *s, int *flags, int case_insensitive, * @param s */ void htp_normalize_uri_path_inplace(bstr *s) { + if (s == NULL) return; char *data = bstr_ptr(s); size_t len = bstr_len(s);