/usr/src/lib/libc/gen/login_cap.c

Bug Summary

File:	src/lib/libc/gen/login_cap.c
Warning:	line 645, column 16 Access to field 'pw_name' results in a dereference of a null pointer (loaded from variable 'pwd')

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name login_cap.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/lib/libc/obj -resource-dir /usr/local/lib/clang/13.0.0 -include namespace.h -I /usr/src/lib/libc/include -I /usr/src/lib/libc/hidden -D __LIBC__ -D APIWARN -D YP -I /usr/src/lib/libc/yp -I /usr/src/lib/libc -I /usr/src/lib/libc/gdtoa -I /usr/src/lib/libc/arch/amd64/gdtoa -D INFNAN_CHECK -D MULTIPLE_THREADS -D NO_FENV_H -D USE_LOCALE -I /usr/src/lib/libc -I /usr/src/lib/libc/citrus -D RESOLVSORT -D FLOATING_POINT -D PRINTF_WIDE_CHAR -D SCANF_WIDE_CHAR -D FUTEX -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/lib/libc/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/lib/libc/gen/login_cap.c

1/*	$OpenBSD: login_cap.c,v 1.40 2021/10/24 14:40:30 deraadt Exp $	*/

3/*
* Copyright (c) 2000-2004 Todd C. Miller <millert@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
18/*-
* Copyright (c) 1995,1997 Berkeley Software Design, Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
*    must display the following acknowledgement:
*	This product includes software developed by Berkeley Software Design,
*	Inc.
* 4. The name of Berkeley Software Design, Inc.  may not be used to endorse
*    or promote products derived from this software without specific prior
*    written permission.
*
* THIS SOFTWARE IS PROVIDED BY BERKELEY SOFTWARE DESIGN, INC. ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL BERKELEY SOFTWARE DESIGN, INC. BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
*	BSDI $From: login_cap.c,v 2.16 2000/03/22 17:10:55 donn Exp $
*/
51#include <sys/types.h>
52#include <sys/stat.h>
53#include <sys/time.h>
54#include <sys/resource.h>

56#include <err.h>
57#include <errno(*__errno()).h>
58#include <fcntl.h>
59#include <limits.h>
60#include <login_cap.h>
61#include <paths.h>
62#include <pwd.h>
63#include <stdio.h>
64#include <stdlib.h>
65#include <string.h>
66#include <syslog.h>
67#include <unistd.h>


70static	char *_authtypes[] = { LOGIN_DEFSTYLE"passwd", 0 };
71static	char *expandstr(const char *, const struct passwd *, int);
72static	int login_setenv(char *, char *, const struct passwd *, int);
73static	int setuserenv(login_cap_t *, const struct passwd *);
74static	int setuserpath(login_cap_t *, const struct passwd *);
75static	u_quad_t multiply(u_quad_t, u_quad_t);
76static	u_quad_t strtolimit(char *, char **, int);
77static	u_quad_t strtosize(char *, char **, int);
78static	int gsetrl(login_cap_t *, int, char *, int);

80login_cap_t *
81login_getclass(char *class)
82{
char *classfiles[2] = {_PATH_LOGIN_CONF"/etc/login.conf", NULL((void *)0)};
login_cap_t *lc;
int res;

if ((lc = calloc(1, sizeof(login_cap_t))) == NULL((void *)0)) {
2
←
Assuming the condition is false→
3
←
Taking false branch→
syslog(LOG_ERR3, "%s:%d malloc: %m", __FILE__"/usr/src/lib/libc/gen/login_cap.c", __LINE__88);
return (0);
}

if (class == NULL((void *)0) || class[0] == '\0')
4
←
Assuming 'class' is not equal to NULL→
5
←
Assuming the condition is false→
6
←
Taking false branch→
class = LOGIN_DEFCLASS"default";

  	if ((lc->lc_class = strdup(class)) == NULL((void *)0)) {
7
←
Assuming the condition is false→
8
←
Taking false branch→
syslog(LOG_ERR3, "%s:%d strdup: %m", __FILE__"/usr/src/lib/libc/gen/login_cap.c", __LINE__96);
free(lc);
return (0);
}

if ((res = cgetent(&lc->lc_cap, classfiles, lc->lc_class)) != 0) {
9
←
Assuming the condition is false→
10
←
Taking false branch→
lc->lc_cap = 0;
switch (res) {
case 1: 
	syslog(LOG_ERR3, "%s: couldn't resolve 'tc'",
		lc->lc_class);
	break;
case -1:
	if ((res = open(classfiles[0], O_RDONLY0x0000)) >= 0)
		close(res);
	if (strcmp(lc->lc_class, LOGIN_DEFCLASS"default") == 0 &&
	    res < 0)
		return (lc);
	syslog(LOG_ERR3, "%s: unknown class", lc->lc_class);
	break;
case -2:
	/*
	 * A missing login.conf file is not an error condition.
	 * The individual routines deal reasonably with missing
	 * capabilities and use default values.
	 */
	if (errno(*__errno()) == ENOENT2)
		return (lc);
	syslog(LOG_ERR3, "%s: getting class information: %m",
	    lc->lc_class);
	break;
case -3:
	syslog(LOG_ERR3, "%s: 'tc' reference loop",
		lc->lc_class);
	break;
default:
	syslog(LOG_ERR3, "%s: unexpected cgetent error",
		lc->lc_class);
	break;
}
free(lc->lc_class);
free(lc);
return (0);
}
return (lc);
11
←
Returning pointer (loaded from 'lc'), which participates in a condition later→
141}
142DEF_WEAK(login_getclass)__asm__(".weak " "login_getclass" " ; " "login_getclass" " = "
 "_libc_login_getclass");

144char *
145login_getstyle(login_cap_t *lc, char *style, char *atype)
146{
  	char **authtypes = _authtypes;
char *auths, *ta;
  	char *f1 = NULL((void *)0), **f2 = NULL((void *)0);
int i;

/* Silently convert 's/key' -> 'skey' */
if (style && strcmp(style, "s/key") == 0)
style = "skey";

free(lc->lc_style);
lc->lc_style = NULL((void *)0);

  	if (!atype || !(auths = login_getcapstr(lc, atype, NULL((void *)0), NULL((void *)0))))
auths = login_getcapstr(lc, "auth", NULL((void *)0), NULL((void *)0));

if (auths) {
f1 = ta = auths;	/* auths malloced by login_getcapstr */
i = 2;
while (*ta)
	if (*ta++ == ',')
		++i;
f2 = authtypes = calloc(sizeof(char *), i);
if (!authtypes) {
	syslog(LOG_ERR3, "malloc: %m");
	free(f1);
	return (0);
}
i = 0;
while (*auths) {
	authtypes[i] = auths;
	while (*auths && *auths != ',')
		++auths;
	if (*auths)
		*auths++ = 0;
	if (!*authtypes[i])
		authtypes[i] = LOGIN_DEFSTYLE"passwd";
	++i;
}
authtypes[i] = 0;
}

if (!style)
style = authtypes[0];

while (*authtypes && strcmp(style, *authtypes))
++authtypes;

if (*authtypes) {
lc->lc_style = strdup(*authtypes);
if (lc->lc_style == NULL((void *)0))
	syslog(LOG_ERR3, "strdup: %m");
}
free(f1);
free(f2);
return (lc->lc_style);
202}
203DEF_WEAK(login_getstyle)__asm__(".weak " "login_getstyle" " ; " "login_getstyle" " = "
 "_libc_login_getstyle");

205char *
206login_getcapstr(login_cap_t *lc, char *cap, char *def, char *e)
207{
char *res = NULL((void *)0), *str = e;
int stat;

errno(*__errno()) = 0;

  	if (!lc->lc_cap)
return (def);

switch (stat = cgetstr(lc->lc_cap, cap, &res)) {
case -1:
str = def;
break;
case -2:
syslog(LOG_ERR3, "%s: getting capability %s: %m",
    lc->lc_class, cap);
break;
default:
if (stat >= 0)
	str = res;
else
	syslog(LOG_ERR3,
	    "%s: unexpected error with capability %s",
	    lc->lc_class, cap);
break;
}

if (res != NULL((void *)0) && str != res)
free(res);
return(str);
237}
238DEF_WEAK(login_getcapstr)__asm__(".weak " "login_getcapstr" " ; " "login_getcapstr" " = "
 "_libc_login_getcapstr");

240quad_t
241login_getcaptime(login_cap_t *lc, char *cap, quad_t def, quad_t e)
242{
char *ep;
char *res = NULL((void *)0), *sres;
int stat;
quad_t q, r;

errno(*__errno()) = 0;

  	if (!lc->lc_cap)
return (def);

switch (stat = cgetstr(lc->lc_cap, cap, &res)) {
case -1:
free(res);
return (def);
case -2:
free(res);
syslog(LOG_ERR3, "%s: getting capability %s: %m",
    lc->lc_class, cap);
errno(*__errno()) = ERANGE34;
return (e);
default:
if (stat >= 0) 
	break;
free(res);
syslog(LOG_ERR3, "%s: unexpected error with capability %s",
    lc->lc_class, cap);
errno(*__errno()) = ERANGE34;
return (e);
}

errno(*__errno()) = 0;

if (strcasecmp(res, "infinity") == 0) {
free(res);
return (RLIM_INFINITY(((rlim_t)1 << 63) - 1));
}

q = 0;
sres = res;
while (*res) {
r = strtoll(res, &ep, 0);
if (!ep || ep == res ||
    ((r == QUAD_MIN(-0x7fffffffffffffffLL-1) || r == QUAD_MAX0x7fffffffffffffffLL) && errno(*__errno()) == ERANGE34)) {
286invalid:
	syslog(LOG_ERR3, "%s:%s=%s: invalid time",
	    lc->lc_class, cap, sres);
	free(sres);
	errno(*__errno()) = ERANGE34;
	return (e);
}
switch (*ep++) {
case '\0':
	--ep;
	break;
case 's': case 'S':
	break;
case 'm': case 'M':
	r *= 60;
	break;
case 'h': case 'H':
	r *= 60 * 60;
	break;
case 'd': case 'D':
	r *= 60 * 60 * 24;
	break;
case 'w': case 'W':
	r *= 60 * 60 * 24 * 7;
	break;
case 'y': case 'Y':	/* Pretty absurd */
	r *= 60 * 60 * 24 * 365;
	break;
default:
	goto invalid;
}
res = ep;
q += r;
}
free(sres);
return (q);
322}
323DEF_WEAK(login_getcaptime)__asm__(".weak " "login_getcaptime" " ; " "login_getcaptime" " = "
 "_libc_login_getcaptime");

325quad_t
326login_getcapnum(login_cap_t *lc, char *cap, quad_t def, quad_t e)
327{
char *ep;
char *res = NULL((void *)0);
int stat;
quad_t q;

errno(*__errno()) = 0;

  	if (!lc->lc_cap)
return (def);

switch (stat = cgetstr(lc->lc_cap, cap, &res)) {
case -1:
free(res);
return (def);
case -2:
free(res);
syslog(LOG_ERR3, "%s: getting capability %s: %m",
    lc->lc_class, cap);
errno(*__errno()) = ERANGE34;
return (e);
default:
if (stat >= 0) 
	break;
free(res);
syslog(LOG_ERR3, "%s: unexpected error with capability %s",
    lc->lc_class, cap);
errno(*__errno()) = ERANGE34;
return (e);
}

errno(*__errno()) = 0;

if (strcasecmp(res, "infinity") == 0) {
free(res);
return (RLIM_INFINITY(((rlim_t)1 << 63) - 1));
}

  	q = strtoll(res, &ep, 0);
if (!ep || ep == res || ep[0] ||
   ((q == QUAD_MIN(-0x7fffffffffffffffLL-1) || q == QUAD_MAX0x7fffffffffffffffLL) && errno(*__errno()) == ERANGE34)) {
syslog(LOG_ERR3, "%s:%s=%s: invalid number",
    lc->lc_class, cap, res);
free(res);
errno(*__errno()) = ERANGE34;
return (e);
}
free(res);
return (q);
376}
377DEF_WEAK(login_getcapnum)__asm__(".weak " "login_getcapnum" " ; " "login_getcapnum" " = "
 "_libc_login_getcapnum");

379quad_t
380login_getcapsize(login_cap_t *lc, char *cap, quad_t def, quad_t e)
381{
char *ep;
char *res = NULL((void *)0);
int stat;
quad_t q;

errno(*__errno()) = 0;

  	if (!lc->lc_cap)
return (def);

switch (stat = cgetstr(lc->lc_cap, cap, &res)) {
case -1:
free(res);
return (def);
case -2:
free(res);
syslog(LOG_ERR3, "%s: getting capability %s: %m",
    lc->lc_class, cap);
errno(*__errno()) = ERANGE34;
return (e);
default:
if (stat >= 0) 
	break;
free(res);
syslog(LOG_ERR3, "%s: unexpected error with capability %s",
    lc->lc_class, cap);
errno(*__errno()) = ERANGE34;
return (e);
}

errno(*__errno()) = 0;
q = strtolimit(res, &ep, 0);
if (!ep || ep == res || (ep[0] && ep[1]) ||
   ((q == QUAD_MIN(-0x7fffffffffffffffLL-1) || q == QUAD_MAX0x7fffffffffffffffLL) && errno(*__errno()) == ERANGE34)) {
syslog(LOG_ERR3, "%s:%s=%s: invalid size",
    lc->lc_class, cap, res);
free(res);
errno(*__errno()) = ERANGE34;
return (e);
}
free(res);
return (q);
424}
425DEF_WEAK(login_getcapsize)__asm__(".weak " "login_getcapsize" " ; " "login_getcapsize" " = "
 "_libc_login_getcapsize");

427int
428login_getcapbool(login_cap_t *lc, char *cap, u_int def)
429{
  	if (!lc->lc_cap)
return (def);

return (cgetcap(lc->lc_cap, cap, ':') != NULL((void *)0));
434}
435DEF_WEAK(login_getcapbool)__asm__(".weak " "login_getcapbool" " ; " "login_getcapbool" " = "
 "_libc_login_getcapbool");

437void
438login_close(login_cap_t *lc)
439{
if (lc) {
free(lc->lc_class);
free(lc->lc_cap);
free(lc->lc_style);
free(lc);
}
446}
447DEF_WEAK(login_close)__asm__(".weak " "login_close" " ; " "login_close" " = " "_libc_login_close"
);

449#define	CTIME1	1
450#define	CSIZE2	2
451#define	CNUMB3	3

453static struct {
int	what;
int	type;
char *	name;
457} r_list[] = {
{ RLIMIT_CPU0,		CTIME1, "cputime", },
{ RLIMIT_FSIZE1,		CSIZE2, "filesize", },
{ RLIMIT_DATA2,		CSIZE2, "datasize", },
{ RLIMIT_STACK3,		CSIZE2, "stacksize", },
{ RLIMIT_RSS5,		CSIZE2, "memoryuse", },
{ RLIMIT_MEMLOCK6,	CSIZE2, "memorylocked", },
{ RLIMIT_NPROC7,		CNUMB3, "maxproc", },
{ RLIMIT_NOFILE8,	CNUMB3, "openfiles", },
{ RLIMIT_CORE4,		CSIZE2, "coredumpsize", },
467#ifdef RLIMIT_VMEM
{ RLIMIT_VMEM,		CSIZE2, "vmemoryuse", },
469#endif
{ -1, 0, 0 }
471};

473static int
474gsetrl(login_cap_t *lc, int what, char *name, int type)
475{
struct rlimit rl;
struct rlimit r;
char name_cur[32];
char name_max[32];
  	char *v;
int len;

/*
* If we have no capabilities then there is nothing to do and
* we can just return success.
*/
if (lc->lc_cap == NULL((void *)0))
return (0);

len = snprintf(name_cur, sizeof name_cur, "%s-cur", name);
if (len < 0 || len >= sizeof name_cur) {
syslog(LOG_ERR3, "current resource limit name too large");
return (-1);
}
len = snprintf(name_max, sizeof name_max, "%s-max", name);
if (len < 0 || len >= sizeof name_max) {
syslog(LOG_ERR3, "max resource limit name too large");
return (-1);
}

if (getrlimit(what, &r)) {
syslog(LOG_ERR3, "getting resource limit: %m");
return (-1);
}

/*
* We need to pre-fetch the 3 possible strings we will look
* up to see what order they come in.  If the one without
* the -cur or -max comes in first then we ignore any later
* -cur or -max entries.
* Note that the cgetent routines will always return failure
* on the entry "".  This will cause our login_get* routines
* to use the default entry.
*/
if ((v = cgetcap(lc->lc_cap, name, '=')) != NULL((void *)0)) {
if (v < cgetcap(lc->lc_cap, name_cur, '='))
	name_cur[0] = '\0';
if (v < cgetcap(lc->lc_cap, name_max, '='))
	name_max[0] = '\0';
}

522#define	RCUR	r.rlim_cur
523#define	RMAX	r.rlim_max

switch (type) {
case CTIME1:
RCUR = (rlim_t)login_getcaptime(lc, name, RCUR, RCUR);
RMAX = (rlim_t)login_getcaptime(lc, name, RMAX, RMAX);
rl.rlim_cur = (rlim_t)login_getcaptime(lc, name_cur, RCUR, RCUR);
rl.rlim_max = (rlim_t)login_getcaptime(lc, name_max, RMAX, RMAX);
break;
case CSIZE2:
RCUR = (rlim_t)login_getcapsize(lc, name, RCUR, RCUR);
RMAX = (rlim_t)login_getcapsize(lc, name, RMAX, RMAX);
rl.rlim_cur = (rlim_t)login_getcapsize(lc, name_cur, RCUR, RCUR);
rl.rlim_max = (rlim_t)login_getcapsize(lc, name_max, RMAX, RMAX);
break;
case CNUMB3:
RCUR = (rlim_t)login_getcapnum(lc, name, RCUR, RCUR);
RMAX = (rlim_t)login_getcapnum(lc, name, RMAX, RMAX);
rl.rlim_cur = (rlim_t)login_getcapnum(lc, name_cur, RCUR, RCUR);
rl.rlim_max = (rlim_t)login_getcapnum(lc, name_max, RMAX, RMAX);
break;
default:
return (-1);
}

if (setrlimit(what, &rl)) {
syslog(LOG_ERR3, "%s: setting resource limit %s: %m",
    lc->lc_class, name);
return (-1);
}
553#undef	RCUR
554#undef	RMAX
return (0);
556}

558int
559setclasscontext(char *class, u_int flags)
560{
int ret;
login_cap_t *lc;

flags &= LOGIN_SETRESOURCES0x0010 | LOGIN_SETPRIORITY0x0008 | LOGIN_SETUMASK0x0020 |
   LOGIN_SETPATH0x0004;

lc = login_getclass(class);
1
Calling 'login_getclass'→
12
←
Returning from 'login_getclass'→
ret = lc12.1
'lc' is non-null
 ? setusercontext(lc, NULL((void *)0), 0, flags) : -1;
13
←
'?' condition is true→
14
←
Passing null pointer value via 2nd parameter 'pwd'→
15
←
Calling 'setusercontext'→
login_close(lc);
return (ret);
571}

573int
574setusercontext(login_cap_t *lc, struct passwd *pwd, uid_t uid, u_int flags)
575{
login_cap_t *flc;
quad_t p;
int i;

flc = NULL((void *)0);

if (!lc15.1
'lc' is non-null
 && !(flc = lc = login_getclass(pwd ? pwd->pw_class : NULL((void *)0))))
return (-1);

/*
* Without the pwd entry being passed we cannot set either
* the group or the login.  We could complain about it.
*/
if (pwd15.2
'pwd' is equal to NULL
 == NULL((void *)0))
16
←
Taking true branch→
flags &= ~(LOGIN_SETGROUP0x0001|LOGIN_SETLOGIN0x0002);

/*
* Verify that we haven't been given invalid values.
*/
if (flags & LOGIN_SETGROUP0x0001) {
17
←
Assuming the condition is false→
18
←
Taking false branch→
if (pwd->pw_gid == -1) {
	syslog(LOG_ERR3, "setusercontext with invalid gid");
	login_close(flc);
	return (-1);
}
}
if (flags & LOGIN_SETUSER0x0040) {
19
←
Assuming the condition is false→
20
←
Taking false branch→
if (uid == -1) {
	syslog(LOG_ERR3, "setusercontext with invalid uid");
	login_close(flc);
	return (-1);
}
}

if (flags & LOGIN_SETRESOURCES0x0010)
21
←
Assuming the condition is false→
22
←
Taking false branch→
for (i = 0; r_list[i].name; ++i) 
	if (gsetrl(lc, r_list[i].what, r_list[i].name,
	    r_list[i].type))
		/* XXX - call syslog()? */;

if (flags & LOGIN_SETPRIORITY0x0008) {
23
←
Assuming the condition is false→
24
←
Taking false branch→
p = login_getcapnum(lc, "priority", 0, 0);

if (setpriority(PRIO_PROCESS0, 0, (int)p) == -1)
	syslog(LOG_ERR3, "%s: setpriority: %m", lc->lc_class);
}

if (flags & LOGIN_SETUMASK0x0020) {
25
←
Assuming the condition is false→
26
←
Taking false branch→
p = login_getcapnum(lc, "umask", LOGIN_DEFUMASK022,LOGIN_DEFUMASK022);
umask((mode_t)p);
}

if (flags & LOGIN_SETGROUP0x0001) {
27
←
Taking false branch→
if (setresgid(pwd->pw_gid, pwd->pw_gid, pwd->pw_gid) == -1) {
	syslog(LOG_ERR3, "setresgid(%u,%u,%u): %m",
	    pwd->pw_gid, pwd->pw_gid, pwd->pw_gid);
	login_close(flc);
	return (-1);
}

if (initgroups(pwd->pw_name, pwd->pw_gid) == -1) {
	syslog(LOG_ERR3, "initgroups(%s,%u): %m",
	    pwd->pw_name, pwd->pw_gid);
	login_close(flc);
	return (-1);
}
}

if (flags & LOGIN_SETLOGIN0x0002)
28
←
Assuming the condition is true→
29
←
Taking true branch→
if (setlogin(pwd->pw_name) == -1) {
30
←
Access to field 'pw_name' results in a dereference of a null pointer (loaded from variable 'pwd')
	syslog(LOG_ERR3, "setlogin(%s) failure: %m",
	    pwd->pw_name);
	login_close(flc);
	return (-1);
}

if (flags & LOGIN_SETUSER0x0040) {
if (setresuid(uid, uid, uid) == -1) {
	syslog(LOG_ERR3, "setresuid(%u,%u,%u): %m",
	    uid, uid, uid);
	login_close(flc);
	return (-1);
}
}

if (flags & LOGIN_SETENV0x0080) {
if (setuserenv(lc, pwd) == -1) {
	syslog(LOG_ERR3, "could not set user environment: %m");
	login_close(flc);
	return (-1);
}
}

if (flags & LOGIN_SETPATH0x0004) {
if (setuserpath(lc, pwd) == -1) {
	syslog(LOG_ERR3, "could not set PATH: %m");
	login_close(flc);
	return (-1);
}
}

login_close(flc);
return (0);
679}
680DEF_WEAK(setusercontext)__asm__(".weak " "setusercontext" " ; " "setusercontext" " = "
 "_libc_setusercontext");

682/*
* Look up "path" for this user in login.conf and replace whitespace
* with ':' while expanding '~' and '$'.  Sets the PATH environment
* variable to the result or _PATH_DEFPATH on error.
*/
687static int
688setuserpath(login_cap_t *lc, const struct passwd *pwd)
689{
char *path = NULL((void *)0), *opath = NULL((void *)0), *op, *np;
int len, error;

if (lc->lc_cap == NULL((void *)0))
goto setit;		/* impossible */

if ((len = cgetustr(lc->lc_cap, "path", &opath)) <= 0)
goto setit;

if ((path = malloc(len + 1)) == NULL((void *)0))
goto setit;

/* Convert opath from space-separated to colon-separated path. */
for (op = opath, np = path; *op != '\0'; ) {
switch (*op) {
case ' ':
case '\t':
	/*
	 * Collapse consecutive spaces and trim any space
	 * at the very end.
	 */
	do {
		op++;
	} while (*op == ' ' || *op == '\t');
	if (*op != '\0')
		*np++ = ':';
	break;
case '\\':
	/* check for escaped whitespace */
	if (*(op + 1) == ' ' || *(op + 1) == '\t')
		*np++ = *op++;
	/* FALLTHROUGH */
default:
	*np++ = *op++;
	break;
}

}
*np = '\0';
729setit:
error = login_setenv("PATH", path ? path : _PATH_DEFPATH"/usr/bin:/bin:/usr/sbin:/sbin:/usr/X11R6/bin:/usr/local/bin:/usr/local/sbin", pwd, 1);
free(opath);
free(path);
return (error);
734}

736/*
* Look up "setenv" for this user in login.conf and set the comma-separated
* list of environment variables, expanding '~' and '$'.
*/
740static int
741setuserenv(login_cap_t *lc, const struct passwd *pwd)
742{
char *beg, *end, *ep, *list, *value;
int len, error;

if (lc->lc_cap == NULL((void *)0))
return (-1);		/* impossible */

if ((len = cgetustr(lc->lc_cap, "setenv", &list)) <= 0)
return (0);

for (beg = end = list, ep = list + len + 1; end < ep; end++) {
switch (*end) {
case '\\':
	if (*(end + 1) == ',')
		end++;	/* skip escaped comma */
	continue;
case ',':
case '\0':
	*end = '\0';
	if (beg == end) {
		beg++;
		continue;
	}
	break;
default:
	continue;
}

if ((value = strchr(beg, '=')) != NULL((void *)0))
	*value++ = '\0';
else
	value = "";
if ((error = login_setenv(beg, value, pwd, 0)) != 0) {
	free(list);
	return (error);
}
beg = end + 1;
}
free(list);
return (0);
782}

784/*
* Set an environment variable, substituting for ~ and $
*/
787static int
788login_setenv(char *name, char *ovalue, const struct passwd *pwd, int ispath)
789{
char *value = NULL((void *)0);
int error;

if (*ovalue != '\0')
value = expandstr(ovalue, pwd, ispath);
error = setenv(name, value ? value : ovalue, 1);
free(value);
return (error);
798}

800/*
* Convert an expression of the following forms
* 	1) A number.
*	2) A number followed by a b (mult by 512).
*	3) A number followed by a k (mult by 1024).
*	5) A number followed by a m (mult by 1024 * 1024).
*	6) A number followed by a g (mult by 1024 * 1024 * 1024).
*	7) A number followed by a t (mult by 1024 * 1024 * 1024 * 1024).
*	8) Two or more numbers (with/without k,b,m,g, or t).
*	   separated by x (also * for backwards compatibility), specifying
*	   the product of the indicated values.
*/
812static
813u_quad_t
814strtosize(char *str, char **endptr, int radix)
815{
u_quad_t num, num2;
char *expr, *expr2;

errno(*__errno()) = 0;
num = strtoull(str, &expr, radix);
if (errno(*__errno()) || expr == str) {
if (endptr)
	*endptr = expr;
return (num);
}

switch(*expr) {
case 'b': case 'B':
num = multiply(num, (u_quad_t)512);
++expr;
break;
case 'k': case 'K':
num = multiply(num, (u_quad_t)1024);
++expr;
break;
case 'm': case 'M':
num = multiply(num, (u_quad_t)1024 * 1024);
++expr;
break;
case 'g': case 'G':
num = multiply(num, (u_quad_t)1024 * 1024 * 1024);
++expr;
break;
case 't': case 'T':
num = multiply(num, (u_quad_t)1024 * 1024);
num = multiply(num, (u_quad_t)1024 * 1024);
++expr;
break;
}

if (errno(*__errno()))
goto erange;

switch(*expr) {
case '*':			/* Backward compatible. */
case 'x':
num2 = strtosize(expr+1, &expr2, radix);
if (errno(*__errno())) {
	expr = expr2;
	goto erange;
}

if (expr2 == expr + 1) {
	if (endptr)
		*endptr = expr;
	return (num);
}
expr = expr2;
num = multiply(num, num2);
if (errno(*__errno()))
	goto erange;
break;
}
if (endptr)
*endptr = expr;
return (num);
877erange:
if (endptr)
*endptr = expr;
errno(*__errno()) = ERANGE34;
return (UQUAD_MAX0xffffffffffffffffULL);
882}

884static
885u_quad_t
886strtolimit(char *str, char **endptr, int radix)
887{
if (strcasecmp(str, "infinity") == 0 || strcasecmp(str, "inf") == 0) {
if (endptr)
	*endptr = str + strlen(str);
return ((u_quad_t)RLIM_INFINITY(((rlim_t)1 << 63) - 1));
}
return (strtosize(str, endptr, radix));
894}

896static u_quad_t
897multiply(u_quad_t n1, u_quad_t n2)
898{
static int bpw = 0;
u_quad_t m;
u_quad_t r;
int b1, b2;

/*
* Get rid of the simple cases
*/
if (n1 == 0 || n2 == 0)
return (0);
if (n1 == 1)
return (n2);
if (n2 == 1)
return (n1);

/*
* sizeof() returns number of bytes needed for storage.
* This may be different from the actual number of useful bits.
*/
if (!bpw) {
bpw = sizeof(u_quad_t) * 8;
while (((u_quad_t)1 << (bpw-1)) == 0)
	--bpw;
}

/*
* First check the magnitude of each number.  If the sum of the
* magnatude is way to high, reject the number.  (If this test
* is not done then the first multiply below may overflow.)
*/
for (b1 = bpw; (((u_quad_t)1 << (b1-1)) & n1) == 0; --b1)
; 
for (b2 = bpw; (((u_quad_t)1 << (b2-1)) & n2) == 0; --b2)
; 
if (b1 + b2 - 2 > bpw) {
errno(*__errno()) = ERANGE34;
return (UQUAD_MAX0xffffffffffffffffULL);
}

/*
* Decompose the multiplication to be:
* h1 = n1 & ~1
* h2 = n2 & ~1
* l1 = n1 & 1
* l2 = n2 & 1
* (h1 + l1) * (h2 + l2)
* (h1 * h2) + (h1 * l2) + (l1 * h2) + (l1 * l2)
*
* Since h1 && h2 do not have the low bit set, we can then say:
*
* (h1>>1 * h2>>1 * 4) + ...
*
* So if (h1>>1 * h2>>1) > (1<<(bpw - 2)) then the result will
* overflow.
*
* Finally, if MAX - ((h1 * l2) + (l1 * h2) + (l1 * l2)) < (h1*h2)
* then adding in residual amount will cause an overflow.
*/

m = (n1 >> 1) * (n2 >> 1);

if (m >= ((u_quad_t)1 << (bpw-2))) {
errno(*__errno()) = ERANGE34;
return (UQUAD_MAX0xffffffffffffffffULL);
}

m *= 4;

r = (n1 & n2 & 1)
 + (n2 & 1) * (n1 & ~(u_quad_t)1)
 + (n1 & 1) * (n2 & ~(u_quad_t)1);

if ((u_quad_t)(m + r) < m) {
errno(*__errno()) = ERANGE34;
return (UQUAD_MAX0xffffffffffffffffULL);
}
m += r;

return (m);
978}

980/*
* Check whether or not a tilde in a string should be expanded.
* We only do expansion for things like "~", "~/...", ~me", "~me/...".
* Additionally, for paths the tilde must be a the beginning.
*/
985#define tilde_valid(s, b, u, l, ip)((!(ip) || (s) == (b) || (s)[-1] == ':') && ((s)[1] ==
 '/' || (s)[1] == '\0' || (strncmp((s)+1, u, l) == 0 &&
 ((s)[l+1] == '/' || (s)[l+1] == '\0')))) \
  ((!(ip) || (s) == (b) || (s)[-1] == ':') && \
  ((s)[1] == '/' || (s)[1] == '\0' || \
  (strncmp((s)+1, u, l) == 0 && ((s)[l+1] == '/' || (s)[l+1] == '\0'))))

990/*
* Make a copy of a string, expanding '~' to the user's homedir, '$' to the
* login name and other escape sequences as per cgetstr(3).
*/
994static char *
995expandstr(const char *ostr, const struct passwd *pwd, int ispath)
996{
size_t n, olen, nlen, ulen, dlen;
const char *ep, *eo, *op;
char *nstr, *np;
int ch;

if (pwd != NULL((void *)0)) {
ulen = strlen(pwd->pw_name);
dlen = strlen(pwd->pw_dir);
}

/* calculate the size of the new string */
olen = nlen = strlen(ostr);
for (op = ostr, ep = ostr + olen; op < ep; op++) {
switch (*op) {
case '~':
	if (pwd == NULL((void *)0) ||
	    !tilde_valid(op, ostr, pwd->pw_name, ulen, ispath)((!(ispath) || (op) == (ostr) || (op)[-1] == ':') && (
(op)[1] == '/' || (op)[1] == '\0' || (strncmp((op)+1, pwd->
pw_name, ulen) == 0 && ((op)[ulen+1] == '/' || (op)[ulen
+1] == '\0')))))
		break;
	if (op[1] != '/' && op[1] != '\0') {
		op += ulen;	/* ~username */
		nlen = nlen - ulen - 1 + dlen;
	} else
		nlen += dlen - 1;
	break;
case '$':
	if (pwd != NULL((void *)0))
		nlen += ulen - 1;
	break;
case '^':
	/* control char */
	if (*++op != '\0')
		nlen--;
	break;
case '\\':
	if (op[1] == '\0')
		break;
	/*
	 * Byte in octal notation (\123) or an escaped char (\t)
	 */
	eo = op + 4;
	do {
		op++;
		nlen--;
	} while (op < eo && *op >= '0' && *op <= '7');
	break;
}
}
if ((np = nstr = malloc(++nlen)) == NULL((void *)0))
return (NULL((void *)0));

for (op = ostr, ep = ostr + olen; op < ep; op++) {
switch ((ch = *op)) {
case '~':
	if (pwd == NULL((void *)0) ||
	    !tilde_valid(op, ostr, pwd->pw_name, ulen, ispath)((!(ispath) || (op) == (ostr) || (op)[-1] == ':') && (
(op)[1] == '/' || (op)[1] == '\0' || (strncmp((op)+1, pwd->
pw_name, ulen) == 0 && ((op)[ulen+1] == '/' || (op)[ulen
+1] == '\0')))))
		break;
	if (op[1] != '/' && op[1] != '\0')
		op += ulen;	/* ~username */
	strlcpy(np, pwd->pw_dir, nlen);
	nlen -= dlen;
	np += dlen;
	continue;
case '$':
	if (pwd == NULL((void *)0))
		break;
	strlcpy(np, pwd->pw_name, nlen);
	nlen -= ulen;
	np += ulen;
	continue;
case '^':
	if (op[1] != '\0')
		ch = *++op & 037;
	break;
case '\\':
	if (op[1] == '\0')
		break;
	switch(*++op) {
	case '0': case '1': case '2': case '3':
	case '4': case '5': case '6': case '7':
		/* byte in octal up to 3 digits long */
		ch = 0;
		n = 3;
		do {
			ch = ch * 8 + (*op++ - '0');
		} while (--n && *op >= '0' && *op <= '7');
		break;
	case 'b': case 'B':
		ch = '\b';
		break;
	case 't': case 'T':
		ch = '\t';
		break;
	case 'n': case 'N':
		ch = '\n';
		break;
	case 'f': case 'F':
		ch = '\f';
		break;
	case 'r': case 'R':
		ch = '\r';
		break;
	case 'e': case 'E':
		ch = '\033';
		break;
	case 'c': case 'C':
		ch = ':';
		break;
	default:
		ch = *op;
		break;
	}
	break;
}
*np++ = ch;
nlen--;
}
*np = '\0';
return (nstr);
1115}