/usr/src/bin/ksh/var.c

Bug Summary

File:	src/bin/ksh/var.c
Warning:	line 579, column 15 Null pointer passed as 1st argument to string length function
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name var.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/bin/ksh/obj -resource-dir /usr/local/lib/clang/13.0.0 -D EMACS -D VI -I . -I /usr/src/bin/ksh -I /usr/src/bin/ksh/../../lib/libc/gen -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/bin/ksh/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/bin/ksh/var.c
1/*	$OpenBSD: var.c,v 1.72 2021/03/05 15:22:03 zhuk Exp $	*/

3#include <sys/stat.h>
4#include <sys/time.h>

6#include <ctype.h>
7#include <errno(*__errno()).h>
8#include <inttypes.h>
9#include <limits.h>
10#include <stdlib.h>
11#include <string.h>
12#include <time.h>
13#include <unistd.h>
14#ifndef SMALL
15# include <term.h>
16# include <curses.h>
17#endif

19#include "sh.h"

21/*
* Variables
*
* WARNING: unreadable code, needs a rewrite
*
* if (flag&INTEGER), val.i contains integer value, and type contains base.
* otherwise, (val.s + type) contains string value.
* if (flag&EXPORT), val.s contains "name=value" for E-Z exporting.
*/
30static	struct tbl vtemp;
31static	struct table specials;
32static char	*formatstr(struct tbl *, const char *);
33static void	export(struct tbl *, const char *);
34static int	special(const char *);
35static void	unspecial(const char *);
36static void	getspec(struct tbl *);
37static void	setspec(struct tbl *);
38static void	unsetspec(struct tbl *);
39static struct tbl *arraysearch(struct tbl *, int);

41/*
* create a new block for function calls and simple commands
* assume caller has allocated and set up genv->loc
*/
45void
46newblock(void)
47{
struct block *l;
static char *const empty[] = {null};

l = alloc(sizeof(struct block), ATEMP&genv->area);
l->flags = 0;
ainit(&l->area); /* todo: could use genv->area (l->area => l->areap) */
if (!genv->loc) {
l->argc = 0;
l->argv = (char **) empty;
} else {
l->argc = genv->loc->argc;
l->argv = genv->loc->argv;
}
l->exit = l->error = NULL((void*)0);
ktinit(&l->vars, &l->area, 0);
ktinit(&l->funs, &l->area, 0);
l->next = genv->loc;
genv->loc = l;
66}

68/*
* pop a block handling special variables
*/
71void
72popblock(void)
73{
struct block *l = genv->loc;
struct tbl *vp, **vpp = l->vars.tbls, *vq;
int i;

genv->loc = l->next;	/* pop block */
for (i = l->vars.size; --i >= 0; )
if ((vp = *vpp++) != NULL((void*)0) && (vp->flag&SPECIAL(1<<(8)))) {
	if ((vq = global(vp->name))->flag & ISSET(1<<(2)))
		setspec(vq);
	else
		unsetspec(vq);
}
if (l->flags & BF_DOGETOPTS(1<<(0)))
user_opt = l->getopts_state;
afreeall(&l->area);
afree(l, ATEMP&genv->area);
90}

92/* called by main() to initialize variable data structures */
93void
94initvar(void)
95{
static const struct {
const char *name;
int v;
} names[] = {
{ "COLUMNS",		V_COLUMNS14 },
{ "IFS",		V_IFS2 },
{ "OPTIND",		V_OPTIND4 },
{ "PATH",		V_PATH1 },
{ "POSIXLY_CORRECT",	V_POSIXLY_CORRECT15 },
{ "TMPDIR",		V_TMPDIR17 },
{ "HISTCONTROL",	V_HISTCONTROL9 },
{ "HISTFILE",		V_HISTFILE11 },
{ "HISTSIZE",		V_HISTSIZE10 },
{ "EDITOR",		V_EDITOR13 },
{ "VISUAL",		V_VISUAL12 },
{ "MAIL",		V_MAIL5 },
{ "MAILCHECK",		V_MAILCHECK7 },
{ "MAILPATH",		V_MAILPATH6 },
{ "RANDOM",		V_RANDOM8 },
{ "SECONDS",		V_SECONDS3 },
{ "TMOUT",		V_TMOUT16 },
{ "LINENO",		V_LINENO18 },
{ "TERM",		V_TERM19 },
{ NULL((void*)0),	0 }
};
int i;
struct tbl *tp;

ktinit(&specials, APERM&aperm, 32); /* must be 2^n (currently 19 specials) */
for (i = 0; names[i].name; i++) {
tp = ktenter(&specials, names[i].name, hash(names[i].name));
tp->flag = DEFINED(1<<(1))|ISSET(1<<(2));
tp->type = names[i].v;
}
130}

132/* Used to calculate an array index for global()/local().  Sets *arrayp to
* non-zero if this is an array, sets *valp to the array index, returns
* the basename of the array.
*/
136static const char *
137array_index_calc(const char *n, bool_Bool *arrayp, int *valp)
138{
const char *p;
int len;

*arrayp = false0;
p = skip_varname(n, false0);
if (p != n && *p == '[' && (len = array_ref_len(p))) {
char *sub, *tmp;
int64_t rval;

/* Calculate the value of the subscript */
*arrayp = true1;
tmp = str_nsave(p+1, len-2, ATEMP&genv->area);
sub = substitute(tmp, 0);
afree(tmp, ATEMP&genv->area);
n = str_nsave(n, p - n, ATEMP&genv->area);
evaluate(sub, &rval, KSH_UNWIND_ERROR0x0, true1);
if (rval < 0 || rval > INT_MAX2147483647)
	errorf("%s: subscript %" PRIi64"lli" " out of range",
	    n, rval);
*valp = rval;
afree(sub, ATEMP&genv->area);
}
return n;
162}

164/*
* Search for variable, if not found create globally.
*/
167struct tbl *
168global(const char *n)
169{
struct block *l = genv->loc;
struct tbl *vp;
long	 num;
int c;
unsigned int h;
bool_Bool	 array;
int	 val;

/* Check to see if this is an array */
n = array_index_calc(n, &array, &val);
h = hash(n);
c = (unsigned char)n[0];
if (!letter(c)!!(ctypes[(unsigned char)(c)]&((1<<(0))))) {
if (array)
	errorf("bad substitution");
vp = &vtemp;
vp->flag = DEFINED(1<<(1));
vp->type = 0;
vp->areap = ATEMP&genv->area;
*vp->name = c;
if (digit(c)isdigit((unsigned char)(c))) {
	errno(*__errno()) = 0;
	num = strtol(n, NULL((void*)0), 10);
	if (errno(*__errno()) == 0 && num <= l->argc)
		/* setstr can't fail here */
		setstr(vp, l->argv[num], KSH_RETURN_ERROR0x1);
	vp->flag |= RDONLY(1<<(10));
	return vp;
}
vp->flag |= RDONLY(1<<(10));
if (n[1] != '\0')
	return vp;
vp->flag |= ISSET(1<<(2))|INTEGER(1<<(9));
switch (c) {
case '$':
	vp->val.i = kshpid;
	break;
case '!':
	/* If no job, expand to nothing */
	if ((vp->val.i = j_async()) == 0)
		vp->flag &= ~(ISSET(1<<(2))|INTEGER(1<<(9)));
	break;
case '?':
	vp->val.i = exstat;
	break;
case '#':
	vp->val.i = l->argc;
	break;
case '-':
	vp->flag &= ~INTEGER(1<<(9));
	vp->val.s = getoptions();
	break;
default:
	vp->flag &= ~(ISSET(1<<(2))|INTEGER(1<<(9)));
}
return vp;
}
for (l = genv->loc; ; l = l->next) {
vp = ktsearch(&l->vars, n, h);
if (vp != NULL((void*)0)) {
	if (array)
		return arraysearch(vp, val);
	else
		return vp;
}
if (l->next == NULL((void*)0))
	break;
}
vp = ktenter(&l->vars, n, h);
if (array)
vp = arraysearch(vp, val);
vp->flag |= DEFINED(1<<(1));
if (special(n))
vp->flag |= SPECIAL(1<<(8));
return vp;
245}

247/*
* Search for local variable, if not found create locally.
*/
250struct tbl *
251local(const char *n, bool_Bool copy)
252{
struct block *l = genv->loc;
struct tbl *vp;
unsigned int h;
bool_Bool	 array;
int	 val;

/* Check to see if this is an array */
n = array_index_calc(n, &array, &val);
h = hash(n);
if (!letter(*n)!!(ctypes[(unsigned char)(*n)]&((1<<(0))))) {
vp = &vtemp;
vp->flag = DEFINED(1<<(1))|RDONLY(1<<(10));
vp->type = 0;
vp->areap = ATEMP&genv->area;
return vp;
}
vp = ktenter(&l->vars, n, h);
if (copy && !(vp->flag & DEFINED(1<<(1)))) {
struct block *ll = l;
struct tbl *vq = NULL((void*)0);

while ((ll = ll->next) && !(vq = ktsearch(&ll->vars, n, h)))
	;
if (vq) {
	vp->flag |= vq->flag &
	    (EXPORT(1<<(3)) | INTEGER(1<<(9)) | RDONLY(1<<(10)) | LJUST(1<<(14)) | RJUST(1<<(15)) |
	    ZEROFIL(1<<(16)) | LCASEV(1<<(17)) | UCASEV_AL(1<<(18)) | INT_U(1<<(19)) | INT_L(1<<(20)));
	if (vq->flag & INTEGER(1<<(9)))
		vp->type = vq->type;
	vp->u2.field = vq->u2.field;
}
}
if (array)
vp = arraysearch(vp, val);
vp->flag |= DEFINED(1<<(1));
if (special(n))
vp->flag |= SPECIAL(1<<(8));
return vp;
291}

293/* get variable string value */
294char *
295str_val(struct tbl *vp)
296{
char *s;

if ((vp->flag&SPECIAL(1<<(8))))
getspec(vp);
if (!(vp->flag&ISSET(1<<(2))))
s = null;		/* special to dollar() */
else if (!(vp->flag&INTEGER(1<<(9))))	/* string source */
s = vp->val.s + vp->type;
else {				/* integer source */
/* worst case number length is when base=2, so use
 * minus base # number BITS(int64_t) NUL */
char strbuf[1 + 2 + 1 + BITS(int64_t)(8 * sizeof(int64_t)) + 1];
const char *digits = (vp->flag & UCASEV_AL(1<<(18))) ?
    "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" :
    "0123456789abcdefghijklmnopqrstuvwxyz";
uint64_t n;
unsigned int base;

s = strbuf + sizeof(strbuf);
if (vp->flag & INT_U(1<<(19)))
	n = (uint64_t) vp->val.i;
else
	n = (vp->val.i < 0) ? -vp->val.i : vp->val.i;
base = (vp->type == 0) ? 10 : vp->type;
if (base < 2 || base > strlen(digits))
	base = 10;

*--s = '\0';
do {
	*--s = digits[n % base];
	n /= base;
} while (n != 0);
if (base != 10) {
	*--s = '#';
	*--s = digits[base % 10];
	if (base >= 10)
		*--s = digits[base / 10];
}
if (!(vp->flag & INT_U(1<<(19))) && vp->val.i < 0)
	*--s = '-';
if (vp->flag & (RJUST(1<<(15))|LJUST(1<<(14)))) /* case already dealt with */
	s = formatstr(vp, s);
else
	s = str_save(s, ATEMP&genv->area);
}
return s;
343}

345/* get variable integer value, with error checking */
346int64_t
347intval(struct tbl *vp)
348{
int64_t num;
int base;

base = getint(vp, &num, false0);
if (base == -1)
/* XXX check calls - is error here ok by POSIX? */
errorf("%s: bad number", str_val(vp));
return num;
357}

359/* set variable to string value */
360int
361setstr(struct tbl *vq, const char *s, int error_ok)
362{
const char *fs = NULL((void*)0);
int no_ro_check = error_ok & KSH_IGNORE_RDONLY0x4;
error_ok &= ~KSH_IGNORE_RDONLY0x4;
if ((vq->flag & RDONLY(1<<(10))) && !no_ro_check) {
16
←
Assuming the condition is false→
warningf(true1, "%s: is read only", vq->name);
if (!error_ok)
	errorf(NULL((void*)0));
return 0;
}
if (!(vq->flag&INTEGER(1<<(9)))) { /* string dest */
17
←
Assuming the condition is true→
18
←
Taking true branch→
if ((vq->flag&ALLOC(1<<(0)))) {
19
←
Assuming the condition is false→
20
←
Taking false branch→
	/* debugging */
	if (s >= vq->val.s &&
	    s <= vq->val.s + strlen(vq->val.s))
		internal_errorf("%s: %s=%s: assigning to self",
		    __func__, vq->name, s);
	afree(vq->val.s, vq->areap);
}
vq->flag &= ~(ISSET(1<<(2))|ALLOC(1<<(0)));
vq->type = 0;
if (s && (vq->flag & (UCASEV_AL(1<<(18))|LCASEV(1<<(17))|LJUST(1<<(14))|RJUST(1<<(15)))))
21
←
Assuming 's' is null→
	fs = s = formatstr(vq, s);
if ((vq->flag&EXPORT(1<<(3))))
22
←
Assuming the condition is true→
23
←
Taking true branch→
	export(vq, s);
24
←
Passing null pointer value via 2nd parameter 'val'→
25
←
Calling 'export'→
else {
	vq->val.s = str_save(s, vq->areap);
	vq->flag |= ALLOC(1<<(0));
}
} else {		/* integer dest */
if (!v_evaluate(vq, s, error_ok, true1))
	return 0;
}
vq->flag |= ISSET(1<<(2));
if ((vq->flag&SPECIAL(1<<(8))))
setspec(vq);
afree((void *)fs, ATEMP&genv->area);
return 1;
400}

402/* set variable to integer */
403void
404setint(struct tbl *vq, int64_t n)
405{
if (!(vq->flag&INTEGER(1<<(9)))) {
struct tbl *vp = &vtemp;
vp->flag = (ISSET(1<<(2))|INTEGER(1<<(9)));
vp->type = 0;
vp->areap = ATEMP&genv->area;
vp->val.i = n;
/* setstr can't fail here */
setstr(vq, str_val(vp), KSH_RETURN_ERROR0x1);
} else
vq->val.i = n;
vq->flag |= ISSET(1<<(2));
if ((vq->flag&SPECIAL(1<<(8))))
setspec(vq);
419}

421int
422getint(struct tbl *vp, int64_t *nump, bool_Bool arith)
423{
char *s;
int c;
int base, neg;
int have_base = 0;
int64_t num;

if (vp->flag&SPECIAL(1<<(8)))
getspec(vp);
/* XXX is it possible for ISSET to be set and val.s to be 0? */
if (!(vp->flag&ISSET(1<<(2))) || (!(vp->flag&INTEGER(1<<(9))) && vp->val.s == NULL((void*)0)))
return -1;
if (vp->flag&INTEGER(1<<(9))) {
*nump = vp->val.i;
return vp->type;
}
s = vp->val.s + vp->type;
if (s == NULL((void*)0))	/* redundant given initial test */
s = null;
base = 10;
num = 0;
neg = 0;
if (arith && *s == '0' && *(s+1)) {
s++;
if (*s == 'x' || *s == 'X') {
	s++;
	base = 16;
} else if (vp->flag & ZEROFIL(1<<(16))) {
	while (*s == '0')
		s++;
} else
	base = 8;
have_base++;
}
for (c = (unsigned char)*s++; c ; c = (unsigned char)*s++) {
if (c == '-') {
	neg++;
} else if (c == '#') {
	base = (int) num;
	if (have_base || base < 2 || base > 36)
		return -1;
	num = 0;
	have_base = 1;
} else if (letnum(c)(!!(ctypes[(unsigned char)(c)]&((1<<(0)))) || isdigit
((unsigned char)(c)))) {
	if (isdigit(c))
		c -= '0';
	else if (islower(c))
		c -= 'a' - 10; /* todo: assumes ascii */
	else if (isupper(c))
		c -= 'A' - 10; /* todo: assumes ascii */
	else
		c = -1; /* _: force error */
	if (c < 0 || c >= base)
		return -1;
	num = num * base + c;
} else
	return -1;
}
if (neg)
num = -num;
*nump = num;
return base;
485}

487/* convert variable vq to integer variable, setting its value from vp
* (vq and vp may be the same)
*/
490struct tbl *
491setint_v(struct tbl *vq, struct tbl *vp, bool_Bool arith)
492{
int base;
int64_t num;

if ((base = getint(vp, &num, arith)) == -1)
return NULL((void*)0);
if (!(vq->flag & INTEGER(1<<(9))) && (vq->flag & ALLOC(1<<(0)))) {
vq->flag &= ~ALLOC(1<<(0));
afree(vq->val.s, vq->areap);
}
vq->val.i = num;
if (vq->type == 0) /* default base */
vq->type = base;
vq->flag |= ISSET(1<<(2))|INTEGER(1<<(9));
if (vq->flag&SPECIAL(1<<(8)))
setspec(vq);
return vq;
509}

511static char *
512formatstr(struct tbl *vp, const char *s)
513{
int olen, nlen;
char *p, *q;

olen = strlen(s);

if (vp->flag & (RJUST(1<<(15))|LJUST(1<<(14)))) {
if (!vp->u2.field)	/* default field width */
	vp->u2.field = olen;
nlen = vp->u2.field;
} else
nlen = olen;

p = alloc(nlen + 1, ATEMP&genv->area);
if (vp->flag & (RJUST(1<<(15))|LJUST(1<<(14)))) {
int slen;

if (vp->flag & RJUST(1<<(15))) {
	const char *r = s + olen;
	/* strip trailing spaces (at&t ksh uses r[-1] == ' ') */
	while (r > s && isspace((unsigned char)r[-1]))
		--r;
	slen = r - s;
	if (slen > vp->u2.field) {
		s += slen - vp->u2.field;
		slen = vp->u2.field;
	}
	shf_snprintf(p, nlen + 1,
		((vp->flag & ZEROFIL(1<<(16))) && digit(*s)isdigit((unsigned char)(*s))) ?
			  "%0*s%.*s" : "%*s%.*s",
		vp->u2.field - slen, null, slen, s);
} else {
	/* strip leading spaces/zeros */
	while (isspace((unsigned char)*s))
		s++;
	if (vp->flag & ZEROFIL(1<<(16)))
		while (*s == '0')
			s++;
	shf_snprintf(p, nlen + 1, "%-*.*s",
		vp->u2.field, vp->u2.field, s);
}
} else
memcpy(p, s, olen + 1);

if (vp->flag & UCASEV_AL(1<<(18))) {
for (q = p; *q; q++)
	if (islower((unsigned char)*q))
		*q = toupper((unsigned char)*q);
} else if (vp->flag & LCASEV(1<<(17))) {
for (q = p; *q; q++)
	if (isupper((unsigned char)*q))
		*q = tolower((unsigned char)*q);
}

return p;
568}

570/*
* make vp->val.s be "name=value" for quick exporting.
*/
573static void
574export(struct tbl *vp, const char *val)
575{
char *xp;
char *op = (vp->flag&ALLOC(1<<(0))) ? vp->val.s : NULL((void*)0);
26
←
Assuming the condition is false→
27
←
'?' condition is false→
int namelen = strlen(vp->name);
int vallen = strlen(val) + 1;
28
←
Null pointer passed as 1st argument to string length function

vp->flag |= ALLOC(1<<(0));
xp = alloc(namelen + 1 + vallen, vp->areap);
memcpy(vp->val.s = xp, vp->name, namelen);
xp += namelen;
*xp++ = '=';
vp->type = xp - vp->val.s; /* offset to value */
memcpy(xp, val, vallen);
afree(op, vp->areap);
589}

591/*
* lookup variable (according to (set&LOCAL)),
* set its attributes (INTEGER, RDONLY, EXPORT, TRACE, LJUST, RJUST, ZEROFIL,
* LCASEV, UCASEV_AL), and optionally set its value if an assignment.
*/
596struct tbl *
597typeset(const char *var, int set, int clr, int field, int base)
598{
struct tbl *vp;
struct tbl *vpbase, *t;
char *tvar;
const char *val;

/* check for valid variable name, search for value */
val = skip_varname(var, false0);
if (val == var)
return NULL((void*)0);
if (*val == '[') {
int len;

len = array_ref_len(val);
if (len == 0)
	return NULL((void*)0);
/* IMPORT is only used when the shell starts up and is
 * setting up its environment.  Allow only simple array
 * references at this time since parameter/command substitution
 * is preformed on the [expression], which would be a major
 * security hole.
 */
if (set & IMPORT(1<<(21))) {
	int i;
	for (i = 1; i < len - 1; i++)
		if (!digit(val[i])isdigit((unsigned char)(val[i])))
			return NULL((void*)0);
}
val += len;
}
if (*val == '=')
tvar = str_nsave(var, val++ - var, ATEMP&genv->area);
else {
/* Importing from original environment: must have an = */
if (set & IMPORT(1<<(21)))
	return NULL((void*)0);
tvar = (char *) var;
val = NULL((void*)0);
}

/* Prevent typeset from creating a local PATH/ENV/SHELL */
if (Flag(FRESTRICTED)(shell_flags[(int) (FRESTRICTED)]) && (strcmp(tvar, "PATH") == 0 ||
   strcmp(tvar, "ENV") == 0 || strcmp(tvar, "SHELL") == 0))
errorf("%s: restricted", tvar);

vp = (set&LOCAL(1<<(11))) ? local(tvar, (set & LOCAL_COPY(1<<(22))) ? true1 : false0) :
   global(tvar);
set &= ~(LOCAL(1<<(11))|LOCAL_COPY(1<<(22)));

vpbase = (vp->flag & ARRAY(1<<(13))) ? global(arrayname(tvar)) : vp;

/* only allow export flag to be set.  at&t ksh allows any attribute to
* be changed, which means it can be truncated or modified
* (-L/-R/-Z/-i).
*/
if ((vpbase->flag&RDONLY(1<<(10))) &&
   (val || clr || (set & ~EXPORT(1<<(3)))))
/* XXX check calls - is error here ok by POSIX? */
errorf("%s: is read only", tvar);
if (val)
afree(tvar, ATEMP&genv->area);

/* most calls are with set/clr == 0 */
if (set | clr) {
int ok = 1;
/* XXX if x[0] isn't set, there will be problems: need to have
 * one copy of attributes for arrays...
 */
for (t = vpbase; t; t = t->u.array) {
	int fake_assign;
	int error_ok = KSH_RETURN_ERROR0x1;
	char *s = NULL((void*)0);
	char *free_me = NULL((void*)0);

	fake_assign = (t->flag & ISSET(1<<(2))) && (!val || t != vp) &&
	    ((set & (UCASEV_AL(1<<(18))|LCASEV(1<<(17))|LJUST(1<<(14))|RJUST(1<<(15))|ZEROFIL(1<<(16)))) ||
	    ((t->flag & INTEGER(1<<(9))) && (clr & INTEGER(1<<(9)))) ||
	    (!(t->flag & INTEGER(1<<(9))) && (set & INTEGER(1<<(9)))));
	if (fake_assign) {
		if (t->flag & INTEGER(1<<(9))) {
			s = str_val(t);
			free_me = NULL((void*)0);
		} else {
			s = t->val.s + t->type;
			free_me = (t->flag & ALLOC(1<<(0))) ? t->val.s :
			    NULL((void*)0);
		}
		t->flag &= ~ALLOC(1<<(0));
	}
	if (!(t->flag & INTEGER(1<<(9))) && (set & INTEGER(1<<(9)))) {
		t->type = 0;
		t->flag &= ~ALLOC(1<<(0));
	}
	if (!(t->flag & RDONLY(1<<(10))) && (set & RDONLY(1<<(10)))) {
		/* allow var to be initialized read-only */
		error_ok |= KSH_IGNORE_RDONLY0x4;
	}
	t->flag = (t->flag | set) & ~clr;
	/* Don't change base if assignment is to be done,
	 * in case assignment fails.
	 */
	if ((set & INTEGER(1<<(9))) && base > 0 && (!val || t != vp))
		t->type = base;
	if (set & (LJUST(1<<(14))|RJUST(1<<(15))|ZEROFIL(1<<(16))))
		t->u2.field = field;
	if (fake_assign) {
		if (!setstr(t, s, error_ok)) {
			/* Somewhat arbitrary action here:
			 * zap contents of variable, but keep
			 * the flag settings.
			 */
			ok = 0;
			if (t->flag & INTEGER(1<<(9)))
				t->flag &= ~ISSET(1<<(2));
			else {
				if (t->flag & ALLOC(1<<(0)))
					afree(t->val.s, t->areap);
				t->flag &= ~(ISSET(1<<(2))|ALLOC(1<<(0)));
				t->type = 0;
			}
		}
		afree(free_me, t->areap);
	}
}
if (!ok)
    errorf(NULL((void*)0));
}

if (val != NULL((void*)0)) {
if (vp->flag&INTEGER(1<<(9))) {
	/* do not zero base before assignment */
	setstr(vp, val, KSH_UNWIND_ERROR0x0 | KSH_IGNORE_RDONLY0x4);
	/* Done after assignment to override default */
	if (base > 0)
		vp->type = base;
} else
	/* setstr can't fail (readonly check already done) */
	setstr(vp, val, KSH_RETURN_ERROR0x1 | KSH_IGNORE_RDONLY0x4);
}

/* only x[0] is ever exported, so use vpbase */
if ((vpbase->flag&EXPORT(1<<(3))) && !(vpbase->flag&INTEGER(1<<(9))) &&
   vpbase->type == 0)
export(vpbase, (vpbase->flag&ISSET(1<<(2))) ? vpbase->val.s : null);

return vp;
744}

746/* Unset a variable.  array_ref is set if there was an array reference in
* the name lookup (eg, x[2]).
*/
749void
750unset(struct tbl *vp, int array_ref)
751{
if (vp->flag & ALLOC(1<<(0)))
afree(vp->val.s, vp->areap);
if ((vp->flag & ARRAY(1<<(13))) && !array_ref) {
struct tbl *a, *tmp;

/* Free up entire array */
for (a = vp->u.array; a; ) {
	tmp = a;
	a = a->u.array;
	if (tmp->flag & ALLOC(1<<(0)))
		afree(tmp->val.s, tmp->areap);
	afree(tmp, tmp->areap);
}
vp->u.array = NULL((void*)0);
}
/* If foo[0] is being unset, the remainder of the array is kept... */
vp->flag &= SPECIAL(1<<(8)) | (array_ref ? ARRAY(1<<(13))|DEFINED(1<<(1)) : 0);
if (vp->flag & SPECIAL(1<<(8)))
unsetspec(vp);	/* responsible for `unspecial'ing var */
771}

773/* return a pointer to the first char past a legal variable name (returns the
* argument if there is no legal name, returns * a pointer to the terminating
* null if whole string is legal).
*/
777char *
778skip_varname(const char *s, int aok)
779{
int alen;

if (s && letter(*s)!!(ctypes[(unsigned char)(*s)]&((1<<(0))))) {
while (*++s && letnum(*s)(!!(ctypes[(unsigned char)(*s)]&((1<<(0)))) || isdigit
((unsigned char)(*s))))
	;
if (aok && *s == '[' && (alen = array_ref_len(s)))
	s += alen;
}
return (char *) s;
789}

791/* Return a pointer to the first character past any legal variable name.  */
792char *
793skip_wdvarname(const char *s,
  int aok)				/* skip array de-reference? */
795{
if (s[0] == CHAR1 && letter(s[1])!!(ctypes[(unsigned char)(s[1])]&((1<<(0))))) {
do {
	s += 2;
} while (s[0] == CHAR1 && letnum(s[1])(!!(ctypes[(unsigned char)(s[1])]&((1<<(0)))) || isdigit
((unsigned char)(s[1]))));
if (aok && s[0] == CHAR1 && s[1] == '[') {
	/* skip possible array de-reference */
	const char *p = s;
	char c;
	int depth = 0;

	while (1) {
		if (p[0] != CHAR1)
			break;
		c = p[1];
		p += 2;
		if (c == '[')
			depth++;
		else if (c == ']' && --depth == 0) {
			s = p;
			break;
		}
	}
}
}
return (char *) s;
821}

823/* Check if coded string s is a variable name */
824int
825is_wdvarname(const char *s, int aok)
826{
char *p = skip_wdvarname(s, aok);

return p != s && p[0] == EOS0;
830}

832/* Check if coded string s is a variable assignment */
833int
834is_wdvarassign(const char *s)
835{
char *p = skip_wdvarname(s, true1);

return p != s && p[0] == CHAR1 && p[1] == '=';
839}

841/*
* Make the exported environment from the exported names in the dictionary.
*/
844char **
845makenv(void)
846{
struct block *l;
XPtrV env;
struct tbl *vp, **vpp;
int i;

XPinit(env, 64)do { void **vp__; vp__ = areallocarray(((void*)0), 64, sizeof
(void *), &genv->area); (env).cur = (env).beg = vp__; (
env).end = vp__ + 64; } while (0);
1
Loop condition is false.  Exiting loop→
for (l = genv->loc; l != NULL((void*)0); l = l->next)
2
←
Assuming 'l' is not equal to NULL→
3
←
Loop condition is true.  Entering loop body→
for (vpp = l->vars.tbls, i = l->vars.size; --i >= 0; )
4
←
Assuming the condition is true→
5
←
Loop condition is true.  Entering loop body→
	if ((vp = *vpp++) != NULL((void*)0) &&
6
←
Assuming the condition is true→
8
←
Taking true branch→
	    (vp->flag&(ISSET(1<<(2))|EXPORT(1<<(3)))) == (ISSET(1<<(2))|EXPORT(1<<(3)))) {
7
←
Assuming the condition is true→
		struct block *l2;
		struct tbl *vp2;
		unsigned int h = hash(vp->name);

		/* unexport any redefined instances */
		for (l2 = l->next; l2 != NULL((void*)0); l2 = l2->next) {
9
←
Assuming 'l2' is equal to NULL→
10
←
Loop condition is false. Execution continues on line 867→
			vp2 = ktsearch(&l2->vars, vp->name, h);
			if (vp2 != NULL((void*)0))
				vp2->flag &= ~EXPORT(1<<(3));
		}
		if ((vp->flag&INTEGER(1<<(9)))) {
11
←
Assuming the condition is true→
12
←
Taking true branch→
			/* integer to string */
			char *val;
			val = str_val(vp);
13
←
Value assigned to 'val'→
			vp->flag &= ~(INTEGER(1<<(9))|RDONLY(1<<(10)));
			/* setstr can't fail here */
			setstr(vp, val, KSH_RETURN_ERROR0x1);
14
←
Passing value via 2nd parameter 's'→
15
←
Calling 'setstr'→
		}
		XPput(env, vp->val.s)do { if ((env).cur >= (env).end) { int n = ((env).cur - (env
).beg); (env).beg = areallocarray((env).beg, n, 2 * sizeof(void
 *), &genv->area); (env).cur = (env).beg + n; (env).end
 = (env).cur + n; } *(env).cur++ = (vp->val.s); } while (0
);
	}
XPput(env, NULL)do { if ((env).cur >= (env).end) { int n = ((env).cur - (env
).beg); (env).beg = areallocarray((env).beg, n, 2 * sizeof(void
 *), &genv->area); (env).cur = (env).beg + n; (env).end
 = (env).cur + n; } *(env).cur++ = (((void*)0)); } while (0);
return (char **) XPclose(env)areallocarray((env).beg, ((env).cur - (env).beg), sizeof(void
 *), &genv->area);
879}

881/*
* Called after a fork in parent to bump the random number generator.
* Done to ensure children will not get the same random number sequence
* if the parent doesn't use $RANDOM.
*/
886void
887change_random(void)
888{
rand();
890}

892/*
* handle special variables with side effects - PATH, SECONDS.
*/

896/* Test if name is a special parameter */
897static int
898special(const char *name)
899{
struct tbl *tp;

tp = ktsearch(&specials, name, hash(name));
return tp && (tp->flag & ISSET(1<<(2))) ? tp->type : V_NONE0;
904}

906/* Make a variable non-special */
907static void
908unspecial(const char *name)
909{
struct tbl *tp;

tp = ktsearch(&specials, name, hash(name));
if (tp)
ktdelete(tp);
915}

917static	struct	timespec seconds;	/* time SECONDS last set */
918static	int	user_lineno;		/* what user set $LINENO to */

920static void
921getspec(struct tbl *vp)
922{
switch (special(vp->name)) {
case V_SECONDS3:
vp->flag &= ~SPECIAL(1<<(8));
/* On start up the value of SECONDS is used before seconds
 * has been set - don't do anything in this case
 * (see initcoms[] in main.c).
 */
if (vp->flag & ISSET(1<<(2))) {
	struct timespec difference, now;

	clock_gettime(CLOCK_MONOTONIC3, &now);
	timespecsub(&now, &seconds, &difference)do { (&difference)->tv_sec = (&now)->tv_sec - (
&seconds)->tv_sec; (&difference)->tv_nsec = (&
now)->tv_nsec - (&seconds)->tv_nsec; if ((&difference
)->tv_nsec < 0) { (&difference)->tv_sec--; (&
difference)->tv_nsec += 1000000000L; } } while (0);
	setint(vp, (int64_t)difference.tv_sec);
}
vp->flag |= SPECIAL(1<<(8));
break;
case V_RANDOM8:
vp->flag &= ~SPECIAL(1<<(8));
setint(vp, (int64_t) (rand() & 0x7fff));
vp->flag |= SPECIAL(1<<(8));
break;
case V_HISTSIZE10:
vp->flag &= ~SPECIAL(1<<(8));
setint(vp, (int64_t) histsize);
vp->flag |= SPECIAL(1<<(8));
break;
case V_OPTIND4:
vp->flag &= ~SPECIAL(1<<(8));
setint(vp, (int64_t) user_opt.uoptind);
vp->flag |= SPECIAL(1<<(8));
break;
case V_LINENO18:
vp->flag &= ~SPECIAL(1<<(8));
setint(vp, (int64_t) current_lineno + user_lineno);
vp->flag |= SPECIAL(1<<(8));
break;
}
960}

962static void
963setspec(struct tbl *vp)
964{
char *s;

switch (special(vp->name)) {
case V_PATH1:
afree(search_path, APERM&aperm);
search_path = str_save(str_val(vp), APERM&aperm);
flushcom(1);	/* clear tracked aliases */
break;
case V_IFS2:
setctypes(s = str_val(vp), C_IFS(1<<(7)));
ifs0 = *s;
break;
case V_OPTIND4:
vp->flag &= ~SPECIAL(1<<(8));
getopts_reset((int) intval(vp));
vp->flag |= SPECIAL(1<<(8));
break;
case V_POSIXLY_CORRECT15:
change_flag(FPOSIX, OF_SPECIAL0x04, 1);
break;
case V_TMPDIR17:
afree(tmpdir, APERM&aperm);
tmpdir = NULL((void*)0);
/* Use tmpdir iff it is an absolute path, is writable and
 * searchable and is a directory...
 */
{
	struct stat statb;

	s = str_val(vp);
	if (s[0] == '/' && access(s, W_OK0x02|X_OK0x01) == 0 &&
	    stat(s, &statb) == 0 && S_ISDIR(statb.st_mode)((statb.st_mode & 0170000) == 0040000))
		tmpdir = str_save(s, APERM&aperm);
}
break;
case V_HISTCONTROL9:
sethistcontrol(str_val(vp));
break;
case V_HISTSIZE10:
vp->flag &= ~SPECIAL(1<<(8));
sethistsize((int) intval(vp));
vp->flag |= SPECIAL(1<<(8));
break;
case V_HISTFILE11:
sethistfile(str_val(vp));
break;
case V_VISUAL12:
set_editmode(str_val(vp));
break;
case V_EDITOR13:
if (!(global("VISUAL")->flag & ISSET(1<<(2))))
	set_editmode(str_val(vp));
break;
case V_COLUMNS14:
{
	int64_t l;

	if (getint(vp, &l, false0) == -1) {
		x_cols = MIN_COLS(2 + 7 + 3);
		break;
	}
	if (l <= MIN_COLS(2 + 7 + 3) || l > INT_MAX2147483647)
		x_cols = MIN_COLS(2 + 7 + 3);
	else
		x_cols = l;
}
break;
case V_MAIL5:
mbset(str_val(vp));
break;
case V_MAILPATH6:
mpset(str_val(vp));
break;
case V_MAILCHECK7:
vp->flag &= ~SPECIAL(1<<(8));
mcset(intval(vp));
vp->flag |= SPECIAL(1<<(8));
break;
case V_RANDOM8:
vp->flag &= ~SPECIAL(1<<(8));
srand_deterministic((unsigned int)intval(vp));
vp->flag |= SPECIAL(1<<(8));
break;
case V_SECONDS3:
vp->flag &= ~SPECIAL(1<<(8));
clock_gettime(CLOCK_MONOTONIC3, &seconds);
seconds.tv_sec -= intval(vp);
vp->flag |= SPECIAL(1<<(8));
break;
case V_TMOUT16:
/* Enforce integer to avoid command execution from initcoms[] */
vp->flag &= ~SPECIAL(1<<(8));
intval(vp);
vp->flag |= SPECIAL(1<<(8));
/* at&t ksh seems to do this (only listen if integer) */
if (vp->flag & INTEGER(1<<(9)))
	ksh_tmout = vp->val.i >= 0 ? vp->val.i : 0;
break;
case V_LINENO18:
vp->flag &= ~SPECIAL(1<<(8));
/* The -1 is because line numbering starts at 1. */
user_lineno = (unsigned int) intval(vp) - current_lineno - 1;
vp->flag |= SPECIAL(1<<(8));
break;
case V_TERM19:
1070#ifndef SMALL
{
	int ret;

	vp->flag &= ~SPECIAL(1<<(8));
	if (setupterm(str_val(vp), shl_out(&shf_iob[2])->fd, &ret) == ERR(-1))
		del_curterm(cur_term);
	vp->flag |= SPECIAL(1<<(8));
}
1079#endif
break;
}
1082}

1084static void
1085unsetspec(struct tbl *vp)
1086{
switch (special(vp->name)) {
case V_PATH1:
afree(search_path, APERM&aperm);
search_path = str_save(def_path, APERM&aperm);
flushcom(1);	/* clear tracked aliases */
break;
case V_IFS2:
setctypes(" \t\n", C_IFS(1<<(7)));
ifs0 = ' ';
break;
case V_TMPDIR17:
/* should not become unspecial */
afree(tmpdir, APERM&aperm);
tmpdir = NULL((void*)0);
break;
case V_MAIL5:
mbset(NULL((void*)0));
break;
case V_MAILPATH6:
mpset(NULL((void*)0));
break;
case V_HISTCONTROL9:
sethistcontrol(NULL((void*)0));
break;
case V_LINENO18:
case V_MAILCHECK7:	/* at&t ksh leaves previous value in place */
case V_RANDOM8:
case V_SECONDS3:
case V_TMOUT16:		/* at&t ksh leaves previous value in place */
unspecial(vp->name);
break;

 /* at&t ksh man page says OPTIND, OPTARG and _ lose special meaning,
  * but OPTARG does not (still set by getopts) and _ is also still
  * set in various places.
  * Don't know what at&t does for:
  *		MAIL, MAILPATH, HISTSIZE, HISTFILE,
  * Unsetting these in at&t ksh does not loose the `specialness':
  *    no effect: IFS, COLUMNS, PATH, TMPDIR,
  *		VISUAL, EDITOR,
  * pdkshisms: no effect:
  *		POSIXLY_CORRECT (use set +o posix instead)
  */
}
1131}

1133/*
* Search for (and possibly create) a table entry starting with
* vp, indexed by val.
*/
1137static struct tbl *
1138arraysearch(struct tbl *vp, int val)
1139{
struct tbl *prev, *curr, *new;
size_t namelen = strlen(vp->name) + 1;

vp->flag |= ARRAY(1<<(13))|DEFINED(1<<(1));
vp->index = 0;
/* The table entry is always [0] */
if (val == 0)
return vp;
prev = vp;
curr = vp->u.array;
while (curr && curr->index < val) {
prev = curr;
curr = curr->u.array;
}
if (curr && curr->index == val) {
if (curr->flag&ISSET(1<<(2)))
	return curr;
else
	new = curr;
} else
new = alloc(sizeof(struct tbl) + namelen,
    vp->areap);
strlcpy(new->name, vp->name, namelen);
new->flag = vp->flag & ~(ALLOC(1<<(0))|DEFINED(1<<(1))|ISSET(1<<(2))|SPECIAL(1<<(8)));
new->type = vp->type;
new->areap = vp->areap;
new->u2.field = vp->u2.field;
new->index = val;
if (curr != new) {		/* not reusing old array entry */
prev->u.array = new;
new->u.array = curr;
}
return new;
1173}

1175/* Return the length of an array reference (eg, [1+2]) - cp is assumed
* to point to the open bracket.  Returns 0 if there is no matching closing
* bracket.
*/
1179int
1180array_ref_len(const char *cp)
1181{
const char *s = cp;
int c;
int depth = 0;

while ((c = *s++) && (c != ']' || --depth))
if (c == '[')
	depth++;
if (!c)
return 0;
return s - cp;
1192}

1194/*
* Make a copy of the base of an array name
*/
1197char *
1198arrayname(const char *str)
1199{
const char *p;

if ((p = strchr(str, '[')) == 0)
/* Shouldn't happen, but why worry? */
return (char *) str;

return str_nsave(str, p - str, ATEMP&genv->area);
1207}

1209/* Set (or overwrite, if !reset) the array variable var to the values in vals.
*/
1211void
1212set_array(const char *var, int reset, char **vals)
1213{
struct tbl *vp, *vq;
int i;

/* to get local array, use "typeset foo; set -A foo" */
vp = global(var);

/* Note: at&t ksh allows set -A but not set +A of a read-only var */
if ((vp->flag&RDONLY(1<<(10))))
errorf("%s: is read only", var);
/* This code is quite non-optimal */
if (reset > 0)
/* trash existing values and attributes */
unset(vp, 0);
/* todo: would be nice for assignment to completely succeed or
* completely fail.  Only really effects integer arrays:
* evaluation of some of vals[] may fail...
*/
for (i = 0; vals[i]; i++) {
vq = arraysearch(vp, i);
/* would be nice to deal with errors here... (see above) */
setstr(vq, vals[i], KSH_RETURN_ERROR0x1);
}
1236}