/usr/src/usr.sbin/mtree/spec.c

Bug Summary

File:	src/usr.sbin/mtree/spec.c
Warning:	line 246, column 10 Null pointer passed as 1st argument to string length function

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name spec.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/mtree/obj -resource-dir /usr/local/lib/clang/13.0.0 -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/mtree/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.sbin/mtree/spec.c

1/*	$NetBSD: spec.c,v 1.6 1995/03/07 21:12:12 cgd Exp $	*/
2/*	$OpenBSD: spec.c,v 1.29 2018/09/16 02:41:16 millert Exp $	*/

4/*-
* Copyright (c) 1989, 1993
*	The Regents of the University of California.  All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of the University nor the names of its contributors
*    may be used to endorse or promote products derived from this software
*    without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

33#include <sys/types.h>
34#include <sys/stat.h>
35#include <pwd.h>
36#include <grp.h>
37#include <errno(*__errno()).h>
38#include <unistd.h>
39#include <stdio.h>
40#include <ctype.h>
41#include <vis.h>
42#include "mtree.h"
43#include "extern.h"

45int lineno;				/* Current spec line number. */

47static void	 set(char *, NODE *);
48static void	 unset(char *, NODE *);

50NODE *
51spec(void)
52{
NODE *centry, *last;
char *p;
NODE ginfo, *root;
int c_cur, c_next;
char *buf, *tbuf = NULL((void *)0);
size_t len;

last = root = NULL((void *)0);
bzero(&ginfo, sizeof(ginfo));
centry = &ginfo;
c_cur = c_next = 0;
for (lineno = 1; (buf = fgetln(stdin(&__sF[0]), &len));
1
Loop condition is true.  Entering loop body→
   ++lineno, c_cur = c_next, c_next = 0) {
/* Null-terminate the line. */
if (buf[len - 1] == '\n') {
2
←
Assuming the condition is true→
3
←
Taking true branch→
	buf[--len] = '\0';
} else {
	/* EOF with no newline. */
	tbuf = malloc(len + 1);
	memcpy(tbuf, buf, len);
	tbuf[len] = '\0';
	buf = tbuf;
}

/* Skip leading whitespace. */
for (p = buf; isspace((unsigned char)*p); p++)
4
←
Loop condition is false. Execution continues on line 82→
	;

/* If nothing but whitespace or comment char, continue. */
if (*p == '\0' || *p == '#')
5
←
Assuming the condition is false→
6
←
Assuming the condition is false→
7
←
Taking false branch→
	continue;

/* See if next line is continuation line. */
if (buf[len - 1] == '\\') {
8
←
Assuming the condition is false→
9
←
Taking false branch→
	c_next = 1;
	if (--len == 0)
		continue;
	buf[len] = '\0';
}

93#ifdef DEBUG
(void)fprintf(stderr(&__sF[2]), "line %d: {%s}\n", lineno, p);
95#endif
if (c_cur9.1
'c_cur' is 0
) {
10
←
Taking false branch→
	set(p, centry);
	continue;
}

/* Grab file name, "$", "set", or "unset". */
if ((p = strtok(p, "\n\t ")) == NULL((void *)0))
11
←
Assuming the condition is false→
12
←
Taking false branch→
	error("missing field");

if (p[0] == '/')
13
←
Assuming the condition is true→
14
←
Taking true branch→
	switch(p[1]) {
15
←
Control jumps to 'case 115:'  at line 107→
	case 's':
		if (strcmp(p + 1, "set"))
16
←
Assuming the condition is false→
17
←
Taking false branch→
			break;
		set(NULL((void *)0), &ginfo);
18
←
Calling 'set'→
		continue;
	case 'u':
		if (strcmp(p + 1, "unset"))
			break;
		unset(NULL((void *)0), &ginfo);
		continue;
	}

if (strchr(p, '/'))
	error("slash character in file name");

if (!strcmp(p, "..")) {
	/* Don't go up, if haven't gone down. */
	if (!root)
		goto noparent;
	if (last->type != F_DIR0x004 || last->flags & F_DONE0x000002) {
		if (last == root)
			goto noparent;
		last = last->parent;
	}
	last->flags |= F_DONE0x000002;
	continue;

134noparent:		error("no parent node");
}

len = strlen(p) + 1;	/* NUL in struct _node */
if ((centry = calloc(1, sizeof(NODE) + len - 1)) == NULL((void *)0))
	error("%s", strerror(errno(*__errno())));
*centry = ginfo;
141#define	MAGIC"?*["	"?*["
if (strpbrk(p, MAGIC"?*["))
	centry->flags |= F_MAGIC0x000020;
if (strunvis(centry->name, p) == -1) {
	fprintf(stderr(&__sF[2]),
	    "mtree: filename (%s) encoded incorrectly\n", p);
	strlcpy(centry->name, p, len);
}
set(NULL((void *)0), centry);

if (!root) {
	last = root = centry;
	root->parent = root;
} else if (last->type == F_DIR0x004 && !(last->flags & F_DONE0x000002)) {
	centry->parent = last;
	last = last->child = centry;
} else {
	centry->parent = last->parent;
	centry->prev = last;
	last = last->next = centry;
}
}
free(tbuf);
return (root);
165}

167static void
168set(char *t, NODE *ip)
169{
int type;
char *kw, *val = NULL((void *)0);
19
←
'val' initialized to a null pointer value→
void *m;
int value;
u_int32_t fset, fclr;
char *ep;
size_t len;

for (; (kw = strtok(t, "= \t\n")); t = NULL((void *)0)) {
20
←
Loop condition is true.  Entering loop body→
ip->flags |= type = parsekey(kw, &value);
if (value && (val = strtok(NULL((void *)0), " \t\n")) == NULL((void *)0))
21
←
Assuming 'value' is 0→
	error("missing value");
switch(type) {
22
←
Control jumps to 'case 8192:'  at line 245→
case F_CKSUM0x000001:
	ip->cksum = strtoul(val, &ep, 10);
	if (*ep)
		error("invalid checksum %s", val);
	break;
case F_MD50x000040:
	ip->md5digest = strdup(val);
	if (!ip->md5digest)
		error("%s", strerror(errno(*__errno())));
	break;
case F_FLAGS0x080000:
	if (!strcmp(val, "none")) {
		ip->file_flags = 0;
		break;
	}
	if (strtofflags(&val, &fset, &fclr))
		error("%s", strerror(errno(*__errno())));
	ip->file_flags = fset;
	break;
case F_GID0x000004:
	ip->st_gid = strtoul(val, &ep, 10);
	if (*ep)
		error("invalid gid %s", val);
	break;
case F_GNAME0x000008:
	if (gid_from_group(val, &ip->st_gid) == -1)
	    error("unknown group %s", val);
	break;
case F_IGN0x000010:
	/* just set flag bit */
	break;
case F_MODE0x000080:
	if ((m = setmode(val)) == NULL((void *)0))
		error("invalid file mode %s", val);
	ip->st_mode = getmode(m, 0);
	free(m);
	break;
case F_NLINK0x000100:
	ip->st_nlink = strtoul(val, &ep, 10);
	if (*ep)
		error("invalid link count %s", val);
	break;
case F_RMD1600x000400:
	ip->rmd160digest = strdup(val);
	if (!ip->rmd160digest)
		error("%s", strerror(errno(*__errno())));
	break;
case F_SHA10x000800:
	ip->sha1digest = strdup(val);
	if (!ip->sha1digest)
		error("%s", strerror(errno(*__errno())));
	break;
case F_SHA2560x200000:
	ip->sha256digest = strdup(val);
	if (!ip->sha256digest)
		error("%s", strerror(errno(*__errno())));
	break;
case F_SIZE0x001000:
	ip->st_size = strtoll(val, &ep, 10);
	if (*ep)
		error("invalid size %s", val);
	break;
case F_SLINK0x002000:
	len = strlen(val) + 1;
23
←
Null pointer passed as 1st argument to string length function
	if ((ip->slink = malloc(len)) == NULL((void *)0))
		error("%s", strerror(errno(*__errno())));
	if (strunvis(ip->slink, val) == -1) {
		fprintf(stderr(&__sF[2]),
		    "mtree: filename (%s) encoded incorrectly\n", val);
		strlcpy(ip->slink, val, len);
	}
	break;
case F_TIME0x004000:
	ip->st_mtimespecst_mtim.tv_sec = strtoul(val, &ep, 10);
	if (*ep != '.')
		error("invalid time %s", val);
	val = ep + 1;
	ip->st_mtimespecst_mtim.tv_nsec = strtoul(val, &ep, 10);
	if (*ep)
		error("invalid time %s", val);
	break;
case F_TYPE0x008000:
	switch(*val) {
	case 'b':
		if (!strcmp(val, "block"))
			ip->type = F_BLOCK0x001;
		break;
	case 'c':
		if (!strcmp(val, "char"))
			ip->type = F_CHAR0x002;
		break;
	case 'd':
		if (!strcmp(val, "dir"))
			ip->type = F_DIR0x004;
		break;
	case 'f':
		if (!strcmp(val, "file"))
			ip->type = F_FILE0x010;
		if (!strcmp(val, "fifo"))
			ip->type = F_FIFO0x008;
		break;
	case 'l':
		if (!strcmp(val, "link"))
			ip->type = F_LINK0x020;
		break;
	case 's':
		if (!strcmp(val, "socket"))
			ip->type = F_SOCK0x040;
		break;
	default:
		error("unknown file type %s", val);
	}
	break;
case F_UID0x010000:
	ip->st_uid = strtoul(val, &ep, 10);
	if (*ep)
		error("invalid uid %s", val);
	break;
case F_UNAME0x020000:
	if (uid_from_user(val, &ip->st_uid) == -1)
	    error("unknown user %s", val);
	break;
}
}
307}

309static void
310unset(char *t, NODE *ip)
311{
char *p;

while ((p = strtok(t, "\n\t ")))
ip->flags &= ~parsekey(p, NULL((void *)0));
316}