/usr/src/usr.bin/telnet/telnet.c

Bug Summary

File:	src/usr.bin/telnet/telnet.c
Warning:	line 622, column 6 Dereference of null pointer (loaded from variable 'next')
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name telnet.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.bin/telnet/obj -resource-dir /usr/local/lib/clang/13.0.0 -D KLUDGELINEMODE -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.bin/telnet/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.bin/telnet/telnet.c
1/*	$OpenBSD: telnet.c,v 1.36 2019/07/11 03:54:27 deraadt Exp $	*/
2/*	$NetBSD: telnet.c,v 1.7 1996/02/28 21:04:15 thorpej Exp $	*/

4/*
* Copyright (c) 1988, 1990, 1993
*	The Regents of the University of California.  All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of the University nor the names of its contributors
*    may be used to endorse or promote products derived from this software
*    without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

33#include "telnet_locl.h"

35#include <arpa/telnet.h>
36#include <ctype.h>
37#include <curses.h>
38#include <stdlib.h>
39#include <unistd.h>
40#include <string.h>
41#include <term.h>

43#define        strip(x)(eight ? (x) : ((x) & 0x7f)) (eight ? (x) : ((x) & 0x7f))

45static unsigned char	subbuffer[SUBBUFSIZE256],
	*subpointer, *subend;	 /* buffer for sub-options */
47#define	SB_CLEAR()subpointer = subbuffer;	subpointer = subbuffer;
48#define	SB_TERM(){ subend = subpointer; subpointer = subbuffer;; }	{ subend = subpointer; SB_CLEAR()subpointer = subbuffer;; }
49#define	SB_ACCUM(c)if (subpointer < (subbuffer+sizeof subbuffer)) { *subpointer
++ = (c); }	if (subpointer < (subbuffer+sizeof subbuffer)) { \
		*subpointer++ = (c); \
	}

53#define	SB_GET()((*subpointer++)&0xff)	((*subpointer++)&0xff)
54#define	SB_PEEK()((*subpointer)&0xff)	((*subpointer)&0xff)
55#define	SB_EOF()(subpointer >= subend)	(subpointer >= subend)
56#define	SB_LEN()(subend - subpointer)	(subend - subpointer)

58static void	lm_will(unsigned char *, int);
59static void	lm_wont(unsigned char *, int);
60static void	lm_do(unsigned char *, int);
61static void	lm_dont(unsigned char *, int);

63static void	slc_init(void);
64static void	slc_import(int);
65static void	slc_export(void);
66static void	slc_start_reply(void);
67static void	slc_add_reply(unsigned char, unsigned char, cc_t);
68static void	slc_end_reply(void);
69static void	slc(unsigned char *, int);
70static int	slc_update(void);

72static void	env_opt(char *, int);
73static void	env_opt_start(void);

75char	options[256];		/* The combined options */
76char	do_dont_resp[256];
77char	will_wont_resp[256];

79int
eight = 3,
binary = 0,
autologin = 0,	/* Autologin anyone? */
skiprc = 0,
connections = 0,
connected,
showoptions,
ISend,		/* trying to send network data in */
crmod,
netdata,	/* Print out network data flow */
crlf,		/* Should '\r' be mapped to <CR><LF> (or <CR><NUL>)? */
telnetport,
SYNCHing,	/* we are in TELNET SYNCH mode */
flushout,	/* flush output */
autoflush = 0,	/* flush output when interrupting? */
autosynch,	/* send interrupt characters with SYNCH? */
localflow,	/* we handle flow control locally */
restartany,	/* if flow control enabled, restart on any character */
localchars,	/* we recognize interrupt/quit */
donelclchars,	/* the user has set "localchars" */
donebinarytoggle,	/* the user has put us in binary */
dontlecho,	/* do we suppress local echoing right now? */
globalmode,
clienteof = 0;

105char *prompt = NULL((void *)0);

107int scheduler_lockout_tty = 0;

109cc_t escape;
110cc_t rlogin;
111#ifdef	KLUDGELINEMODE1
112cc_t echoc;
113#endif

115/*
* Telnet receiver states for fsm
*/
118#define	TS_DATA0		0
119#define	TS_IAC1		1
120#define	TS_WILL2		2
121#define	TS_WONT3		3
122#define	TS_DO4		4
123#define	TS_DONT5		5
124#define	TS_CR6		6
125#define	TS_SB7		7		/* sub-option collection */
126#define	TS_SE8		8		/* looking for sub-option end */

128static int	telrcv_state;
129# define telopt_environ39 TELOPT_NEW_ENVIRON39

131jmp_buf	toplevel = { 0 };
132jmp_buf	peerdied;

134int	flushline;
135int	linemode;

137#ifdef	KLUDGELINEMODE1
138int	kludgelinemode = 1;
139#endif

141/*
* The following are some clocks used to decide how to interpret
* the relationship between various variables.
*/

146Clocks clocks;

148
149/*
* Initialize telnet environment.
*/

153void
154init_telnet(void)
155{
  env_init();

  SB_CLEAR()subpointer = subbuffer;;
  memset(options, 0, sizeof options);

  connected = ISend = localflow = donebinarytoggle = 0;
  restartany = -1;

  SYNCHing = 0;

  escape = CONTROL(']')((']')&0x1f);
  rlogin = _POSIX_VDISABLE(0377);
168#ifdef	KLUDGELINEMODE1
  echoc = CONTROL('E')(('E')&0x1f);
170#endif

  flushline = 1;
  telrcv_state = TS_DATA0;
174}
175

177/*
* These routines are in charge of sending option negotiations
* to the other side.
*
* The basic idea is that we send the negotiation if either side
* is in disagreement as to what the current state should be.
*/

185void
186send_do(int c, int init)
187{
  if (init) {
if (((do_dont_resp[c] == 0) && my_state_is_do(c)(options[c]&0x04)) ||
		my_want_state_is_do(c)(options[c]&0x08))
   return;
set_my_want_state_do(c){options[c] |= 0x08;};
do_dont_resp[c]++;
  }
  NET2ADD(IAC, DO){ { *netoring.supply = 255; ring_supplied(&netoring, 1); }
; { *netoring.supply = 253; ring_supplied(&netoring, 1); }
; };
  NETADD(c){ *netoring.supply = c; ring_supplied(&netoring, 1); };
  printoption("SENT",DO253, c);
198}

200void
201send_dont(int c, int init)
202{
  if (init) {
if (((do_dont_resp[c] == 0) && my_state_is_dont(c)(!(options[c]&0x04))) ||
		my_want_state_is_dont(c)(!(options[c]&0x08)))
   return;
set_my_want_state_dont(c){options[c] &= ~0x08;};
do_dont_resp[c]++;
  }
  NET2ADD(IAC, DONT){ { *netoring.supply = 255; ring_supplied(&netoring, 1); }
; { *netoring.supply = 254; ring_supplied(&netoring, 1); }
; };
  NETADD(c){ *netoring.supply = c; ring_supplied(&netoring, 1); };
  printoption("SENT", DONT254, c);
213}

215void
216send_will(int c, int init)
217{
  if (init) {
if (((will_wont_resp[c] == 0) && my_state_is_will(c)(options[c]&0x01)) ||
		my_want_state_is_will(c)(options[c]&0x02))
   return;
set_my_want_state_will(c){options[c] |= 0x02;};
will_wont_resp[c]++;
  }
  NET2ADD(IAC, WILL){ { *netoring.supply = 255; ring_supplied(&netoring, 1); }
; { *netoring.supply = 251; ring_supplied(&netoring, 1); }
; };
  NETADD(c){ *netoring.supply = c; ring_supplied(&netoring, 1); };
  printoption("SENT", WILL251, c);
228}

230void
231send_wont(int c, int init)
232{
  if (init) {
if (((will_wont_resp[c] == 0) && my_state_is_wont(c)(!(options[c]&0x01))) ||
		my_want_state_is_wont(c)(!(options[c]&0x02)))
   return;
set_my_want_state_wont(c){options[c] &= ~0x02;};
will_wont_resp[c]++;
  }
  NET2ADD(IAC, WONT){ { *netoring.supply = 255; ring_supplied(&netoring, 1); }
; { *netoring.supply = 252; ring_supplied(&netoring, 1); }
; };
  NETADD(c){ *netoring.supply = c; ring_supplied(&netoring, 1); };
  printoption("SENT", WONT252, c);
243}

245static void
246willoption(int option)
247{
int new_state_ok = 0;

if (do_dont_resp[option]) {
   --do_dont_resp[option];
   if (do_dont_resp[option] && my_state_is_do(option)(options[option]&0x04))
--do_dont_resp[option];
}

if ((do_dont_resp[option] == 0) && my_want_state_is_dont(option)(!(options[option]&0x08))) {

   switch (option) {

   case TELOPT_ECHO1:
   case TELOPT_BINARY0:
   case TELOPT_SGA3:
settimer(modenegotiated)clocks.modenegotiated = clocks.system++;
/* FALL THROUGH */
   case TELOPT_STATUS5:
new_state_ok = 1;
break;

   case TELOPT_TM6:
if (flushout)
    flushout = 0;
/*
 * Special case for TM.  If we get back a WILL,
 * pretend we got back a WONT.
 */
set_my_want_state_dont(option){options[option] &= ~0x08;};
set_my_state_dont(option){options[option] &= ~0x04;};
return;			/* Never reply to TM will's/wont's */

   case TELOPT_LINEMODE34:
   default:
break;
   }

   if (new_state_ok) {
set_my_want_state_do(option){options[option] |= 0x08;};
send_do(option, 0);
setconnmode(0);		/* possibly set new tty mode */
   } else {
do_dont_resp[option]++;
send_dont(option, 0);
   }
}
set_my_state_do(option){options[option] |= 0x04;};

296}

298static void
299wontoption(int option)
300{
if (do_dont_resp[option]) {
   --do_dont_resp[option];
   if (do_dont_resp[option] && my_state_is_dont(option)(!(options[option]&0x04)))
--do_dont_resp[option];
}

if ((do_dont_resp[option] == 0) && my_want_state_is_do(option)(options[option]&0x08)) {

   switch (option) {

311#ifdef	KLUDGELINEMODE1
   case TELOPT_SGA3:
if (!kludgelinemode)
    break;
/* FALL THROUGH */
316#endif
   case TELOPT_ECHO1:
settimer(modenegotiated)clocks.modenegotiated = clocks.system++;
break;

   case TELOPT_TM6:
if (flushout)
    flushout = 0;
set_my_want_state_dont(option){options[option] &= ~0x08;};
set_my_state_dont(option){options[option] &= ~0x04;};
return;		/* Never reply to TM will's/wont's */

   default:
break;
   }
   set_my_want_state_dont(option){options[option] &= ~0x08;};
   if (my_state_is_do(option)(options[option]&0x04))
send_dont(option, 0);
   setconnmode(0);			/* Set new tty mode */
} else if (option == TELOPT_TM6) {
   /*
    * Special case for TM.
    */
   if (flushout)
flushout = 0;
   set_my_want_state_dont(option){options[option] &= ~0x08;};
}
set_my_state_dont(option){options[option] &= ~0x04;};
344}

346static void
347dooption(int option)
348{
int new_state_ok = 0;

if (will_wont_resp[option]) {
   --will_wont_resp[option];
   if (will_wont_resp[option] && my_state_is_will(option)(options[option]&0x01))
--will_wont_resp[option];
}

if (will_wont_resp[option] == 0) {
 if (my_want_state_is_wont(option)(!(options[option]&0x02))) {

   switch (option) {

   case TELOPT_TM6:
/*
 * Special case for TM.  We send a WILL, but pretend
 * we sent WONT.
 */
send_will(option, 0);
set_my_want_state_wont(TELOPT_TM){options[6] &= ~0x02;};
set_my_state_wont(TELOPT_TM){options[6] &= ~0x01;};
return;

   case TELOPT_BINARY0:		/* binary mode */
   case TELOPT_NAWS31:		/* window size */
   case TELOPT_TSPEED32:		/* terminal speed */
   case TELOPT_LFLOW33:		/* local flow control */
   case TELOPT_TTYPE24:		/* terminal type option */
   case TELOPT_SGA3:		/* no big deal */
new_state_ok = 1;
break;

   case TELOPT_NEW_ENVIRON39:	/* New environment variable option */
new_state_ok = 1;
break;

   case TELOPT_XDISPLOC35:	/* X Display location */
if (env_getvalue("DISPLAY", 0))
    new_state_ok = 1;
break;

   case TELOPT_LINEMODE34:
391#ifdef	KLUDGELINEMODE1
kludgelinemode = 0;
send_do(TELOPT_SGA3, 1);
394#endif
set_my_want_state_will(TELOPT_LINEMODE){options[34] |= 0x02;};
send_will(option, 0);
set_my_state_will(TELOPT_LINEMODE){options[34] |= 0x01;};
slc_init();
return;

   case TELOPT_ECHO1:		/* We're never going to echo... */
   default:
break;
   }

   if (new_state_ok) {
set_my_want_state_will(option){options[option] |= 0x02;};
send_will(option, 0);
setconnmode(0);			/* Set new tty mode */
   } else {
will_wont_resp[option]++;
send_wont(option, 0);
   }
 } else {
   /*
    * Handle options that need more things done after the
    * other side has acknowledged the option.
    */
   switch (option) {
   case TELOPT_LINEMODE34:
421#ifdef	KLUDGELINEMODE1
kludgelinemode = 0;
send_do(TELOPT_SGA3, 1);
424#endif
set_my_state_will(option){options[option] |= 0x01;};
slc_init();
send_do(TELOPT_SGA3, 0);
return;
   }
 }
}
set_my_state_will(option){options[option] |= 0x01;};
433}

435static void
436dontoption(int option)
437{

if (will_wont_resp[option]) {
   --will_wont_resp[option];
   if (will_wont_resp[option] && my_state_is_wont(option)(!(options[option]&0x01)))
--will_wont_resp[option];
}

if ((will_wont_resp[option] == 0) && my_want_state_is_will(option)(options[option]&0x02)) {
   switch (option) {
   case TELOPT_LINEMODE34:
linemode = 0;	/* put us back to the default state */
break;
   }
   /* we always accept a DONT */
   set_my_want_state_wont(option){options[option] &= ~0x02;};
   if (my_state_is_will(option)(options[option]&0x01))
send_wont(option, 0);
   setconnmode(0);			/* Set new tty mode */
}
set_my_state_wont(option){options[option] &= ~0x01;};
458}

460/*
* This routine will turn a pipe separated list of names in the buffer
* into an array of pointers to NUL terminated names.  We toss out any
* bad, duplicate, or verbose names (names with spaces).
*/

466int is_unique(char *, char **, char **);

468static char *name_unknown = "UNKNOWN";
469static char *unknown[] = { NULL((void *)0), NULL((void *)0) };

471char **
472mklist(char *buf, char *name)
473{
int n;
char c, *cp, **argvp, *cp2, **argv, **avt;

if (name) {
if (strlen(name) > 40) {
	name = NULL((void *)0);
	unknown[0] = name_unknown;
} else {
	unknown[0] = name;
	upcase(name);
}
} else
unknown[0] = name_unknown;
/*
* Count up the number of names.
*/
for (n = 1, cp = buf; *cp; cp++) {
if (*cp == '|')
	n++;
}
/*
* Allocate an array to put the name pointers into
*/
argv = reallocarray(NULL((void *)0), n+3, sizeof(char *));
if (argv == NULL((void *)0))
return(unknown);

/*
* Fill up the array of pointers to names.
*/
*argv = NULL((void *)0);
argvp = argv+1;
n = 0;
for (cp = cp2 = buf; (c = *cp);  cp++) {
if (c == '|' || c == ':') {
	*cp++ = '\0';
	/*
	 * Skip entries that have spaces or are over 40
	 * characters long.  If this is our environment
	 * name, then put it up front.  Otherwise, as
	 * long as this is not a duplicate name (case
	 * insensitive) add it to the list.
	 */
	if (n || (cp - cp2 > 41))
		;
	else if (name && (strncasecmp(name, cp2, cp-cp2) == 0))
		*argv = cp2;
	else if (is_unique(cp2, argv+1, argvp))
		*argvp++ = cp2;
	if (c == ':')
		break;
	/*
	 * Skip multiple delimiters. Reset cp2 to
	 * the beginning of the next name. Reset n,
	 * the flag for names with spaces.
	 */
	while ((c = *cp) == '|')
		cp++;
	cp2 = cp;
	n = 0;
}
/*
 * Skip entries with spaces or non-ascii values.
 * Convert lower case letters to upper case.
 */
539#define ISASCII(c)(!((c)&0x80)) (!((c)&0x80))
if ((c == ' ') || !ISASCII(c)(!((c)&0x80)))
	n = 1;
else
	*cp = toupper((unsigned char)c);
}

/*
* Check for an old V6 2 character name.  If the second
* name points to the beginning of the buffer, and is
* only 2 characters long, move it to the end of the array.
*/
if ((argv[1] == buf) && (strlen(argv[1]) == 2)) {
--argvp;
for (avt = &argv[1]; avt < argvp; avt++)
	*avt = *(avt+1);
*argvp++ = buf;
}

/*
* Duplicate last name, for TTYPE option, and null
* terminate the array.  If we didn't find a match on
* our terminal name, put that name at the beginning.
*/
cp = *(argvp-1);
*argvp++ = cp;
*argvp = NULL((void *)0);

if (*argv == NULL((void *)0)) {
if (name)
	*argv = name;
else {
	--argvp;
	for (avt = argv; avt < argvp; avt++)
		*avt = *(avt+1);
}
}
if (*argv)
return(argv);
else
return(unknown);
580}

582int
583is_unique(char *name, char **as, char **ae)
584{
char **ap;
int n;

n = strlen(name) + 1;
for (ap = as; ap < ae; ap++)
if (strncasecmp(*ap, name, n) == 0)
	return(0);
return (1);
593}

595int resettermname = 1;

597char *
598gettermname(void)
599{
char *tname;
static char **tnamep = NULL((void *)0);
static char **next;
22
←
'next' initialized to a null pointer value→
int errret;

if (resettermname) {
23
←
Assuming 'resettermname' is 0→
24
←
Taking false branch→
resettermname = 0;
if (tnamep && tnamep != unknown)
	free(tnamep);
if ((tname = env_getvalue("TERM", 0)) &&
    (setupterm(tname, 1, &errret) == OK(0))) {
	tnamep = mklist(ttytype, tname);
} else {
	if (tname && (strlen(tname) <= 40)) {
		unknown[0] = tname;
		upcase(tname);
	} else
		unknown[0] = name_unknown;
	tnamep = unknown;
}
next = tnamep;
}
if (*next == NULL((void *)0))
25
←
Dereference of null pointer (loaded from variable 'next')
next = tnamep;
return(*next++);
625}

627/*
* suboption()
*
*	Look at the sub-option buffer, and try to be helpful to the other
* side.
*
*	Currently we recognize:
*
*		Terminal type, send request.
*		Terminal speed (send request).
*		Local flow control (is request).
*		Linemode
*/

641static void
642suboption(void)
643{
  unsigned char subchar;

  printsub('<', subbuffer, SB_LEN()(subend - subpointer)+2);
  switch (subchar = SB_GET()((*subpointer++)&0xff)) {
15
←
Control jumps to 'case 24:'  at line 648→
  case TELOPT_TTYPE24:
if (my_want_state_is_wont(TELOPT_TTYPE)(!(options[24]&0x02)))
16
←
Assuming the condition is false→
17
←
Taking false branch→
   return;
if (SB_EOF()(subpointer >= subend) || SB_GET()((*subpointer++)&0xff) != TELQUAL_SEND1) {
18
←
Assuming 'subpointer' is < 'subend'→
19
←
Assuming the condition is false→
20
←
Taking false branch→
   return;
} else {
   char *name;
   unsigned char temp[50];
   int len;

   name = gettermname();
21
←
Calling 'gettermname'→
   len = strlen(name) + 4 + 2;
   if (len < NETROOM()(ring_empty_count(&netoring))) {
snprintf((char *)temp, sizeof(temp),
	 "%c%c%c%c%s%c%c", IAC255, SB250, TELOPT_TTYPE24,
	 TELQUAL_IS0, name, IAC255, SE240);
ring_supply_data(&netoring, temp, len);
printsub('>', &temp[2], len-2);
   } else
ExitString("No room in buffer for terminal type.\n", 1);
}
break;
  case TELOPT_TSPEED32:
if (my_want_state_is_wont(TELOPT_TSPEED)(!(options[32]&0x02)))
   return;
if (SB_EOF()(subpointer >= subend))
   return;
if (SB_GET()((*subpointer++)&0xff) == TELQUAL_SEND1) {
   long ospeed, ispeed;
   unsigned char temp[50];
   int len;

   TerminalSpeeds(&ispeed, &ospeed);

   snprintf((char *)temp, sizeof(temp),
     "%c%c%c%c%ld,%ld%c%c", IAC255, SB250, TELOPT_TSPEED32,
     TELQUAL_IS0, ospeed, ispeed, IAC255, SE240);
   len = strlen((char *)temp+4) + 4;	/* temp[3] is 0 ... */

   if (len < NETROOM()(ring_empty_count(&netoring))) {
ring_supply_data(&netoring, temp, len);
printsub('>', temp+2, len - 2);
   }
691/*@*/	    else printf("lm_will: not enough room in buffer\n");
}
break;
  case TELOPT_LFLOW33:
if (my_want_state_is_wont(TELOPT_LFLOW)(!(options[33]&0x02)))
   return;
if (SB_EOF()(subpointer >= subend))
   return;
switch(SB_GET()((*subpointer++)&0xff)) {
case LFLOW_RESTART_ANY2:
   restartany = 1;
   break;
case LFLOW_RESTART_XON3:
   restartany = 0;
   break;
case LFLOW_ON1:
   localflow = 1;
   break;
case LFLOW_OFF0:
   localflow = 0;
   break;
default:
   return;
}
setcommandmode();
setconnmode(0);
break;

  case TELOPT_LINEMODE34:
if (my_want_state_is_wont(TELOPT_LINEMODE)(!(options[34]&0x02)))
   return;
if (SB_EOF()(subpointer >= subend))
   return;
switch (SB_GET()((*subpointer++)&0xff)) {
case WILL251:
   lm_will(subpointer, SB_LEN()(subend - subpointer));
   break;
case WONT252:
   lm_wont(subpointer, SB_LEN()(subend - subpointer));
   break;
case DO253:
   lm_do(subpointer, SB_LEN()(subend - subpointer));
   break;
case DONT254:
   lm_dont(subpointer, SB_LEN()(subend - subpointer));
   break;
case LM_SLC3:
   slc(subpointer, SB_LEN()(subend - subpointer));
   break;
case LM_MODE1:
   lm_mode(subpointer, SB_LEN()(subend - subpointer), 0);
   break;
default:
   break;
}
break;

  case TELOPT_NEW_ENVIRON39:
if (SB_EOF()(subpointer >= subend))
   return;
switch(SB_PEEK()((*subpointer)&0xff)) {
case TELQUAL_IS0:
case TELQUAL_INFO2:
   if (my_want_state_is_dont(subchar)(!(options[subchar]&0x08)))
return;
   break;
case TELQUAL_SEND1:
   if (my_want_state_is_wont(subchar)(!(options[subchar]&0x02))) {
return;
   }
   break;
default:
   return;
}
env_opt(subpointer, SB_LEN()(subend - subpointer));
break;

  case TELOPT_XDISPLOC35:
if (my_want_state_is_wont(TELOPT_XDISPLOC)(!(options[35]&0x02)))
   return;
if (SB_EOF()(subpointer >= subend))
   return;
if (SB_GET()((*subpointer++)&0xff) == TELQUAL_SEND1) {
   unsigned char temp[50], *dp;
   int len;

   if ((dp = env_getvalue("DISPLAY", 0)) == NULL((void *)0)) {
/*
 * Something happened, we no longer have a DISPLAY
 * variable.  So, turn off the option.
 */
send_wont(TELOPT_XDISPLOC35, 1);
break;
   }
   snprintf((char *)temp, sizeof(temp),
    "%c%c%c%c%s%c%c", IAC255, SB250, TELOPT_XDISPLOC35,
    TELQUAL_IS0, dp, IAC255, SE240);
   len = strlen((char *)temp+4) + 4;	/* temp[3] is 0 ... */

   if (len < NETROOM()(ring_empty_count(&netoring))) {
ring_supply_data(&netoring, temp, len);
printsub('>', temp+2, len - 2);
   }
794/*@*/	    else printf("lm_will: not enough room in buffer\n");
}
break;

  default:
break;
  }
801}

803static unsigned char str_lm[] = { IAC255, SB250, TELOPT_LINEMODE34, 0, 0, IAC255, SE240 };

805static void
806lm_will(unsigned char *cmd, int len)
807{
  if (len < 1) {
809/*@*/	printf("lm_will: no command!!!\n");	/* Should not happen... */
return;
  }
  switch(cmd[0]) {
  case LM_FORWARDMASK2:	/* We shouldn't ever get this... */
  default:
str_lm[3] = DONT254;
str_lm[4] = cmd[0];
if (NETROOM()(ring_empty_count(&netoring)) > sizeof(str_lm)) {
   ring_supply_data(&netoring, str_lm, sizeof(str_lm));
   printsub('>', &str_lm[2], sizeof(str_lm)-2);
}
821/*@*/	else printf("lm_will: not enough room in buffer\n");
break;
  }
824}

826static void
827lm_wont(unsigned char *cmd, int len)
828{
  if (len < 1) {
830/*@*/	printf("lm_wont: no command!!!\n");	/* Should not happen... */
return;
  }
  switch(cmd[0]) {
  case LM_FORWARDMASK2:	/* We shouldn't ever get this... */
  default:
/* We are always DONT, so don't respond */
return;
  }
839}

841static void
842lm_do(unsigned char *cmd, int len)
843{
  if (len < 1) {
845/*@*/	printf("lm_do: no command!!!\n");	/* Should not happen... */
return;
  }
  switch(cmd[0]) {
  case LM_FORWARDMASK2:
  default:
str_lm[3] = WONT252;
str_lm[4] = cmd[0];
if (NETROOM()(ring_empty_count(&netoring)) > sizeof(str_lm)) {
   ring_supply_data(&netoring, str_lm, sizeof(str_lm));
   printsub('>', &str_lm[2], sizeof(str_lm)-2);
}
857/*@*/	else printf("lm_do: not enough room in buffer\n");
break;
  }
860}

862static void
863lm_dont(unsigned char *cmd, int len)
864{
  if (len < 1) {
866/*@*/	printf("lm_dont: no command!!!\n");	/* Should not happen... */
return;
  }
  switch(cmd[0]) {
  case LM_FORWARDMASK2:
  default:
/* we are always WONT, so don't respond */
break;
  }
875}

877static unsigned char str_lm_mode[] = {
IAC255, SB250, TELOPT_LINEMODE34, LM_MODE1, 0, IAC255, SE240
879};

881void
882lm_mode(unsigned char *cmd, int len, int init)
883{
if (len != 1)
return;
if ((linemode&MODE_MASK0x1f&~MODE_ACK0x04) == *cmd)
return;
if (*cmd&MODE_ACK0x04)
return;
linemode = *cmd&(MODE_MASK0x1f&~MODE_ACK0x04);
str_lm_mode[4] = linemode;
if (!init)
   str_lm_mode[4] |= MODE_ACK0x04;
if (NETROOM()(ring_empty_count(&netoring)) > sizeof(str_lm_mode)) {
   ring_supply_data(&netoring, str_lm_mode, sizeof(str_lm_mode));
   printsub('>', &str_lm_mode[2], sizeof(str_lm_mode)-2);
}
898/*@*/	else printf("lm_mode: not enough room in buffer\n");
setconnmode(0);	/* set changed mode */
900}

902

904/*
* slc()
* Handle special character suboption of LINEMODE.
*/

909struct spc {
cc_t val;
cc_t *valp;
char flags;	/* Current flags & level */
char mylevel;	/* Maximum level & flags */
914} spc_data[NSLC30+1];

916#define SLC_IMPORT0	0
917#define	SLC_EXPORT1	1
918#define SLC_RVALUE2	2
919static int slc_mode = SLC_EXPORT1;

921static void
922slc_init(void)
923{
struct spc *spcp;

localchars = 1;
for (spcp = spc_data; spcp < &spc_data[NSLC30+1]; spcp++) {
spcp->val = 0;
spcp->valp = NULL((void *)0);
spcp->flags = spcp->mylevel = SLC_NOSUPPORT0;
}

933#define	initfunc(func, flags) { \
			spcp = &spc_data[func]; \
			if ((spcp->valp = tcval(func))) { \
			    spcp->val = *spcp->valp; \
			    spcp->mylevel = SLC_VARIABLE2|flags; \
			} else { \
			    spcp->val = 0; \
			    spcp->mylevel = SLC_DEFAULT3; \
			} \
		    }

initfunc(SLC_SYNCH1, 0);
/* No BRK */
initfunc(SLC_AO4, 0);
initfunc(SLC_AYT5, 0);
/* No EOR */
initfunc(SLC_ABORT7, SLC_FLUSHIN0x40|SLC_FLUSHOUT0x20);
initfunc(SLC_EOF8, 0);
initfunc(SLC_SUSP9, SLC_FLUSHIN0x40);
initfunc(SLC_EC10, 0);
initfunc(SLC_EL11, 0);
initfunc(SLC_EW12, 0);
initfunc(SLC_RP13, 0);
initfunc(SLC_LNEXT14, 0);
initfunc(SLC_XON15, 0);
initfunc(SLC_XOFF16, 0);
initfunc(SLC_FORW117, 0);
initfunc(SLC_FORW218, 0);
/* No FORW2 */

initfunc(SLC_IP3, SLC_FLUSHIN0x40|SLC_FLUSHOUT0x20);
964#undef	initfunc

if (slc_mode == SLC_EXPORT1)
slc_export();
else
slc_import(1);

971}

973void
974slcstate(void)
975{
  printf("Special characters are %s values\n",
slc_mode == SLC_IMPORT0 ? "remote default" :
slc_mode == SLC_EXPORT1 ? "local" :
			 "remote");
980}

982void
983slc_mode_export(int unused)
984{
  slc_mode = SLC_EXPORT1;
  if (my_state_is_will(TELOPT_LINEMODE)(options[34]&0x01))
slc_export();
988}

990void
991slc_mode_import(int def)
992{
  slc_mode = def ? SLC_IMPORT0 : SLC_RVALUE2;
  if (my_state_is_will(TELOPT_LINEMODE)(options[34]&0x01))
slc_import(def);
996}

998unsigned char slc_import_val[] = {
IAC255, SB250, TELOPT_LINEMODE34, LM_SLC3, 0, SLC_VARIABLE2, 0, IAC255, SE240
1000};
1001unsigned char slc_import_def[] = {
IAC255, SB250, TELOPT_LINEMODE34, LM_SLC3, 0, SLC_DEFAULT3, 0, IAC255, SE240
1003};

1005static void
1006slc_import(int def)
1007{
  if (NETROOM()(ring_empty_count(&netoring)) > sizeof(slc_import_val)) {
if (def) {
   ring_supply_data(&netoring, slc_import_def, sizeof(slc_import_def));
   printsub('>', &slc_import_def[2], sizeof(slc_import_def)-2);
} else {
   ring_supply_data(&netoring, slc_import_val, sizeof(slc_import_val));
   printsub('>', &slc_import_val[2], sizeof(slc_import_val)-2);
}
  }
1017/*@*/ else printf("slc_import: not enough room\n");
1018}

1020static void
1021slc_export(void)
1022{
  struct spc *spcp;

  TerminalDefaultChars();

  slc_start_reply();
  for (spcp = &spc_data[1]; spcp < &spc_data[NSLC30+1]; spcp++) {
if (spcp->mylevel != SLC_NOSUPPORT0) {
   if (spcp->val == (cc_t)(_POSIX_VDISABLE(0377)))
spcp->flags = SLC_NOSUPPORT0;
   else
spcp->flags = spcp->mylevel;
   if (spcp->valp)
spcp->val = *spcp->valp;
   slc_add_reply(spcp - spc_data, spcp->flags, spcp->val);
}
  }
  slc_end_reply();
  (void)slc_update();
  setconnmode(1);	/* Make sure the character values are set */
1042}

1044static void
1045slc(unsigned char *cp, int len)
1046{
struct spc *spcp;
int func,level;

slc_start_reply();

for (; len >= 3; len -=3, cp +=3) {

func = cp[SLC_FUNC0];

if (func == 0) {
	/*
	 * Client side: always ignore 0 function.
	 */
	continue;
}
if (func > NSLC30) {
	if ((cp[SLC_FLAGS1] & SLC_LEVELBITS0x03) != SLC_NOSUPPORT0)
		slc_add_reply(func, SLC_NOSUPPORT0, 0);
	continue;
}

spcp = &spc_data[func];

level = cp[SLC_FLAGS1]&(SLC_LEVELBITS0x03|SLC_ACK0x80);

if ((cp[SLC_VALUE2] == (unsigned char)spcp->val) &&
    ((level&SLC_LEVELBITS0x03) == (spcp->flags&SLC_LEVELBITS0x03))) {
	continue;
}

if (level == (SLC_DEFAULT3|SLC_ACK0x80)) {
	/*
	 * This is an error condition, the SLC_ACK
	 * bit should never be set for the SLC_DEFAULT
	 * level.  Our best guess to recover is to
	 * ignore the SLC_ACK bit.
	 */
	cp[SLC_FLAGS1] &= ~SLC_ACK0x80;
}

if (level == ((spcp->flags&SLC_LEVELBITS0x03)|SLC_ACK0x80)) {
	spcp->val = (cc_t)cp[SLC_VALUE2];
	spcp->flags = cp[SLC_FLAGS1];	/* include SLC_ACK */
	continue;
}

level &= ~SLC_ACK0x80;

if (level <= (spcp->mylevel&SLC_LEVELBITS0x03)) {
	spcp->flags = cp[SLC_FLAGS1]|SLC_ACK0x80;
	spcp->val = (cc_t)cp[SLC_VALUE2];
}
if (level == SLC_DEFAULT3) {
	if ((spcp->mylevel&SLC_LEVELBITS0x03) != SLC_DEFAULT3)
		spcp->flags = spcp->mylevel;
	else
		spcp->flags = SLC_NOSUPPORT0;
}
slc_add_reply(func, spcp->flags, spcp->val);
}
slc_end_reply();
if (slc_update())
setconnmode(1);	/* set the  new character values */
1110}

1112void
1113slc_check(void)
1114{
  struct spc *spcp;

  slc_start_reply();
  for (spcp = &spc_data[1]; spcp < &spc_data[NSLC30+1]; spcp++) {
if (spcp->valp && spcp->val != *spcp->valp) {
   spcp->val = *spcp->valp;
   if (spcp->val == (cc_t)(_POSIX_VDISABLE(0377)))
spcp->flags = SLC_NOSUPPORT0;
   else
spcp->flags = spcp->mylevel;
   slc_add_reply(spcp - spc_data, spcp->flags, spcp->val);
}
  }
  slc_end_reply();
  setconnmode(1);
1130}


1133static unsigned char slc_reply[2 * SUBBUFSIZE256];
1134static unsigned char *slc_replyp;

1136unsigned char
1137slc_add(unsigned char ch)
1138{
if (slc_replyp == slc_reply + sizeof(slc_reply))
return ch;
return *slc_replyp++ = ch;
1142}

1144static void
1145slc_start_reply(void)
1146{
slc_replyp = slc_reply;
slc_add(IAC255);
slc_add(SB250);
slc_add(TELOPT_LINEMODE34);
slc_add(LM_SLC3);
1152}

1154static void
1155slc_add_reply(unsigned char func, unsigned char flags, cc_t value)
1156{
if (slc_replyp + 6 >= slc_reply + sizeof(slc_reply)) {
printf("slc_add_reply: not enough room\n");
return;
}
if (slc_add(func) == IAC255)
slc_add(IAC255);
if (slc_add(flags) == IAC255)
slc_add(IAC255);
if (slc_add((unsigned char)value) == IAC255)
slc_add(IAC255);
1167}

1169static void
1170slc_end_reply(void)
1171{
  int len;

  if (slc_replyp + 2 >= slc_reply + sizeof(slc_reply)) {
printf("slc_end_reply: not enough room\n");
return;
  }

  slc_add(IAC255);
  slc_add(SE240);
  len = slc_replyp - slc_reply;
  if (len <= 6)
return;
  if (NETROOM()(ring_empty_count(&netoring)) > len) {
ring_supply_data(&netoring, slc_reply, slc_replyp - slc_reply);
printsub('>', &slc_reply[2], slc_replyp - slc_reply - 2);
  }
1188/*@*/else printf("slc_end_reply: not enough room\n");
1189}

1191static int
1192slc_update(void)
1193{
struct spc *spcp;
int need_update = 0;

for (spcp = &spc_data[1]; spcp < &spc_data[NSLC30+1]; spcp++) {
if (!(spcp->flags&SLC_ACK0x80))
	continue;
spcp->flags &= ~SLC_ACK0x80;
if (spcp->valp && (*spcp->valp != spcp->val)) {
	*spcp->valp = spcp->val;
	need_update = 1;
}
}
return(need_update);
1207}

1209static void
1210env_opt(char *buf, int len)
1211{
char *ep = 0, *epc = 0;
int i;

switch(buf[0]&0xff) {
case TELQUAL_SEND1:
env_opt_start();
if (len == 1) {
	env_opt_add(NULL((void *)0));
} else for (i = 1; i < len; i++) {
	switch (buf[i]&0xff) {
	case NEW_ENV_VAR0:
	case ENV_USERVAR3:
		if (ep) {
			*epc = 0;
			env_opt_add(ep);
		}
		ep = epc = &buf[i+1];
		break;
	case ENV_ESC2:
		i++;
		/*FALL THROUGH*/
	default:
		if (epc)
			*epc++ = buf[i];
		break;
	}
}
if (ep) {
	*epc = 0;
	env_opt_add(ep);
}
env_opt_end(1);
break;

case TELQUAL_IS0:
case TELQUAL_INFO2:
/* Ignore for now.  We shouldn't get it anyway. */
break;

default:
break;
}
1254}

1256#define	OPT_REPLY_SIZE(2 * 256)	(2 * SUBBUFSIZE256)
1257static unsigned char *opt_reply;
1258static unsigned char *opt_replyp;
1259static unsigned char *opt_replyend;

1261void
1262opt_add(unsigned char ch)
1263{
if (opt_replyp == opt_replyend)
return;
*opt_replyp++ = ch;
1267}

1269static void
1270env_opt_start(void)
1271{
unsigned char *p;

p = realloc(opt_reply, OPT_REPLY_SIZE(2 * 256));
if (p == NULL((void *)0))
free(opt_reply);
opt_reply = p;
if (opt_reply == NULL((void *)0)) {
1279/*@*/		printf("env_opt_start: realloc() failed!!!\n");
opt_reply = opt_replyp = opt_replyend = NULL((void *)0);
return;
}
opt_replyp = opt_reply;
opt_replyend = opt_reply + OPT_REPLY_SIZE(2 * 256);
opt_add(IAC255);
opt_add(SB250);
opt_add(telopt_environ39);
opt_add(TELQUAL_IS0);
1289}

1291void
1292env_opt_start_info(void)
1293{
env_opt_start();
if (opt_replyp)
   opt_replyp[-1] = TELQUAL_INFO2;
1297}

1299void
1300env_opt_add(char *ep)
1301{
char *vp, c;

if (opt_reply == NULL((void *)0))		/*XXX*/
return;			/*XXX*/

if (ep == NULL((void *)0) || *ep == '\0') {
/* Send user defined variables first. */
env_default(1, 0);
while ((ep = env_default(0, 0)))
	env_opt_add(ep);

/* Now add the list of well know variables.  */
env_default(1, 1);
while ((ep = env_default(0, 1)))
	env_opt_add(ep);
return;
}
vp = env_getvalue(ep, 1);
if (2 * (vp ? strlen(vp) : 0) + 2 * strlen(ep) + 6 >
   opt_replyend - opt_replyp)
{
size_t len;
unsigned char *p;

len = opt_replyend - opt_reply;
len += OPT_REPLY_SIZE(2 * 256) + 2 * strlen(ep);
if (vp)
	len += 2 * strlen(vp);
p = realloc(opt_reply, len);
if (p == NULL((void *)0)) {
	free(opt_reply);
1333/*@*/			printf("env_opt_add: realloc() failed!!!\n");
	opt_reply = opt_replyp = opt_replyend = NULL((void *)0);
	return;
}
opt_replyp = p + (opt_replyp - opt_reply);
opt_replyend = p + len;
opt_reply = p;
}
if (opt_welldefined(ep))
opt_add(NEW_ENV_VAR0);
else
opt_add(ENV_USERVAR3);

for (;;) {
while ((c = *ep++)) {
	switch(c&0xff) {
	case IAC255:
		opt_add(IAC255);
		break;
	case NEW_ENV_VAR0:
	case NEW_ENV_VALUE1:
	case ENV_ESC2:
	case ENV_USERVAR3:
		opt_add(ENV_ESC2);
		break;
	}
	opt_add(c);
}
if ((ep = vp)) {
		opt_add(NEW_ENV_VALUE1);
	vp = NULL((void *)0);
} else
	break;
}
1367}

1369int
1370opt_welldefined(const char *ep)
1371{
if ((strcmp(ep, "USER") == 0) ||
   (strcmp(ep, "DISPLAY") == 0) ||
   (strcmp(ep, "PRINTER") == 0) ||
   (strcmp(ep, "SYSTEMTYPE") == 0) ||
   (strcmp(ep, "JOB") == 0) ||
   (strcmp(ep, "ACCT") == 0))
return(1);
return(0);
1380}

1382void
1383env_opt_end(int emptyok)
1384{
int len;

len = opt_replyp - opt_reply + 2;
if (emptyok || len > 6) {
opt_add(IAC255);
opt_add(SE240);
if (NETROOM()(ring_empty_count(&netoring)) > len) {
	ring_supply_data(&netoring, opt_reply, len);
	printsub('>', &opt_reply[2], len - 2);
}
1395/*@*/		else printf("slc_end_reply: not enough room\n");
}
if (opt_reply) {
free(opt_reply);
opt_reply = opt_replyp = opt_replyend = NULL((void *)0);
}
1401}

1403

1405int
1406telrcv(void)
1407{
  int c;
  int scc;
  unsigned char *sbp;
  int count;
  int returnValue = 0;

  scc = 0;
  count = 0;
  while (TTYROOM()(ring_empty_count(&ttyoring)) > 2) {
1
Assuming the condition is true→
2
←
Loop condition is true.  Entering loop body→
if (scc2.1
'scc' is equal to 0
 == 0) {
3
←
Taking true branch→
   if (count3.1
'count' is 0
) {
4
←
Taking false branch→
ring_consumed(&netiring, count);
returnValue = 1;
count = 0;
   }
   sbp = netiring.consume;
   scc = ring_full_consecutive(&netiring);
   if (scc == 0) {
5
←
Assuming 'scc' is not equal to 0→
6
←
Taking false branch→
/* No more data coming in */
break;
   }
}

c = *sbp++ & 0xff, scc--; count++;

switch (telrcv_state) {
7
←
Control jumps to 'case 8:'  at line 1578→

case TS_CR6:
   telrcv_state = TS_DATA0;
   if (c == '\0') {
break;	/* Ignore \0 after CR */
   }
   else if ((c == '\n') && my_want_state_is_dont(TELOPT_ECHO)(!(options[1]&0x08)) && !crmod) {
TTYADD(c)if (!(SYNCHing||flushout)) { *ttyoring.supply = c; ring_supplied
(&ttyoring, 1); };
break;
   }
   /* Else, fall through */

case TS_DATA0:
   if (c == IAC255) {
telrcv_state = TS_IAC1;
break;
   }
    /*
     * The 'crmod' hack (see following) is needed
     * since we can't set CRMOD on output only.
     * Machines like MULTICS like to send \r without
     * \n; since we must turn off CRMOD to get proper
     * input, the mapping is done here (sigh).
     */
   if ((c == '\r') && my_want_state_is_dont(TELOPT_BINARY)(!(options[0]&0x08))) {
if (scc > 0) {
    c = *sbp&0xff;
    if (c == 0) {
	sbp++, scc--; count++;
	/* a "true" CR */
	TTYADD('\r')if (!(SYNCHing||flushout)) { *ttyoring.supply = '\r'; ring_supplied
(&ttyoring, 1); };
    } else if (my_want_state_is_dont(TELOPT_ECHO)(!(options[1]&0x08)) &&
			(c == '\n')) {
	sbp++, scc--; count++;
	TTYADD('\n')if (!(SYNCHing||flushout)) { *ttyoring.supply = '\n'; ring_supplied
(&ttyoring, 1); };
    } else {
	TTYADD('\r')if (!(SYNCHing||flushout)) { *ttyoring.supply = '\r'; ring_supplied
(&ttyoring, 1); };
	if (crmod) {
		TTYADD('\n')if (!(SYNCHing||flushout)) { *ttyoring.supply = '\n'; ring_supplied
(&ttyoring, 1); };
	}
    }
} else {
    telrcv_state = TS_CR6;
    TTYADD('\r')if (!(SYNCHing||flushout)) { *ttyoring.supply = '\r'; ring_supplied
(&ttyoring, 1); };
    if (crmod) {
	    TTYADD('\n')if (!(SYNCHing||flushout)) { *ttyoring.supply = '\n'; ring_supplied
(&ttyoring, 1); };
    }
}
   } else {
TTYADD(c)if (!(SYNCHing||flushout)) { *ttyoring.supply = c; ring_supplied
(&ttyoring, 1); };
   }
   continue;

case TS_IAC1:
1488process_iac:
   switch (c) {

   case WILL251:
telrcv_state = TS_WILL2;
continue;

   case WONT252:
telrcv_state = TS_WONT3;
continue;

   case DO253:
telrcv_state = TS_DO4;
continue;

   case DONT254:
telrcv_state = TS_DONT5;
continue;

   case DM242:
    /*
     * We may have missed an urgent notification,
     * so make sure we flush whatever is in the
     * buffer currently.
     */
printoption("RCVD", IAC255, DM242);
SYNCHing = 1;
(void) ttyflush(1);
SYNCHing = stilloob();
break;

   case SB250:
SB_CLEAR()subpointer = subbuffer;;
telrcv_state = TS_SB7;
continue;

   case IAC255:
TTYADD(IAC)if (!(SYNCHing||flushout)) { *ttyoring.supply = 255; ring_supplied
(&ttyoring, 1); };
break;

   case NOP241:
   case GA249:
   default:
printoption("RCVD", IAC255, c);
break;
   }
   telrcv_state = TS_DATA0;
   continue;

case TS_WILL2:
   printoption("RCVD", WILL251, c);
   willoption(c);
   telrcv_state = TS_DATA0;
   continue;

case TS_WONT3:
   printoption("RCVD", WONT252, c);
   wontoption(c);
   telrcv_state = TS_DATA0;
   continue;

case TS_DO4:
   printoption("RCVD", DO253, c);
   dooption(c);
   if (c == TELOPT_NAWS31) {
sendnaws();
   } else if (c == TELOPT_LFLOW33) {
localflow = 1;
setcommandmode();
setconnmode(0);
   }
   telrcv_state = TS_DATA0;
   continue;

case TS_DONT5:
   printoption("RCVD", DONT254, c);
   dontoption(c);
   flushline = 1;
   setconnmode(0);	/* set new tty mode (maybe) */
   telrcv_state = TS_DATA0;
   continue;

case TS_SB7:
   if (c == IAC255) {
telrcv_state = TS_SE8;
   } else {
SB_ACCUM(c)if (subpointer < (subbuffer+sizeof subbuffer)) { *subpointer
++ = (c); };
   }
   continue;

case TS_SE8:
   if (c != SE240) {
8
←
Assuming 'c' is equal to SE→
9
←
Taking false branch→
if (c != IAC255) {
    /*
     * This is an error.  We only expect to get
     * "IAC IAC" or "IAC SE".  Several things may
     * have happened.  An IAC was not doubled, the
     * IAC SE was left off, or another option got
     * inserted into the suboption are all possibilities.
     * If we assume that the IAC was not doubled,
     * and really the IAC SE was left off, we could
     * get into an infinite loop here.  So, instead,
     * we terminate the suboption, and process the
     * partial suboption if we can.
     */
    SB_ACCUM(IAC)if (subpointer < (subbuffer+sizeof subbuffer)) { *subpointer
++ = (255); };
    SB_ACCUM(c)if (subpointer < (subbuffer+sizeof subbuffer)) { *subpointer
++ = (c); };
    subpointer -= 2;
    SB_TERM(){ subend = subpointer; subpointer = subbuffer;; };

    printoption("In SUBOPTION processing, RCVD", IAC255, c);
    suboption();	/* handle sub-option */
    telrcv_state = TS_IAC1;
    goto process_iac;
}
SB_ACCUM(c)if (subpointer < (subbuffer+sizeof subbuffer)) { *subpointer
++ = (c); };
telrcv_state = TS_SB7;
   } else {
SB_ACCUM(IAC)if (subpointer < (subbuffer+sizeof subbuffer)) { *subpointer
++ = (255); };
10
←
Assuming the condition is false→
11
←
Taking false branch→
SB_ACCUM(SE)if (subpointer < (subbuffer+sizeof subbuffer)) { *subpointer
++ = (240); };
12
←
Assuming the condition is false→
13
←
Taking false branch→
subpointer -= 2;
SB_TERM(){ subend = subpointer; subpointer = subbuffer;; };
suboption();	/* handle sub-option */
14
←
Calling 'suboption'→
telrcv_state = TS_DATA0;
   }
}
  }
  if (count)
ring_consumed(&netiring, count);
  return returnValue||count;
1618}

1620static int bol = 1, local = 0;

1622int
1623rlogin_susp(void)
1624{
  if (local) {
local = 0;
bol = 1;
command(0, "z\n", 2);
return(1);
  }
  return(0);
1632}

1634static int
1635telsnd(void)
1636{
  int tcc;
  int count;
  int returnValue = 0;
  unsigned char *tbp;

  tcc = 0;
  count = 0;
  while (NETROOM()(ring_empty_count(&netoring)) > 2) {
int sc;
int c;

if (tcc == 0) {
   if (count) {
ring_consumed(&ttyiring, count);
returnValue = 1;
count = 0;
   }
   tbp = ttyiring.consume;
   tcc = ring_full_consecutive(&ttyiring);
   if (tcc == 0) {
break;
   }
}
c = *tbp++ & 0xff, sc = strip(c)(eight ? (c) : ((c) & 0x7f)), tcc--; count++;
if (rlogin != _POSIX_VDISABLE(0377)) {
if (bol) {
	bol = 0;
	if (sc == rlogin) {
		local = 1;
		continue;
	}
} else if (local) {
	local = 0;
	if (sc == '.' || c == termEofCharnew_tc.c_cc[0]) {
		bol = 1;
		command(0, "close\n", 6);
		continue;
	}
	if (sc == termSuspCharnew_tc.c_cc[10]) {
		bol = 1;
		command(0, "z\n", 2);
		continue;
	}
	if (sc == escape) {
		command(0, (char *)tbp, tcc);
		bol = 1;
		count += tcc;
		tcc = 0;
		flushline = 1;
		break;
	}
	if (sc != rlogin) {
		++tcc;
		--tbp;
		--count;
		c = sc = rlogin;
	}
}
if ((sc == '\n') || (sc == '\r'))
	bol = 1;
} else if (escape != _POSIX_VDISABLE(0377) && sc == escape) {
   /*
    * Double escape is a pass through of a single escape character.
    */
   if (tcc && strip(*tbp)(eight ? (*tbp) : ((*tbp) & 0x7f)) == escape) {
tbp++;
tcc--;
count++;
bol = 0;
   } else {
command(0, (char *)tbp, tcc);
bol = 1;
count += tcc;
tcc = 0;
flushline = 1;
break;
   }
} else
   bol = 0;
1716#ifdef	KLUDGELINEMODE1
if (kludgelinemode && (globalmode&MODE_EDIT0x01) && (sc == echoc)) {
   if (tcc > 0 && strip(*tbp)(eight ? (*tbp) : ((*tbp) & 0x7f)) == echoc) {
tcc--; tbp++; count++;
   } else {
dontlecho = !dontlecho;
settimer(echotoggle)clocks.echotoggle = clocks.system++;
setconnmode(0);
flushline = 1;
break;
   }
}
1728#endif
if (sc != _POSIX_VDISABLE(0377) && MODE_LOCAL_CHARS(globalmode)((globalmode)&(0x01|0x02))) {
   if (TerminalSpecialChars(sc) == 0) {
bol = 1;
break;
   }
}
if (my_want_state_is_wont(TELOPT_BINARY)(!(options[0]&0x02))) {
   switch (c) {
   case '\n':
    /*
     * If we are in CRMOD mode (\r ==> \n)
     * on our local machine, then probably
     * a newline (unix) is CRLF (TELNET).
     */
if (MODE_LOCAL_CHARS(globalmode)((globalmode)&(0x01|0x02))) {
    NETADD('\r'){ *netoring.supply = '\r'; ring_supplied(&netoring, 1); };
}
NETADD('\n'){ *netoring.supply = '\n'; ring_supplied(&netoring, 1); };
bol = flushline = 1;
break;
   case '\r':
if (!crlf) {
    NET2ADD('\r', '\0'){ { *netoring.supply = '\r'; ring_supplied(&netoring, 1);
 }; { *netoring.supply = '\0'; ring_supplied(&netoring, 1
); }; };
} else {
    NET2ADD('\r', '\n'){ { *netoring.supply = '\r'; ring_supplied(&netoring, 1);
 }; { *netoring.supply = '\n'; ring_supplied(&netoring, 1
); }; };
}
bol = flushline = 1;
break;
   case IAC255:
NET2ADD(IAC, IAC){ { *netoring.supply = 255; ring_supplied(&netoring, 1); }
; { *netoring.supply = 255; ring_supplied(&netoring, 1); }
; };
break;
   default:
NETADD(c){ *netoring.supply = c; ring_supplied(&netoring, 1); };
break;
   }
} else if (c == IAC255) {
   NET2ADD(IAC, IAC){ { *netoring.supply = 255; ring_supplied(&netoring, 1); }
; { *netoring.supply = 255; ring_supplied(&netoring, 1); }
; };
} else {
   NETADD(c){ *netoring.supply = c; ring_supplied(&netoring, 1); };
}
  }
  if (count)
ring_consumed(&ttyiring, count);
  return returnValue||count;		/* Non-zero if we did anything */
1773}
1774
1775/*
* Scheduler()
*
* Try to do something.
*
* If we do something useful, return 1; else return 0.
*
*/

1784int
1785Scheduler(int block)			/* should we block in the select ? */
1786{
/* One wants to be a bit careful about setting returnValue
 * to one, since a one implies we did some useful work,
 * and therefore probably won't be called to block next
 * time (TN3270 mode only).
 */
  int returnValue;
  int netin, netout, netex, ttyin, ttyout;

  /* Decide which rings should be processed */

  netout = ring_full_count(&netoring) &&
   (flushline ||
(my_want_state_is_wont(TELOPT_LINEMODE)(!(options[34]&0x02))
1800#ifdef	KLUDGELINEMODE1
	&& (!kludgelinemode || my_want_state_is_do(TELOPT_SGA)(options[3]&0x08))
1802#endif
) ||
	my_want_state_is_will(TELOPT_BINARY)(options[0]&0x02));
  ttyout = ring_full_count(&ttyoring);

  ttyin = ring_empty_count(&ttyiring) && (clienteof == 0);

  netin = !ISend && ring_empty_count(&netiring);

  netex = !SYNCHing;

  /* If we have seen a signal recently, reset things */

  if (scheduler_lockout_tty) {
ttyin = ttyout = 0;
  }

  /* Call to system code to process rings */

  returnValue = process_rings(netin, netout, netex, ttyin, ttyout, !block);

  /* Now, look at the input rings, looking for work to do. */

  if (ring_full_count(&ttyiring)) {
      returnValue |= telsnd();
  }

  if (ring_full_count(&netiring)) {
returnValue |= telrcv();
  }
  return returnValue;
1833}
1834
1835/*
* Select from tty and network...
*/
1838void
1839telnet(char *user)
1840{
  connections++;
  sys_telnet_init();

  if (pledge("stdio rpath tty", NULL((void *)0)) == -1) {
perror("pledge");
exit(1);
  }

  if (telnetport) {
send_do(TELOPT_SGA3, 1);
send_will(TELOPT_TTYPE24, 1);
send_will(TELOPT_NAWS31, 1);
send_will(TELOPT_TSPEED32, 1);
send_will(TELOPT_LFLOW33, 1);
send_will(TELOPT_LINEMODE34, 1);
send_will(TELOPT_NEW_ENVIRON39, 1);
send_do(TELOPT_STATUS5, 1);
if (env_getvalue("DISPLAY", 0))
   send_will(TELOPT_XDISPLOC35, 1);
if (binary)
   tel_enter_binary(binary);
  }

  for (;;) {
int schedValue;

while ((schedValue = Scheduler(0)) != 0) {
   if (schedValue == -1) {
setcommandmode();
return;
   }
}

if (Scheduler(1) == -1) {
   setcommandmode();
   return;
}
  }
1879}
1880
1881#if	0	/* XXX - this not being in is a bug */
1882/*
* nextitem()
*
*	Return the address of the next "item" in the TELNET data
* stream.  This will be the address of the next character if
* the current address is a user data character, or it will
* be the address of the character following the TELNET command
* if the current address is a TELNET IAC ("I Am a Command")
* character.
*/

1893static char *
1894nextitem(char *current)
1895{
  if ((*current&0xff) != IAC255) {
return current+1;
  }
  switch (*(current+1)&0xff) {
  case DO253:
  case DONT254:
  case WILL251:
  case WONT252:
return current+3;
  case SB250:		/* loop forever looking for the SE */
{
   char *look = current+2;

   for (;;) {
if ((*look++&0xff) == IAC255) {
    if ((*look++&0xff) == SE240) {
	return look;
    }
}
   }
}
  default:
return current+2;
  }
1920}
1921#endif	/* 0 */

1923/*
* netclear()
*
*	We are about to do a TELNET SYNCH operation.  Clear
* the path to the network.
*
*	Things are a bit tricky since we may have sent the first
* byte or so of a previous TELNET command into the network.
* So, we have to scan the network buffer from the beginning
* until we are up to where we want to be.
*
*	A side effect of what we do, just to keep things
* simple, is to clear the urgent data pointer.  The principal
* caller should be setting the urgent data pointer AFTER calling
* us in any case.
*/

1940static void
1941netclear(void)
1942{
1943#if	0	/* XXX */
  char *thisitem, *next;
  char *good;
1946#define	wewant(p)	((nfrontp > p) && ((*p&0xff) == IAC255) && \
		((*(p+1)&0xff) != EC247) && ((*(p+1)&0xff) != EL248))

  thisitem = netobuf;

  while ((next = nextitem(thisitem)) <= netobuf.send) {
thisitem = next;
  }

  /* Now, thisitem is first before/at boundary. */

  good = netobuf;	/* where the good bytes go */

  while (netoring.add > thisitem) {
if (wewant(thisitem)) {
   int length;

   next = thisitem;
   do {
next = nextitem(next);
   } while (wewant(next) && (nfrontp > next));
   length = next-thisitem;
   memmove(good, thisitem, length);
   good += length;
   thisitem = next;
} else {
   thisitem = nextitem(thisitem);
}
  }

1976#endif	/* 0 */
1977}
1978
1979/*
* These routines add various telnet commands to the data stream.
*/

1983static void
1984doflush(void)
1985{
  NET2ADD(IAC, DO){ { *netoring.supply = 255; ring_supplied(&netoring, 1); }
; { *netoring.supply = 253; ring_supplied(&netoring, 1); }
; };
  NETADD(TELOPT_TM){ *netoring.supply = 6; ring_supplied(&netoring, 1); };
  flushline = 1;
  flushout = 1;
  (void) ttyflush(1);			/* Flush/drop output */
  /* do printoption AFTER flush, otherwise the output gets tossed... */
  printoption("SENT", DO253, TELOPT_TM6);
1993}

1995void
1996xmitAO(void)
1997{
  NET2ADD(IAC, AO){ { *netoring.supply = 255; ring_supplied(&netoring, 1); }
; { *netoring.supply = 245; ring_supplied(&netoring, 1); }
; };
  printoption("SENT", IAC255, AO245);
  if (autoflush) {
doflush();
  }
2003}


2006void
2007xmitEL(void)
2008{
  NET2ADD(IAC, EL){ { *netoring.supply = 255; ring_supplied(&netoring, 1); }
; { *netoring.supply = 248; ring_supplied(&netoring, 1); }
; };
  printoption("SENT", IAC255, EL248);
2011}

2013void
2014xmitEC(void)
2015{
  NET2ADD(IAC, EC){ { *netoring.supply = 255; ring_supplied(&netoring, 1); }
; { *netoring.supply = 247; ring_supplied(&netoring, 1); }
; };
  printoption("SENT", IAC255, EC247);
2018}


2021int
2022dosynch(void)
2023{
  netclear();			/* clear the path to the network */
  NETADD(IAC){ *netoring.supply = 255; ring_supplied(&netoring, 1); };
  setneturg();
  NETADD(DM){ *netoring.supply = 242; ring_supplied(&netoring, 1); };
  printoption("SENT", IAC255, DM242);
  return 1;
2030}

2032int want_status_response = 0;

2034int
2035get_status(void)
2036{
  unsigned char tmp[16];
  unsigned char *cp;

  if (my_want_state_is_dont(TELOPT_STATUS)(!(options[5]&0x08))) {
printf("Remote side does not support STATUS option\n");
return 0;
  }
  cp = tmp;

  *cp++ = IAC255;
  *cp++ = SB250;
  *cp++ = TELOPT_STATUS5;
  *cp++ = TELQUAL_SEND1;
  *cp++ = IAC255;
  *cp++ = SE240;
  if (NETROOM()(ring_empty_count(&netoring)) >= cp - tmp) {
ring_supply_data(&netoring, tmp, cp-tmp);
printsub('>', tmp+2, cp - tmp - 2);
  }
  ++want_status_response;
  return 1;
2058}

2060void
2061intp(void)
2062{
  NET2ADD(IAC, IP){ { *netoring.supply = 255; ring_supplied(&netoring, 1); }
; { *netoring.supply = 244; ring_supplied(&netoring, 1); }
; };
  printoption("SENT", IAC255, IP244);
  flushline = 1;
  if (autoflush) {
doflush();
  }
  if (autosynch) {
dosynch();
  }
2072}

2074void
2075sendbrk(void)
2076{
  NET2ADD(IAC, BREAK){ { *netoring.supply = 255; ring_supplied(&netoring, 1); }
; { *netoring.supply = 243; ring_supplied(&netoring, 1); }
; };
  printoption("SENT", IAC255, BREAK243);
  flushline = 1;
  if (autoflush) {
doflush();
  }
  if (autosynch) {
dosynch();
  }
2086}

2088void
2089sendabort(void)
2090{
  NET2ADD(IAC, ABORT){ { *netoring.supply = 255; ring_supplied(&netoring, 1); }
; { *netoring.supply = 238; ring_supplied(&netoring, 1); }
; };
  printoption("SENT", IAC255, ABORT238);
  flushline = 1;
  if (autoflush) {
doflush();
  }
  if (autosynch) {
dosynch();
  }
2100}

2102void
2103sendsusp(void)
2104{
  NET2ADD(IAC, SUSP){ { *netoring.supply = 255; ring_supplied(&netoring, 1); }
; { *netoring.supply = 237; ring_supplied(&netoring, 1); }
; };
  printoption("SENT", IAC255, SUSP237);
  flushline = 1;
  if (autoflush) {
doflush();
  }
  if (autosynch) {
dosynch();
  }
2114}

2116void
2117sendeof(void)
2118{
  NET2ADD(IAC, xEOF){ { *netoring.supply = 255; ring_supplied(&netoring, 1); }
; { *netoring.supply = 236; ring_supplied(&netoring, 1); }
; };
  printoption("SENT", IAC255, xEOF236);
2121}

2123void
2124sendayt(void)
2125{
  NET2ADD(IAC, AYT){ { *netoring.supply = 255; ring_supplied(&netoring, 1); }
; { *netoring.supply = 246; ring_supplied(&netoring, 1); }
; };
  printoption("SENT", IAC255, AYT246);
2128}

2130/*
* Send a window size update to the remote system.
*/

2134void
2135sendnaws(void)
2136{
  long rows, cols;
  unsigned char tmp[16];
  unsigned char *cp;

  if (my_state_is_wont(TELOPT_NAWS)(!(options[31]&0x01)))
return;

2144#define	PUTSHORT(cp, x){ if ((*cp++ = ((x)>>8)&0xff) == 255) *cp++ = 255; if
 ((*cp++ = ((x))&0xff) == 255) *cp++ = 255; } { if ((*cp++ = ((x)>>8)&0xff) == IAC255) *cp++ = IAC255; \
	    if ((*cp++ = ((x))&0xff) == IAC255) *cp++ = IAC255; }

  if (TerminalWindowSize(&rows, &cols) == 0) {	/* Failed */
return;
  }

  cp = tmp;

  *cp++ = IAC255;
  *cp++ = SB250;
  *cp++ = TELOPT_NAWS31;
  PUTSHORT(cp, cols){ if ((*cp++ = ((cols)>>8)&0xff) == 255) *cp++ = 255
; if ((*cp++ = ((cols))&0xff) == 255) *cp++ = 255; };
  PUTSHORT(cp, rows){ if ((*cp++ = ((rows)>>8)&0xff) == 255) *cp++ = 255
; if ((*cp++ = ((rows))&0xff) == 255) *cp++ = 255; };
  *cp++ = IAC255;
  *cp++ = SE240;
  if (NETROOM()(ring_empty_count(&netoring)) >= cp - tmp) {
ring_supply_data(&netoring, tmp, cp-tmp);
printsub('>', tmp+2, cp - tmp - 2);
  }
2164}

2166void
2167tel_enter_binary(int rw)
2168{
  if (rw&1)
send_do(TELOPT_BINARY0, 1);
  if (rw&2)
send_will(TELOPT_BINARY0, 1);
2173}

2175void
2176tel_leave_binary(int rw)
2177{
  if (rw&1)
send_dont(TELOPT_BINARY0, 1);
  if (rw&2)
send_wont(TELOPT_BINARY0, 1);
2182}