/usr/src/usr.bin/rcs/rcs.c

Bug Summary

File:	src/usr.bin/rcs/rcs.c
Warning:	line 891, column 16 Use of memory after it is freed
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name rcs.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.bin/rcs/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/usr.bin/rcs -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.bin/rcs/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.bin/rcs/rcs.c
1/*	$OpenBSD: rcs.c,v 1.89 2021/11/28 19:28:42 deraadt Exp $	*/
2/*
* Copyright (c) 2004 Jean-Francois Brousseau <jfb@openbsd.org>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. The name of the author may not be used to endorse or promote products
*    derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
* THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
* EXEMPLARY, OR CONSEQUENTIAL  DAMAGES (INCLUDING, BUT NOT LIMITED TO,
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
* OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

27#include <sys/types.h>
28#include <sys/stat.h>

30#include <ctype.h>
31#include <err.h>
32#include <errno(*__errno()).h>
33#include <pwd.h>
34#include <stdarg.h>
35#include <stdio.h>
36#include <stdlib.h>
37#include <string.h>
38#include <unistd.h>

40#include "diff.h"
41#include "rcs.h"
42#include "rcsparse.h"
43#include "rcsprog.h"
44#include "rcsutil.h"
45#include "xmalloc.h"

47#define _MAXBSIZE(64 * 1024) (64 * 1024)

49#define MINIMUM(a, b)(((a) < (b)) ? (a) : (b))	(((a) < (b)) ? (a) : (b))

51/* invalid characters in RCS states */
52static const char rcs_state_invch[] = RCS_STATE_INVALCHAR"$,:;@";

54/* invalid characters in RCS symbol names */
55static const char rcs_sym_invch[] = RCS_SYM_INVALCHAR"$,.:;@";

57struct rcs_kw rcs_expkw[] =  {
{ "Author",	RCS_KW_AUTHOR0x1000   },
{ "Date",	RCS_KW_DATE0x2000     },
{ "Locker",	RCS_KW_LOCKER0x10000   },
{ "Header",	RCS_KW_HEADER((0x0100 | 0x0200 | 0x2000 | 0x1000 | 0x0800 | 0x10000) | 0x0010
)   },
{ "Id",		RCS_KW_ID(0x0100 | 0x0200 | 0x2000 | 0x1000 | 0x0800 | 0x10000)       },
{ "OpenBSD",	RCS_KW_ID(0x0100 | 0x0200 | 0x2000 | 0x1000 | 0x0800 | 0x10000)       },
{ "Log",	RCS_KW_LOG0x4000      },
{ "Name",	RCS_KW_NAME0x8000     },
{ "RCSfile",	RCS_KW_RCSFILE0x0100  },
{ "Revision",	RCS_KW_REVISION0x0200 },
{ "Source",	RCS_KW_SOURCE0x0400   },
{ "State",	RCS_KW_STATE0x0800    },
{ "Mdocdate",	RCS_KW_MDOCDATE0x0020 },
71};

73int rcs_errno = RCS_ERR_NOERR0;
74char *timezone_flag = NULL((void *)0);

76int		rcs_patch_lines(struct rcs_lines *, struct rcs_lines *);
77static int	rcs_movefile(char *, char *, mode_t, u_int);

79static void	rcs_freedelta(struct rcs_delta *);
80static void	rcs_strprint(const u_char *, size_t, FILE *);

82static BUF	*rcs_expand_keywords(char *, struct rcs_delta *, BUF *, int);

84RCSFILE *
85rcs_open(const char *path, int fd, int flags, ...)
86{
int mode;
mode_t fmode;
RCSFILE *rfp;
va_list vap;
struct rcs_delta *rdp;
struct rcs_lock *lkr;

fmode = S_IRUSR0000400|S_IRGRP0000040|S_IROTH0000004;
flags &= 0xffff;	/* ditch any internal flags */

if (flags & RCS_CREATE(1<<2)) {
va_start(vap, flags)__builtin_va_start(vap, flags);
mode = va_arg(vap, int)__builtin_va_arg(vap, int);
va_end(vap)__builtin_va_end(vap);
fmode = (mode_t)mode;
}

rfp = xcalloc(1, sizeof(*rfp));

rfp->rf_path = xstrdup(path);
rfp->rf_flags = flags | RCS_SLOCK(1<<6) | RCS_SYNCED(1<<5);
rfp->rf_mode = fmode;
if (fd == -1)
rfp->rf_file = NULL((void *)0);
else if ((rfp->rf_file = fdopen(fd, "r")) == NULL((void *)0))
err(1, "rcs_open: fdopen: `%s'", path);

TAILQ_INIT(&(rfp->rf_delta))do { (&(rfp->rf_delta))->tqh_first = ((void *)0); (
&(rfp->rf_delta))->tqh_last = &(&(rfp->rf_delta
))->tqh_first; } while (0);
TAILQ_INIT(&(rfp->rf_access))do { (&(rfp->rf_access))->tqh_first = ((void *)0); (
&(rfp->rf_access))->tqh_last = &(&(rfp->
rf_access))->tqh_first; } while (0);
TAILQ_INIT(&(rfp->rf_symbols))do { (&(rfp->rf_symbols))->tqh_first = ((void *)0);
 (&(rfp->rf_symbols))->tqh_last = &(&(rfp->
rf_symbols))->tqh_first; } while (0);
TAILQ_INIT(&(rfp->rf_locks))do { (&(rfp->rf_locks))->tqh_first = ((void *)0); (
&(rfp->rf_locks))->tqh_last = &(&(rfp->rf_locks
))->tqh_first; } while (0);

if (!(rfp->rf_flags & RCS_CREATE(1<<2))) {
if (rcsparse_init(rfp))
	errx(1, "could not parse admin data");

/* fill in rd_locker */
TAILQ_FOREACH(lkr, &(rfp->rf_locks), rl_list)for((lkr) = ((&(rfp->rf_locks))->tqh_first); (lkr) !=
 ((void *)0); (lkr) = ((lkr)->rl_list.tqe_next)) {
	if ((rdp = rcs_findrev(rfp, lkr->rl_num)) == NULL((void *)0)) {
		rcs_close(rfp);
		return (NULL((void *)0));
	}

	rdp->rd_locker = xstrdup(lkr->rl_name);
}
}

return (rfp);
135}

137/*
* rcs_close()
*
* Close an RCS file handle.
*/
142void
143rcs_close(RCSFILE *rfp)
144{
struct rcs_delta *rdp;
struct rcs_access *rap;
struct rcs_lock *rlp;
struct rcs_sym *rsp;

if ((rfp->rf_flags & RCS_WRITE(1<<1)) && !(rfp->rf_flags & RCS_SYNCED(1<<5)))
rcs_write(rfp);

while (!TAILQ_EMPTY(&(rfp->rf_delta))(((&(rfp->rf_delta))->tqh_first) == ((void *)0))) {
rdp = TAILQ_FIRST(&(rfp->rf_delta))((&(rfp->rf_delta))->tqh_first);
TAILQ_REMOVE(&(rfp->rf_delta), rdp, rd_list)do { if (((rdp)->rd_list.tqe_next) != ((void *)0)) (rdp)->
rd_list.tqe_next->rd_list.tqe_prev = (rdp)->rd_list.tqe_prev
; else (&(rfp->rf_delta))->tqh_last = (rdp)->rd_list
.tqe_prev; *(rdp)->rd_list.tqe_prev = (rdp)->rd_list.tqe_next
; ; ; } while (0);
rcs_freedelta(rdp);
}

while (!TAILQ_EMPTY(&(rfp->rf_access))(((&(rfp->rf_access))->tqh_first) == ((void *)0))) {
rap = TAILQ_FIRST(&(rfp->rf_access))((&(rfp->rf_access))->tqh_first);
TAILQ_REMOVE(&(rfp->rf_access), rap, ra_list)do { if (((rap)->ra_list.tqe_next) != ((void *)0)) (rap)->
ra_list.tqe_next->ra_list.tqe_prev = (rap)->ra_list.tqe_prev
; else (&(rfp->rf_access))->tqh_last = (rap)->ra_list
.tqe_prev; *(rap)->ra_list.tqe_prev = (rap)->ra_list.tqe_next
; ; ; } while (0);
free(rap->ra_name);
free(rap);
}

while (!TAILQ_EMPTY(&(rfp->rf_symbols))(((&(rfp->rf_symbols))->tqh_first) == ((void *)0))) {
rsp = TAILQ_FIRST(&(rfp->rf_symbols))((&(rfp->rf_symbols))->tqh_first);
TAILQ_REMOVE(&(rfp->rf_symbols), rsp, rs_list)do { if (((rsp)->rs_list.tqe_next) != ((void *)0)) (rsp)->
rs_list.tqe_next->rs_list.tqe_prev = (rsp)->rs_list.tqe_prev
; else (&(rfp->rf_symbols))->tqh_last = (rsp)->rs_list
.tqe_prev; *(rsp)->rs_list.tqe_prev = (rsp)->rs_list.tqe_next
; ; ; } while (0);
rcsnum_free(rsp->rs_num);
free(rsp->rs_name);
free(rsp);
}

while (!TAILQ_EMPTY(&(rfp->rf_locks))(((&(rfp->rf_locks))->tqh_first) == ((void *)0))) {
rlp = TAILQ_FIRST(&(rfp->rf_locks))((&(rfp->rf_locks))->tqh_first);
TAILQ_REMOVE(&(rfp->rf_locks), rlp, rl_list)do { if (((rlp)->rl_list.tqe_next) != ((void *)0)) (rlp)->
rl_list.tqe_next->rl_list.tqe_prev = (rlp)->rl_list.tqe_prev
; else (&(rfp->rf_locks))->tqh_last = (rlp)->rl_list
.tqe_prev; *(rlp)->rl_list.tqe_prev = (rlp)->rl_list.tqe_next
; ; ; } while (0);
rcsnum_free(rlp->rl_num);
free(rlp->rl_name);
free(rlp);
}

rcsnum_free(rfp->rf_head);
rcsnum_free(rfp->rf_branch);

if (rfp->rf_file != NULL((void *)0))
fclose(rfp->rf_file);

free(rfp->rf_path);
free(rfp->rf_comment);
free(rfp->rf_expand);
free(rfp->rf_desc);
if (rfp->rf_pdata != NULL((void *)0))
rcsparse_free(rfp);

free(rfp);
196}

198/*
* rcs_write()
*
* Write the contents of the RCS file handle <rfp> to disk in the file whose
* path is in <rf_path>.
*/
204void
205rcs_write(RCSFILE *rfp)
206{
FILE *fp;
char numbuf[RCS_REV_BUFSZ64], *fn;
struct rcs_access *ap;
struct rcs_sym *symp;
struct rcs_branch *brp;
struct rcs_delta *rdp;
struct rcs_lock *lkp;
size_t len;
int fd;

fn = NULL((void *)0);

if (rfp->rf_flags & RCS_SYNCED(1<<5))
return;

/* Write operations need the whole file parsed */
if (rcsparse_deltatexts(rfp, NULL((void *)0)))
errx(1, "problem parsing deltatexts");

(void)xasprintf(&fn, "%s/rcs.XXXXXXXXXX", rcs_tmpdir);

if ((fd = mkstemp(fn)) == -1)
err(1, "%s", fn);

if ((fp = fdopen(fd, "w+")) == NULL((void *)0)) {
int saved_errno;

saved_errno = errno(*__errno());
(void)unlink(fn);
errno(*__errno()) = saved_errno;
err(1, "%s", fn);
}

worklist_add(fn, &temp_files);

if (rfp->rf_head != NULL((void *)0))
rcsnum_tostr(rfp->rf_head, numbuf, sizeof(numbuf));
else
numbuf[0] = '\0';

fprintf(fp, "head\t%s;\n", numbuf);

if (rfp->rf_branch != NULL((void *)0)) {
rcsnum_tostr(rfp->rf_branch, numbuf, sizeof(numbuf));
fprintf(fp, "branch\t%s;\n", numbuf);
}

fputs("access", fp);
TAILQ_FOREACH(ap, &(rfp->rf_access), ra_list)for((ap) = ((&(rfp->rf_access))->tqh_first); (ap) !=
 ((void *)0); (ap) = ((ap)->ra_list.tqe_next)) {
fprintf(fp, "\n\t%s", ap->ra_name);
}
fputs(";\n", fp);

fprintf(fp, "symbols");
TAILQ_FOREACH(symp, &(rfp->rf_symbols), rs_list)for((symp) = ((&(rfp->rf_symbols))->tqh_first); (symp
) != ((void *)0); (symp) = ((symp)->rs_list.tqe_next)) {
if (RCSNUM_ISBRANCH(symp->rs_num)((symp->rs_num)->rn_len % 2))
	rcsnum_addmagic(symp->rs_num);
rcsnum_tostr(symp->rs_num, numbuf, sizeof(numbuf));
fprintf(fp, "\n\t%s:%s", symp->rs_name, numbuf);
}
fprintf(fp, ";\n");

fprintf(fp, "locks");
TAILQ_FOREACH(lkp, &(rfp->rf_locks), rl_list)for((lkp) = ((&(rfp->rf_locks))->tqh_first); (lkp) !=
 ((void *)0); (lkp) = ((lkp)->rl_list.tqe_next)) {
rcsnum_tostr(lkp->rl_num, numbuf, sizeof(numbuf));
fprintf(fp, "\n\t%s:%s", lkp->rl_name, numbuf);
}

fprintf(fp, ";");

if (rfp->rf_flags & RCS_SLOCK(1<<6))
fprintf(fp, " strict;");
fputc('\n', fp);

fputs("comment\t@", fp);
if (rfp->rf_comment != NULL((void *)0)) {
rcs_strprint((const u_char *)rfp->rf_comment,
    strlen(rfp->rf_comment), fp);
fputs("@;\n", fp);
} else
fputs("# @;\n", fp);

if (rfp->rf_expand != NULL((void *)0)) {
fputs("expand @", fp);
rcs_strprint((const u_char *)rfp->rf_expand,
    strlen(rfp->rf_expand), fp);
fputs("@;\n", fp);
}

fputs("\n\n", fp);

TAILQ_FOREACH(rdp, &(rfp->rf_delta), rd_list)for((rdp) = ((&(rfp->rf_delta))->tqh_first); (rdp) !=
 ((void *)0); (rdp) = ((rdp)->rd_list.tqe_next)) {
fprintf(fp, "%s\n", rcsnum_tostr(rdp->rd_num, numbuf,
    sizeof(numbuf)));
fprintf(fp, "date\t%d.%02d.%02d.%02d.%02d.%02d;",
    rdp->rd_date.tm_year + 1900, rdp->rd_date.tm_mon + 1,
    rdp->rd_date.tm_mday, rdp->rd_date.tm_hour,
    rdp->rd_date.tm_min, rdp->rd_date.tm_sec);
fprintf(fp, "\tauthor %s;\tstate %s;\n",
    rdp->rd_author, rdp->rd_state);
fputs("branches", fp);
TAILQ_FOREACH(brp, &(rdp->rd_branches), rb_list)for((brp) = ((&(rdp->rd_branches))->tqh_first); (brp
) != ((void *)0); (brp) = ((brp)->rb_list.tqe_next)) {
	fprintf(fp, "\n\t%s", rcsnum_tostr(brp->rb_num, numbuf,
	    sizeof(numbuf)));
}
fputs(";\n", fp);
fprintf(fp, "next\t%s;\n\n", rcsnum_tostr(rdp->rd_next,
    numbuf, sizeof(numbuf)));
}

fputs("\ndesc\n@", fp);
if (rfp->rf_desc != NULL((void *)0) && (len = strlen(rfp->rf_desc)) > 0) {
rcs_strprint((const u_char *)rfp->rf_desc, len, fp);
if (rfp->rf_desc[len-1] != '\n')
	fputc('\n', fp);
}
fputs("@\n", fp);

/* deltatexts */
TAILQ_FOREACH(rdp, &(rfp->rf_delta), rd_list)for((rdp) = ((&(rfp->rf_delta))->tqh_first); (rdp) !=
 ((void *)0); (rdp) = ((rdp)->rd_list.tqe_next)) {
fprintf(fp, "\n\n%s\n", rcsnum_tostr(rdp->rd_num, numbuf,
    sizeof(numbuf)));
fputs("log\n@", fp);
if (rdp->rd_log != NULL((void *)0)) {
	len = strlen(rdp->rd_log);
	rcs_strprint((const u_char *)rdp->rd_log, len, fp);
	if (len == 0 || rdp->rd_log[len-1] != '\n')
		fputc('\n', fp);
}
fputs("@\ntext\n@", fp);
if (rdp->rd_text != NULL((void *)0))
	rcs_strprint(rdp->rd_text, rdp->rd_tlen, fp);
fputs("@\n", fp);
}
(void)fclose(fp);

if (rcs_movefile(fn, rfp->rf_path, rfp->rf_mode, rfp->rf_flags) == -1) {
(void)unlink(fn);
errx(1, "rcs_movefile failed");
}

rfp->rf_flags |= RCS_SYNCED(1<<5);

free(fn);
351}

353/*
* rcs_movefile()
*
* Move a file using rename(2) if possible and copying if not.
* Returns 0 on success, -1 on failure.
*/
359static int
360rcs_movefile(char *from, char *to, mode_t perm, u_int to_flags)
361{
FILE *src, *dst;
size_t nread, nwritten;
char *buf;

if (rename(from, to) == 0) {
if (chmod(to, perm) == -1) {
	warn("%s", to);
	return (-1);
}
return (0);
} else if (errno(*__errno()) != EXDEV18) {
warn("failed to access temp RCS output file");
return (-1);
}

if ((chmod(to, S_IWUSR0000200) == -1) && !(to_flags & RCS_CREATE(1<<2))) {
warnx("chmod(%s, 0%o) failed", to, S_IWUSR0000200);
return (-1);
}

/* different filesystem, have to copy the file */
if ((src = fopen(from, "r")) == NULL((void *)0)) {
warn("%s", from);
return (-1);
}
if ((dst = fopen(to, "w")) == NULL((void *)0)) {
warn("%s", to);
(void)fclose(src);
return (-1);
}
if (fchmod(fileno(dst)(!__isthreaded ? ((dst)->_file) : (fileno)(dst)), perm)) {
warn("%s", to);
(void)unlink(to);
(void)fclose(src);
(void)fclose(dst);
return (-1);
}

buf = xmalloc(_MAXBSIZE(64 * 1024));
while ((nread = fread(buf, sizeof(char), _MAXBSIZE(64 * 1024), src)) != 0) {
if (ferror(src)(!__isthreaded ? (((src)->_flags & 0x0040) != 0) : (ferror
)(src))) {
	warnx("failed to read `%s'", from);
	(void)unlink(to);
	goto out;
}
nwritten = fwrite(buf, sizeof(char), nread, dst);
if (nwritten != nread) {
	warnx("failed to write `%s'", to);
	(void)unlink(to);
	goto out;
}
}

(void)unlink(from);

417out:
(void)fclose(src);
(void)fclose(dst);
free(buf);

return (0);
423}

425/*
* rcs_head_set()
*
* Set the revision number of the head revision for the RCS file <file> to
* <rev>, which must reference a valid revision within the file.
*/
431int
432rcs_head_set(RCSFILE *file, RCSNUM *rev)
433{
if (rcs_findrev(file, rev) == NULL((void *)0))
return (-1);

if (file->rf_head == NULL((void *)0))
file->rf_head = rcsnum_alloc();

rcsnum_cpy(rev, file->rf_head, 0);
file->rf_flags &= ~RCS_SYNCED(1<<5);
return (0);
443}


446/*
* rcs_branch_get()
*
* Retrieve the default branch number for the RCS file <file>.
* Returns the number on success.  If NULL is returned, then there is no
* default branch for this file.
*/
453const RCSNUM *
454rcs_branch_get(RCSFILE *file)
455{
return (file->rf_branch);
457}

459/*
* rcs_access_add()
*
* Add the login name <login> to the access list for the RCS file <file>.
* Returns 0 on success, or -1 on failure.
*/
465int
466rcs_access_add(RCSFILE *file, const char *login)
467{
struct rcs_access *ap;

/* first look for duplication */
TAILQ_FOREACH(ap, &(file->rf_access), ra_list)for((ap) = ((&(file->rf_access))->tqh_first); (ap) !=
 ((void *)0); (ap) = ((ap)->ra_list.tqe_next)) {
if (strcmp(ap->ra_name, login) == 0) {
	rcs_errno = RCS_ERR_DUPENT2;
	return (-1);
}
}

ap = xmalloc(sizeof(*ap));
ap->ra_name = xstrdup(login);
TAILQ_INSERT_TAIL(&(file->rf_access), ap, ra_list)do { (ap)->ra_list.tqe_next = ((void *)0); (ap)->ra_list
.tqe_prev = (&(file->rf_access))->tqh_last; *(&
(file->rf_access))->tqh_last = (ap); (&(file->rf_access
))->tqh_last = &(ap)->ra_list.tqe_next; } while (0);

/* not synced anymore */
file->rf_flags &= ~RCS_SYNCED(1<<5);
return (0);
485}

487/*
* rcs_access_remove()
*
* Remove an entry with login name <login> from the access list of the RCS
* file <file>.
* Returns 0 on success, or -1 on failure.
*/
494int
495rcs_access_remove(RCSFILE *file, const char *login)
496{
struct rcs_access *ap;

TAILQ_FOREACH(ap, &(file->rf_access), ra_list)for((ap) = ((&(file->rf_access))->tqh_first); (ap) !=
 ((void *)0); (ap) = ((ap)->ra_list.tqe_next))
if (strcmp(ap->ra_name, login) == 0)
	break;

if (ap == NULL((void *)0)) {
rcs_errno = RCS_ERR_NOENT1;
return (-1);
}

TAILQ_REMOVE(&(file->rf_access), ap, ra_list)do { if (((ap)->ra_list.tqe_next) != ((void *)0)) (ap)->
ra_list.tqe_next->ra_list.tqe_prev = (ap)->ra_list.tqe_prev
; else (&(file->rf_access))->tqh_last = (ap)->ra_list
.tqe_prev; *(ap)->ra_list.tqe_prev = (ap)->ra_list.tqe_next
; ; ; } while (0);
free(ap->ra_name);
free(ap);

/* not synced anymore */
file->rf_flags &= ~RCS_SYNCED(1<<5);
return (0);
515}

517/*
* rcs_sym_add()
*
* Add a symbol to the list of symbols for the RCS file <rfp>.  The new symbol
* is named <sym> and is bound to the RCS revision <snum>.
* Returns 0 on success, or -1 on failure.
*/
524int
525rcs_sym_add(RCSFILE *rfp, const char *sym, RCSNUM *snum)
526{
struct rcs_sym *symp;

if (!rcs_sym_check(sym)) {
rcs_errno = RCS_ERR_BADSYM4;
return (-1);
}

/* first look for duplication */
TAILQ_FOREACH(symp, &(rfp->rf_symbols), rs_list)for((symp) = ((&(rfp->rf_symbols))->tqh_first); (symp
) != ((void *)0); (symp) = ((symp)->rs_list.tqe_next)) {
if (strcmp(symp->rs_name, sym) == 0) {
	rcs_errno = RCS_ERR_DUPENT2;
	return (-1);
}
}

symp = xmalloc(sizeof(*symp));
symp->rs_name = xstrdup(sym);
symp->rs_num = rcsnum_alloc();
rcsnum_cpy(snum, symp->rs_num, 0);

TAILQ_INSERT_HEAD(&(rfp->rf_symbols), symp, rs_list)do { if (((symp)->rs_list.tqe_next = (&(rfp->rf_symbols
))->tqh_first) != ((void *)0)) (&(rfp->rf_symbols))
->tqh_first->rs_list.tqe_prev = &(symp)->rs_list
.tqe_next; else (&(rfp->rf_symbols))->tqh_last = &
(symp)->rs_list.tqe_next; (&(rfp->rf_symbols))->
tqh_first = (symp); (symp)->rs_list.tqe_prev = &(&
(rfp->rf_symbols))->tqh_first; } while (0);

/* not synced anymore */
rfp->rf_flags &= ~RCS_SYNCED(1<<5);
return (0);
552}

554/*
* rcs_sym_remove()
*
* Remove the symbol with name <sym> from the symbol list for the RCS file
* <file>.  If no such symbol is found, the call fails and returns with an
* error.
* Returns 0 on success, or -1 on failure.
*/
562int
563rcs_sym_remove(RCSFILE *file, const char *sym)
564{
struct rcs_sym *symp;

if (!rcs_sym_check(sym)) {
rcs_errno = RCS_ERR_BADSYM4;
return (-1);
}

TAILQ_FOREACH(symp, &(file->rf_symbols), rs_list)for((symp) = ((&(file->rf_symbols))->tqh_first); (symp
) != ((void *)0); (symp) = ((symp)->rs_list.tqe_next))
if (strcmp(symp->rs_name, sym) == 0)
	break;

if (symp == NULL((void *)0)) {
rcs_errno = RCS_ERR_NOENT1;
return (-1);
}

TAILQ_REMOVE(&(file->rf_symbols), symp, rs_list)do { if (((symp)->rs_list.tqe_next) != ((void *)0)) (symp)
->rs_list.tqe_next->rs_list.tqe_prev = (symp)->rs_list
.tqe_prev; else (&(file->rf_symbols))->tqh_last = (
symp)->rs_list.tqe_prev; *(symp)->rs_list.tqe_prev = (symp
)->rs_list.tqe_next; ; ; } while (0);
free(symp->rs_name);
rcsnum_free(symp->rs_num);
free(symp);

/* not synced anymore */
file->rf_flags &= ~RCS_SYNCED(1<<5);
return (0);
589}

591/*
* rcs_sym_getrev()
*
* Retrieve the RCS revision number associated with the symbol <sym> for the
* RCS file <file>.  The returned value is a dynamically-allocated copy and
* should be freed by the caller once they are done with it.
* Returns the RCSNUM on success, or NULL on failure.
*/
599RCSNUM *
600rcs_sym_getrev(RCSFILE *file, const char *sym)
601{
RCSNUM *num;
struct rcs_sym *symp;

if (!rcs_sym_check(sym)) {
rcs_errno = RCS_ERR_BADSYM4;
return (NULL((void *)0));
}

num = NULL((void *)0);
TAILQ_FOREACH(symp, &(file->rf_symbols), rs_list)for((symp) = ((&(file->rf_symbols))->tqh_first); (symp
) != ((void *)0); (symp) = ((symp)->rs_list.tqe_next))
if (strcmp(symp->rs_name, sym) == 0)
	break;

if (symp == NULL((void *)0)) {
rcs_errno = RCS_ERR_NOENT1;
} else {
num = rcsnum_alloc();
rcsnum_cpy(symp->rs_num, num, 0);
}

return (num);
623}

625/*
* rcs_sym_check()
*
* Check the RCS symbol name <sym> for any unsupported characters.
* Returns 1 if the tag is correct, 0 if it isn't valid.
*/
631int
632rcs_sym_check(const char *sym)
633{
int ret;
const unsigned char *cp;

ret = 1;
cp = sym;
if (!isalpha(*cp++))
return (0);

for (; *cp != '\0'; cp++)
if (!isgraph(*cp) || (strchr(rcs_sym_invch, *cp) != NULL((void *)0))) {
	ret = 0;
	break;
}

return (ret);
649}

651/*
* rcs_lock_getmode()
*
* Retrieve the locking mode of the RCS file <file>.
*/
656int
657rcs_lock_getmode(RCSFILE *file)
658{
return (file->rf_flags & RCS_SLOCK(1<<6)) ? RCS_LOCK_STRICT1 : RCS_LOCK_LOOSE0;
660}

662/*
* rcs_lock_setmode()
*
* Set the locking mode of the RCS file <file> to <mode>, which must either
* be RCS_LOCK_LOOSE or RCS_LOCK_STRICT.
* Returns the previous mode on success, or -1 on failure.
*/
669int
670rcs_lock_setmode(RCSFILE *file, int mode)
671{
int pmode;
pmode = rcs_lock_getmode(file);

if (mode == RCS_LOCK_STRICT1)
file->rf_flags |= RCS_SLOCK(1<<6);
else if (mode == RCS_LOCK_LOOSE0)
file->rf_flags &= ~RCS_SLOCK(1<<6);
else
errx(1, "rcs_lock_setmode: invalid mode `%d'", mode);

file->rf_flags &= ~RCS_SYNCED(1<<5);
return (pmode);
684}

686/*
* rcs_lock_add()
*
* Add an RCS lock for the user <user> on revision <rev>.
* Returns 0 on success, or -1 on failure.
*/
692int
693rcs_lock_add(RCSFILE *file, const char *user, RCSNUM *rev)
694{
struct rcs_lock *lkp;
struct rcs_delta *rdp;

if ((rdp = rcs_findrev(file, rev)) == NULL((void *)0)) {
rcs_errno = RCS_ERR_NOENT1;
return (-1);
}

/* first look for duplication */
TAILQ_FOREACH(lkp, &(file->rf_locks), rl_list)for((lkp) = ((&(file->rf_locks))->tqh_first); (lkp)
 != ((void *)0); (lkp) = ((lkp)->rl_list.tqe_next)) {
if (strcmp(lkp->rl_name, user) == 0 &&
    rcsnum_cmp(rev, lkp->rl_num, 0) == 0) {
	rcs_errno = RCS_ERR_DUPENT2;
	return (-1);
}
}

lkp = xmalloc(sizeof(*lkp));
lkp->rl_name = xstrdup(user);
lkp->rl_num = rcsnum_alloc();
rcsnum_cpy(rev, lkp->rl_num, 0);

free(rdp->rd_locker);
rdp->rd_locker = xstrdup(user);

TAILQ_INSERT_TAIL(&(file->rf_locks), lkp, rl_list)do { (lkp)->rl_list.tqe_next = ((void *)0); (lkp)->rl_list
.tqe_prev = (&(file->rf_locks))->tqh_last; *(&(
file->rf_locks))->tqh_last = (lkp); (&(file->rf_locks
))->tqh_last = &(lkp)->rl_list.tqe_next; } while (0
);

/* not synced anymore */
file->rf_flags &= ~RCS_SYNCED(1<<5);
return (0);
725}


728/*
* rcs_lock_remove()
*
* Remove the RCS lock on revision <rev>.
* Returns 0 on success, or -1 on failure.
*/
734int
735rcs_lock_remove(RCSFILE *file, const char *user, RCSNUM *rev)
736{
struct rcs_lock *lkp;
struct rcs_delta *rdp;

if ((rdp = rcs_findrev(file, rev)) == NULL((void *)0)) {
rcs_errno = RCS_ERR_NOENT1;
return (-1);
}

TAILQ_FOREACH(lkp, &(file->rf_locks), rl_list)for((lkp) = ((&(file->rf_locks))->tqh_first); (lkp)
 != ((void *)0); (lkp) = ((lkp)->rl_list.tqe_next)) {
if (strcmp(lkp->rl_name, user) == 0 &&
    rcsnum_cmp(lkp->rl_num, rev, 0) == 0)
	break;
}

if (lkp == NULL((void *)0)) {
rcs_errno = RCS_ERR_NOENT1;
return (-1);
}

TAILQ_REMOVE(&(file->rf_locks), lkp, rl_list)do { if (((lkp)->rl_list.tqe_next) != ((void *)0)) (lkp)->
rl_list.tqe_next->rl_list.tqe_prev = (lkp)->rl_list.tqe_prev
; else (&(file->rf_locks))->tqh_last = (lkp)->rl_list
.tqe_prev; *(lkp)->rl_list.tqe_prev = (lkp)->rl_list.tqe_next
; ; ; } while (0);
rcsnum_free(lkp->rl_num);
free(lkp->rl_name);
free(lkp);

free(rdp->rd_locker);
rdp->rd_locker = NULL((void *)0);

/* not synced anymore */
file->rf_flags &= ~RCS_SYNCED(1<<5);
return (0);
767}

769/*
* rcs_desc_set()
*
* Set the description for the RCS file <file>.
*/
774void
775rcs_desc_set(RCSFILE *file, const char *desc)
776{
char *tmp;

tmp = xstrdup(desc);
free(file->rf_desc);
file->rf_desc = tmp;
file->rf_flags &= ~RCS_SYNCED(1<<5);
783}

785/*
* rcs_comment_set()
*
* Set the comment leader for the RCS file <file>.
*/
790void
791rcs_comment_set(RCSFILE *file, const char *comment)
792{
char *tmp;

tmp = xstrdup(comment);
free(file->rf_comment);
file->rf_comment = tmp;
file->rf_flags &= ~RCS_SYNCED(1<<5);
799}

801int
802rcs_patch_lines(struct rcs_lines *dlines, struct rcs_lines *plines)
803{
char op, *ep;
struct rcs_line *lp, *dlp, *ndlp;
int i, lineno, nbln;
u_char tmp;

dlp = TAILQ_FIRST(&(dlines->l_lines))((&(dlines->l_lines))->tqh_first);
lp = TAILQ_FIRST(&(plines->l_lines))((&(plines->l_lines))->tqh_first);

/* skip first bogus line */
for (lp = TAILQ_NEXT(lp, l_list)((lp)->l_list.tqe_next); lp != NULL((void *)0);
1
Assuming 'lp' is not equal to NULL→
2
←
Loop condition is true.  Entering loop body→
   lp = TAILQ_NEXT(lp, l_list)((lp)->l_list.tqe_next)) {
if (lp->l_len < 2)
3
←
Assuming field 'l_len' is >= 2→
4
←
Taking false branch→
	errx(1, "line too short, RCS patch seems broken");
op = *(lp->l_line);
/* NUL-terminate line buffer for strtol() safety. */
tmp = lp->l_line[lp->l_len - 1];
lp->l_line[lp->l_len - 1] = '\0';
lineno = (int)strtol((lp->l_line + 1), &ep, 10);
if (lineno > dlines->l_nblines || lineno < 0 ||
5
←
Assuming 'lineno' is <= field 'l_nblines'→
6
←
Assuming 'lineno' is >= 0→
8
←
Taking false branch→
    *ep != ' ')
7
←
Assuming the condition is false→
	errx(1, "invalid line specification in RCS patch");
ep++;
nbln = (int)strtol(ep, &ep, 10);
/* Restore the last byte of the buffer */
lp->l_line[lp->l_len - 1] = tmp;
if (nbln < 0)
9
←
Assuming 'nbln' is >= 0→
10
←
Taking false branch→
	errx(1,
	    "invalid line number specification in RCS patch");

/* find the appropriate line */
for (;;) {
11
←
Loop condition is true.  Entering loop body→
	if (dlp == NULL((void *)0))
12
←
Assuming 'dlp' is not equal to NULL→
13
←
Taking false branch→
		break;
	if (dlp->l_lineno == lineno)
14
←
Assuming 'lineno' is equal to field 'l_lineno'→
15
←
Taking true branch→
		break;
16
←
 Execution continues on line 848→
	if (dlp->l_lineno > lineno) {
		dlp = TAILQ_PREV(dlp, tqh, l_list)(*(((struct tqh *)((dlp)->l_list.tqe_prev))->tqh_last));
	} else if (dlp->l_lineno < lineno) {
		if (((ndlp = TAILQ_NEXT(dlp, l_list)((dlp)->l_list.tqe_next)) == NULL((void *)0)) ||
		    ndlp->l_lineno > lineno)
			break;
		dlp = ndlp;
	}
}
if (dlp16.1
'dlp' is not equal to NULL
 == NULL((void *)0))
17
←
Taking false branch→
	errx(1, "can't find referenced line in RCS patch");

if (op == 'd') {
18
←
Assuming the condition is true→
19
←
Taking true branch→
	for (i = 0; (i < nbln) && (dlp20.1
'dlp' is not equal to NULL
 != NULL((void *)0)); i++) {
20
←
Assuming 'i' is < 'nbln'→
21
←
Loop condition is true.  Entering loop body→
27
←
Assuming 'i' is >= 'nbln'→
		ndlp = TAILQ_NEXT(dlp, l_list)((dlp)->l_list.tqe_next);
		TAILQ_REMOVE(&(dlines->l_lines), dlp, l_list)do { if (((dlp)->l_list.tqe_next) != ((void *)0)) (dlp)->
l_list.tqe_next->l_list.tqe_prev = (dlp)->l_list.tqe_prev
; else (&(dlines->l_lines))->tqh_last = (dlp)->l_list
.tqe_prev; *(dlp)->l_list.tqe_prev = (dlp)->l_list.tqe_next
; ; ; } while (0);
22
←
Assuming field 'tqe_next' is not equal to null→
23
←
Taking true branch→
24
←
Loop condition is false.  Exiting loop→
		free(dlp);
25
←
Memory is released→
		dlp = ndlp;
		/* last line is gone - reset dlp */
		if (dlp25.1
'dlp' is not equal to NULL
 == NULL((void *)0)) {
26
←
Taking false branch→
			ndlp = TAILQ_LAST(&(dlines->l_lines),(*(((struct tqh *)((&(dlines->l_lines))->tqh_last))
->tqh_last))
			    tqh)(*(((struct tqh *)((&(dlines->l_lines))->tqh_last))
->tqh_last));
			dlp = ndlp;
		}
	}
} else if (op == 'a') {
	for (i = 0; i < nbln; i++) {
		ndlp = lp;
		lp = TAILQ_NEXT(lp, l_list)((lp)->l_list.tqe_next);
		if (lp == NULL((void *)0))
			errx(1, "truncated RCS patch");
		TAILQ_REMOVE(&(plines->l_lines), lp, l_list)do { if (((lp)->l_list.tqe_next) != ((void *)0)) (lp)->
l_list.tqe_next->l_list.tqe_prev = (lp)->l_list.tqe_prev
; else (&(plines->l_lines))->tqh_last = (lp)->l_list
.tqe_prev; *(lp)->l_list.tqe_prev = (lp)->l_list.tqe_next
; ; ; } while (0);
		TAILQ_INSERT_AFTER(&(dlines->l_lines), dlp,do { if (((lp)->l_list.tqe_next = (dlp)->l_list.tqe_next
) != ((void *)0)) (lp)->l_list.tqe_next->l_list.tqe_prev
 = &(lp)->l_list.tqe_next; else (&(dlines->l_lines
))->tqh_last = &(lp)->l_list.tqe_next; (dlp)->l_list
.tqe_next = (lp); (lp)->l_list.tqe_prev = &(dlp)->l_list
.tqe_next; } while (0)
		    lp, l_list)do { if (((lp)->l_list.tqe_next = (dlp)->l_list.tqe_next
) != ((void *)0)) (lp)->l_list.tqe_next->l_list.tqe_prev
 = &(lp)->l_list.tqe_next; else (&(dlines->l_lines
))->tqh_last = &(lp)->l_list.tqe_next; (dlp)->l_list
.tqe_next = (lp); (lp)->l_list.tqe_prev = &(dlp)->l_list
.tqe_next; } while (0);
		dlp = lp;

		/* we don't want lookup to block on those */
		lp->l_lineno = lineno;

		lp = ndlp;
	}
} else
	errx(1, "unknown RCS patch operation `%c'", op);

/* last line of the patch, done */
if (lp->l_lineno == plines->l_nblines)
28
←
Assuming field 'l_lineno' is equal to field 'l_nblines'→
29
←
Taking true branch→
	break;
30
←
 Execution continues on line 889→
}

/* once we're done patching, rebuild the line numbers */
lineno = 0;
TAILQ_FOREACH(lp, &(dlines->l_lines), l_list)for((lp) = ((&(dlines->l_lines))->tqh_first); (lp) !=
 ((void *)0); (lp) = ((lp)->l_list.tqe_next))
31
←
Loop condition is true.  Entering loop body→
lp->l_lineno = lineno++;
32
←
Use of memory after it is freed
dlines->l_nblines = lineno - 1;

return (0);
895}

897/*
* rcs_getrev()
*
* Get the whole contents of revision <rev> from the RCSFILE <rfp>.  The
* returned buffer is dynamically allocated and should be released using
* buf_free() once the caller is done using it.
*/
904BUF *
905rcs_getrev(RCSFILE *rfp, RCSNUM *frev)
906{
u_int i, numlen;
int isbranch, lookonbranch, found;
size_t dlen, plen, len;
RCSNUM *crev, *rev, *brev;
BUF *rbuf;
struct rcs_delta *rdp = NULL((void *)0);
struct rcs_branch *rb;
u_char *data, *patch;

if (rfp->rf_head == NULL((void *)0))
return (NULL((void *)0));

if (frev == RCS_HEAD_REV((RCSNUM *)(-1)))
rev = rfp->rf_head;
else
rev = frev;

/* XXX rcsnum_cmp() */
for (i = 0; i < rfp->rf_head->rn_len; i++) {
if (rfp->rf_head->rn_id[i] < rev->rn_id[i]) {
	rcs_errno = RCS_ERR_NOENT1;
	return (NULL((void *)0));
}
}

/* No matter what, we'll need everything parsed up until the description
         so go for it. */
if (rcsparse_deltas(rfp, NULL((void *)0)))
return (NULL((void *)0));

rdp = rcs_findrev(rfp, rfp->rf_head);
if (rdp == NULL((void *)0)) {
warnx("failed to get RCS HEAD revision");
return (NULL((void *)0));
}

if (rdp->rd_tlen == 0)
if (rcsparse_deltatexts(rfp, rfp->rf_head))
	return (NULL((void *)0));

len = rdp->rd_tlen;
if (len == 0) {
rbuf = buf_alloc(1);
buf_empty(rbuf);
return (rbuf);
}

rbuf = buf_alloc(len);
buf_append(rbuf, rdp->rd_text, len);

isbranch = 0;
brev = NULL((void *)0);

/*
* If a branch was passed, get the latest revision on it.
*/
if (RCSNUM_ISBRANCH(rev)((rev)->rn_len % 2)) {
brev = rev;
rdp = rcs_findrev(rfp, rev);
if (rdp == NULL((void *)0)) {
	buf_free(rbuf);
	return (NULL((void *)0));
}

rev = rdp->rd_num;
} else {
if (RCSNUM_ISBRANCHREV(rev)(!((rev)->rn_len % 2) && ((rev)->rn_len >= 4
))) {
	brev = rcsnum_revtobr(rev);
	isbranch = 1;
}
}

lookonbranch = 0;
crev = NULL((void *)0);

/* Apply patches backwards to get the right version.
*/
do {
found = 0;

if (rcsnum_cmp(rfp->rf_head, rev, 0) == 0)
	break;

if (isbranch == 1 && rdp->rd_num->rn_len < rev->rn_len &&
    !TAILQ_EMPTY(&(rdp->rd_branches))(((&(rdp->rd_branches))->tqh_first) == ((void *)0)))
	lookonbranch = 1;

if (isbranch && lookonbranch == 1) {
	lookonbranch = 0;
	TAILQ_FOREACH(rb, &(rdp->rd_branches), rb_list)for((rb) = ((&(rdp->rd_branches))->tqh_first); (rb)
 != ((void *)0); (rb) = ((rb)->rb_list.tqe_next)) {
		/* XXX rcsnum_cmp() is totally broken for
		 * this purpose.
		 */
		numlen = MINIMUM(brev->rn_len,(((brev->rn_len) < (rb->rb_num->rn_len - 1)) ? (brev
->rn_len) : (rb->rb_num->rn_len - 1))
		    rb->rb_num->rn_len - 1)(((brev->rn_len) < (rb->rb_num->rn_len - 1)) ? (brev
->rn_len) : (rb->rb_num->rn_len - 1));
		for (i = 0; i < numlen; i++) {
			if (rb->rb_num->rn_id[i] !=
			    brev->rn_id[i])
				break;
		}

		if (i == numlen) {
			crev = rb->rb_num;
			found = 1;
			break;
		}
	}
	if (found == 0)
		crev = rdp->rd_next;
} else {
	crev = rdp->rd_next;
}

rdp = rcs_findrev(rfp, crev);
if (rdp == NULL((void *)0)) {
	buf_free(rbuf);
	return (NULL((void *)0));
}

plen = rdp->rd_tlen;
dlen = buf_len(rbuf);
patch = rdp->rd_text;
data = buf_release(rbuf);
/* check if we have parsed this rev's deltatext */
if (rdp->rd_tlen == 0)
	if (rcsparse_deltatexts(rfp, rdp->rd_num))
		return (NULL((void *)0));

rbuf = rcs_patchfile(data, dlen, patch, plen, rcs_patch_lines);
free(data);

if (rbuf == NULL((void *)0))
	break;
} while (rcsnum_cmp(crev, rev, 0) != 0);

return (rbuf);
1043}

1045void
1046rcs_delta_stats(struct rcs_delta *rdp, int *ladded, int *lremoved)
1047{
struct rcs_lines *plines;
struct rcs_line *lp;
int added, i, nbln, removed;
char op, *ep;
u_char tmp;

added = removed = 0;

plines = rcs_splitlines(rdp->rd_text, rdp->rd_tlen);
lp = TAILQ_FIRST(&(plines->l_lines))((&(plines->l_lines))->tqh_first);

/* skip first bogus line */
for (lp = TAILQ_NEXT(lp, l_list)((lp)->l_list.tqe_next); lp != NULL((void *)0);
lp = TAILQ_NEXT(lp, l_list)((lp)->l_list.tqe_next)) {
	if (lp->l_len < 2)
		errx(1,
		    "line too short, RCS patch seems broken");
	op = *(lp->l_line);
	/* NUL-terminate line buffer for strtol() safety. */
	tmp = lp->l_line[lp->l_len - 1];
	lp->l_line[lp->l_len - 1] = '\0';
	(void)strtol((lp->l_line + 1), &ep, 10);
	ep++;
	nbln = (int)strtol(ep, &ep, 10);
	/* Restore the last byte of the buffer */
	lp->l_line[lp->l_len - 1] = tmp;
	if (nbln < 0)
		errx(1, "invalid line number specification "
		    "in RCS patch");

	if (op == 'a') {
		added += nbln;
		for (i = 0; i < nbln; i++) {
			lp = TAILQ_NEXT(lp, l_list)((lp)->l_list.tqe_next);
			if (lp == NULL((void *)0))
				errx(1, "truncated RCS patch");
		}
	} else if (op == 'd')
		removed += nbln;
	else
		errx(1, "unknown RCS patch operation '%c'", op);
}

rcs_freelines(plines);

*ladded = added;
*lremoved = removed;
1095}

1097/*
* rcs_rev_add()
*
* Add a revision to the RCS file <rf>.  The new revision's number can be
* specified in <rev> (which can also be RCS_HEAD_REV, in which case the
* new revision will have a number equal to the previous head revision plus
* one).  The <msg> argument specifies the log message for that revision, and
* <date> specifies the revision's date (a value of -1 is
* equivalent to using the current time).
* If <author> is NULL, set the author for this revision to the current user.
* Returns 0 on success, or -1 on failure.
*/
1109int
1110rcs_rev_add(RCSFILE *rf, RCSNUM *rev, const char *msg, time_t date,
  const char *author)
1112{
time_t now;
struct passwd *pw;
struct rcs_delta *ordp, *rdp;

if (rev == RCS_HEAD_REV((RCSNUM *)(-1))) {
if (rf->rf_flags & RCS_CREATE(1<<2)) {
	if ((rev = rcsnum_parse(RCS_HEAD_INIT"1.1")) == NULL((void *)0))
		return (-1);
	rf->rf_head = rev;
} else {
	rev = rcsnum_inc(rf->rf_head);
}
} else {
if ((rdp = rcs_findrev(rf, rev)) != NULL((void *)0)) {
	rcs_errno = RCS_ERR_DUPENT2;
	return (-1);
}
}

rdp = xcalloc(1, sizeof(*rdp));

TAILQ_INIT(&(rdp->rd_branches))do { (&(rdp->rd_branches))->tqh_first = ((void *)0)
; (&(rdp->rd_branches))->tqh_last = &(&(rdp
->rd_branches))->tqh_first; } while (0);

rdp->rd_num = rcsnum_alloc();
rcsnum_cpy(rev, rdp->rd_num, 0);

rdp->rd_next = rcsnum_alloc();

if (!(rf->rf_flags & RCS_CREATE(1<<2))) {
/* next should point to the previous HEAD */
ordp = TAILQ_FIRST(&(rf->rf_delta))((&(rf->rf_delta))->tqh_first);
rcsnum_cpy(ordp->rd_num, rdp->rd_next, 0);
}

if (!author && !(author = getlogin())) {
if (!(pw = getpwuid(getuid())))
	errx(1, "getpwuid failed");
author = pw->pw_name;
}
rdp->rd_author = xstrdup(author);
rdp->rd_state = xstrdup(RCS_STATE_EXP"Exp");
rdp->rd_log = xstrdup(msg);

if (date != (time_t)(-1))
now = date;
else
time(&now);
gmtime_r(&now, &(rdp->rd_date));

TAILQ_INSERT_HEAD(&(rf->rf_delta), rdp, rd_list)do { if (((rdp)->rd_list.tqe_next = (&(rf->rf_delta
))->tqh_first) != ((void *)0)) (&(rf->rf_delta))->
tqh_first->rd_list.tqe_prev = &(rdp)->rd_list.tqe_next
; else (&(rf->rf_delta))->tqh_last = &(rdp)->
rd_list.tqe_next; (&(rf->rf_delta))->tqh_first = (rdp
); (rdp)->rd_list.tqe_prev = &(&(rf->rf_delta))
->tqh_first; } while (0);
rf->rf_ndelta++;

/* not synced anymore */
rf->rf_flags &= ~RCS_SYNCED(1<<5);

return (0);
1169}

1171/*
* rcs_rev_remove()
*
* Remove the revision whose number is <rev> from the RCS file <rf>.
*/
1176int
1177rcs_rev_remove(RCSFILE *rf, RCSNUM *rev)
1178{
char *path_tmp1, *path_tmp2;
struct rcs_delta *rdp, *prevrdp, *nextrdp;
BUF *newdeltatext, *nextbuf, *prevbuf, *newdiff;

nextrdp = prevrdp = NULL((void *)0);
path_tmp1 = path_tmp2 = NULL((void *)0);

if (rev == RCS_HEAD_REV((RCSNUM *)(-1)))
rev = rf->rf_head;

/* do we actually have that revision? */
if ((rdp = rcs_findrev(rf, rev)) == NULL((void *)0)) {
rcs_errno = RCS_ERR_NOENT1;
return (-1);
}

/*
* This is confusing, the previous delta is next in the TAILQ list.
* the next delta is the previous one in the TAILQ list.
*
* When the HEAD revision got specified, nextrdp will be NULL.
* When the first revision got specified, prevrdp will be NULL.
*/
prevrdp = (struct rcs_delta *)TAILQ_NEXT(rdp, rd_list)((rdp)->rd_list.tqe_next);
nextrdp = (struct rcs_delta *)TAILQ_PREV(rdp, tqh, rd_list)(*(((struct tqh *)((rdp)->rd_list.tqe_prev))->tqh_last)
);

newdeltatext = prevbuf = nextbuf = NULL((void *)0);

if (prevrdp != NULL((void *)0)) {
if ((prevbuf = rcs_getrev(rf, prevrdp->rd_num)) == NULL((void *)0))
	errx(1, "error getting revision");
}

if (prevrdp != NULL((void *)0) && nextrdp != NULL((void *)0)) {
if ((nextbuf = rcs_getrev(rf, nextrdp->rd_num)) == NULL((void *)0))
	errx(1, "error getting revision");

newdiff = buf_alloc(64);

/* calculate new diff */
(void)xasprintf(&path_tmp1, "%s/diff1.XXXXXXXXXX", rcs_tmpdir);
buf_write_stmp(nextbuf, path_tmp1);
buf_free(nextbuf);

(void)xasprintf(&path_tmp2, "%s/diff2.XXXXXXXXXX", rcs_tmpdir);
buf_write_stmp(prevbuf, path_tmp2);
buf_free(prevbuf);

diff_format = D_RCSDIFF5;
if (diffreg(path_tmp1, path_tmp2, newdiff, D_FORCEASCII0x01) == D_ERROR2)
	errx(1, "diffreg failed");

newdeltatext = newdiff;
} else if (nextrdp == NULL((void *)0) && prevrdp != NULL((void *)0)) {
newdeltatext = prevbuf;
}

if (newdeltatext != NULL((void *)0)) {
if (rcs_deltatext_set(rf, prevrdp->rd_num, newdeltatext) < 0)
	errx(1, "error setting new deltatext");
}

TAILQ_REMOVE(&(rf->rf_delta), rdp, rd_list)do { if (((rdp)->rd_list.tqe_next) != ((void *)0)) (rdp)->
rd_list.tqe_next->rd_list.tqe_prev = (rdp)->rd_list.tqe_prev
; else (&(rf->rf_delta))->tqh_last = (rdp)->rd_list
.tqe_prev; *(rdp)->rd_list.tqe_prev = (rdp)->rd_list.tqe_next
; ; ; } while (0);

/* update pointers */
if (prevrdp != NULL((void *)0) && nextrdp != NULL((void *)0)) {
rcsnum_cpy(prevrdp->rd_num, nextrdp->rd_next, 0);
} else if (prevrdp != NULL((void *)0)) {
if (rcs_head_set(rf, prevrdp->rd_num) < 0)
	errx(1, "rcs_head_set failed");
} else if (nextrdp != NULL((void *)0)) {
rcsnum_free(nextrdp->rd_next);
nextrdp->rd_next = rcsnum_alloc();
} else {
rcsnum_free(rf->rf_head);
rf->rf_head = NULL((void *)0);
}

rf->rf_ndelta--;
rf->rf_flags &= ~RCS_SYNCED(1<<5);

rcs_freedelta(rdp);

free(path_tmp1);
free(path_tmp2);

return (0);
1266}

1268/*
* rcs_findrev()
*
* Find a specific revision's delta entry in the tree of the RCS file <rfp>.
* The revision number is given in <rev>.
*
* If the given revision is a branch number, we translate it into the latest
* revision on the branch.
*
* Returns a pointer to the delta on success, or NULL on failure.
*/
1279struct rcs_delta *
1280rcs_findrev(RCSFILE *rfp, RCSNUM *rev)
1281{
u_int cmplen;
struct rcs_delta *rdp;
RCSNUM *brev, *frev;

/*
* We need to do more parsing if the last revision in the linked list
* is greater than the requested revision.
*/
rdp = TAILQ_LAST(&(rfp->rf_delta), rcs_dlist)(*(((struct rcs_dlist *)((&(rfp->rf_delta))->tqh_last
))->tqh_last));
if (rdp == NULL((void *)0) ||
   rcsnum_cmp(rdp->rd_num, rev, 0) == -1) {
if (rcsparse_deltas(rfp, rev))
	return (NULL((void *)0));
}

/*
* Translate a branch into the latest revision on the branch itself.
*/
if (RCSNUM_ISBRANCH(rev)((rev)->rn_len % 2)) {
brev = rcsnum_brtorev(rev);
frev = brev;
for (;;) {
	rdp = rcs_findrev(rfp, frev);
	if (rdp == NULL((void *)0))
		return (NULL((void *)0));

	if (rdp->rd_next->rn_len == 0)
		break;

	frev = rdp->rd_next;
}

rcsnum_free(brev);
return (rdp);
}

cmplen = rev->rn_len;

TAILQ_FOREACH(rdp, &(rfp->rf_delta), rd_list)for((rdp) = ((&(rfp->rf_delta))->tqh_first); (rdp) !=
 ((void *)0); (rdp) = ((rdp)->rd_list.tqe_next)) {
if (rcsnum_cmp(rdp->rd_num, rev, cmplen) == 0)
	return (rdp);
}

return (NULL((void *)0));
1326}

1328/*
* rcs_kwexp_set()
*
* Set the keyword expansion mode to use on the RCS file <file> to <mode>.
*/
1333void
1334rcs_kwexp_set(RCSFILE *file, int mode)
1335{
int i;
char *tmp, buf[8] = "";

if (RCS_KWEXP_INVAL(mode)((mode & 0x10) || ((mode & 0x08) && (mode &
 ~0x08))))
return;

i = 0;
if (mode == RCS_KWEXP_NONE0x00)
buf[0] = 'b';
else if (mode == RCS_KWEXP_OLD0x08)
buf[0] = 'o';
else {
if (mode & RCS_KWEXP_NAME0x01)
	buf[i++] = 'k';
if (mode & RCS_KWEXP_VAL0x02)
	buf[i++] = 'v';
if (mode & RCS_KWEXP_LKR0x04)
	buf[i++] = 'l';
}

tmp = xstrdup(buf);
free(file->rf_expand);
file->rf_expand = tmp;
/* not synced anymore */
file->rf_flags &= ~RCS_SYNCED(1<<5);
1361}

1363/*
* rcs_kwexp_get()
*
* Retrieve the keyword expansion mode to be used for the RCS file <file>.
*/
1368int
1369rcs_kwexp_get(RCSFILE *file)
1370{
if (file->rf_expand == NULL((void *)0))
return (RCS_KWEXP_DEFAULT(0x01 | 0x02));

return (rcs_kflag_get(file->rf_expand));
1375}

1377/*
* rcs_kflag_get()
*
* Get the keyword expansion mode from a set of character flags given in
* <flags> and return the appropriate flag mask.  In case of an error, the
* returned mask will have the RCS_KWEXP_ERR bit set to 1.
*/
1384int
1385rcs_kflag_get(const char *flags)
1386{
int fl;
size_t len;
const char *fp;

if (flags == NULL((void *)0) || !(len = strlen(flags)))
return (RCS_KWEXP_ERR0x10);

fl = 0;
for (fp = flags; *fp != '\0'; fp++) {
if (*fp == 'k')
	fl |= RCS_KWEXP_NAME0x01;
else if (*fp == 'v')
	fl |= RCS_KWEXP_VAL0x02;
else if (*fp == 'l')
	fl |= RCS_KWEXP_LKR0x04;
else if (*fp == 'o') {
	if (len != 1)
		fl |= RCS_KWEXP_ERR0x10;
	fl |= RCS_KWEXP_OLD0x08;
} else if (*fp == 'b') {
	if (len != 1)
		fl |= RCS_KWEXP_ERR0x10;
	fl |= RCS_KWEXP_NONE0x00;
} else	/* unknown letter */
	fl |= RCS_KWEXP_ERR0x10;
}

return (fl);
1415}

1417/*
* rcs_freedelta()
*
* Free the contents of a delta structure.
*/
1422static void
1423rcs_freedelta(struct rcs_delta *rdp)
1424{
struct rcs_branch *rb;

rcsnum_free(rdp->rd_num);
rcsnum_free(rdp->rd_next);

free(rdp->rd_author);
free(rdp->rd_locker);
free(rdp->rd_state);
free(rdp->rd_log);
free(rdp->rd_text);

while ((rb = TAILQ_FIRST(&(rdp->rd_branches))((&(rdp->rd_branches))->tqh_first)) != NULL((void *)0)) {
TAILQ_REMOVE(&(rdp->rd_branches), rb, rb_list)do { if (((rb)->rb_list.tqe_next) != ((void *)0)) (rb)->
rb_list.tqe_next->rb_list.tqe_prev = (rb)->rb_list.tqe_prev
; else (&(rdp->rd_branches))->tqh_last = (rb)->rb_list
.tqe_prev; *(rb)->rb_list.tqe_prev = (rb)->rb_list.tqe_next
; ; ; } while (0);
rcsnum_free(rb->rb_num);
free(rb);
}

free(rdp);
1443}

1445/*
* rcs_strprint()
*
* Output an RCS string <str> of size <slen> to the stream <stream>.  Any
* '@' characters are escaped.  Otherwise, the string can contain arbitrary
* binary data.
*/
1452static void
1453rcs_strprint(const u_char *str, size_t slen, FILE *stream)
1454{
const u_char *ap, *ep, *sp;

if (slen == 0)
return;

ep = str + slen - 1;

for (sp = str; sp <= ep;)  {
ap = memchr(sp, '@', ep - sp);
if (ap == NULL((void *)0))
	ap = ep;
(void)fwrite(sp, sizeof(u_char), ap - sp + 1, stream);

if (*ap == '@')
	putc('@', stream)(!__isthreaded ? __sputc('@', stream) : (putc)('@', stream));
sp = ap + 1;
}
1472}

1474/*
* rcs_expand_keywords()
*
* Return expansion any RCS keywords in <data>
*
* On error, return NULL.
*/
1481static BUF *
1482rcs_expand_keywords(char *rcsfile_in, struct rcs_delta *rdp, BUF *bp, int mode)
1483{
BUF *newbuf;
u_char *c, *kw, *fin;
char buf[256], *tmpf, resolved[PATH_MAX1024], *rcsfile;
u_char *line, *line2;
u_int i, j;
int kwtype;
int found;
struct tm tb;

tb = rdp->rd_date;
if (timezone_flag != NULL((void *)0))
rcs_set_tz(timezone_flag, rdp, &tb);

if (realpath(rcsfile_in, resolved) == NULL((void *)0))
rcsfile = rcsfile_in;
else
rcsfile = resolved;

newbuf = buf_alloc(buf_len(bp));

/*
* Keyword formats:
* $Keyword$
* $Keyword: value$
*/
c = buf_get(bp);
fin = c + buf_len(bp);
/* Copying to newbuf is deferred until the first keyword. */
found = 0;

while (c < fin) {
kw = memchr(c, '$', fin - c);
if (kw == NULL((void *)0))
	break;
++kw;
if (found) {
	/* Copy everything up to and including the $. */
	buf_append(newbuf, c, kw - c);
}
c = kw;
/* c points after the $ now. */
if (c == fin)
	break;
if (!isalpha(*c)) /* all valid keywords start with a letter */
	continue;

for (i = 0; i < RCS_NKWORDS(sizeof(rcs_expkw)/sizeof(rcs_expkw[0])); ++i) {
	size_t kwlen;

	kwlen = strlen(rcs_expkw[i].kw_str);
	/*
	 * kwlen must be less than clen since clen includes
	 * either a terminating `$' or a `:'.
	 */
	if (c + kwlen < fin &&
	    memcmp(c , rcs_expkw[i].kw_str, kwlen) == 0 &&
	    (c[kwlen] == '$' || c[kwlen] == ':')) {
		c += kwlen;
		break;
	}
}
if (i == RCS_NKWORDS(sizeof(rcs_expkw)/sizeof(rcs_expkw[0])))
	continue;
kwtype = rcs_expkw[i].kw_type;

/*
 * If the next character is ':' we need to look for an '$'
 * before the end of the line to be sure it is in fact a
 * keyword.
 */
if (*c == ':') {
	for (; c < fin; ++c) {
		if (*c == '$' || *c == '\n')
			break;
	}

	if (*c != '$') {
		if (found)
			buf_append(newbuf, kw, c - kw);
		continue;
	}
}
++c;

if (!found) {
	found = 1;
	/* Copy everything up to and including the $. */
	buf_append(newbuf, buf_get(bp), kw - buf_get(bp));
}

if (mode & RCS_KWEXP_NAME0x01) {
	buf_puts(newbuf, rcs_expkw[i].kw_str);
	if (mode & RCS_KWEXP_VAL0x02)
		buf_puts(newbuf, ": ");
}

/* Order matters because of RCS_KW_ID and RCS_KW_HEADER. */
if (mode & RCS_KWEXP_VAL0x02) {
	if (kwtype & (RCS_KW_RCSFILE0x0100|RCS_KW_LOG0x4000)) {
		if ((kwtype & RCS_KW_FULLPATH0x0010) ||
		    (tmpf = strrchr(rcsfile, '/')) == NULL((void *)0))
			buf_puts(newbuf, rcsfile);
		else
			buf_puts(newbuf, tmpf + 1);
		buf_putc(newbuf, ' ');
	}

	if (kwtype & RCS_KW_REVISION0x0200) {
		rcsnum_tostr(rdp->rd_num, buf, sizeof(buf));
		buf_puts(newbuf, buf);
		buf_putc(newbuf, ' ');
	}

	if (kwtype & RCS_KW_DATE0x2000) {
		strftime(buf, sizeof(buf),
		    "%Y/%m/%d %H:%M:%S ", &tb);
		buf_puts(newbuf, buf);
	}

	if (kwtype & RCS_KW_AUTHOR0x1000) {
		buf_puts(newbuf, rdp->rd_author);
		buf_putc(newbuf, ' ');
	}

	if (kwtype & RCS_KW_STATE0x0800) {
		buf_puts(newbuf, rdp->rd_state);
		buf_putc(newbuf, ' ');
	}

	/* Order does not matter anymore below. */
	if (kwtype & RCS_KW_SOURCE0x0400) {
		buf_puts(newbuf, rcsfile);
		buf_putc(newbuf, ' ');
	}

	if (kwtype & RCS_KW_MDOCDATE0x0020) {
		strftime(buf, sizeof(buf), "%B", &tb);
		buf_puts(newbuf, buf);
		/* Only one blank before single-digit day. */
		snprintf(buf, sizeof(buf), " %d", tb.tm_mday);
		buf_puts(newbuf, buf);
		strftime(buf, sizeof(buf), " %Y ", &tb);
		buf_puts(newbuf, buf);
	}

	if (kwtype & RCS_KW_NAME0x8000)
		buf_putc(newbuf, ' ');

	if ((kwtype & RCS_KW_LOCKER0x10000)) {
		if (rdp->rd_locker) {
			buf_puts(newbuf, rdp->rd_locker);
			buf_putc(newbuf, ' ');
		}
	}
}

/* End the expansion. */
if (mode & RCS_KWEXP_NAME0x01)
	buf_putc(newbuf, '$');

if (kwtype & RCS_KW_LOG0x4000) {
	line = memrchr(buf_get(bp), '\n', kw - buf_get(bp) - 1);
	if (line == NULL((void *)0))
		line = buf_get(bp);
	else
		++line;
	line2 = kw - 1;
	while (line2 > line && line2[-1] == ' ')
		--line2;

	buf_putc(newbuf, '\n');
	buf_append(newbuf, line, kw - 1 - line);
	buf_puts(newbuf, "Revision ");
	rcsnum_tostr(rdp->rd_num, buf, sizeof(buf));
	buf_puts(newbuf, buf);
	buf_puts(newbuf, "  ");
	strftime(buf, sizeof(buf), "%Y/%m/%d %H:%M:%S", &tb);
	buf_puts(newbuf, buf);

	buf_puts(newbuf, "  ");
	buf_puts(newbuf, rdp->rd_author);
	buf_putc(newbuf, '\n');

	for (i = 0; rdp->rd_log[i]; i += j) {
		j = strcspn(rdp->rd_log + i, "\n");
		if (j == 0)
			buf_append(newbuf, line, line2 - line);
		else
			buf_append(newbuf, line, kw - 1 - line);
		if (rdp->rd_log[i + j])
			++j;
		buf_append(newbuf, rdp->rd_log + i, j);
	}

	if (i > 0 && rdp->rd_log[i - 1] != '\n')
		buf_putc(newbuf, '\n');

	buf_append(newbuf, line, line2 - line);
	for (j = 0; c + j < fin; ++j) {
		if (c[j] != ' ')
			break;
	}
	if (c + j == fin || c[j] == '\n')
		c += j;
}
}

if (found) {
buf_append(newbuf, c, fin - c);
buf_free(bp);
return (newbuf);
} else {
buf_free(newbuf);
return (bp);
}
1699}

1701/*
* rcs_deltatext_set()
*
* Set deltatext for <rev> in RCS file <rfp> to <dtext>
* Returns -1 on error, 0 on success.
*/
1707int
1708rcs_deltatext_set(RCSFILE *rfp, RCSNUM *rev, BUF *bp)
1709{
size_t len;
u_char *dtext;
struct rcs_delta *rdp;

/* Write operations require full parsing */
if (rcsparse_deltatexts(rfp, NULL((void *)0)))
return (-1);

if ((rdp = rcs_findrev(rfp, rev)) == NULL((void *)0))
return (-1);

free(rdp->rd_text);

len = buf_len(bp);
dtext = buf_release(bp);
bp = NULL((void *)0);

if (len != 0) {
rdp->rd_text = xmalloc(len);
rdp->rd_tlen = len;
(void)memcpy(rdp->rd_text, dtext, len);
} else {
rdp->rd_text = NULL((void *)0);
rdp->rd_tlen = 0;
}

free(dtext);

return (0);
1739}

1741/*
* rcs_rev_setlog()
*
* Sets the log message of revision <rev> to <logtext>.
*/
1746int
1747rcs_rev_setlog(RCSFILE *rfp, RCSNUM *rev, const char *logtext)
1748{
struct rcs_delta *rdp;

if ((rdp = rcs_findrev(rfp, rev)) == NULL((void *)0))
return (-1);

free(rdp->rd_log);

rdp->rd_log = xstrdup(logtext);
rfp->rf_flags &= ~RCS_SYNCED(1<<5);
return (0);
1759}
1760/*
* rcs_rev_getdate()
*
* Get the date corresponding to a given revision.
* Returns the date on success, -1 on failure.
*/
1766time_t
1767rcs_rev_getdate(RCSFILE *rfp, RCSNUM *rev)
1768{
struct rcs_delta *rdp;

if ((rdp = rcs_findrev(rfp, rev)) == NULL((void *)0))
return (-1);

return (mktime(&rdp->rd_date));
1775}

1777/*
* rcs_state_set()
*
* Sets the state of revision <rev> to <state>
* NOTE: default state is 'Exp'. States may not contain spaces.
*
* Returns -1 on failure, 0 on success.
*/
1785int
1786rcs_state_set(RCSFILE *rfp, RCSNUM *rev, const char *state)
1787{
struct rcs_delta *rdp;

if ((rdp = rcs_findrev(rfp, rev)) == NULL((void *)0))
return (-1);

free(rdp->rd_state);

rdp->rd_state = xstrdup(state);

rfp->rf_flags &= ~RCS_SYNCED(1<<5);

return (0);
1800}

1802/*
* rcs_state_check()
*
* Check if string <state> is valid.
*
* Returns 0 if the string is valid, -1 otherwise.
*/
1809int
1810rcs_state_check(const char *state)
1811{
int ret;
const unsigned char *cp;

ret = 0;
cp = state;
if (!isalpha(*cp++))
return (-1);

for (; *cp != '\0'; cp++)
if (!isgraph(*cp) || (strchr(rcs_state_invch, *cp) != NULL((void *)0))) {
	ret = -1;
	break;
}

return (ret);
1827}

1829/*
* rcs_kwexp_buf()
*
* Do keyword expansion on a buffer if necessary
*
*/
1835BUF *
1836rcs_kwexp_buf(BUF *bp, RCSFILE *rf, RCSNUM *rev)
1837{
struct rcs_delta *rdp;
int expmode;

/*
* Do keyword expansion if required.
*/
expmode = rcs_kwexp_get(rf);

if (!(expmode & RCS_KWEXP_NONE0x00)) {
if ((rdp = rcs_findrev(rf, rev)) == NULL((void *)0))
	errx(1, "could not fetch revision");
return (rcs_expand_keywords(rf->rf_path, rdp, bp, expmode));
}
return (bp);
1852}