book_chunked_validate.c

Go to the documentation of this file.

#include <string.h>
 
#include "book_chunked.h"
#include "ra8_attributes.h"

typedef struct {
  book_chunked_t* rd;         
  uint8_t*        chunk;      
  uint32_t        loaded_idx; 
  uint32_t        loaded_len; 
  bool            loaded;     
} chunk_validate_t;

typedef enum : uint8_t {
  k_chunk_validate_span_count = 5U, 
} chunk_validate_constant_t;

RA8_INTERNAL
static bool
internal_spans_overlap(const void* a, uint64_t a_len, const void* b, uint64_t b_len, bool* invalid)
{
  uintptr_t a_begin = 0U;
  uintptr_t b_begin = 0U;
  static_assert(sizeof(a_begin) == sizeof(a), "uintptr_t must preserve pointer representation");
  static_assert(sizeof(b_begin) == sizeof(b), "uintptr_t must preserve pointer representation");
  (void)memcpy((void*)&a_begin, (const void*)&a, sizeof(a_begin));
  (void)memcpy((void*)&b_begin, (const void*)&b, sizeof(b_begin));
  *invalid = true;
  if (a_len > (uint64_t)UINTPTR_MAX) {
    return false;
  }
  if (b_len > (uint64_t)UINTPTR_MAX) {
    return false;
  }
  if (a_begin > (UINTPTR_MAX - (uintptr_t)a_len)) {
    return false;
  }
  if (b_begin > (UINTPTR_MAX - (uintptr_t)b_len)) {
    return false;
  }
  *invalid              = false;
  const uintptr_t a_end = a_begin + (uintptr_t)a_len;
  const uintptr_t b_end = b_begin + (uintptr_t)b_len;
  if (a_begin >= b_end) {
    return false;
  }
  return b_begin < a_end;
}

RA8_INTERNAL
static ra8_err_t internal_validate_reader_fields(const book_chunked_t* rd)
{
  if (rd->file_read == nullptr) {
    return k_ra8_err_invalid_state;
  }
  if (rd->inflate_cb == nullptr) {
    return k_ra8_err_invalid_state;
  }
  if (rd->table == nullptr) {
    return k_ra8_err_invalid_state;
  }
  if (rd->staging == nullptr) {
    return k_ra8_err_invalid_state;
  }
  if (rd->chunk_bytes == 0U) {
    return k_ra8_err_invalid_state;
  }
  if (rd->chunk_count == 0U) {
    return k_ra8_err_invalid_state;
  }
  if (rd->inflated_total == 0U) {
    return k_ra8_err_invalid_state;
  }
  if (rd->staging_cap == 0U) {
    return k_ra8_err_invalid_state;
  }
  return k_ra8_ok;
}

RA8_INTERNAL
static ra8_err_t internal_validate_reader_table(const book_chunked_t* rd)
{
  const uint64_t expected_count =
    (rd->inflated_total / (uint64_t)rd->chunk_bytes) +
    (((rd->inflated_total % (uint64_t)rd->chunk_bytes) != 0U) ? 1U : 0U);
  const uint64_t table_entries = (uint64_t)rd->chunk_count + 1U;
  if (expected_count > (uint64_t)UINT32_MAX) {
    return k_ra8_err_invalid_state;
  }
  if ((uint64_t)rd->chunk_count != expected_count) {
    return k_ra8_err_invalid_state;
  }
  if (table_entries > (uint64_t)rd->table_cap_entries) {
    return k_ra8_err_invalid_state;
  }
  if (rd->table[0] != 0U) {
    return k_ra8_err_invalid_state;
  }
  for (uint32_t i = 0U; i < rd->chunk_count; ++i) {
    if (rd->table[i + 1U] <= rd->table[i]) {
      return k_ra8_err_invalid_state;
    }
    if ((rd->table[i + 1U] - rd->table[i]) > (uint64_t)rd->staging_cap) {
      return k_ra8_err_invalid_state;
    }
  }
  if (rd->table[rd->chunk_count] > (UINT64_MAX - rd->payload_off)) {
    return k_ra8_err_invalid_state;
  }
  return k_ra8_ok;
}

RA8_INTERNAL
static ra8_err_t internal_validate_reader(const book_chunked_t* rd)
{
  const ra8_err_t fields = internal_validate_reader_fields(rd);
  if (fields != k_ra8_ok) {
    return fields;
  }
  return internal_validate_reader_table(rd);
}

RA8_INTERNAL
static bool internal_output_is_aliased(const book_chunked_t* rd,
                                       const uint8_t*        chunk,
                                       uint32_t              chunk_cap,
                                       const uint8_t*        scratch,
                                       uint32_t              scratch_cap,
                                       const book_header_t*  out_header)
{
  const uint64_t table_len = (uint64_t)rd->table_cap_entries * sizeof(rd->table[0]);
  const void*    bases[k_chunk_validate_span_count] = {rd, chunk, scratch, rd->staging, rd->table};
  const uint64_t lens[k_chunk_validate_span_count]  = {sizeof(*rd),
                                                       chunk_cap,
                                                       scratch_cap,
                                                       rd->staging_cap,
                                                       table_len};
  for (uint8_t i = 0U; i < k_chunk_validate_span_count; ++i) {
    if (bases[i] != nullptr) {
      if (lens[i] == 0U) {
        continue;
      }
      bool invalid = false;
      if (internal_spans_overlap(out_header, sizeof(*out_header), bases[i], lens[i], &invalid)) {
        return true;
      }
      if (invalid) {
        return true;
      }
    }
  }
  return false;
}

RA8_INTERNAL
static ra8_err_t internal_validate_workspaces(const book_chunked_t* rd,
                                              const uint8_t*        chunk,
                                              uint32_t              chunk_len,
                                              const uint8_t*        scratch,
                                              uint32_t              scratch_cap)
{
  const uint64_t table_len = ((uint64_t)rd->chunk_count + 1U) * sizeof(rd->table[0]);
  const void*    bases[k_chunk_validate_span_count] = {rd, chunk, scratch, rd->staging, rd->table};
  const uint64_t lens[k_chunk_validate_span_count]  = {sizeof(*rd),
                                                       chunk_len,
                                                       scratch_cap,
                                                       rd->staging_cap,
                                                       table_len};
  for (uint8_t i = 0U; i < k_chunk_validate_span_count; ++i) {
    for (uint8_t j = (uint8_t)(i + 1U); j < k_chunk_validate_span_count; ++j) {
      bool invalid = false;
      if (internal_spans_overlap(bases[i], lens[i], bases[j], lens[j], &invalid)) {
        return k_ra8_err_invalid_arg;
      }
      if (invalid) {
        return k_ra8_err_invalid_arg;
      }
    }
  }
  return k_ra8_ok;
}

RA8_INTERNAL
static ra8_err_t internal_load_chunk(chunk_validate_t* ctx, uint32_t idx)
{
  if (ctx->loaded && (ctx->loaded_idx == idx)) {
    return k_ra8_ok;
  }
  const uint64_t offset = (uint64_t)idx * (uint64_t)ctx->rd->chunk_bytes;
  uint64_t       remain = ctx->rd->inflated_total - offset;
  uint32_t       span   = ctx->rd->chunk_bytes;
  if (remain < (uint64_t)span) {
    span = (uint32_t)remain;
  }
  const ra8_err_t err = book_chunked_read(ctx->rd, offset, ctx->chunk, span);
  if (err == k_ra8_ok) {
    ctx->loaded     = true;
    ctx->loaded_idx = idx;
    ctx->loaded_len = span;
  }
  return err;
}

RA8_INTERNAL
static ra8_err_t internal_chunk_flat_read(void* opaque, uint64_t offset, uint8_t* dst, uint32_t len)
{
  chunk_validate_t* ctx    = (chunk_validate_t*)opaque;
  uint64_t          cursor = offset;
  // mcdc-deactivated: internal_chunk_flat_read range guard; this callback is reachable only from book_validate_stream_strict, whose priv_book_stream_read applies the identical `(off > source_size) || (len > source_size - off)` test against the same rd->inflated_total before invoking it, so neither condition can be true here -- it is a defensive duplicate of an upstream bound.
  if ((cursor > ctx->rd->inflated_total) || ((uint64_t)len > (ctx->rd->inflated_total - cursor))) {
    return k_ra8_err_out_of_range;
  }
  uint32_t copied = 0U;
  while (copied < len) {
    const uint32_t idx = (uint32_t)(cursor / (uint64_t)ctx->rd->chunk_bytes);
    ra8_err_t      err = internal_load_chunk(ctx, idx);
    if (err != k_ra8_ok) {
      return err;
    }
    const uint32_t in_chunk = (uint32_t)(cursor % (uint64_t)ctx->rd->chunk_bytes);
    uint32_t       span     = ctx->loaded_len - in_chunk;
    if (span > (len - copied)) {
      span = len - copied;
    }
    (void)memmove(&dst[copied], &ctx->chunk[in_chunk], span);
    copied += span;
    cursor += span;
  }
  return k_ra8_ok;
}
 
ra8_err_t book_chunked_validate_strict(book_chunked_t* rd,
                                       uint8_t*        chunk,
                                       uint32_t        chunk_cap,
                                       uint8_t*        scratch,
                                       uint32_t        scratch_cap,
                                       book_header_t*  out_header)
{
  if (out_header == nullptr) {
    return k_ra8_err_null_ptr;
  }
  if (rd == nullptr) {
    *out_header = (book_header_t){};
    return k_ra8_err_null_ptr;
  }
  if (internal_output_is_aliased(rd, chunk, chunk_cap, scratch, scratch_cap, out_header)) {
    return k_ra8_err_invalid_arg;
  }
  *out_header = (book_header_t){};
  if ((chunk == nullptr) || (scratch == nullptr)) {
    return k_ra8_err_null_ptr;
  }
  if ((chunk_cap == 0U) || (scratch_cap == 0U)) {
    return k_ra8_err_invalid_size;
  }
  ra8_err_t err = internal_validate_reader(rd);
  if (err != k_ra8_ok) {
    return err;
  }
  if (chunk_cap < rd->chunk_bytes) {
    return k_ra8_err_invalid_size;
  }
  err = internal_validate_workspaces(rd, chunk, rd->chunk_bytes, scratch, scratch_cap);
  if (err != k_ra8_ok) {
    return err;
  }
  chunk_validate_t ctx = {
    .rd         = rd,
    .chunk      = chunk,
    .loaded_idx = 0U,
    .loaded_len = 0U,
    .loaded     = false,
  };
  book_header_t validated = {};
  err                     = book_validate_stream_strict(internal_chunk_flat_read,
                                                        &ctx,
                                                        rd->inflated_total,
                                                        scratch,
                                                        scratch_cap,
                                                        &validated);
  if (err == k_ra8_ok) {
    *out_header = validated;
  }
  return err;
}