From: Viktor Szakats <commit@vsz.me>
Date: Fri, 25 Aug 2023 22:28:35 +0000 (+0000)
Subject: lib: fix null ptr derefs and uninitialized vars (h2/h3)
X-Git-Tag: curl-8_3_0~92
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d50fe6becb3fca7318191a8aae6bb0b3c2c4e195;p=thirdparty%2Fcurl.git

lib: fix null ptr derefs and uninitialized vars (h2/h3)

Fixing compiler warnings with gcc 13.2.0 in unity builds.

Assisted-by: Jay Satiro
Assisted-by: Stefan Eissing
Closes #11739
---

diff --git a/lib/cf-h2-proxy.c b/lib/cf-h2-proxy.c
index 817ec24022..9f9f605935 100644
--- a/lib/cf-h2-proxy.c
+++ b/lib/cf-h2-proxy.c
@@ -244,12 +244,17 @@ static ssize_t proxy_nw_in_reader(void *reader_ctx,
                                   CURLcode *err)
 {
   struct Curl_cfilter *cf = reader_ctx;
-  struct Curl_easy *data = CF_DATA_CURRENT(cf);
   ssize_t nread;
 
-  nread = Curl_conn_cf_recv(cf->next, data, (char *)buf, buflen, err);
-  CURL_TRC_CF(data, cf, "nw_in_reader(len=%zu) -> %zd, %d",
-              buflen, nread, *err);
+  if(cf) {
+    struct Curl_easy *data = CF_DATA_CURRENT(cf);
+    nread = Curl_conn_cf_recv(cf->next, data, (char *)buf, buflen, err);
+    CURL_TRC_CF(data, cf, "nw_in_reader(len=%zu) -> %zd, %d",
+                buflen, nread, *err);
+  }
+  else {
+    nread = 0;
+  }
   return nread;
 }
 
@@ -258,12 +263,18 @@ static ssize_t proxy_h2_nw_out_writer(void *writer_ctx,
                                       CURLcode *err)
 {
   struct Curl_cfilter *cf = writer_ctx;
-  struct Curl_easy *data = CF_DATA_CURRENT(cf);
   ssize_t nwritten;
 
-  nwritten = Curl_conn_cf_send(cf->next, data, (const char *)buf, buflen, err);
-  CURL_TRC_CF(data, cf, "nw_out_writer(len=%zu) -> %zd, %d",
-              buflen, nwritten, *err);
+  if(cf) {
+    struct Curl_easy *data = CF_DATA_CURRENT(cf);
+    nwritten = Curl_conn_cf_send(cf->next, data, (const char *)buf, buflen,
+                                 err);
+    CURL_TRC_CF(data, cf, "nw_out_writer(len=%zu) -> %zd, %d",
+                buflen, nwritten, *err);
+  }
+  else {
+    nwritten = 0;
+  }
   return nwritten;
 }
 
diff --git a/lib/http2.c b/lib/http2.c
index 63873cc0b8..2c5d6b4d74 100644
--- a/lib/http2.c
+++ b/lib/http2.c
@@ -1814,10 +1814,10 @@ out:
 }
 
 static ssize_t stream_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
+                           struct stream_ctx *stream,
                            char *buf, size_t len, CURLcode *err)
 {
   struct cf_h2_ctx *ctx = cf->ctx;
-  struct stream_ctx *stream = H2_STREAM_CTX(data);
   ssize_t nread = -1;
 
   *err = CURLE_AGAIN;
@@ -1937,7 +1937,7 @@ static ssize_t cf_h2_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
 
   CF_DATA_SAVE(save, cf, data);
 
-  nread = stream_recv(cf, data, buf, len, err);
+  nread = stream_recv(cf, data, stream, buf, len, err);
   if(nread < 0 && *err != CURLE_AGAIN)
     goto out;
 
@@ -1946,7 +1946,7 @@ static ssize_t cf_h2_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
     if(*err)
       goto out;
 
-    nread = stream_recv(cf, data, buf, len, err);
+    nread = stream_recv(cf, data, stream, buf, len, err);
   }
 
   if(nread > 0) {
diff --git a/lib/vquic/curl_ngtcp2.c b/lib/vquic/curl_ngtcp2.c
index d4701a31d8..ebc391bf0b 100644
--- a/lib/vquic/curl_ngtcp2.c
+++ b/lib/vquic/curl_ngtcp2.c
@@ -2349,7 +2349,7 @@ static CURLcode cf_connect_start(struct Curl_cfilter *cf,
   int rc;
   int rv;
   CURLcode result;
-  const struct Curl_sockaddr_ex *sockaddr;
+  const struct Curl_sockaddr_ex *sockaddr = NULL;
   int qfd;
 
   ctx->version = NGTCP2_PROTO_VER_MAX;
@@ -2395,6 +2395,8 @@ static CURLcode cf_connect_start(struct Curl_cfilter *cf,
 
   Curl_cf_socket_peek(cf->next, data, &ctx->q.sockfd,
                       &sockaddr, NULL, NULL, NULL, NULL);
+  if(!sockaddr)
+    return CURLE_QUIC_CONNECT_ERROR;
   ctx->q.local_addrlen = sizeof(ctx->q.local_addr);
   rv = getsockname(ctx->q.sockfd, (struct sockaddr *)&ctx->q.local_addr,
                    &ctx->q.local_addrlen);
@@ -2525,8 +2527,8 @@ out:
 
 #ifndef CURL_DISABLE_VERBOSE_STRINGS
   if(result) {
-    const char *r_ip;
-    int r_port;
+    const char *r_ip = NULL;
+    int r_port = 0;
 
     Curl_cf_socket_peek(cf->next, data, NULL, NULL,
                         &r_ip, &r_port, NULL, NULL);
diff --git a/lib/vquic/vquic.c b/lib/vquic/vquic.c
index a60165f91f..e6b50d327a 100644
--- a/lib/vquic/vquic.c
+++ b/lib/vquic/vquic.c
@@ -334,8 +334,8 @@ static CURLcode recvmmsg_packets(struct Curl_cfilter *cf,
         goto out;
       }
       if(!cf->connected && SOCKERRNO == ECONNREFUSED) {
-        const char *r_ip;
-        int r_port;
+        const char *r_ip = NULL;
+        int r_port = 0;
         Curl_cf_socket_peek(cf->next, data, NULL, NULL,
                             &r_ip, &r_port, NULL, NULL);
         failf(data, "QUIC: connection to %s port %u refused",
@@ -404,8 +404,8 @@ static CURLcode recvmsg_packets(struct Curl_cfilter *cf,
         goto out;
       }
       if(!cf->connected && SOCKERRNO == ECONNREFUSED) {
-        const char *r_ip;
-        int r_port;
+        const char *r_ip = NULL;
+        int r_port = 0;
         Curl_cf_socket_peek(cf->next, data, NULL, NULL,
                             &r_ip, &r_port, NULL, NULL);
         failf(data, "QUIC: connection to %s port %u refused",
@@ -464,8 +464,8 @@ static CURLcode recvfrom_packets(struct Curl_cfilter *cf,
         goto out;
       }
       if(!cf->connected && SOCKERRNO == ECONNREFUSED) {
-        const char *r_ip;
-        int r_port;
+        const char *r_ip = NULL;
+        int r_port = 0;
         Curl_cf_socket_peek(cf->next, data, NULL, NULL,
                             &r_ip, &r_port, NULL, NULL);
         failf(data, "QUIC: connection to %s port %u refused",