clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name usbhidaction.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.bin/usbhidaction/obj -resource-dir /usr/local/lib/clang/13.0.0 -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.bin/usbhidaction/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.bin/usbhidaction/usbhidaction.c
1 | |
2 | |
3 | |
4 | |
5 | |
6 | |
7 | |
8 | |
9 | |
10 | |
11 | |
12 | |
13 | |
14 | |
15 | |
16 | |
17 | |
18 | |
19 | |
20 | |
21 | |
22 | |
23 | |
24 | |
25 | |
26 | |
27 | |
28 | |
29 | |
30 | |
31 | |
32 | |
33 | #include <stdio.h> |
34 | #include <stdlib.h> |
35 | #include <string.h> |
36 | #include <ctype.h> |
37 | #include <err.h> |
38 | #include <fcntl.h> |
39 | #include <limits.h> |
40 | #include <unistd.h> |
41 | #include <sys/types.h> |
42 | #include <sys/ioctl.h> |
43 | #include <dev/usb/usb.h> |
44 | #include <dev/usb/usbhid.h> |
45 | #include <usbhid.h> |
46 | #include <syslog.h> |
47 | #include <signal.h> |
48 | #include <paths.h> |
49 | |
50 | int verbose = 0; |
51 | int isdemon = 0; |
52 | |
53 | volatile sig_atomic_t reparse = 0; |
54 | |
55 | struct command { |
56 | struct command *next; |
57 | int line; |
58 | |
59 | struct hid_item item; |
60 | int value; |
61 | char anyvalue; |
62 | char *name; |
63 | char *action; |
64 | }; |
65 | struct command *commands; |
66 | |
67 | #define SIZE 4000 |
68 | |
69 | void usage(void); |
70 | struct command *parse_conf(const char *, report_desc_t, int, int); |
71 | void docmd(struct command *, int, const char *, int, char **); |
72 | void freecommands(struct command *); |
73 | |
74 | |
75 | static void |
76 | sighup(int signo) |
77 | { |
78 | reparse = 1; |
79 | } |
80 | |
81 | int |
82 | main(int argc, char **argv) |
83 | { |
84 | const char *conf = NULL; |
85 | const char *dev = NULL; |
86 | int fd, ch, sz, n, val, i; |
87 | int demon, ignore; |
88 | report_desc_t repd; |
89 | char buf[100]; |
90 | char devnamebuf[PATH_MAX]; |
91 | struct command *cmd; |
92 | int reportid; |
93 | |
94 | demon = 1; |
95 | ignore = 0; |
96 | while ((ch = getopt(argc, argv, "c:df:iv")) != -1) { |
| 1 | Assuming the condition is true | |
|
| 2 | | Loop condition is true. Entering loop body | |
|
| 5 | | Assuming the condition is true | |
|
| 6 | | Loop condition is true. Entering loop body | |
|
| 9 | | Assuming the condition is false | |
|
| 10 | | Loop condition is false. Execution continues on line 119 | |
|
97 | switch(ch) { |
| 3 | | Control jumps to 'case 102:' at line 107 | |
|
| 7 | | Control jumps to 'case 99:' at line 98 | |
|
98 | case 'c': |
99 | conf = optarg; |
100 | break; |
| 8 | | Execution continues on line 96 | |
|
101 | case 'd': |
102 | demon ^= 1; |
103 | break; |
104 | case 'i': |
105 | ignore++; |
106 | break; |
107 | case 'f': |
108 | dev = optarg; |
109 | break; |
| 4 | | Execution continues on line 96 | |
|
110 | case 'v': |
111 | demon = 0; |
112 | verbose++; |
113 | break; |
114 | case '?': |
115 | default: |
116 | usage(); |
117 | } |
118 | } |
119 | argc -= optind; |
120 | argv += optind; |
121 | |
122 | if (conf == NULL || dev == NULL) |
| 11 | | Assuming 'conf' is not equal to NULL | |
|
| |
123 | usage(); |
124 | |
125 | if (hid_start(NULL) == -1) |
| 13 | | Assuming the condition is false | |
|
| |
126 | errx(1, "hid_init"); |
127 | |
128 | if (dev[0] != '/') { |
| 15 | | Assuming the condition is false | |
|
| |
129 | snprintf(devnamebuf, sizeof(devnamebuf), "/dev/%s%s", |
130 | isdigit((unsigned char)dev[0]) ? "uhid" : "", dev); |
131 | dev = devnamebuf; |
132 | } |
133 | |
134 | if (demon && conf[0] != '/') |
| |
135 | errx(1, "config file must have an absolute path, %s", conf); |
136 | |
137 | fd = open(dev, O_RDWR | O_CLOEXEC); |
138 | if (fd == -1) |
| 18 | | Assuming the condition is false | |
|
| |
139 | err(1, "%s", dev); |
140 | |
141 | if (ioctl(fd, USB_GET_REPORT_ID, &reportid) == -1) |
| 20 | | Assuming the condition is false | |
|
| |
142 | reportid = -1; |
143 | repd = hid_get_report_desc(fd); |
144 | if (repd == NULL) |
| 22 | | Assuming 'repd' is not equal to NULL | |
|
| |
145 | err(1, "hid_get_report_desc() failed"); |
146 | |
147 | commands = parse_conf(conf, repd, reportid, ignore); |
| |
148 | |
149 | sz = hid_report_size(repd, hid_input, reportid); |
150 | |
151 | if (verbose) |
152 | printf("report size %d\n", sz); |
153 | if (sz > sizeof buf) |
154 | errx(1, "report too large"); |
155 | |
156 | (void)signal(SIGHUP, sighup); |
157 | |
158 | |
159 | (void)signal(SIGCHLD, SIG_IGN); |
160 | |
161 | if (demon) { |
162 | if (daemon(0, 0) == -1) |
163 | err(1, "daemon()"); |
164 | isdemon = 1; |
165 | } |
166 | |
167 | if (unveil(conf, "r") == -1) |
168 | err(1, "unveil %s", conf); |
169 | if (unveil(NULL, NULL) == -1) |
170 | err(1, "unveil"); |
171 | |
172 | for(;;) { |
173 | n = read(fd, buf, sz); |
174 | if (verbose > 2) { |
175 | printf("read %d bytes:", n); |
176 | for (i = 0; i < n; i++) |
177 | printf(" %02x", buf[i]); |
178 | printf("\n"); |
179 | } |
180 | if (n == -1) { |
181 | if (verbose) |
182 | err(1, "read"); |
183 | else |
184 | exit(1); |
185 | } |
186 | if (n != sz) { |
187 | err(2, "read size"); |
188 | } |
189 | for (cmd = commands; cmd; cmd = cmd->next) { |
190 | val = hid_get_data(buf, &cmd->item); |
191 | if (cmd->value == val || cmd->anyvalue) |
192 | docmd(cmd, val, dev, argc, argv); |
193 | } |
194 | if (reparse) { |
195 | struct command *cmds = |
196 | parse_conf(conf, repd, reportid, ignore); |
197 | if (cmds) { |
198 | freecommands(commands); |
199 | commands = cmds; |
200 | } |
201 | reparse = 0; |
202 | } |
203 | } |
204 | |
205 | exit(0); |
206 | } |
207 | |
208 | void |
209 | usage(void) |
210 | { |
211 | extern char *__progname; |
212 | |
213 | fprintf(stderr, "usage: %s [-div] -c config-file -f device arg ...\n", |
214 | __progname); |
215 | exit(1); |
216 | } |
217 | |
218 | static int |
219 | peek(FILE *f) |
220 | { |
221 | int c; |
222 | |
223 | c = getc(f); |
224 | if (c != EOF) |
225 | ungetc(c, f); |
226 | return c; |
227 | } |
228 | |
229 | struct command * |
230 | parse_conf(const char *conf, report_desc_t repd, int reportid, int ignore) |
231 | { |
232 | FILE *f; |
233 | char *p; |
234 | int line; |
235 | char buf[SIZE], name[SIZE], value[SIZE], action[SIZE]; |
236 | char usage[SIZE], coll[SIZE]; |
237 | struct command *cmd, *cmds; |
238 | struct hid_data *d; |
239 | struct hid_item h; |
240 | int u, lo, hi, range; |
241 | |
242 | f = fopen(conf, "r"); |
243 | if (f == NULL) |
| 25 | | Assuming 'f' is not equal to NULL | |
|
| |
244 | err(1, "%s", conf); |
245 | |
246 | cmds = NULL; |
247 | for (line = 1; ; line++) { |
| 27 | | Loop condition is true. Entering loop body | |
|
248 | if (fgets(buf, sizeof buf, f) == NULL) |
| 28 | | Assuming the condition is false | |
|
| |
249 | break; |
250 | if (buf[0] == '#' || buf[0] == '\n') |
| 30 | | Assuming the condition is false | |
|
| 31 | | Assuming the condition is false | |
|
| |
251 | continue; |
252 | p = strchr(buf, '\n'); |
253 | while (p && isspace(peek(f))) { |
| |
254 | if (fgets(p, sizeof buf - strlen(buf), f) == NULL) |
255 | break; |
256 | p = strchr(buf, '\n'); |
257 | } |
258 | if (p) |
| |
259 | *p = 0; |
260 | if (sscanf(buf, "%s %s %[^\n]", name, value, action) != 3) { |
| 35 | | Assuming the condition is false | |
|
| |
261 | if (isdemon) { |
262 | syslog(LOG_WARNING, "config file `%s', line %d" |
263 | ", syntax error: %s", conf, line, buf); |
264 | freecommands(cmds); |
265 | fclose(f); |
266 | return (NULL); |
267 | } else { |
268 | errx(1, "config file `%s', line %d" |
269 | ", syntax error: %s", conf, line, buf); |
270 | } |
271 | } |
272 | |
273 | cmd = malloc(sizeof *cmd); |
| 37 | | Uninitialized value stored to field 'value' | |
|
274 | if (cmd == NULL) |
| 38 | | Assuming 'cmd' is not equal to NULL | |
|
| |
275 | err(1, "malloc failed"); |
276 | cmd->next = cmds; |
277 | cmds = cmd; |
278 | cmd->line = line; |
279 | |
280 | if (strcmp(value, "*") == 0) { |
| 40 | | Assuming the condition is true | |
|
| |
281 | cmd->anyvalue = 1; |
282 | } else { |
283 | cmd->anyvalue = 0; |
284 | if (sscanf(value, "%d", &cmd->value) != 1) { |
285 | if (isdemon) { |
286 | syslog(LOG_WARNING, |
287 | "config file `%s', line %d, " |
288 | "bad value: %s", |
289 | conf, line, value); |
290 | freecommands(cmds); |
291 | fclose(f); |
292 | return (NULL); |
293 | } else { |
294 | errx(1, "config file `%s', line %d, " |
295 | "bad value: %s", |
296 | conf, line, value); |
297 | } |
298 | } |
299 | } |
300 | |
301 | coll[0] = 0; |
302 | d = hid_start_parse(repd, 1 << hid_input, reportid); |
303 | if (d == NULL) |
| 42 | | Assuming 'd' is not equal to NULL | |
|
| |
304 | err(1, "hid_start_parse failed"); |
305 | while (hid_get_item(d, &h)) { |
| 44 | | Loop condition is true. Entering loop body | |
|
306 | if (verbose > 2) |
| 45 | | Assuming 'verbose' is <= 2 | |
|
| |
307 | printf("kind=%d usage=%x\n", h.kind, h.usage); |
308 | if (h.flags & HIO_CONST) |
| 47 | | Assuming the condition is false | |
|
| |
309 | continue; |
310 | switch (h.kind) { |
| 49 | | Control jumps to 'case hid_input:' at line 311 | |
|
311 | case hid_input: |
312 | if (h.usage_minimum != 0 || |
| 50 | | Assuming field 'usage_minimum' is not equal to 0 | |
|
313 | h.usage_maximum != 0) { |
314 | lo = h.usage_minimum; |
315 | hi = h.usage_maximum; |
316 | range = 1; |
317 | } else { |
318 | lo = h.usage; |
319 | hi = h.usage; |
320 | range = 0; |
321 | } |
322 | for (u = lo; u <= hi; u++) { |
| 51 | | Assuming 'u' is <= 'hi' | |
|
| 52 | | Loop condition is true. Entering loop body | |
|
323 | snprintf(usage, sizeof usage, "%s:%s", |
324 | hid_usage_page(HID_PAGE(u)), |
325 | hid_usage_in_page(u)); |
326 | if (verbose > 2) |
| |
327 | printf("usage %s\n", usage); |
328 | if (!strcasecmp(usage, name)) |
| 54 | | Assuming the condition is true | |
|
| |
329 | goto foundhid; |
| 56 | | Control jumps to line 378 | |
|
330 | if (coll[0]) { |
331 | snprintf(usage, sizeof usage, |
332 | "%s.%s:%s", coll+1, |
333 | hid_usage_page(HID_PAGE(u)), |
334 | hid_usage_in_page(u)); |
335 | if (verbose > 2) |
336 | printf("usage %s\n", |
337 | usage); |
338 | if (!strcasecmp(usage, name)) |
339 | goto foundhid; |
340 | } |
341 | } |
342 | break; |
343 | case hid_collection: |
344 | snprintf(coll + strlen(coll), |
345 | sizeof coll - strlen(coll), ".%s:%s", |
346 | hid_usage_page(HID_PAGE(h.usage)), |
347 | hid_usage_in_page(h.usage)); |
348 | break; |
349 | case hid_endcollection: |
350 | if (coll[0]) |
351 | *strrchr(coll, '.') = 0; |
352 | break; |
353 | default: |
354 | break; |
355 | } |
356 | } |
357 | hid_end_parse(d); |
358 | if (ignore) { |
359 | if (verbose) |
360 | warnx("ignore item '%s'", name); |
361 | |
362 | cmds = cmd->next; |
363 | free(cmd); |
364 | continue; |
365 | } |
366 | if (isdemon) { |
367 | syslog(LOG_WARNING, "config file `%s', line %d, HID " |
368 | "item not found: `%s'", conf, line, name); |
369 | freecommands(cmds); |
370 | fclose(f); |
371 | return (NULL); |
372 | } else { |
373 | errx(1, "config file `%s', line %d, HID item " |
374 | "not found: `%s'", conf, line, name); |
375 | } |
376 | |
377 | foundhid: |
378 | hid_end_parse(d); |
379 | cmd->item = h; |
380 | cmd->name = strdup(name); |
381 | cmd->action = strdup(action); |
382 | if (range) { |
| |
383 | if (cmd->value == 1) |
| 58 | | The left operand of '==' is a garbage value |
|
384 | cmd->value = u - lo; |
385 | else |
386 | cmd->value = -1; |
387 | } |
388 | |
389 | if (verbose) |
390 | printf("PARSE:%d %s, %d, '%s'\n", cmd->line, name, |
391 | cmd->value, cmd->action); |
392 | } |
393 | fclose(f); |
394 | return (cmds); |
395 | } |
396 | |
397 | void |
398 | docmd(struct command *cmd, int value, const char *hid, int argc, char **argv) |
399 | { |
400 | char cmdbuf[SIZE], *p, *q; |
401 | size_t len; |
402 | int n, r; |
403 | pid_t pid; |
404 | |
405 | if (cmd->action == NULL) { |
406 | if (verbose) |
407 | printf("no action for device %s value %d\n", |
408 | hid, value); |
409 | return; |
410 | } |
411 | for (p = cmd->action, q = cmdbuf; *p && q < &cmdbuf[SIZE-1]; ) { |
412 | if (*p == '$') { |
413 | p++; |
414 | len = &cmdbuf[SIZE-1] - q; |
415 | if (isdigit((unsigned char)*p)) { |
416 | n = strtol(p, &p, 10) - 1; |
417 | if (n >= 0 && n < argc) { |
418 | strncpy(q, argv[n], len); |
419 | q += strlen(q); |
420 | } |
421 | } else if (*p == 'V') { |
422 | p++; |
423 | snprintf(q, len, "%d", value); |
424 | q += strlen(q); |
425 | } else if (*p == 'N') { |
426 | p++; |
427 | strncpy(q, cmd->name, len); |
428 | q += strlen(q); |
429 | } else if (*p == 'H') { |
430 | p++; |
431 | strncpy(q, hid, len); |
432 | q += strlen(q); |
433 | } else if (*p) { |
434 | *q++ = *p++; |
435 | } |
436 | } else { |
437 | *q++ = *p++; |
438 | } |
439 | } |
440 | *q = 0; |
441 | |
442 | pid = fork(); |
443 | if (pid == -1) |
444 | warn("fork failed"); |
445 | else if (pid == 0) { |
446 | setpgid(0, 0); |
447 | if (verbose) |
448 | printf("executing '%s'\n", cmdbuf); |
449 | r = execl(_PATH_BSHELL, "sh", "-c", cmdbuf, (char *)NULL); |
450 | err(1, "execl"); |
451 | } |
452 | } |
453 | |
454 | void |
455 | freecommands(struct command *cmd) |
456 | { |
457 | struct command *next; |
458 | |
459 | while (cmd) { |
460 | next = cmd->next; |
461 | free(cmd); |
462 | cmd = next; |
463 | } |
464 | } |