/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c

Bug Summary

File:	lib/lwan-request.c
Warning:	line 1724, column 13 1st function call argument is an uninitialized value
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name lwan-request.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -fno-plt -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/home/buildbot/lwan-worker/clang-analyze/build/src/lib -resource-dir /usr/lib/clang/14.0.6 -include /home/buildbot/lwan-worker/clang-analyze/build/lwan-build-config.h -D _FILE_OFFSET_BITS=64 -D _TIME_BITS=64 -I /home/buildbot/lwan-worker/clang-analyze/build/src/lib/missing -I /usr/include/luajit-2.1 -I /usr/include/valgrind -I /home/buildbot/lwan-worker/clang-analyze/build/src/lib -I /home/buildbot/lwan-worker/clang-analyze/build -internal-isystem /usr/lib/clang/14.0.6/include -internal-isystem /usr/local/include -internal-isystem /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/12.2.0/../../../../x86_64-pc-linux-gnu/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -Wno-unused-parameter -Wno-free-nonheap-object -std=gnu11 -fdebug-compilation-dir=/home/buildbot/lwan-worker/clang-analyze/build/src/lib -ferror-limit 19 -stack-protector 2 -fgnuc-version=4.2.1 -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/buildbot/lwan-worker/clang-analyze/CLANG/2023-01-03-043944-1058096-1 -x c /home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c
1/*
* lwan - web server
* Copyright (c) 2012-2014 L. A. F. Pereira <l@tia.mat.br>
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
*/

20#define _GNU_SOURCE
21#include <arpa/inet.h>
22#include <assert.h>
23#include <ctype.h>
24#include <errno(*__errno_location ()).h>
25#include <fcntl.h>
26#include <inttypes.h>
27#include <limits.h>
28#include <stddef.h>
29#include <stdio.h>
30#include <stdlib.h>
31#include <string.h>
32#include <strings.h>
33#include <sys/mman.h>
34#include <sys/socket.h>
35#include <sys/stat.h>
36#include <sys/types.h>
37#include <sys/vfs.h>
38#include <unistd.h>

40#include "lwan-private.h"

42#include "base64.h"
43#include "list.h"
44#include "lwan-config.h"
45#include "lwan-http-authorize.h"
46#include "lwan-io-wrappers.h"
47#include "sha1.h"

49#define HEADER_VALUE_SEPARATOR_LEN(sizeof(": ") - 1) (sizeof(": ") - 1)
50#define HEADER_TERMINATOR_LEN(sizeof("\r\n") - 1) (sizeof("\r\n") - 1)
51#define MIN_REQUEST_SIZE(sizeof("GET / HTTP/1.1\r\n\r\n") - 1) (sizeof("GET / HTTP/1.1\r\n\r\n") - 1)

53enum lwan_read_finalizer {
  FINALIZER_DONE,
  FINALIZER_TRY_AGAIN,
  FINALIZER_TIMEOUT,
57};

59struct proxy_header_v2 {
  uint8_t sig[12];
  uint8_t cmd_ver;
  uint8_t fam;
  uint16_t len;
  union {
      struct {
          in_addr_t src_addr;
          in_addr_t dst_addr;
          uint16_t src_port;
          uint16_t dst_port;
      } ip4;
      struct {
          struct in6_addr src_addr;
          struct in6_addr dst_addr;
          uint16_t src_port;
          uint16_t dst_port;
      } ip6;
  } addr;
78};

80static char decode_hex_digit(char ch) __attribute__((pure));
81static char *ignore_leading_whitespace(char *buffer) __attribute__((pure));


84static bool_Bool
85parse_ascii_port(char *port, unsigned short *out)
86{
  unsigned long parsed;
  char *end_ptr;

  errno(*__errno_location ()) = 0;
  parsed = strtoul(port, &end_ptr, 10);

  if (UNLIKELY(errno != 0)__builtin_expect((((*__errno_location ()) != 0)), (0)))
      return false0;

  if (UNLIKELY(*end_ptr != '\0')__builtin_expect(((*end_ptr != '\0')), (0)))
      return false0;

  if (UNLIKELY((unsigned long)(unsigned short)parsed != parsed)__builtin_expect((((unsigned long)(unsigned short)parsed != parsed
)), (0)))
      return false0;

  *out = htons((unsigned short)parsed);
  return true1;
104}

106static char *
107strsep_char(char *strp, const char *end, char delim)
108{
  char *ptr;

  if (UNLIKELY(!strp)__builtin_expect(((!strp)), (0)))
      return NULL((void*)0);

  if (UNLIKELY(strp > end)__builtin_expect(((strp > end)), (0)))
      return NULL((void*)0);

  ptr = strchr(strp, delim);
  if (UNLIKELY(!ptr)__builtin_expect(((!ptr)), (0)))
      return NULL((void*)0);

  *ptr = '\0';
  return ptr + 1;
123}

125static char *
126parse_proxy_protocol_v1(struct lwan_request *request, char *buffer)
127{
  static const size_t line_size = 108;
  char *end, *protocol, *src_addr, *dst_addr, *src_port, *dst_port;
  unsigned int size;
  struct lwan_proxy *const proxy = request->proxy;

  end = memchr(buffer, '\r', line_size);
  if (UNLIKELY(!end || end[1] != '\n')__builtin_expect(((!end || end[1] != '\n')), (0)))
      return NULL((void*)0);
  *end = '\0';
  size = (unsigned int) (end + 2 - buffer);

  protocol = buffer + sizeof("PROXY ") - 1;
  src_addr = strsep_char(protocol, end, ' ');
  dst_addr = strsep_char(src_addr, end, ' ');
  src_port = strsep_char(dst_addr, end, ' ');
  dst_port = strsep_char(src_port, end, ' ');

  if (UNLIKELY(!dst_port)__builtin_expect(((!dst_port)), (0)))
      return NULL((void*)0);

  STRING_SWITCH(protocol)switch (string_as_uint32(protocol)) {
  case STR4_INT('T', 'C', 'P', '4')((uint32_t)(('T') | ('C') << 8 | ('P') << 16 | ('4'
) << 24)): {
      struct sockaddr_in *from = &proxy->from.ipv4;
      struct sockaddr_in *to = &proxy->to.ipv4;

      from->sin_family = to->sin_family = AF_INET2;

      if (UNLIKELY(inet_pton(AF_INET, src_addr, &from->sin_addr) <= 0)__builtin_expect(((inet_pton(2, src_addr, &from->sin_addr
) <= 0)), (0)))
          return NULL((void*)0);
      if (UNLIKELY(inet_pton(AF_INET, dst_addr, &to->sin_addr) <= 0)__builtin_expect(((inet_pton(2, dst_addr, &to->sin_addr
) <= 0)), (0)))
          return NULL((void*)0);
      if (UNLIKELY(!parse_ascii_port(src_port, &from->sin_port))__builtin_expect(((!parse_ascii_port(src_port, &from->
sin_port))), (0)))
          return NULL((void*)0);
      if (UNLIKELY(!parse_ascii_port(dst_port, &to->sin_port))__builtin_expect(((!parse_ascii_port(dst_port, &to->sin_port
))), (0)))
          return NULL((void*)0);

      break;
  }
  case STR4_INT('T', 'C', 'P', '6')((uint32_t)(('T') | ('C') << 8 | ('P') << 16 | ('6'
) << 24)): {
      struct sockaddr_in6 *from = &proxy->from.ipv6;
      struct sockaddr_in6 *to = &proxy->to.ipv6;

      from->sin6_family = to->sin6_family = AF_INET610;

      if (UNLIKELY(inet_pton(AF_INET6, src_addr, &from->sin6_addr) <= 0)__builtin_expect(((inet_pton(10, src_addr, &from->sin6_addr
) <= 0)), (0)))
          return NULL((void*)0);
      if (UNLIKELY(inet_pton(AF_INET6, dst_addr, &to->sin6_addr) <= 0)__builtin_expect(((inet_pton(10, dst_addr, &to->sin6_addr
) <= 0)), (0)))
          return NULL((void*)0);
      if (UNLIKELY(!parse_ascii_port(src_port, &from->sin6_port))__builtin_expect(((!parse_ascii_port(src_port, &from->
sin6_port))), (0)))
          return NULL((void*)0);
      if (UNLIKELY(!parse_ascii_port(dst_port, &to->sin6_port))__builtin_expect(((!parse_ascii_port(dst_port, &to->sin6_port
))), (0)))
          return NULL((void*)0);

      break;
  }
  default:
      return NULL((void*)0);
  }

  request->flags |= REQUEST_PROXIED;
  return buffer + size;
189}

191static char *parse_proxy_protocol_v2(struct lwan_request *request, char *buffer)
192{
  struct proxy_header_v2 *hdr = (struct proxy_header_v2 *)buffer;
  struct lwan_request_parser_helper *helper = request->helper;
  const unsigned int proto_signature_length = 16;
  unsigned int size;
  struct lwan_proxy *const proxy = request->proxy;

  enum { LOCAL = 0x20, PROXY = 0x21, TCP4 = 0x11, TCP6 = 0x21 };

  size = proto_signature_length + (unsigned int)ntohs(hdr->len);
  if (UNLIKELY(size > (unsigned int)sizeof(*hdr))__builtin_expect(((size > (unsigned int)sizeof(*hdr))), (0
)))
      return NULL((void*)0);
  if (UNLIKELY(size >= helper->buffer->len)__builtin_expect(((size >= helper->buffer->len)), (0
)))
      return NULL((void*)0);

  if (LIKELY(hdr->cmd_ver == PROXY)__builtin_expect((!!(hdr->cmd_ver == PROXY)), (1))) {
      if (hdr->fam == TCP4) {
          struct sockaddr_in *from = &proxy->from.ipv4;
          struct sockaddr_in *to = &proxy->to.ipv4;

          to->sin_family = from->sin_family = AF_INET2;

          from->sin_addr.s_addr = hdr->addr.ip4.src_addr;
          from->sin_port = hdr->addr.ip4.src_port;

          to->sin_addr.s_addr = hdr->addr.ip4.dst_addr;
          to->sin_port = hdr->addr.ip4.dst_port;
      } else if (hdr->fam == TCP6) {
          struct sockaddr_in6 *from = &proxy->from.ipv6;
          struct sockaddr_in6 *to = &proxy->to.ipv6;

          from->sin6_family = to->sin6_family = AF_INET610;

          from->sin6_addr = hdr->addr.ip6.src_addr;
          from->sin6_port = hdr->addr.ip6.src_port;

          to->sin6_addr = hdr->addr.ip6.dst_addr;
          to->sin6_port = hdr->addr.ip6.dst_port;
      } else {
          return NULL((void*)0);
      }
  } else if (hdr->cmd_ver == LOCAL) {
      struct sockaddr_in *from = &proxy->from.ipv4;
      struct sockaddr_in *to = &proxy->to.ipv4;

      from->sin_family = to->sin_family = AF_UNSPEC0;
  } else {
      return NULL((void*)0);
  }

  request->flags |= REQUEST_PROXIED;
  return buffer + size;
244}

246#if !defined(LWAN_HAVE_BUILTIN_EXPECT_PROBABILITY)
247#define __builtin_expect_with_probability(value1, value2, probability) \
  __builtin_expect(value1, value2)
249#endif

251static ALWAYS_INLINEinline __attribute__((always_inline)) char *identify_http_method(struct lwan_request *request,
                                              char *buffer)
253{
  const uint32_t first_four = string_as_uint32(buffer);

256#define GENERATE_IF(upper, lower, mask, constant, probability)                 \
  if (__builtin_expect_with_probability(first_four == (constant), 1,         \
                                        probability)) {                      \
      request->flags |= (mask);                                              \
      return buffer + sizeof(#upper);                                        \
  }

  FOR_EACH_REQUEST_METHOD(GENERATE_IF)GENERATE_IF(GET, get, (1 << 0), (((uint32_t)(('G') | ('E'
) << 8 | ('T') << 16 | (' ') << 24))), 0.6)
 GENERATE_IF(POST, post, (1 << 3 | 1 << 1 | 1 <<
 0), (((uint32_t)(('P') | ('O') << 8 | ('S') << 16
 | ('T') << 24))), 0.2) GENERATE_IF(HEAD, head, (1 <<
 1), (((uint32_t)(('H') | ('E') << 8 | ('A') << 16
 | ('D') << 24))), 0.2) GENERATE_IF(OPTIONS, options, (
<< 2), (((uint32_t)(('O') | ('P') << 8 | ('T') <<
| ('I') << 24))), 0.1) GENERATE_IF(DELETE, delete, (
<< 1 | 1 << 2), (((uint32_t)(('D') | ('E') <<
| ('L') << 16 | ('E') << 24))), 0.1) GENERATE_IF
(PUT, put, (1 << 3 | 1 << 2 | 1 << 0), (((uint32_t
)(('P') | ('U') << 8 | ('T') << 16 | (' ') <<
 24))), 0.1)

265#undef GENERATE_IF

  return NULL((void*)0);
268}

270static ALWAYS_INLINEinline __attribute__((always_inline)) char decode_hex_digit(char ch)
271{
  static const char hex_digit_tbl[256] = {
      ['0'] = 0,  ['1'] = 1,  ['2'] = 2,  ['3'] = 3,  ['4'] = 4,  ['5'] = 5,
      ['6'] = 6,  ['7'] = 7,  ['8'] = 8,  ['9'] = 9,  ['a'] = 10, ['b'] = 11,
      ['c'] = 12, ['d'] = 13, ['e'] = 14, ['f'] = 15, ['A'] = 10, ['B'] = 11,
      ['C'] = 12, ['D'] = 13, ['E'] = 14, ['F'] = 15,
  };
  return hex_digit_tbl[(unsigned char)ch];
279}

281__attribute__((nonnull(1))) static ssize_t url_decode(char *str)
282{
  const char *inptr = str;
  char *outptr = str;

  for (char *ch = strchr(str, '+'); ch; ch = strchr(ch + 1, '+'))
      *ch = ' ';

  for (const char *pct = strchr(inptr, '%'); pct; pct = strchr(inptr, '%')) {
      ptrdiff_t diff = pct - inptr;
      if (diff)
          outptr = stpncpy(outptr, inptr, (size_t)diff);

      char decoded = (char)(decode_hex_digit(pct[1]) << 4);
      decoded |= (char)decode_hex_digit(pct[2]);
      if (UNLIKELY(!decoded)__builtin_expect(((!decoded)), (0)))
          return -1;

      *outptr = decoded;
      outptr++;

      inptr = pct + 3;
  }

  if (inptr > outptr)
      outptr = stpcpy(outptr, inptr);

  return (ssize_t)(outptr - str);
309}

311static int key_value_compare(const void *a, const void *b)
312{
  return strcmp(((const struct lwan_key_value *)a)->key,
                ((const struct lwan_key_value *)b)->key);
315}

317static void
318reset_key_value_array(void *data)
319{
  struct lwan_key_value_array *array = data;

  lwan_key_value_array_reset(array);
323}

325static void parse_key_values(struct lwan_request *request,
                           struct lwan_value *helper_value,
                           struct lwan_key_value_array *array,
                           ssize_t (*decode_value)(char *value),
                           const char separator)
330{
  struct lwan_key_value *kv;
  char *ptr = helper_value->value;
  const char *end = helper_value->value + helper_value->len;
  coro_deferred reset_defer;

  if (!helper_value->len)
      return;

  lwan_key_value_array_init(array);
  reset_defer = coro_defer(request->conn->coro, reset_key_value_array, array);

  do {
      char *key, *value;

      while (*ptr == ' ' || *ptr == separator)
          ptr++;
      if (UNLIKELY(*ptr == '\0')__builtin_expect(((*ptr == '\0')), (0)))
          break;

      key = ptr;
      ptr = strsep_char(key, end, separator);

      value = strsep_char(key, end, '=');
      if (UNLIKELY(!value)__builtin_expect(((!value)), (0))) {
          value = "";
      } else if (UNLIKELY(decode_value(value) < 0)__builtin_expect(((decode_value(value) < 0)), (0))) {
          /* Disallow values that failed decoding, but allow empty values */
          goto error;
      }

      if (UNLIKELY(decode_value(key) <= 0)__builtin_expect(((decode_value(key) <= 0)), (0))) {
          /* Disallow keys that failed decoding, or empty keys */
          goto error;
      }

      kv = lwan_key_value_array_append(array);
      if (UNLIKELY(!kv)__builtin_expect(((!kv)), (0)))
          goto error;

      kv->key = key;
      kv->value = value;
  } while (ptr);

  lwan_key_value_array_sort(array, key_value_compare);

  return;

378error:
  coro_defer_fire_and_disarm(request->conn->coro, reset_defer);
380}

382static ssize_t
383identity_decode(char *input __attribute__((unused)))
384{
  return 1;
386}

388static void parse_cookies(struct lwan_request *request)
389{
  const char *cookies = lwan_request_get_header(request, "Cookie");

  if (!cookies)
      return;

  struct lwan_value header = {.value = (char *)cookies,
                              .len = strlen(cookies)};
  parse_key_values(request, &header, &request->helper->cookies,
                   identity_decode, ';');
399}

401static void parse_query_string(struct lwan_request *request)
402{
  struct lwan_request_parser_helper *helper = request->helper;

  parse_key_values(request, &helper->query_string, &helper->query_params,
                   url_decode, '&');
407}

409static void parse_form_data(struct lwan_request *request)
410{
  struct lwan_request_parser_helper *helper = request->helper;
  static const char content_type[] = "application/x-www-form-urlencoded";

  if (helper->content_type.len < sizeof(content_type) - 1)
      return;
  if (UNLIKELY(strncmp(helper->content_type.value, content_type,__builtin_expect(((strncmp(helper->content_type.value, content_type
, sizeof(content_type) - 1))), (0))
                       sizeof(content_type) - 1))__builtin_expect(((strncmp(helper->content_type.value, content_type
, sizeof(content_type) - 1))), (0)))
      return;

  parse_key_values(request, &helper->body_data, &helper->post_params,
                   url_decode, '&');
422}

424static void find_query_string(struct lwan_request *request, const char *space)
425{
  struct lwan_request_parser_helper *helper = request->helper;

  char *query_string = memchr(request->url.value, '?', request->url.len);
  if (query_string) {
      *query_string = '\0';
      helper->query_string.value = query_string + 1;
      helper->query_string.len = (size_t)(space - query_string - 1);
      request->url.len -= helper->query_string.len + 1;
      request->flags |= REQUEST_HAS_QUERY_STRING;
  }
436}

438static char *
439identify_http_path(struct lwan_request *request, char *buffer)
440{
  struct lwan_request_parser_helper *helper = request->helper;
  static const size_t minimal_request_line_len = sizeof("/ HTTP/1.0") - 1;
  char *space, *end_of_line;
  ptrdiff_t end_len;

  if (UNLIKELY(*buffer != '/')__builtin_expect(((*buffer != '/')), (0)))
      return NULL((void*)0);

  end_len = buffer - helper->buffer->value;
  if (UNLIKELY((size_t)end_len >= helper->buffer->len)__builtin_expect((((size_t)end_len >= helper->buffer->
len)), (0)))
      return NULL((void*)0);

  end_of_line = memchr(buffer, '\r', helper->buffer->len - (size_t)end_len);
  if (UNLIKELY(!end_of_line)__builtin_expect(((!end_of_line)), (0)))
      return NULL((void*)0);
  if (UNLIKELY((size_t)(end_of_line - buffer) < minimal_request_line_len)__builtin_expect((((size_t)(end_of_line - buffer) < minimal_request_line_len
)), (0)))
      return NULL((void*)0);
  *end_of_line = '\0';

  space = end_of_line - sizeof("HTTP/X.X");

  request->url.value = buffer;
  request->url.len = (size_t)(space - buffer);
  find_query_string(request, space);
  request->original_url = request->url;

  *space++ = '\0';

  STRING_SWITCH_LARGE(space)switch (string_as_uint64(space)) {
  case STR8_INT('H','T','T','P','/','1','.','0')((uint64_t)((uint32_t)(('H') | ('T') << 8 | ('T') <<
| ('P') << 24)) | (uint64_t)((uint32_t)(('/') | ('1'
) << 8 | ('.') << 16 | ('0') << 24)) <<
 32):
      request->flags |= REQUEST_IS_HTTP_1_0;
      break;
  case STR8_INT('H','T','T','P','/','1','.','1')((uint64_t)((uint32_t)(('H') | ('T') << 8 | ('T') <<
| ('P') << 24)) | (uint64_t)((uint32_t)(('/') | ('1'
) << 8 | ('.') << 16 | ('1') << 24)) <<
 32):
      break;
  default:
      return NULL((void*)0);
  }

  return end_of_line + 1;
480}

482__attribute__((noinline)) static void set_header_value(
  struct lwan_value *header, char *end, char *p, size_t header_len)
484{
  p += header_len;

  if (LIKELY(string_as_uint16(p) == STR2_INT(':', ' '))__builtin_expect((!!(string_as_uint16(p) == ((uint16_t)((':')
 | (' ') << 8)))), (1))) {
      *end = '\0';
      char *value = p + sizeof(": ") - 1;

      header->value = value;
      header->len = (size_t)(end - value);
  }
494}

496#define HEADER_LENGTH(hdr)                                                     \
  ({                                                                         \
      if (UNLIKELY(end - sizeof(hdr) + 1 < p)__builtin_expect(((end - sizeof(hdr) + 1 < p)), (0)))                               \
          continue;                                                          \
      sizeof(hdr) - 1;                                                       \
  })

503#define SET_HEADER_VALUE(dest, hdr)                                            \
  do {                                                                       \
      const size_t header_len = HEADER_LENGTH(hdr);                          \
      set_header_value(&(helper->dest), end, p, header_len);                 \
  } while (0)

509static ALWAYS_INLINEinline __attribute__((always_inline)) ssize_t find_headers(char **header_start,
                                        struct lwan_value *request_buffer,
                                        char **next_request)
512{
  char *buffer = request_buffer->value;
  char *buffer_end = buffer + request_buffer->len;
  ssize_t n_headers = 0;
  char *next_header;

  for (char *next_chr = buffer + 1;;) {
      next_header = memchr(next_chr, '\r', (size_t)(buffer_end - next_chr));

      if (UNLIKELY(!next_header)__builtin_expect(((!next_header)), (0)))
          return -1;

      if (next_chr == next_header) {
          if (buffer_end - next_chr >= (ptrdiff_t)HEADER_TERMINATOR_LEN(sizeof("\r\n") - 1)) {
              STRING_SWITCH_SMALL (next_header)switch (string_as_uint16(next_header)) {
              case STR2_INT('\r', '\n')((uint16_t)(('\r') | ('\n') << 8)):
                  *next_request = next_header + HEADER_TERMINATOR_LEN(sizeof("\r\n") - 1);
              }
          }
          goto out;
      }

      /* Is there at least a space for a minimal (H)eader and a (V)alue? */
      if (LIKELY(next_header - next_chr >= (ptrdiff_t)(sizeof("H: V") - 1))__builtin_expect((!!(next_header - next_chr >= (ptrdiff_t)
(sizeof("H: V") - 1))), (1))) {
          header_start[n_headers++] = next_chr;

          if (UNLIKELY(n_headers >= N_HEADER_START - 1)__builtin_expect(((n_headers >= 64 - 1)), (0)))
              return -1;
      } else {
          /* Better to abort early if there's no space. */
          return -1;
      }

      next_chr = next_header + HEADER_TERMINATOR_LEN(sizeof("\r\n") - 1);
      if (UNLIKELY(next_chr >= buffer_end)__builtin_expect(((next_chr >= buffer_end)), (0)))
          return -1;
  }

550out:
  header_start[n_headers] = next_header;
  return n_headers;
553}

555static bool_Bool parse_headers(struct lwan_request_parser_helper *helper,
                        char *buffer)
557{
  char **header_start = helper->header_start;
  ssize_t n_headers = 0;

  /* FIXME: is there a better way to do this? */
  struct lwan_value header_start_buffer = {
      .value = buffer,
      .len = helper->buffer->len - (size_t)(buffer - helper->buffer->value)
  };
  n_headers = find_headers(header_start, &header_start_buffer,
                           &helper->next_request);
  if (UNLIKELY(n_headers < 0)__builtin_expect(((n_headers < 0)), (0)))
      return false0;

  for (ssize_t i = 0; i < n_headers; i++) {
      char *p = header_start[i];
      char *end = header_start[i + 1] - HEADER_TERMINATOR_LEN(sizeof("\r\n") - 1);

      STRING_SWITCH_L (p)switch (((string_as_uint32(p)) | (uint32_t)0x20202020)) {
      case STR4_INT_L('A', 'c', 'c', 'e')((((uint32_t)(('A') | ('c') << 8 | ('c') << 16 | (
'e') << 24))) | (uint32_t)0x20202020):
          p += HEADER_LENGTH("Accept");

          STRING_SWITCH_L (p)switch (((string_as_uint32(p)) | (uint32_t)0x20202020)) {
          case STR4_INT_L('-', 'E', 'n', 'c')((((uint32_t)(('-') | ('E') << 8 | ('n') << 16 | (
'c') << 24))) | (uint32_t)0x20202020):
              SET_HEADER_VALUE(accept_encoding, "-Encoding");
              break;
          }
          break;
      case STR4_INT_L('C', 'o', 'n', 'n')((((uint32_t)(('C') | ('o') << 8 | ('n') << 16 | (
'n') << 24))) | (uint32_t)0x20202020):
          SET_HEADER_VALUE(connection, "Connection");
          break;
      case STR4_INT_L('C', 'o', 'n', 't')((((uint32_t)(('C') | ('o') << 8 | ('n') << 16 | (
't') << 24))) | (uint32_t)0x20202020):
          p += HEADER_LENGTH("Content");

          STRING_SWITCH_L (p)switch (((string_as_uint32(p)) | (uint32_t)0x20202020)) {
          case STR4_INT_L('-', 'T', 'y', 'p')((((uint32_t)(('-') | ('T') << 8 | ('y') << 16 | (
'p') << 24))) | (uint32_t)0x20202020):
              SET_HEADER_VALUE(content_type, "-Type");
              break;
          case STR4_INT_L('-', 'L', 'e', 'n')((((uint32_t)(('-') | ('L') << 8 | ('e') << 16 | (
'n') << 24))) | (uint32_t)0x20202020):
              SET_HEADER_VALUE(content_length, "-Length");
              break;
          }
          break;
      case STR4_INT_L('I', 'f', '-', 'M')((((uint32_t)(('I') | ('f') << 8 | ('-') << 16 | (
'M') << 24))) | (uint32_t)0x20202020):
          SET_HEADER_VALUE(if_modified_since.raw, "If-Modified-Since");
          break;
      case STR4_INT_L('H', 'o', 's', 't')((((uint32_t)(('H') | ('o') << 8 | ('s') << 16 | (
't') << 24))) | (uint32_t)0x20202020):
          SET_HEADER_VALUE(host, "Host");
          break;
      case STR4_INT_L('R', 'a', 'n', 'g')((((uint32_t)(('R') | ('a') << 8 | ('n') << 16 | (
'g') << 24))) | (uint32_t)0x20202020):
          SET_HEADER_VALUE(range.raw, "Range");
          break;
      }
  }

  helper->n_header_start = (size_t)n_headers;
  return true1;
614}
615#undef HEADER_LENGTH
616#undef SET_HEADER_VALUE

618ssize_t lwan_find_headers(char **header_start, struct lwan_value *buffer,
                        char **next_request)
620{
  return find_headers(header_start, buffer, next_request);
622}

624static void parse_if_modified_since(struct lwan_request_parser_helper *helper)
625{
  static const size_t header_len =
      sizeof("Wed, 17 Apr 2019 13:59:27 GMT") - 1;
  time_t parsed;

  if (UNLIKELY(helper->if_modified_since.raw.len != header_len)__builtin_expect(((helper->if_modified_since.raw.len != header_len
)), (0)))
      return;

  if (UNLIKELY(lwan_parse_rfc_time(helper->if_modified_since.raw.value,__builtin_expect(((lwan_parse_rfc_time(helper->if_modified_since
.raw.value, &parsed) < 0)), (0))
                                   &parsed) < 0)__builtin_expect(((lwan_parse_rfc_time(helper->if_modified_since
.raw.value, &parsed) < 0)), (0)))
      return;

  helper->if_modified_since.parsed = parsed;
638}

640static bool_Bool
641parse_off_without_sign(const char *ptr, char **end, off_t *off)
642{
  unsigned long long val;

  static_assert_Static_assert(sizeof(val) >= sizeof(off_t),
                "off_t fits in a long long");

  errno(*__errno_location ()) = 0;

  val = strtoull(ptr, end, 10);
  if (UNLIKELY(val == 0 && *end == ptr)__builtin_expect(((val == 0 && *end == ptr)), (0)))
      return false0;
  if (UNLIKELY(errno != 0)__builtin_expect((((*__errno_location ()) != 0)), (0)))
      return false0;
  if (UNLIKELY(val > OFF_MAX)__builtin_expect(((val > 9223372036854775807LL)), (0)))
      return false0;

  *off = (off_t)val;
  return true1;
660}

662static void
663parse_range(struct lwan_request_parser_helper *helper)
664{
  if (UNLIKELY(helper->range.raw.len <= (sizeof("bytes=") - 1))__builtin_expect(((helper->range.raw.len <= (sizeof("bytes="
) - 1))), (0)))
      return;

  char *range = helper->range.raw.value;
  if (UNLIKELY(strncmp(range, "bytes=", sizeof("bytes=") - 1))__builtin_expect(((strncmp(range, "bytes=", sizeof("bytes=") -
 1))), (0)))
      return;

  range += sizeof("bytes=") - 1;

  off_t from, to;
  char *end;

  if (*range == '-') {
      from = 0;

      if (!parse_off_without_sign(range + 1, &end, &to))
          goto invalid_range;
      if (*end != '\0')
          goto invalid_range;
  } else if (lwan_char_isdigit(*range)) {
      if (!parse_off_without_sign(range, &end, &from))
          goto invalid_range;
      if (*end != '-')
          goto invalid_range;

      range = end + 1;
      if (*range == '\0') {
          to = -1;
      } else {
          if (!parse_off_without_sign(range, &end, &to))
              goto invalid_range;
          if (*end != '\0')
              goto invalid_range;
      }
  } else {
700invalid_range:
      to = from = -1;
  }

  helper->range.from = from;
  helper->range.to = to;
706}

708static void
709parse_accept_encoding(struct lwan_request *request)
710{
  struct lwan_request_parser_helper *helper = request->helper;

  if (!helper->accept_encoding.len)
      return;

  for (const char *p = helper->accept_encoding.value; *p; p++) {
      STRING_SWITCH(p)switch (string_as_uint32(p)) {
      case STR4_INT('d','e','f','l')((uint32_t)(('d') | ('e') << 8 | ('f') << 16 | ('l'
) << 24)):
      case STR4_INT(' ','d','e','f')((uint32_t)((' ') | ('d') << 8 | ('e') << 16 | ('f'
) << 24)):
          request->flags |= REQUEST_ACCEPT_DEFLATE;
          break;
      case STR4_INT('g','z','i','p')((uint32_t)(('g') | ('z') << 8 | ('i') << 16 | ('p'
) << 24)):
      case STR4_INT(' ','g','z','i')((uint32_t)((' ') | ('g') << 8 | ('z') << 16 | ('i'
) << 24)):
          request->flags |= REQUEST_ACCEPT_GZIP;
          break;
726#if defined(LWAN_HAVE_ZSTD)
      case STR4_INT('z','s','t','d')((uint32_t)(('z') | ('s') << 8 | ('t') << 16 | ('d'
) << 24)):
      case STR4_INT(' ','z','s','t')((uint32_t)((' ') | ('z') << 8 | ('s') << 16 | ('t'
) << 24)):
          request->flags |= REQUEST_ACCEPT_ZSTD;
          break;
731#endif
732#if defined(LWAN_HAVE_BROTLI)
      default:
          while (lwan_char_isspace(*p))
              p++;

          STRING_SWITCH_SMALL(p)switch (string_as_uint16(p)) {
          case STR2_INT('b', 'r')((uint16_t)(('b') | ('r') << 8)):
              request->flags |= REQUEST_ACCEPT_BROTLI;
              break;
          }
742#endif
      }

      if (!(p = strchr(p, ',')))
          break;
  }
748}

750static ALWAYS_INLINEinline __attribute__((always_inline)) char *
751ignore_leading_whitespace(char *buffer)
752{
  while (lwan_char_isspace(*buffer))
      buffer++;
  return buffer;
756}

758static ALWAYS_INLINEinline __attribute__((always_inline)) void parse_connection_header(struct lwan_request *request)
759{
  struct lwan_request_parser_helper *helper = request->helper;
  bool_Bool has_keep_alive = false0;
  bool_Bool has_close = false0;

  if (!helper->connection.len)
      goto out;

  for (const char *p = helper->connection.value; *p; p++) {
      STRING_SWITCH_L(p)switch (((string_as_uint32(p)) | (uint32_t)0x20202020)) {
      case STR4_INT_L('k','e','e','p')((((uint32_t)(('k') | ('e') << 8 | ('e') << 16 | (
'p') << 24))) | (uint32_t)0x20202020):
      case STR4_INT_L(' ', 'k','e','e')((((uint32_t)((' ') | ('k') << 8 | ('e') << 16 | (
'e') << 24))) | (uint32_t)0x20202020):
          has_keep_alive = true1;
          break;
      case STR4_INT_L('c','l','o','s')((((uint32_t)(('c') | ('l') << 8 | ('o') << 16 | (
's') << 24))) | (uint32_t)0x20202020):
      case STR4_INT_L(' ', 'c','l','o')((((uint32_t)((' ') | ('c') << 8 | ('l') << 16 | (
'o') << 24))) | (uint32_t)0x20202020):
          has_close = true1;
          break;
      case STR4_INT_L('u','p','g','r')((((uint32_t)(('u') | ('p') << 8 | ('g') << 16 | (
'r') << 24))) | (uint32_t)0x20202020):
      case STR4_INT_L(' ', 'u','p','g')((((uint32_t)((' ') | ('u') << 8 | ('p') << 16 | (
'g') << 24))) | (uint32_t)0x20202020):
          request->conn->flags |= CONN_IS_UPGRADE;
          break;
      }

      if (!(p = strchr(p, ',')))
          break;
  }

787out:
  if (LIKELY(!(request->flags & REQUEST_IS_HTTP_1_0))__builtin_expect((!!(!(request->flags & REQUEST_IS_HTTP_1_0
))), (1)))
      has_keep_alive = !has_close;

  if (has_keep_alive) {
      request->conn->flags |= CONN_IS_KEEP_ALIVE;
  } else {
      request->conn->flags &=
          ~(CONN_IS_KEEP_ALIVE | CONN_SENT_CONNECTION_HEADER);
  }
797}

799#if defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
800static void save_to_corpus_for_fuzzing(struct lwan_value buffer)
801{
  struct lwan_value buffer_copy;
  char corpus_name[PATH_MAX4096];
  const char *crlfcrlf;
  int fd;

  if (!(crlfcrlf = memmem(buffer.value, buffer.len, "\r\n\r\n", 4)))
      return;
  buffer.len = (size_t)(crlfcrlf - buffer.value + 4);

811try_another_file_name:
  buffer_copy = buffer;

  snprintf(corpus_name, sizeof(corpus_name), "corpus-request-%d", rand());

  fd = open(corpus_name, O_WRONLY01 | O_CLOEXEC02000000 | O_CREAT0100 | O_EXCL0200, 0644);
  if (fd < 0)
      goto try_another_file_name;

  while (buffer_copy.len) {
      ssize_t r = write(fd, buffer_copy.value, buffer_copy.len);

      if (r < 0) {
          if (errno(*__errno_location ()) == EAGAIN11 || errno(*__errno_location ()) == EINTR4)
              continue;

          close(fd);
          unlink(corpus_name);
          goto try_another_file_name;
      }

      buffer_copy.value += r;
      buffer_copy.len -= r;
  }

  close(fd);
  lwan_status_debug("Request saved to %s", corpus_name)lwan_status_debug_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 837, __FUNCTION__, "Request saved to %s", corpus_name);
838}
839#endif

841static enum lwan_http_status
842client_read(struct lwan_request *request,
          struct lwan_value *buffer,
          const size_t want_to_read,
          enum lwan_read_finalizer (*finalizer)(const struct lwan_value *buffer,
                                                size_t want_to_read,
                                                const struct lwan_request *request,
                                                int n_packets))
849{
  struct lwan_request_parser_helper *helper = request->helper;
  int n_packets = 0;

  if (helper->next_request) {
      const size_t next_request_len = (size_t)(helper->next_request - buffer->value);
      size_t new_len;

      if (__builtin_sub_overflow(buffer->len, next_request_len, &new_len)) {
          helper->next_request = NULL((void*)0);
      } else if (new_len) {
          /* FIXME: This memmove() could be eventually removed if a better
           * stucture (maybe a ringbuffer, reading with readv(), and each
           * pointer is coro_strdup() if they wrap around?) were used for
           * the request buffer.  */
          buffer->len = new_len;
          memmove(buffer->value, helper->next_request, new_len);
          goto try_to_finalize;
      }
  }

  for (buffer->len = 0;; n_packets++) {
      size_t to_read = (size_t)(want_to_read - buffer->len);

      if (UNLIKELY(to_read == 0)__builtin_expect(((to_read == 0)), (0)))
          return HTTP_TOO_LARGE;

      ssize_t n = recv(request->fd, buffer->value + buffer->len, to_read, 0);
      if (UNLIKELY(n <= 0)__builtin_expect(((n <= 0)), (0))) {
          if (n < 0) {
              switch (errno(*__errno_location ())) {
              case EINTR4:
              case EAGAIN11:
882yield_and_read_again:
                  coro_yield(request->conn->coro, CONN_CORO_WANT_READ);
                  continue;
              }

              /* Unexpected error before reading anything */
              if (UNLIKELY(!buffer->len)__builtin_expect(((!buffer->len)), (0)))
                  return HTTP_BAD_REQUEST;
          }

          /* Client shut down orderly (n = 0), or unrecoverable error (n < 0);
           * shut down coro. */
          break;
      }

      buffer->len += (size_t)n;

899try_to_finalize:
      switch (finalizer(buffer, want_to_read, request, n_packets)) {
      case FINALIZER_DONE:
          buffer->value[buffer->len] = '\0';
903#if defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
          save_to_corpus_for_fuzzing(*buffer);
905#endif
          return HTTP_OK;

      case FINALIZER_TRY_AGAIN:
          goto yield_and_read_again;

      case FINALIZER_TIMEOUT:
          return HTTP_TIMEOUT;
      }
  }

  coro_yield(request->conn->coro, CONN_CORO_ABORT);
  __builtin_unreachable();
  return HTTP_INTERNAL_ERROR;
919}

921static enum lwan_read_finalizer
922read_request_finalizer_from_helper(const struct lwan_value *buffer,
                                 struct lwan_request_parser_helper *helper,
                                 int n_packets,
                                 bool_Bool allow_proxy_reqs)
926{
  static const size_t min_proxied_request_size =
      MIN_REQUEST_SIZE(sizeof("GET / HTTP/1.1\r\n\r\n") - 1) + sizeof(struct proxy_header_v2);

  if (LIKELY(buffer->len >= MIN_REQUEST_SIZE)__builtin_expect((!!(buffer->len >= (sizeof("GET / HTTP/1.1\r\n\r\n"
) - 1))), (1))) {
      STRING_SWITCH (buffer->value + buffer->len - 4)switch (string_as_uint32(buffer->value + buffer->len - 4
)) {
      case STR4_INT('\r', '\n', '\r', '\n')((uint32_t)(('\r') | ('\n') << 8 | ('\r') << 16 |
 ('\n') << 24)):
          return FINALIZER_DONE;
      }
  }

  char *crlfcrlf = memmem(buffer->value, buffer->len, "\r\n\r\n", 4);
  if (LIKELY(crlfcrlf)__builtin_expect((!!(crlfcrlf)), (1))) {
      if (LIKELY(helper->next_request)__builtin_expect((!!(helper->next_request)), (1))) {
          helper->next_request = NULL((void*)0);
          return FINALIZER_DONE;
      }

      const size_t crlfcrlf_to_base = (size_t)(crlfcrlf - buffer->value);
      if (crlfcrlf_to_base >= MIN_REQUEST_SIZE(sizeof("GET / HTTP/1.1\r\n\r\n") - 1) - 4)
          return FINALIZER_DONE;

      if (buffer->len > min_proxied_request_size && allow_proxy_reqs) {
          /* FIXME: Checking for PROXYv2 protocol header here is a layering
           * violation. */
          STRING_SWITCH_LARGE (crlfcrlf + 4)switch (string_as_uint64(crlfcrlf + 4)) {
          case STR8_INT(0x00, 0x0d, 0x0a, 0x51, 0x55, 0x49, 0x54, 0x0a)((uint64_t)((uint32_t)((0x00) | (0x0d) << 8 | (0x0a) <<
| (0x51) << 24)) | (uint64_t)((uint32_t)((0x55) | (
0x49) << 8 | (0x54) << 16 | (0x0a) << 24)) <<
 32):
              return FINALIZER_DONE;
          }
      }
  }

  /* Yield a timeout error to avoid clients being intentionally slow and
   * hogging the server.  (Clients can't only connect and do nothing, they
   * need to send data, otherwise the timeout queue timer will kick in and
   * close the connection.  Limit the number of packets to avoid them sending
   * just a byte at a time.) See lwan_calculate_n_packets() to see how this is
   * calculated. */
  if (UNLIKELY(n_packets > helper->error_when_n_packets)__builtin_expect(((n_packets > helper->error_when_n_packets
)), (0)))
      return FINALIZER_TIMEOUT;

  return FINALIZER_TRY_AGAIN;
968}

970static inline enum lwan_read_finalizer
971read_request_finalizer(const struct lwan_value *buffer,
                     size_t want_to_read __attribute__((unused)),
                     const struct lwan_request *request,
                     int n_packets)
975{
  return read_request_finalizer_from_helper(
      buffer, request->helper, n_packets,
      request->flags & REQUEST_ALLOW_PROXY_REQS);
979}

981static ALWAYS_INLINEinline __attribute__((always_inline)) enum lwan_http_status
982read_request(struct lwan_request *request)
983{
  return client_read(request, request->helper->buffer,
                     DEFAULT_BUFFER_SIZE4096 - 1 /* -1 for NUL byte */,
                     read_request_finalizer);
987}

989static enum lwan_read_finalizer
990body_data_finalizer(const struct lwan_value *buffer,
                  size_t want_to_read,
                  const struct lwan_request *request,
                  int n_packets)
994{
  const struct lwan_request_parser_helper *helper = request->helper;

  if (want_to_read == buffer->len)
      return FINALIZER_DONE;

  /* For POST requests, the body can be larger, and due to small MTUs on
   * most ethernet connections, responding with a timeout solely based on
   * number of packets doesn't work.  Use keepalive timeout instead.  */
  if (UNLIKELY(time(NULL) > helper->error_when_time)__builtin_expect(((time(((void*)0)) > helper->error_when_time
)), (0)))
      return FINALIZER_TIMEOUT;

  /* In addition to time, also estimate the number of packets based on an
   * usual MTU value and the request body size.  */
  if (UNLIKELY(n_packets > helper->error_when_n_packets)__builtin_expect(((n_packets > helper->error_when_n_packets
)), (0)))
      return FINALIZER_TIMEOUT;

  return FINALIZER_TRY_AGAIN;
1012}

1014static const char *is_dir(const char *v)
1015{
  struct stat st;

  if (!v)
      return NULL((void*)0);

  if (*v != '/')
      return NULL((void*)0);

  if (stat(v, &st) < 0)
      return NULL((void*)0);

  if (!S_ISDIR(st.st_mode)((((st.st_mode)) & 0170000) == (0040000)))
      return NULL((void*)0);

  if (!(st.st_mode & S_ISVTX01000)) {
      lwan_status_warning(lwan_status_warning_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1034, __FUNCTION__, "Using %s as temporary directory, but it doesn't have "
 "the sticky bit set.", v)
          "Using %s as temporary directory, but it doesn't have "lwan_status_warning_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1034, __FUNCTION__, "Using %s as temporary directory, but it doesn't have "
 "the sticky bit set.", v)
          "the sticky bit set.",lwan_status_warning_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1034, __FUNCTION__, "Using %s as temporary directory, but it doesn't have "
 "the sticky bit set.", v)
          v)lwan_status_warning_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1034, __FUNCTION__, "Using %s as temporary directory, but it doesn't have "
 "the sticky bit set.", v);
  }

  return v;
1038}

1040static const char *is_dir_good_for_tmp(const char *v)
1041{
  struct statfs sb;

  v = is_dir(v);
  if (!v)
      return NULL((void*)0);

  if (!statfs(v, &sb) && sb.f_type == TMPFS_MAGIC0x01021994) {
      lwan_status_warning("%s is a tmpfs filesystem, "lwan_status_warning_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1050, __FUNCTION__, "%s is a tmpfs filesystem, " "not considering it"
, v)
                          "not considering it", v)lwan_status_warning_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1050, __FUNCTION__, "%s is a tmpfs filesystem, " "not considering it"
, v);
      return NULL((void*)0);
  }

  return v;
1055}

1057static const char *temp_dir;
1058static const size_t body_buffer_temp_file_thresh = 1<<20;

1060static const char *
1061get_temp_dir(void)
1062{
  const char *tmpdir;

  tmpdir = is_dir_good_for_tmp(secure_getenv("TMPDIR"));
  if (tmpdir)
      return tmpdir;

  tmpdir = is_dir_good_for_tmp(secure_getenv("TMP"));
  if (tmpdir)
      return tmpdir;

  tmpdir = is_dir_good_for_tmp(secure_getenv("TEMP"));
  if (tmpdir)
      return tmpdir;

  tmpdir = is_dir_good_for_tmp("/var/tmp");
  if (tmpdir)
      return tmpdir;

  tmpdir = is_dir_good_for_tmp(P_tmpdir"/tmp");
  if (tmpdir)
      return tmpdir;

  lwan_status_warning("Temporary directory could not be determined. POST "lwan_status_warning_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1087, __FUNCTION__, "Temporary directory could not be determined. POST "
 "or PUT requests over %zu bytes bytes will fail.", body_buffer_temp_file_thresh
)
                      "or PUT requests over %zu bytes bytes will fail.",lwan_status_warning_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1087, __FUNCTION__, "Temporary directory could not be determined. POST "
 "or PUT requests over %zu bytes bytes will fail.", body_buffer_temp_file_thresh
)
                      body_buffer_temp_file_thresh)lwan_status_warning_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1087, __FUNCTION__, "Temporary directory could not be determined. POST "
 "or PUT requests over %zu bytes bytes will fail.", body_buffer_temp_file_thresh
);
  return NULL((void*)0);
1089}

1091__attribute__((constructor)) static void initialize_temp_dir(void)
1092{
  temp_dir = get_temp_dir();
1094}

1096static int create_temp_file(void)
1097{
  char template[PATH_MAX4096];
  mode_t prev_mask;
  int ret;

  if (UNLIKELY(!temp_dir)__builtin_expect(((!temp_dir)), (0)))
      return -ENOENT2;

1105#if defined(O_TMPFILE(020000000 | 0200000))
  int fd = open(temp_dir,
                O_TMPFILE(020000000 | 0200000) | O_CREAT0100 | O_RDWR02 | O_EXCL0200 | O_CLOEXEC02000000 |
                    O_NOFOLLOW0400000 | O_NOATIME01000000,
                S_IRUSR0400 | S_IWUSR0200);
  if (LIKELY(fd >= 0)__builtin_expect((!!(fd >= 0)), (1)))
      return fd;
1112#endif

  ret = snprintf(template, sizeof(template), "%s/lwanXXXXXX", temp_dir);
  if (UNLIKELY(ret < 0 || ret >= (int)sizeof(template))__builtin_expect(((ret < 0 || ret >= (int)sizeof(template
))), (0)))
      return -EOVERFLOW75;

  prev_mask = umask_for_tmpfile(S_IRUSR | S_IWUSR)({ (void)(0400 | 0200); 0U; });
  ret = mkostemp(template, O_CLOEXEC02000000);
  umask_for_tmpfile(prev_mask)({ (void)(prev_mask); 0U; });

  if (LIKELY(ret >= 0)__builtin_expect((!!(ret >= 0)), (1)))
      unlink(template);

  return ret;
1126}

1128struct file_backed_buffer {
  void *ptr;
  size_t size;
1131};

1133static void
1134free_body_buffer(void *data)
1135{
  struct file_backed_buffer *buf = data;

  munmap(buf->ptr, buf->size);
  free(buf);
1140}

1142static void*
1143alloc_body_buffer(struct coro *coro, size_t size, bool_Bool allow_file)
1144{
  struct file_backed_buffer *buf;
  void *ptr = (void *)MAP_FAILED((void *) -1);
  int fd;

  if (LIKELY(size < body_buffer_temp_file_thresh)__builtin_expect((!!(size < body_buffer_temp_file_thresh))
, (1))) {
      ptr = coro_malloc(coro, size);

      if (LIKELY(ptr)__builtin_expect((!!(ptr)), (1)))
          return ptr;
  }

  if (UNLIKELY(!allow_file)__builtin_expect(((!allow_file)), (0)))
      return NULL((void*)0);

  fd = create_temp_file();
  if (UNLIKELY(fd < 0)__builtin_expect(((fd < 0)), (0)))
      return NULL((void*)0);

  if (UNLIKELY(ftruncate(fd, (off_t)size) < 0)__builtin_expect(((ftruncate(fd, (off_t)size) < 0)), (0))) {
      close(fd);
      return NULL((void*)0);
  }

  if (MAP_HUGETLB0x40000) {
      ptr = mmap(NULL((void*)0), size, PROT_READ0x1 | PROT_WRITE0x2,
                 MAP_SHARED0x01 | MAP_HUGETLB0x40000, fd, 0);
  }
  if (UNLIKELY(ptr == MAP_FAILED)__builtin_expect(((ptr == ((void *) -1))), (0)))
      ptr = mmap(NULL((void*)0), size, PROT_READ0x1 | PROT_WRITE0x2, MAP_SHARED0x01, fd, 0);
  close(fd);
  if (UNLIKELY(ptr == MAP_FAILED)__builtin_expect(((ptr == ((void *) -1))), (0)))
      return NULL((void*)0);

  buf = coro_malloc_full(coro, sizeof(*buf), free_body_buffer);
  if (UNLIKELY(!buf)__builtin_expect(((!buf)), (0))) {
      munmap(ptr, size);
      return NULL((void*)0);
  }

  buf->ptr = ptr;
  buf->size = size;
  return ptr;
1187}

1189static enum lwan_http_status
1190get_remaining_body_data_length(struct lwan_request *request,
                             const size_t max_size,
                             size_t *total,
                             size_t *have)
1194{
  struct lwan_request_parser_helper *helper = request->helper;
  long long parsed_size;

  if (UNLIKELY(!helper->content_length.value)__builtin_expect(((!helper->content_length.value)), (0)))
      return HTTP_BAD_REQUEST;

  parsed_size = parse_long_long(helper->content_length.value, -1);
  if (UNLIKELY(parsed_size < 0)__builtin_expect(((parsed_size < 0)), (0)))
      return HTTP_BAD_REQUEST;
  if (UNLIKELY((size_t)parsed_size >= max_size)__builtin_expect((((size_t)parsed_size >= max_size)), (0)))
      return HTTP_TOO_LARGE;
  if (UNLIKELY(!parsed_size)__builtin_expect(((!parsed_size)), (0)))
      return HTTP_OK;

  *total = (size_t)parsed_size;

  if (!helper->next_request) {
      *have = 0;
      return HTTP_PARTIAL_CONTENT;
  }

  char *buffer_end = helper->buffer->value + helper->buffer->len;

  *have = (size_t)(buffer_end - helper->next_request);

  if (*have < *total)
      return HTTP_PARTIAL_CONTENT;

  helper->body_data.value = helper->next_request;
  helper->body_data.len = *total;
  helper->next_request += *total;
  return HTTP_OK;
1227}

1229static int read_body_data(struct lwan_request *request)
1230{
  /* Holy indirection, Batman! */
  const struct lwan_config *config = &request->conn->thread->lwan->config;
  struct lwan_request_parser_helper *helper = request->helper;
  enum lwan_http_status status;
  size_t total, have, max_data_size;
  bool_Bool allow_temp_file;
  char *new_buffer;

  switch (lwan_request_get_method(request)) {
  case REQUEST_METHOD_POST:
      allow_temp_file = config->allow_post_temp_file;
      max_data_size = config->max_post_data_size;
      break;
  case REQUEST_METHOD_PUT:
      allow_temp_file = config->allow_put_temp_file;
      max_data_size = config->max_put_data_size;
      break;
  default:
      return -HTTP_NOT_ALLOWED;
  }

  status =
      get_remaining_body_data_length(request, max_data_size, &total, &have);
  if (status != HTTP_PARTIAL_CONTENT)
      return -(int)status;

  new_buffer =
      alloc_body_buffer(request->conn->coro, total + 1, allow_temp_file);
  if (UNLIKELY(!new_buffer)__builtin_expect(((!new_buffer)), (0)))
      return -HTTP_INTERNAL_ERROR;

  if (!(request->flags & REQUEST_IS_HTTP_1_0)) {
      /* §8.2.3 https://www.w3.org/Protocols/rfc2616/rfc2616-sec8.html */
      const char *expect = lwan_request_get_header(request, "Expect");

      if (expect && strncmp(expect, "100-", 4) == 0) {
          static const char continue_header[] = "HTTP/1.1 100 Continue\r\n\r\n";

          lwan_send(request, continue_header, sizeof(continue_header) - 1, 0);
      }
  }

  helper->body_data.value = new_buffer;
  helper->body_data.len = total;
  if (have) {
      new_buffer = mempcpy(new_buffer, helper->next_request, have);
      total -= have;
  }
  helper->next_request = NULL((void*)0);

  helper->error_when_time = time(NULL((void*)0)) + config->keep_alive_timeout;
  helper->error_when_n_packets = lwan_calculate_n_packets(total);

  struct lwan_value buffer = {.value = new_buffer, .len = total};
  return (int)client_read(request, &buffer, total, body_data_finalizer);
1286}

1288static char *
1289parse_proxy_protocol(struct lwan_request *request, char *buffer)
1290{
  STRING_SWITCH(buffer)switch (string_as_uint32(buffer)) {
  case STR4_INT('P','R','O','X')((uint32_t)(('P') | ('R') << 8 | ('O') << 16 | ('X'
) << 24)):
      return parse_proxy_protocol_v1(request, buffer);
  case STR4_INT('\x0D','\x0A','\x0D','\x0A')((uint32_t)(('\x0D') | ('\x0A') << 8 | ('\x0D') <<
| ('\x0A') << 24)):
      return parse_proxy_protocol_v2(request, buffer);
  }

  return buffer;
1299}

1301static enum lwan_http_status parse_http_request(struct lwan_request *request)
1302{
  struct lwan_request_parser_helper *helper = request->helper;
  char *buffer = helper->buffer->value;

  if (request->flags & REQUEST_ALLOW_PROXY_REQS) {
      /* REQUEST_ALLOW_PROXY_REQS will be cleared in lwan_process_request() */

      buffer = parse_proxy_protocol(request, buffer);
      if (UNLIKELY(!buffer)__builtin_expect(((!buffer)), (0)))
          return HTTP_BAD_REQUEST;
  }

  buffer = ignore_leading_whitespace(buffer);

  if (UNLIKELY(buffer > helper->buffer->value + helper->buffer->len -__builtin_expect(((buffer > helper->buffer->value + helper
->buffer->len - (sizeof("GET / HTTP/1.1\r\n\r\n") - 1))
), (0))
                             MIN_REQUEST_SIZE)__builtin_expect(((buffer > helper->buffer->value + helper
->buffer->len - (sizeof("GET / HTTP/1.1\r\n\r\n") - 1))
), (0)))
      return HTTP_BAD_REQUEST;

  char *path = identify_http_method(request, buffer);
  if (UNLIKELY(!path)__builtin_expect(((!path)), (0)))
      return HTTP_NOT_ALLOWED;

  buffer = identify_http_path(request, path);
  if (UNLIKELY(!buffer)__builtin_expect(((!buffer)), (0)))
      return HTTP_BAD_REQUEST;

  if (UNLIKELY(!parse_headers(helper, buffer))__builtin_expect(((!parse_headers(helper, buffer))), (0)))
      return HTTP_BAD_REQUEST;

  ssize_t decoded_len = url_decode(request->url.value);
  if (UNLIKELY(decoded_len < 0)__builtin_expect(((decoded_len < 0)), (0)))
      return HTTP_BAD_REQUEST;
  request->original_url.len = request->url.len = (size_t)decoded_len;

  parse_connection_header(request);

  return HTTP_OK;
1339}

1341static enum lwan_http_status
1342prepare_websocket_handshake(struct lwan_request *request, char **encoded)
1343{
  static const unsigned char websocket_uuid[] =
      "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
  unsigned char digest[20];
  sha1_context ctx;

  if (UNLIKELY(request->flags & RESPONSE_SENT_HEADERS)__builtin_expect(((request->flags & RESPONSE_SENT_HEADERS
)), (0)))
      return HTTP_INTERNAL_ERROR;

  if (UNLIKELY(!(request->conn->flags & CONN_IS_UPGRADE))__builtin_expect(((!(request->conn->flags & CONN_IS_UPGRADE
))), (0)))
      return HTTP_BAD_REQUEST;

  const char *upgrade = lwan_request_get_header(request, "Upgrade");
  if (UNLIKELY(!upgrade || !streq(upgrade, "websocket"))__builtin_expect(((!upgrade || !streq(upgrade, "websocket")))
, (0)))
      return HTTP_BAD_REQUEST;

  const char *sec_websocket_key =
      lwan_request_get_header(request, "Sec-WebSocket-Key");
  if (UNLIKELY(!sec_websocket_key)__builtin_expect(((!sec_websocket_key)), (0)))
      return HTTP_BAD_REQUEST;

  const size_t sec_websocket_key_len = strlen(sec_websocket_key);
  if (base64_encoded_len(16) != sec_websocket_key_len)
      return HTTP_BAD_REQUEST;
  if (UNLIKELY(!base64_validate((void *)sec_websocket_key, sec_websocket_key_len))__builtin_expect(((!base64_validate((void *)sec_websocket_key
, sec_websocket_key_len))), (0)))
      return HTTP_BAD_REQUEST;

  sha1_init(&ctx);
  sha1_update(&ctx, (void *)sec_websocket_key, sec_websocket_key_len);
  sha1_update(&ctx, websocket_uuid, sizeof(websocket_uuid) - 1);
  sha1_finalize(&ctx, digest);

  *encoded = (char *)base64_encode(digest, sizeof(digest), NULL((void*)0));
  return LIKELY(*encoded)__builtin_expect((!!(*encoded)), (1)) ? HTTP_SWITCHING_PROTOCOLS : HTTP_INTERNAL_ERROR;
1377}

1379enum lwan_http_status
1380lwan_request_websocket_upgrade(struct lwan_request *request)
1381{
  char header_buf[DEFAULT_HEADERS_SIZE2048];
  size_t header_buf_len;
  char *encoded;

  enum lwan_http_status r = prepare_websocket_handshake(request, &encoded);
  if (r != HTTP_SWITCHING_PROTOCOLS)
      return r;

  request->flags |= RESPONSE_NO_CONTENT_LENGTH;
  header_buf_len = lwan_prepare_response_header_full(
      request, HTTP_SWITCHING_PROTOCOLS, header_buf, sizeof(header_buf),
      (struct lwan_key_value[]){
          /* Connection: Upgrade is implicit if conn->flags & CONN_IS_UPGRADE */
          {.key = "Sec-WebSocket-Accept", .value = encoded},
          {.key = "Upgrade", .value = "websocket"},
          {},
      });
  free(encoded);
  if (UNLIKELY(!header_buf_len)__builtin_expect(((!header_buf_len)), (0)))
      return HTTP_INTERNAL_ERROR;

  request->conn->flags |= CONN_IS_WEBSOCKET;
  lwan_send(request, header_buf, header_buf_len, 0);

  return HTTP_SWITCHING_PROTOCOLS;
1407}

1409static inline bool_Bool request_has_body(const struct lwan_request *request)
1410{
  /* 3rd bit set in method: request method has body. See lwan.h,
   * definition of FOR_EACH_REQUEST_METHOD() for more info. */
  return lwan_request_get_method(request) & 1 << 3;
1414}

1416static enum lwan_http_status
1417maybe_read_body_data(const struct lwan_url_map *url_map,
                   struct lwan_request *request)
1419{
  int status = 0;

  if (url_map->flags & HANDLER_EXPECTS_BODY_DATA) {
      status = read_body_data(request);
      if (status > 0)
          return (enum lwan_http_status)status;
  }

  /* Instead of trying to read the body here, which will require
   * us to allocate and read potentially a lot of bytes, force
   * this connection to be closed as soon as we send a "not allowed"
   * response.  */
  request->conn->flags &= ~CONN_IS_KEEP_ALIVE;

  if (status < 0) {
      status = -status;
      return (enum lwan_http_status)status;
  }

  return HTTP_NOT_ALLOWED;
1440}

1442static enum lwan_http_status prepare_for_response(const struct lwan_url_map *url_map,
                                                struct lwan_request *request)
1444{
  request->url.value += url_map->prefix_len;
  request->url.len -= url_map->prefix_len;
  while (*request->url.value == '/' && request->url.len > 0) {
      request->url.value++;
      request->url.len--;
  }

  if (UNLIKELY(url_map->flags & HANDLER_MUST_AUTHORIZE)__builtin_expect(((url_map->flags & HANDLER_MUST_AUTHORIZE
)), (0))) {
      if (!lwan_http_authorize_urlmap(request, url_map))
          return HTTP_NOT_AUTHORIZED;
  }

  if (UNLIKELY(request_has_body(request))__builtin_expect(((request_has_body(request))), (0)))
      return maybe_read_body_data(url_map, request);

  return HTTP_OK;
1461}

1463static bool_Bool handle_rewrite(struct lwan_request *request)
1464{
  struct lwan_request_parser_helper *helper = request->helper;

  request->flags &= ~RESPONSE_URL_REWRITTEN;

  find_query_string(request, request->url.value + request->url.len);

  helper->urls_rewritten++;
  if (UNLIKELY(helper->urls_rewritten > 4)__builtin_expect(((helper->urls_rewritten > 4)), (0))) {
      lwan_default_response(request, HTTP_INTERNAL_ERROR);
      return false0;
  }

  return true1;
1478}

1480const char *lwan_request_get_method_str(const struct lwan_request *request)
1481{
1482#define GENERATE_CASE_STMT(upper, lower, mask, constant, probability)          \
  case REQUEST_METHOD_##upper:                                               \
      return #upper;

  switch (lwan_request_get_method(request)) {
      FOR_EACH_REQUEST_METHOD(GENERATE_CASE_STMT)GENERATE_CASE_STMT(GET, get, (1 << 0), (((uint32_t)(('G'
) | ('E') << 8 | ('T') << 16 | (' ') << 24)
)), 0.6) GENERATE_CASE_STMT(POST, post, (1 << 3 | 1 <<
| 1 << 0), (((uint32_t)(('P') | ('O') << 8 | (
'S') << 16 | ('T') << 24))), 0.2) GENERATE_CASE_STMT
(HEAD, head, (1 << 1), (((uint32_t)(('H') | ('E') <<
| ('A') << 16 | ('D') << 24))), 0.2) GENERATE_CASE_STMT
(OPTIONS, options, (1 << 2), (((uint32_t)(('O') | ('P')
 << 8 | ('T') << 16 | ('I') << 24))), 0.1) GENERATE_CASE_STMT
(DELETE, delete, (1 << 1 | 1 << 2), (((uint32_t)(
('D') | ('E') << 8 | ('L') << 16 | ('E') <<
 24))), 0.1) GENERATE_CASE_STMT(PUT, put, (1 << 3 | 1 <<
| 1 << 0), (((uint32_t)(('P') | ('U') << 8 | (
'T') << 16 | (' ') << 24))), 0.1)
  default:
      return "UNKNOWN";
  }
1491#undef GENERATE_CASE_STMT
1492}

1494#ifndef NDEBUG
1495static void log_request(struct lwan_request *request,
                      enum lwan_http_status status,
                      double time_to_read_request,
                      double time_to_process_request)
1499{
  char ip_buffer[INET6_ADDRSTRLEN46];

  lwan_status_debug(lwan_status_debug_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1509, __FUNCTION__, "%s [%s] %016lx \"%s %s HTTP/%s\" %d %s (r:%.3fms p:%.3fms)"
, lwan_request_get_remote_address(request, ip_buffer), request
->conn->thread->date.date, lwan_request_get_id(request
), lwan_request_get_method_str(request), request->original_url
.value, request->flags & REQUEST_IS_HTTP_1_0 ? "1.0" :
 "1.1", status, request->response.mime_type, time_to_read_request
, time_to_process_request)
5
←
Calling 'lwan_request_get_remote_address'→
      "%s [%s] %016lx \"%s %s HTTP/%s\" %d %s (r:%.3fms p:%.3fms)",lwan_status_debug_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1509, __FUNCTION__, "%s [%s] %016lx \"%s %s HTTP/%s\" %d %s (r:%.3fms p:%.3fms)"
, lwan_request_get_remote_address(request, ip_buffer), request
->conn->thread->date.date, lwan_request_get_id(request
), lwan_request_get_method_str(request), request->original_url
.value, request->flags & REQUEST_IS_HTTP_1_0 ? "1.0" :
 "1.1", status, request->response.mime_type, time_to_read_request
, time_to_process_request)
      lwan_request_get_remote_address(request, ip_buffer),lwan_status_debug_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1509, __FUNCTION__, "%s [%s] %016lx \"%s %s HTTP/%s\" %d %s (r:%.3fms p:%.3fms)"
, lwan_request_get_remote_address(request, ip_buffer), request
->conn->thread->date.date, lwan_request_get_id(request
), lwan_request_get_method_str(request), request->original_url
.value, request->flags & REQUEST_IS_HTTP_1_0 ? "1.0" :
 "1.1", status, request->response.mime_type, time_to_read_request
, time_to_process_request)
      request->conn->thread->date.date, lwan_request_get_id(request),lwan_status_debug_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1509, __FUNCTION__, "%s [%s] %016lx \"%s %s HTTP/%s\" %d %s (r:%.3fms p:%.3fms)"
, lwan_request_get_remote_address(request, ip_buffer), request
->conn->thread->date.date, lwan_request_get_id(request
), lwan_request_get_method_str(request), request->original_url
.value, request->flags & REQUEST_IS_HTTP_1_0 ? "1.0" :
 "1.1", status, request->response.mime_type, time_to_read_request
, time_to_process_request)
      lwan_request_get_method_str(request), request->original_url.value,lwan_status_debug_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1509, __FUNCTION__, "%s [%s] %016lx \"%s %s HTTP/%s\" %d %s (r:%.3fms p:%.3fms)"
, lwan_request_get_remote_address(request, ip_buffer), request
->conn->thread->date.date, lwan_request_get_id(request
), lwan_request_get_method_str(request), request->original_url
.value, request->flags & REQUEST_IS_HTTP_1_0 ? "1.0" :
 "1.1", status, request->response.mime_type, time_to_read_request
, time_to_process_request)
      request->flags & REQUEST_IS_HTTP_1_0 ? "1.0" : "1.1", status,lwan_status_debug_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1509, __FUNCTION__, "%s [%s] %016lx \"%s %s HTTP/%s\" %d %s (r:%.3fms p:%.3fms)"
, lwan_request_get_remote_address(request, ip_buffer), request
->conn->thread->date.date, lwan_request_get_id(request
), lwan_request_get_method_str(request), request->original_url
.value, request->flags & REQUEST_IS_HTTP_1_0 ? "1.0" :
 "1.1", status, request->response.mime_type, time_to_read_request
, time_to_process_request)
      request->response.mime_type, time_to_read_request,lwan_status_debug_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1509, __FUNCTION__, "%s [%s] %016lx \"%s %s HTTP/%s\" %d %s (r:%.3fms p:%.3fms)"
, lwan_request_get_remote_address(request, ip_buffer), request
->conn->thread->date.date, lwan_request_get_id(request
), lwan_request_get_method_str(request), request->original_url
.value, request->flags & REQUEST_IS_HTTP_1_0 ? "1.0" :
 "1.1", status, request->response.mime_type, time_to_read_request
, time_to_process_request)
      time_to_process_request)lwan_status_debug_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1509, __FUNCTION__, "%s [%s] %016lx \"%s %s HTTP/%s\" %d %s (r:%.3fms p:%.3fms)"
, lwan_request_get_remote_address(request, ip_buffer), request
->conn->thread->date.date, lwan_request_get_id(request
), lwan_request_get_method_str(request), request->original_url
.value, request->flags & REQUEST_IS_HTTP_1_0 ? "1.0" :
 "1.1", status, request->response.mime_type, time_to_read_request
, time_to_process_request);
1510}
1511#else
1512#define log_request(...)
1513#endif

1515#ifndef NDEBUG
1516static struct timespec current_precise_monotonic_timespec(void)
1517{
  struct timespec now;

  if (UNLIKELY(clock_gettime(CLOCK_MONOTONIC, &now) < 0)__builtin_expect(((clock_gettime(1, &now) < 0)), (0))) {
      lwan_status_perror("clock_gettime")lwan_status_perror_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1521, __FUNCTION__, "clock_gettime");
      return (struct timespec){};
  }

  return now;
1526}

1528static double elapsed_time_ms(const struct timespec then)
1529{
  const struct timespec now = current_precise_monotonic_timespec();
  struct timespec diff = {
      .tv_sec = now.tv_sec - then.tv_sec,
      .tv_nsec = now.tv_nsec - then.tv_nsec,
  };

  if (diff.tv_nsec < 0) {
      diff.tv_sec--;
      diff.tv_nsec += 1000000000l;
  }

  return (double)diff.tv_sec / 1000.0 + (double)diff.tv_nsec / 1000000.0;
1542}
1543#endif

1545void lwan_process_request(struct lwan *l, struct lwan_request *request)
1546{
  enum lwan_http_status status;
  struct lwan_url_map *url_map;

1550#ifndef NDEBUG
  struct timespec request_read_begin_time = current_precise_monotonic_timespec();
1552#endif
  status = read_request(request);

1555#ifndef NDEBUG
  double time_to_read_request = elapsed_time_ms(request_read_begin_time);

  struct timespec request_begin_time = current_precise_monotonic_timespec();
1559#endif
  if (UNLIKELY(status != HTTP_OK)__builtin_expect(((status != HTTP_OK)), (0))) {
1
Taking false branch→
      /* If read_request() returns any error at this point, it's probably
       * better to just send an error response and abort the coroutine and
       * let the client handle the error instead: we don't have
       * information to even log the request because it has not been
       * parsed yet at this stage.  Even if there are other requests waiting
       * in the pipeline, this seems like the safer thing to do.  */
      request->conn->flags &= ~CONN_IS_KEEP_ALIVE;
      lwan_default_response(request, status);
      /* Let process_request_coro() gracefully close the connection. */
      return;
  }

  status = parse_http_request(request);
  if (UNLIKELY(status != HTTP_OK)__builtin_expect(((status != HTTP_OK)), (0)))
2
←
Taking true branch→
      goto log_and_return;
3
←
Control jumps to line 1598→

1577lookup_again:
  url_map = lwan_trie_lookup_prefix(&l->url_map_trie, request->url.value);
  if (UNLIKELY(!url_map)__builtin_expect(((!url_map)), (0))) {
      status = HTTP_NOT_FOUND;
      goto log_and_return;
  }

  status = prepare_for_response(url_map, request);
  if (UNLIKELY(status != HTTP_OK)__builtin_expect(((status != HTTP_OK)), (0)))
      goto log_and_return;

  status = url_map->handler(request, &request->response, url_map->data);
  if (UNLIKELY(url_map->flags & HANDLER_CAN_REWRITE_URL)__builtin_expect(((url_map->flags & HANDLER_CAN_REWRITE_URL
)), (0))) {
      if (request->flags & RESPONSE_URL_REWRITTEN) {
          if (LIKELY(handle_rewrite(request))__builtin_expect((!!(handle_rewrite(request))), (1)))
              goto lookup_again;
          return;
      }
  }

1597log_and_return:
  lwan_response(request, status);

  log_request(request, status, time_to_read_request, elapsed_time_ms(request_begin_time));
4
←
Calling 'log_request'→
1601}

1603static inline void *
1604value_lookup(const struct lwan_key_value_array *array, const char *key)
1605{
  const struct lwan_array *la = (const struct lwan_array *)array;

  if (LIKELY(la->elements)__builtin_expect((!!(la->elements)), (1))) {
      struct lwan_key_value k = { .key = (char *)key };
      struct lwan_key_value *entry;

      entry = bsearch(&k, la->base, la->elements, sizeof(k), key_value_compare);
      if (LIKELY(entry)__builtin_expect((!!(entry)), (1)))
          return entry->value;
  }

  return NULL((void*)0);
1618}

1620const char *lwan_request_get_query_param(struct lwan_request *request,
                                       const char *key)
1622{
  return value_lookup(lwan_request_get_query_params(request), key);
1624}

1626const char *lwan_request_get_post_param(struct lwan_request *request,
                                      const char *key)
1628{
  return value_lookup(lwan_request_get_post_params(request), key);
1630}

1632const char *lwan_request_get_cookie(struct lwan_request *request,
                                  const char *key)
1634{
  return value_lookup(lwan_request_get_cookies(request), key);
1636}

1638const char *
1639lwan_request_get_header_from_helper(struct lwan_request_parser_helper *helper,
                                  const char *header)
1641{
  const size_t header_len = strlen(header);
  const size_t header_len_with_separator =
      header_len + HEADER_VALUE_SEPARATOR_LEN(sizeof(": ") - 1);

  assert(strchr(header, ':') == NULL)((void) sizeof ((strchr(header, ':') == ((void*)0)) ? 1 : 0),
 __extension__ ({ if (strchr(header, ':') == ((void*)0)) ; else
 __assert_fail ("strchr(header, ':') == NULL", "/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1646, __extension__ __PRETTY_FUNCTION__); }));

  for (size_t i = 0; i < helper->n_header_start; i++) {
      const char *start = helper->header_start[i];
      char *end = helper->header_start[i + 1] - HEADER_TERMINATOR_LEN(sizeof("\r\n") - 1);

      if (UNLIKELY((size_t)(end - start) < header_len_with_separator)__builtin_expect((((size_t)(end - start) < header_len_with_separator
)), (0)))
          continue;

      STRING_SWITCH_SMALL (start + header_len)switch (string_as_uint16(start + header_len)) {
      case STR2_INT(':', ' ')((uint16_t)((':') | (' ') << 8)):
          if (!strncasecmp(start, header, header_len)) {
              *end = '\0';
              return start + header_len_with_separator;
          }
      }
  }

  return NULL((void*)0);
1665}

1667inline const char *lwan_request_get_header(struct lwan_request *request,
                                         const char *header)
1669{
  return lwan_request_get_header_from_helper(request->helper, header);
1671}

1673const char *lwan_request_get_host(struct lwan_request *request)
1674{
  const struct lwan_request_parser_helper *helper = request->helper;

  return helper->host.len ? helper->host.value : NULL((void*)0);
1678}

1680ALWAYS_INLINEinline __attribute__((always_inline)) int
1681lwan_connection_get_fd(const struct lwan *lwan, const struct lwan_connection *conn)
1682{
  return (int)(intptr_t)(conn - lwan->conns);
1684}

1686const char *
1687lwan_request_get_remote_address_and_port(struct lwan_request *request,
                                       char buffer[static INET6_ADDRSTRLEN46],
                                       uint16_t *port)
1690{
  struct sockaddr_storage non_proxied_addr = {.ss_family = AF_UNSPEC0};
  struct sockaddr_storage *sock_addr;

  *port = 0;

  if (request->flags & REQUEST_PROXIED) {
7
←
Assuming the condition is false→
8
←
Taking false branch→
      sock_addr = (struct sockaddr_storage *)&request->proxy->from;

      if (UNLIKELY(sock_addr->ss_family == AF_UNSPEC)__builtin_expect(((sock_addr->ss_family == 0)), (0))) {
          static const char unspecified[] = "*unspecified*";

          static_assert_Static_assert(sizeof(unspecified) <= INET6_ADDRSTRLEN46,
                        "Enough space for unspecified address family");
          return memcpy(buffer, unspecified, sizeof(unspecified));
      }
  } else {
      socklen_t sock_len = sizeof(non_proxied_addr);

      sock_addr = &non_proxied_addr;

      if (UNLIKELY(getpeername(request->fd, (struct sockaddr *)sock_addr,__builtin_expect(((getpeername(request->fd, (struct sockaddr
 *)sock_addr, &sock_len) < 0)), (0))
9
←
Assuming the condition is false→
10
←
Taking false branch→
                               &sock_len) < 0)__builtin_expect(((getpeername(request->fd, (struct sockaddr
 *)sock_addr, &sock_len) < 0)), (0))) {
          return NULL((void*)0);
      }
  }

  if (sock_addr->ss_family10.1
Field 'ss_family' is not equal to AF_INET
 == AF_INET2) {
11
←
Taking false branch→
      struct sockaddr_in *sin = (struct sockaddr_in *)sock_addr;
      *port = ntohs(sin->sin_port);
      return inet_ntop(AF_INET2, &sin->sin_addr, buffer, INET6_ADDRSTRLEN46);
  }

  struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sock_addr;
  *port = ntohs(sin6->sin6_port);
12
←
1st function call argument is an uninitialized value
  return inet_ntop(AF_INET610, &sin6->sin6_addr, buffer, INET6_ADDRSTRLEN46);
1726}

1728const char *
1729lwan_request_get_remote_address(struct lwan_request *request,
                              char buffer[static INET6_ADDRSTRLEN46])
1731{
  uint16_t port;
  return lwan_request_get_remote_address_and_port(request, buffer, &port);
6
←
Calling 'lwan_request_get_remote_address_and_port'→
1734}

1736static void remove_sleep(void *data1, void *data2)
1737{
  static const enum lwan_connection_flags suspended_sleep =
      CONN_SUSPENDED | CONN_HAS_REMOVE_SLEEP_DEFER;
  struct timeouts *wheel = data1;
  struct timeout *timeout = data2;
  struct lwan_request *request =
      container_of(timeout, struct lwan_request, timeout)((struct lwan_request *) ((char *)(timeout) - __builtin_offsetof
(struct lwan_request, timeout)) + ((typeof(*(timeout)) *)0 !=
 (typeof(((struct lwan_request *)0)->timeout) *)0));

  if ((request->conn->flags & suspended_sleep) == suspended_sleep)
      timeouts_del(wheel, timeout);

  request->conn->flags &= ~CONN_HAS_REMOVE_SLEEP_DEFER;
1749}

1751void lwan_request_sleep(struct lwan_request *request, uint64_t ms)
1752{
  struct lwan_connection *conn = request->conn;
  struct timeouts *wheel = conn->thread->wheel;
  struct timespec now;
  coro_deferred defer = -1;

  /* We need to update the timer wheel right now because
   * a request might have requested to sleep a long time
   * before it was being serviced -- causing the timeout
   * to essentially be a no-op. */
  if (UNLIKELY(clock_gettime(monotonic_clock_id, &now) < 0)__builtin_expect(((clock_gettime(monotonic_clock_id, &now
) < 0)), (0)))
      lwan_status_critical("Could not get monotonic time")lwan_status_critical_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1763, __FUNCTION__, "Could not get monotonic time");
  timeouts_update(wheel, (timeout_t)(now.tv_sec * 1000 + now.tv_nsec / 1000000));

  request->timeout = (struct timeout) {};
  timeouts_add(wheel, &request->timeout, ms);

  if (!(conn->flags & CONN_HAS_REMOVE_SLEEP_DEFER)) {
      defer = coro_defer2(conn->coro, remove_sleep, wheel, &request->timeout);
      conn->flags |= CONN_HAS_REMOVE_SLEEP_DEFER;
  }

  coro_yield(conn->coro, CONN_CORO_SUSPEND);

  if (defer > 0)
      coro_defer_fire_and_disarm(conn->coro, defer);
1778}

1780ALWAYS_INLINEinline __attribute__((always_inline)) int
1781lwan_request_get_range(struct lwan_request *request, off_t *from, off_t *to)
1782{
  struct lwan_request_parser_helper *helper = request->helper;

  if (!(request->flags & REQUEST_PARSED_RANGE)) {
      parse_range(helper);
      request->flags |= REQUEST_PARSED_RANGE;
  }

  if (LIKELY(helper->range.raw.len)__builtin_expect((!!(helper->range.raw.len)), (1))) {
      *from = helper->range.from;
      *to = helper->range.to;
      return 0;
  }

  return -ENOENT2;
1797}

1799ALWAYS_INLINEinline __attribute__((always_inline)) int
1800lwan_request_get_if_modified_since(struct lwan_request *request, time_t *value)
1801{
  struct lwan_request_parser_helper *helper = request->helper;

  if (!(request->flags & REQUEST_PARSED_IF_MODIFIED_SINCE)) {
      parse_if_modified_since(helper);
      request->flags |= REQUEST_PARSED_IF_MODIFIED_SINCE;
  }

  if (LIKELY(helper->if_modified_since.raw.len)__builtin_expect((!!(helper->if_modified_since.raw.len)), (
1))) {
      *value = helper->if_modified_since.parsed;
      return 0;
  }

  return -ENOENT2;
1815}

1817ALWAYS_INLINEinline __attribute__((always_inline)) const struct lwan_value *
1818lwan_request_get_request_body(struct lwan_request *request)
1819{
  return &request->helper->body_data;
1821}

1823ALWAYS_INLINEinline __attribute__((always_inline)) const struct lwan_value *
1824lwan_request_get_content_type(struct lwan_request *request)
1825{
  return &request->helper->content_type;
1827}

1829ALWAYS_INLINEinline __attribute__((always_inline)) const struct lwan_key_value_array *
1830lwan_request_get_cookies(struct lwan_request *request)
1831{
  if (!(request->flags & REQUEST_PARSED_COOKIES)) {
      parse_cookies(request);
      request->flags |= REQUEST_PARSED_COOKIES;
  }

  return &request->helper->cookies;
1838}

1840ALWAYS_INLINEinline __attribute__((always_inline)) const struct lwan_key_value_array *
1841lwan_request_get_query_params(struct lwan_request *request)
1842{
  if (!(request->flags & REQUEST_PARSED_QUERY_STRING)) {
      parse_query_string(request);
      request->flags |= REQUEST_PARSED_QUERY_STRING;
  }

  return &request->helper->query_params;
1849}

1851ALWAYS_INLINEinline __attribute__((always_inline)) const struct lwan_key_value_array *
1852lwan_request_get_post_params(struct lwan_request *request)
1853{
  if (!(request->flags & REQUEST_PARSED_FORM_DATA)) {
      parse_form_data(request);
      request->flags |= REQUEST_PARSED_FORM_DATA;
  }

  return &request->helper->post_params;
1860}

1862ALWAYS_INLINEinline __attribute__((always_inline)) enum lwan_request_flags
1863lwan_request_get_accept_encoding(struct lwan_request *request)
1864{
  if (!(request->flags & REQUEST_PARSED_ACCEPT_ENCODING)) {
      parse_accept_encoding(request);
      request->flags |= REQUEST_PARSED_ACCEPT_ENCODING;
  }

  return request->flags & REQUEST_ACCEPT_MASK;
1871}

1873#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
1874static int useless_coro_for_fuzzing(struct coro *c __attribute__((unused)),
                                  void *data __attribute__((unused)))
1876{
  return 0;
1878}

1880static bool_Bool request_seems_complete(struct lwan_request_parser_helper *helper)
1881{
  return read_request_finalizer_from_helper(helper->buffer, helper, 1,
                                            false0) == FINALIZER_DONE;
1884}

1886__attribute__((used)) int fuzz_parse_http_request(const uint8_t *data,
                                                size_t length)
1888{
  static struct coro_switcher switcher;
  static struct coro *coro;
  static char *header_start[N_HEADER_START64];
  static char data_copy[32767] = {0};

  if (length > sizeof(data_copy))
      length = sizeof(data_copy);
  memcpy(data_copy, data, length);

  if (!coro) {
      coro = coro_new(&switcher, useless_coro_for_fuzzing, NULL((void*)0));

      lwan_job_thread_init();
      lwan_http_authorize_init();
  }

  struct lwan_request_parser_helper helper = {
      .buffer = &(struct lwan_value){.value = data_copy, .len = length},
      .header_start = header_start,
      .error_when_n_packets = 2,
  };
  struct lwan_connection conn = {.coro = coro};
  struct lwan_proxy proxy = {};
  struct lwan_request request = {
      .helper = &helper,
      .conn = &conn,
      .flags = REQUEST_ALLOW_PROXY_REQS,
      .proxy = &proxy,
  };

  /* If the finalizer isn't happy with a request, there's no point in
   * going any further with parsing it. */
  if (!request_seems_complete(&helper))
      return 0;

  /* client_read() NUL-terminates the string */
  data_copy[length - 1] = '\0';

  if (parse_http_request(&request) != HTTP_OK)
      return 0;

  off_t trash1;
  time_t trash2;
  char *trash3;
  size_t gen = coro_deferred_get_generation(coro);

  /* Only pointers were set in helper struct; actually parse them here. */
  parse_accept_encoding(&request);

  /* Requesting these items will force them to be parsed, and also
   * exercise the lookup function. */
  LWAN_NO_DISCARD(lwan_request_get_header(&request, "Non-Existing-Header"))do { __typeof__(lwan_request_get_header(&request, "Non-Existing-Header"
)) no_discard_ = lwan_request_get_header(&request, "Non-Existing-Header"
); __asm__ __volatile__("" ::"g"(no_discard_) : "memory"); } while
 (0);

  /* Usually existing short header */
  LWAN_NO_DISCARD(lwan_request_get_header(&request, "Host"))do { __typeof__(lwan_request_get_header(&request, "Host")
) no_discard_ = lwan_request_get_header(&request, "Host")
; __asm__ __volatile__("" ::"g"(no_discard_) : "memory"); } while
 (0);

  LWAN_NO_DISCARD(lwan_request_get_cookie(&request, "Non-Existing-Cookie"))do { __typeof__(lwan_request_get_cookie(&request, "Non-Existing-Cookie"
)) no_discard_ = lwan_request_get_cookie(&request, "Non-Existing-Cookie"
); __asm__ __volatile__("" ::"g"(no_discard_) : "memory"); } while
 (0);
  /* Set by some tests */
  LWAN_NO_DISCARD(lwan_request_get_cookie(&request, "FOO"))do { __typeof__(lwan_request_get_cookie(&request, "FOO"))
 no_discard_ = lwan_request_get_cookie(&request, "FOO"); __asm__
 __volatile__("" ::"g"(no_discard_) : "memory"); } while (0);

  LWAN_NO_DISCARD(do { __typeof__(lwan_request_get_query_param(&request, "Non-Existing-Query-Param"
)) no_discard_ = lwan_request_get_query_param(&request, "Non-Existing-Query-Param"
); __asm__ __volatile__("" ::"g"(no_discard_) : "memory"); } while
 (0)
      lwan_request_get_query_param(&request, "Non-Existing-Query-Param"))do { __typeof__(lwan_request_get_query_param(&request, "Non-Existing-Query-Param"
)) no_discard_ = lwan_request_get_query_param(&request, "Non-Existing-Query-Param"
); __asm__ __volatile__("" ::"g"(no_discard_) : "memory"); } while
 (0);

  LWAN_NO_DISCARD(do { __typeof__(lwan_request_get_post_param(&request, "Non-Existing-Post-Param"
)) no_discard_ = lwan_request_get_post_param(&request, "Non-Existing-Post-Param"
); __asm__ __volatile__("" ::"g"(no_discard_) : "memory"); } while
 (0)
      lwan_request_get_post_param(&request, "Non-Existing-Post-Param"))do { __typeof__(lwan_request_get_post_param(&request, "Non-Existing-Post-Param"
)) no_discard_ = lwan_request_get_post_param(&request, "Non-Existing-Post-Param"
); __asm__ __volatile__("" ::"g"(no_discard_) : "memory"); } while
 (0);

  lwan_request_get_range(&request, &trash1, &trash1);
  LWAN_NO_DISCARD(trash1)do { __typeof__(trash1) no_discard_ = trash1; __asm__ __volatile__
("" ::"g"(no_discard_) : "memory"); } while (0);

  lwan_request_get_if_modified_since(&request, &trash2);
  LWAN_NO_DISCARD(trash2)do { __typeof__(trash2) no_discard_ = trash2; __asm__ __volatile__
("" ::"g"(no_discard_) : "memory"); } while (0);

  enum lwan_http_status handshake =
      prepare_websocket_handshake(&request, &trash3);
  LWAN_NO_DISCARD(trash3)do { __typeof__(trash3) no_discard_ = trash3; __asm__ __volatile__
("" ::"g"(no_discard_) : "memory"); } while (0);
  if (handshake == HTTP_SWITCHING_PROTOCOLS)
      free(trash3);

  LWAN_NO_DISCARD(lwan_http_authorize(&request, "Fuzzy Realm", "/dev/null"))do { __typeof__(lwan_http_authorize(&request, "Fuzzy Realm"
, "/dev/null")) no_discard_ = lwan_http_authorize(&request
, "Fuzzy Realm", "/dev/null"); __asm__ __volatile__("" ::"g"(
no_discard_) : "memory"); } while (0);

  coro_deferred_run(coro, gen);

  return 0;
1972}
1973#endif

1975static inline int64_t
1976make_async_yield_value(int fd, enum lwan_connection_coro_yield event)
1977{
  return (int64_t)(((uint64_t)fd << 32 | event));
1979}

1981static inline void async_await_fd(struct coro *coro,
                                int fd,
                                enum lwan_connection_coro_yield events)
1984{
  assert(events >= CONN_CORO_ASYNC_AWAIT_READ &&((void) sizeof ((events >= CONN_CORO_ASYNC_AWAIT_READ &&
 events <= CONN_CORO_ASYNC_AWAIT_READ_WRITE) ? 1 : 0), __extension__
 ({ if (events >= CONN_CORO_ASYNC_AWAIT_READ && events
 <= CONN_CORO_ASYNC_AWAIT_READ_WRITE) ; else __assert_fail
 ("events >= CONN_CORO_ASYNC_AWAIT_READ && events <= CONN_CORO_ASYNC_AWAIT_READ_WRITE"
, "/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1986, __extension__ __PRETTY_FUNCTION__); }))
         events <= CONN_CORO_ASYNC_AWAIT_READ_WRITE)((void) sizeof ((events >= CONN_CORO_ASYNC_AWAIT_READ &&
 events <= CONN_CORO_ASYNC_AWAIT_READ_WRITE) ? 1 : 0), __extension__
 ({ if (events >= CONN_CORO_ASYNC_AWAIT_READ && events
 <= CONN_CORO_ASYNC_AWAIT_READ_WRITE) ; else __assert_fail
 ("events >= CONN_CORO_ASYNC_AWAIT_READ && events <= CONN_CORO_ASYNC_AWAIT_READ_WRITE"
, "/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1986, __extension__ __PRETTY_FUNCTION__); }));

  return (void)coro_yield(coro, make_async_yield_value(fd, events));
1989}

1991void lwan_request_await_read(struct lwan_request *r, int fd)
1992{
  return async_await_fd(r->conn->coro, fd, CONN_CORO_ASYNC_AWAIT_READ);
1994}

1996void lwan_request_await_write(struct lwan_request *r, int fd)
1997{
  return async_await_fd(r->conn->coro, fd, CONN_CORO_ASYNC_AWAIT_WRITE);
1999}

2001void lwan_request_await_read_write(struct lwan_request *r, int fd)
2002{
  return async_await_fd(r->conn->coro, fd, CONN_CORO_ASYNC_AWAIT_READ_WRITE);
2004}

2006ssize_t lwan_request_async_read_flags(
  struct lwan_request *request, int fd, void *buf, size_t len, int flags)
2008{
  while (true1) {
      ssize_t r = recv(fd, buf, len, MSG_DONTWAITMSG_DONTWAIT | MSG_NOSIGNALMSG_NOSIGNAL | flags);

      if (r < 0) {
          switch (errno(*__errno_location ())) {
          case EWOULDBLOCK11:
              lwan_request_await_read(request, fd);
              /* Fallthrough */
          case EINTR4:
              continue;
          case EPIPE32:
              return -errno(*__errno_location ());
          }
      }

      return r;
  }
2026}

2028ssize_t lwan_request_async_read(struct lwan_request *request,
                              int fd,
                              void *buf,
                              size_t len)
2032{
  return lwan_request_async_read_flags(request, fd, buf, len, 0);
2034}

2036ssize_t lwan_request_async_write(struct lwan_request *request,
                               int fd,
                               const void *buf,
                               size_t len)
2040{
  while (true1) {
      ssize_t r = send(fd, buf, len, MSG_DONTWAITMSG_DONTWAIT|MSG_NOSIGNALMSG_NOSIGNAL);

      if (r < 0) {
          switch (errno(*__errno_location ())) {
          case EWOULDBLOCK11:
              lwan_request_await_write(request, fd);
              /* Fallthrough */
          case EINTR4:
              continue;
          case EPIPE32:
              return -errno(*__errno_location ());
          }
      }

      return r;
  }
2058}

2060ssize_t lwan_request_async_writev(struct lwan_request *request,
                                int fd,
                                struct iovec *iov,
                                int iov_count)
2064{
  ssize_t total_written = 0;
  int curr_iov = 0;

  for (int tries = 10; tries;) {
      const int remaining_len = (int)(iov_count - curr_iov);
      ssize_t written;

      if (remaining_len == 1) {
          const struct iovec *vec = &iov[curr_iov];
          return lwan_request_async_write(request, fd, vec->iov_base,
                                          vec->iov_len);
      }

      written = writev(fd, iov + curr_iov, (size_t)remaining_len);
      if (UNLIKELY(written < 0)__builtin_expect(((written < 0)), (0))) {
          /* FIXME: Consider short writes as another try as well? */
          tries--;

          switch (errno(*__errno_location ())) {
          case EAGAIN11:
          case EINTR4:
              goto try_again;
          default:
              goto out;
          }
      }

      total_written += written;

      while (curr_iov < iov_count &&
             written >= (ssize_t)iov[curr_iov].iov_len) {
          written -= (ssize_t)iov[curr_iov].iov_len;
          curr_iov++;
      }

      if (curr_iov == iov_count)
          return total_written;

      iov[curr_iov].iov_base = (char *)iov[curr_iov].iov_base + written;
      iov[curr_iov].iov_len -= (size_t)written;

  try_again:
      lwan_request_await_write(request, fd);
  }

2110out:
  coro_yield(request->conn->coro, CONN_CORO_ABORT);
  __builtin_unreachable();
2113}

2115void lwan_request_foreach_header_for_cgi(struct lwan_request *request,
                                       void (*cb)(const char *header_name,
                                                  size_t header_len,
                                                  const char *value,
                                                  size_t value_len,
                                                  void *user_data),
                                       void *user_data)
2122{
  struct lwan_request_parser_helper *helper = request->helper;
  char **header_start = helper->header_start;
  size_t n_header_start = helper->n_header_start;

  for (size_t i = 0; i < n_header_start; i++) {
      const char *header = header_start[i];
      const char *next_header = header_start[i + 1];
      const char *colon = memchr(header, ':', 127 - sizeof("HTTP_: ") - 1);
      char header_name[128];
      int r;

      if (!colon)
          continue;

      const size_t header_len = (size_t)(colon - header);
      const size_t value_len = (size_t)(next_header - colon - 4);

      r = snprintf(header_name, sizeof(header_name), "HTTP_%.*s",
                   (int)header_len, header);
      if (r < 0 || r >= (int)sizeof(header_name))
          continue;

      /* FIXME: RFC7230/RFC3875 compliance */
      for (char *p = header_name; *p; p++) {
          if (isalpha(*p)((*__ctype_b_loc ())[(int) ((*p))] & (unsigned short int)
 _ISalpha))
              *p &= ~0x20;
          else if (!isdigit(*p)((*__ctype_b_loc ())[(int) ((*p))] & (unsigned short int)
 _ISdigit))
              *p = '_';
      }

      if (streq(header_name, "HTTP_PROXY")) {
          /* Mitigation for https://httpoxy.org */
          continue;
      }

      cb(header_name, header_len + sizeof("HTTP_") - 1, colon + 2, value_len,
         user_data);
  }
2161}