/usr/src/usr.sbin/pppd/fsm.c

Bug Summary

File:	src/usr.sbin/pppd/fsm.c
Warning:	line 809, column 2 Null pointer passed as 2nd argument to memory copy function

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name fsm.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/pppd/obj -resource-dir /usr/local/lib/clang/13.0.0 -I . -I /usr/src/usr.sbin/pppd/../../lib/libpcap -D HAVE_PATHS_H -D PPP_FILTER -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/pppd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.sbin/pppd/fsm.c

1/*	$OpenBSD: fsm.c,v 1.8 2009/10/27 23:59:53 deraadt Exp $	*/

3/*
* fsm.c - {Link, IP} Control Protocol Finite State Machine.
*
* Copyright (c) 1984-2000 Carnegie Mellon University. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in
*    the documentation and/or other materials provided with the
*    distribution.
*
* 3. The name "Carnegie Mellon University" must not be used to
*    endorse or promote products derived from this software without
*    prior written permission. For permission or any legal
*    details, please contact
*      Office of Technology Transfer
*      Carnegie Mellon University
*      5000 Forbes Avenue
*      Pittsburgh, PA  15213-3890
*      (412) 268-4387, fax: (412) 268-7395
*      tech-transfer@andrew.cmu.edu
*
* 4. Redistributions of any form whatsoever must retain the following
*    acknowledgment:
*    "This product includes software developed by Computing Services
*     at Carnegie Mellon University (http://www.cmu.edu/computing/)."
*
* CARNEGIE MELLON UNIVERSITY DISCLAIMS ALL WARRANTIES WITH REGARD TO
* THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS, IN NO EVENT SHALL CARNEGIE MELLON UNIVERSITY BE LIABLE
* FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
* AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
* OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/

45/*
* TODO:
* Randomize fsm id on link/init.
* Deal with variable outgoing MTU.
*/

51#include <stdio.h>
52#include <string.h>
53#include <sys/types.h>
54#include <syslog.h>

56#include "pppd.h"
57#include "fsm.h"

59static void fsm_timeout(void *);
60static void fsm_rconfreq(fsm *, int, u_char *, int);
61static void fsm_rconfack(fsm *, int, u_char *, int);
62static void fsm_rconfnakrej(fsm *, int, int, u_char *, int);
63static void fsm_rtermreq(fsm *, int, u_char *, int);
64static void fsm_rtermack(fsm *);
65static void fsm_rcoderej(fsm *, u_char *, int);
66static void fsm_sconfreq(fsm *, int);

68#define PROTO_NAME(f)((f)->callbacks->proto_name)	((f)->callbacks->proto_name)

70int peer_mru[NUM_PPP1];


73/*
* fsm_init - Initialize fsm.
*
* Initialize fsm state.
*/
78void
79fsm_init(f)
  fsm *f;
81{
  f->state = INITIAL0;
  f->flags = 0;
  f->id = 0;				/* XXX Start with random id? */
  f->timeouttime = DEFTIMEOUT3;
  f->maxconfreqtransmits = DEFMAXCONFREQS10;
  f->maxtermtransmits = DEFMAXTERMREQS2;
  f->maxnakloops = DEFMAXNAKLOOPS5;
  f->term_reason_len = 0;
90}


93/*
* fsm_lowerup - The lower layer is up.
*/
96void
97fsm_lowerup(f)
  fsm *f;
99{
  switch( f->state ){
  case INITIAL0:
f->state = CLOSED2;
break;

  case STARTING1:
if( f->flags & OPT_SILENT4 )
   f->state = STOPPED3;
else {
   /* Send an initial configure-request */
   fsm_sconfreq(f, 0);
   f->state = REQSENT6;
}
break;

  default:
FSMDEBUG((LOG_INFO, "%s: Up event in state %d!",
  PROTO_NAME(f), f->state));
  }
119}


122/*
* fsm_lowerdown - The lower layer is down.
*
* Cancel all timeouts and inform upper layers.
*/
127void
128fsm_lowerdown(f)
  fsm *f;
130{
  switch( f->state ){
  case CLOSED2:
f->state = INITIAL0;
break;

  case STOPPED3:
f->state = STARTING1;
if( f->callbacks->starting )
   (*f->callbacks->starting)(f);
break;

  case CLOSING4:
f->state = INITIAL0;
UNTIMEOUT(fsm_timeout, f)untimeout((fsm_timeout), (f));	/* Cancel timeout */
break;

  case STOPPING5:
  case REQSENT6:
  case ACKRCVD7:
  case ACKSENT8:
f->state = STARTING1;
UNTIMEOUT(fsm_timeout, f)untimeout((fsm_timeout), (f));	/* Cancel timeout */
break;

  case OPENED9:
if( f->callbacks->down )
   (*f->callbacks->down)(f);
f->state = STARTING1;
break;

  default:
FSMDEBUG((LOG_INFO, "%s: Down event in state %d!",
  PROTO_NAME(f), f->state));
  }
165}


168/*
* fsm_open - Link is allowed to come up.
*/
171void
172fsm_open(f)
  fsm *f;
174{
  switch( f->state ){
  case INITIAL0:
f->state = STARTING1;
if( f->callbacks->starting )
   (*f->callbacks->starting)(f);
break;

  case CLOSED2:
if( f->flags & OPT_SILENT4 )
   f->state = STOPPED3;
else {
   /* Send an initial configure-request */
   fsm_sconfreq(f, 0);
   f->state = REQSENT6;
}
break;

  case CLOSING4:
f->state = STOPPING5;
/* fall through */
  case STOPPED3:
  case OPENED9:
if( f->flags & OPT_RESTART2 ){
   fsm_lowerdown(f);
   fsm_lowerup(f);
}
break;
  }
203}


206/*
* fsm_close - Start closing connection.
*
* Cancel timeouts and either initiate close or possibly go directly to
* the CLOSED state.
*/
212void
213fsm_close(f, reason)
  fsm *f;
  char *reason;
216{
  f->term_reason = reason;
1
Value assigned to field 'term_reason'→
  f->term_reason_len = (reason == NULL((void *)0)? 0: strlen(reason));
2
←
Assuming 'reason' is equal to NULL→
3
←
'?' condition is true→
  switch( f->state ){
4
←
Control jumps to 'case 9:'  at line 233→
  case STARTING1:
f->state = INITIAL0;
break;
  case STOPPED3:
f->state = CLOSED2;
break;
  case STOPPING5:
f->state = CLOSING4;
break;

  case REQSENT6:
  case ACKRCVD7:
  case ACKSENT8:
  case OPENED9:
if( f->state4.1
Field 'state' is equal to OPENED
 != OPENED9 )
5
←
Taking false branch→
   UNTIMEOUT(fsm_timeout, f)untimeout((fsm_timeout), (f));	/* Cancel timeout */
else if( f->callbacks->down )
6
←
Assuming field 'down' is null→
7
←
Taking false branch→
   (*f->callbacks->down)(f);	/* Inform upper layers we're down */

/* Init restart counter, send Terminate-Request */
f->retransmits = f->maxtermtransmits;
fsm_sdata(f, TERMREQ5, f->reqid = ++f->id,
9
←
Calling 'fsm_sdata'→
  (u_char *) f->term_reason, f->term_reason_len);
8
←
Passing null pointer value via 4th parameter 'data'→
TIMEOUT(fsm_timeout, f, f->timeouttime)timeout((fsm_timeout), (f), (f->timeouttime));
--f->retransmits;

f->state = CLOSING4;
break;
  }
249}


252/*
* fsm_timeout - Timeout expired.
*/
255static void
256fsm_timeout(arg)
  void *arg;
258{
  fsm *f = (fsm *) arg;

  switch (f->state) {
  case CLOSING4:
  case STOPPING5:
if( f->retransmits <= 0 ){
   /*
    * We've waited for an ack long enough.  Peer probably heard us.
    */
   f->state = (f->state == CLOSING4)? CLOSED2: STOPPED3;
   if( f->callbacks->finished )
(*f->callbacks->finished)(f);
} else {
   /* Send Terminate-Request */
   fsm_sdata(f, TERMREQ5, f->reqid = ++f->id,
      (u_char *) f->term_reason, f->term_reason_len);
   TIMEOUT(fsm_timeout, f, f->timeouttime)timeout((fsm_timeout), (f), (f->timeouttime));
   --f->retransmits;
}
break;

  case REQSENT6:
  case ACKRCVD7:
  case ACKSENT8:
if (f->retransmits <= 0) {
   syslog(LOG_WARNING4, "%s: timeout sending Config-Requests",
   PROTO_NAME(f)((f)->callbacks->proto_name));
   f->state = STOPPED3;
   if( (f->flags & OPT_PASSIVE1) == 0 && f->callbacks->finished )
(*f->callbacks->finished)(f);

} else {
   /* Retransmit the configure-request */
   if (f->callbacks->retransmit)
(*f->callbacks->retransmit)(f);
   fsm_sconfreq(f, 1);		/* Re-send Configure-Request */
   if( f->state == ACKRCVD7 )
f->state = REQSENT6;
}
break;

  default:
FSMDEBUG((LOG_INFO, "%s: Timeout event in state %d!",
  PROTO_NAME(f), f->state));
  }
304}


307/*
* fsm_input - Input packet.
*/
310void
311fsm_input(f, inpacket, l)
  fsm *f;
  u_char *inpacket;
  int l;
315{
  u_char *inp;
  u_char code, id;
  int len;

  /*
   * Parse header (code, id and length).
   * If packet too short, drop it.
   */
  inp = inpacket;
  if (l < HEADERLEN(sizeof (u_char) + sizeof (u_char) + sizeof (u_short))) {
FSMDEBUG((LOG_WARNING, "fsm_input(%x): Rcvd short header.",
  f->protocol));
return;
  }
  GETCHAR(code, inp){ (code) = *(inp)++; };
  GETCHAR(id, inp){ (id) = *(inp)++; };
  GETSHORT(len, inp){ (len) = *(inp)++ << 8; (len) |= *(inp)++; };
  if (len < HEADERLEN(sizeof (u_char) + sizeof (u_char) + sizeof (u_short))) {
FSMDEBUG((LOG_INFO, "fsm_input(%x): Rcvd illegal length.",
  f->protocol));
return;
  }
  if (len > l) {
FSMDEBUG((LOG_INFO, "fsm_input(%x): Rcvd short packet.",
  f->protocol));
return;
  }
  len -= HEADERLEN(sizeof (u_char) + sizeof (u_char) + sizeof (u_short));		/* subtract header length */

  if( f->state == INITIAL0 || f->state == STARTING1 ){
FSMDEBUG((LOG_INFO, "fsm_input(%x): Rcvd packet in state %d.",
  f->protocol, f->state));
return;
  }

  /*
   * Action depends on code.
   */
  switch (code) {
  case CONFREQ1:
fsm_rconfreq(f, id, inp, len);
break;
  
  case CONFACK2:
fsm_rconfack(f, id, inp, len);
break;
  
  case CONFNAK3:
  case CONFREJ4:
fsm_rconfnakrej(f, code, id, inp, len);
break;
  
  case TERMREQ5:
fsm_rtermreq(f, id, inp, len);
break;
  
  case TERMACK6:
fsm_rtermack(f);
break;
  
  case CODEREJ7:
fsm_rcoderej(f, inp, len);
break;
  
  default:
if( !f->callbacks->extcode
  || !(*f->callbacks->extcode)(f, code, id, inp, len) )
   fsm_sdata(f, CODEREJ7, ++f->id, inpacket, len + HEADERLEN(sizeof (u_char) + sizeof (u_char) + sizeof (u_short)));
break;
  }
386}


389/*
* fsm_rconfreq - Receive Configure-Request.
*/
392static void
393fsm_rconfreq(f, id, inp, len)
  fsm *f;
  u_char id;
  u_char *inp;
  int len;
398{
  int code, reject_if_disagree;

  FSMDEBUG((LOG_INFO, "fsm_rconfreq(%s): Rcvd id %d.", PROTO_NAME(f), id));
  switch( f->state ){
  case CLOSED2:
/* Go away, we're closed */
fsm_sdata(f, TERMACK6, id, NULL((void *)0), 0);
return;
  case CLOSING4:
  case STOPPING5:
return;

  case OPENED9:
/* Go down and restart negotiation */
if( f->callbacks->down )
   (*f->callbacks->down)(f);	/* Inform upper layers */
fsm_sconfreq(f, 0);		/* Send initial Configure-Request */
break;

  case STOPPED3:
/* Negotiation started by our peer */
fsm_sconfreq(f, 0);		/* Send initial Configure-Request */
f->state = REQSENT6;
break;
  }

  /*
   * Pass the requested configuration options
   * to protocol-specific code for checking.
   */
  if (f->callbacks->reqci){		/* Check CI */
reject_if_disagree = (f->nakloops >= f->maxnakloops);
code = (*f->callbacks->reqci)(f, inp, &len, reject_if_disagree);
  } else if (len)
code = CONFREJ4;			/* Reject all CI */
  else
code = CONFACK2;

  /* send the Ack, Nak or Rej to the peer */
  fsm_sdata(f, code, id, inp, len);

  if (code == CONFACK2) {
if (f->state == ACKRCVD7) {
   UNTIMEOUT(fsm_timeout, f)untimeout((fsm_timeout), (f));	/* Cancel timeout */
   f->state = OPENED9;
   if (f->callbacks->up)
(*f->callbacks->up)(f);	/* Inform upper layers */
} else
   f->state = ACKSENT8;
f->nakloops = 0;

  } else {
/* we sent CONFACK or CONFREJ */
if (f->state != ACKRCVD7)
   f->state = REQSENT6;
if( code == CONFNAK3 )
   ++f->nakloops;
  }
457}


460/*
* fsm_rconfack - Receive Configure-Ack.
*/
463static void
464fsm_rconfack(f, id, inp, len)
  fsm *f;
  int id;
  u_char *inp;
  int len;
469{
  FSMDEBUG((LOG_INFO, "fsm_rconfack(%s): Rcvd id %d.",
     PROTO_NAME(f), id));

  if (id != f->reqid || f->seen_ack)		/* Expected id? */
return;					/* Nope, toss... */
  if( !(f->callbacks->ackci? (*f->callbacks->ackci)(f, inp, len):
 (len == 0)) ){
/* Ack is bad - ignore it */
log_packet(inp, len, "Received bad configure-ack: ", LOG_ERR3);
FSMDEBUG((LOG_INFO, "%s: received bad Ack (length %d)",
  PROTO_NAME(f), len));
return;
  }
  f->seen_ack = 1;

  switch (f->state) {
  case CLOSED2:
  case STOPPED3:
fsm_sdata(f, TERMACK6, id, NULL((void *)0), 0);
break;

  case REQSENT6:
f->state = ACKRCVD7;
f->retransmits = f->maxconfreqtransmits;
break;

  case ACKRCVD7:
/* Huh? an extra valid Ack? oh well... */
UNTIMEOUT(fsm_timeout, f)untimeout((fsm_timeout), (f));	/* Cancel timeout */
fsm_sconfreq(f, 0);
f->state = REQSENT6;
break;

  case ACKSENT8:
UNTIMEOUT(fsm_timeout, f)untimeout((fsm_timeout), (f));	/* Cancel timeout */
f->state = OPENED9;
f->retransmits = f->maxconfreqtransmits;
if (f->callbacks->up)
   (*f->callbacks->up)(f);	/* Inform upper layers */
break;

  case OPENED9:
/* Go down and restart negotiation */
if (f->callbacks->down)
   (*f->callbacks->down)(f);	/* Inform upper layers */
fsm_sconfreq(f, 0);		/* Send initial Configure-Request */
f->state = REQSENT6;
break;
  }
519}


522/*
* fsm_rconfnakrej - Receive Configure-Nak or Configure-Reject.
*/
525static void
526fsm_rconfnakrej(f, code, id, inp, len)
  fsm *f;
  int code, id;
  u_char *inp;
  int len;
531{
  int (*proc)(fsm *, u_char *, int);
  int ret;

  FSMDEBUG((LOG_INFO, "fsm_rconfnakrej(%s): Rcvd id %d.",
     PROTO_NAME(f), id));

  if (id != f->reqid || f->seen_ack)	/* Expected id? */
return;				/* Nope, toss... */
  proc = (code == CONFNAK3)? f->callbacks->nakci: f->callbacks->rejci;
  if (!proc || !(ret = proc(f, inp, len))) {
/* Nak/reject is bad - ignore it */
log_packet(inp, len, "Received bad configure-nak/rej: ", LOG_ERR3);
FSMDEBUG((LOG_INFO, "%s: received bad %s (length %d)",
  PROTO_NAME(f), (code==CONFNAK? "Nak": "reject"), len));
return;
  }
  f->seen_ack = 1;

  switch (f->state) {
  case CLOSED2:
  case STOPPED3:
fsm_sdata(f, TERMACK6, id, NULL((void *)0), 0);
break;

  case REQSENT6:
  case ACKSENT8:
/* They didn't agree to what we wanted - try another request */
UNTIMEOUT(fsm_timeout, f)untimeout((fsm_timeout), (f));	/* Cancel timeout */
if (ret < 0)
   f->state = STOPPED3;		/* kludge for stopping CCP */
else
   fsm_sconfreq(f, 0);		/* Send Configure-Request */
break;

  case ACKRCVD7:
/* Got a Nak/reject when we had already had an Ack?? oh well... */
UNTIMEOUT(fsm_timeout, f)untimeout((fsm_timeout), (f));	/* Cancel timeout */
fsm_sconfreq(f, 0);
f->state = REQSENT6;
break;

  case OPENED9:
/* Go down and restart negotiation */
if (f->callbacks->down)
   (*f->callbacks->down)(f);	/* Inform upper layers */
fsm_sconfreq(f, 0);		/* Send initial Configure-Request */
f->state = REQSENT6;
break;
  }
581}


584/*
* fsm_rtermreq - Receive Terminate-Req.
*/
587static void
588fsm_rtermreq(f, id, p, len)
  fsm *f;
  int id;
  u_char *p;
  int len;
593{
  char str[80];

  FSMDEBUG((LOG_INFO, "fsm_rtermreq(%s): Rcvd id %d.",
     PROTO_NAME(f), id));

  switch (f->state) {
  case ACKRCVD7:
  case ACKSENT8:
f->state = REQSENT6;		/* Start over but keep trying */
break;

  case OPENED9:
if (len > 0) {
   fmtmsg(str, sizeof(str), "%0.*v", len, p);
   syslog(LOG_INFO6, "%s terminated by peer (%s)", PROTO_NAME(f)((f)->callbacks->proto_name), str);
} else
   syslog(LOG_INFO6, "%s terminated by peer", PROTO_NAME(f)((f)->callbacks->proto_name));
if (f->callbacks->down)
   (*f->callbacks->down)(f);	/* Inform upper layers */
f->retransmits = 0;
f->state = STOPPING5;
TIMEOUT(fsm_timeout, f, f->timeouttime)timeout((fsm_timeout), (f), (f->timeouttime));
break;
  }

  fsm_sdata(f, TERMACK6, id, NULL((void *)0), 0);
620}


623/*
* fsm_rtermack - Receive Terminate-Ack.
*/
626static void
627fsm_rtermack(f)
  fsm *f;
629{
  FSMDEBUG((LOG_INFO, "fsm_rtermack(%s).", PROTO_NAME(f)));

  switch (f->state) {
  case CLOSING4:
UNTIMEOUT(fsm_timeout, f)untimeout((fsm_timeout), (f));
f->state = CLOSED2;
if( f->callbacks->finished )
   (*f->callbacks->finished)(f);
break;
  case STOPPING5:
UNTIMEOUT(fsm_timeout, f)untimeout((fsm_timeout), (f));
f->state = STOPPED3;
if( f->callbacks->finished )
   (*f->callbacks->finished)(f);
break;

  case ACKRCVD7:
f->state = REQSENT6;
break;

  case OPENED9:
if (f->callbacks->down)
   (*f->callbacks->down)(f);	/* Inform upper layers */
fsm_sconfreq(f, 0);
break;
  }
656}


659/*
* fsm_rcoderej - Receive an Code-Reject.
*/
662static void
663fsm_rcoderej(f, inp, len)
  fsm *f;
  u_char *inp;
  int len;
667{
  u_char code, id;

  FSMDEBUG((LOG_INFO, "fsm_rcoderej(%s).", PROTO_NAME(f)));

  if (len < HEADERLEN(sizeof (u_char) + sizeof (u_char) + sizeof (u_short))) {
FSMDEBUG((LOG_INFO, "fsm_rcoderej: Rcvd short Code-Reject packet!"));
return;
  }
  GETCHAR(code, inp){ (code) = *(inp)++; };
  GETCHAR(id, inp){ (id) = *(inp)++; };
  syslog(LOG_WARNING4, "%s: Rcvd Code-Reject for code %d, id %d",
  PROTO_NAME(f)((f)->callbacks->proto_name), code, id);

  if( f->state == ACKRCVD7 )
f->state = REQSENT6;
683}


686/*
* fsm_protreject - Peer doesn't speak this protocol.
*
* Treat this as a catastrophic error (RXJ-).
*/
691void
692fsm_protreject(f)
  fsm *f;
694{
  switch( f->state ){
  case CLOSING4:
UNTIMEOUT(fsm_timeout, f)untimeout((fsm_timeout), (f));	/* Cancel timeout */
/* fall through */
  case CLOSED2:
f->state = CLOSED2;
if( f->callbacks->finished )
   (*f->callbacks->finished)(f);
break;

  case STOPPING5:
  case REQSENT6:
  case ACKRCVD7:
  case ACKSENT8:
UNTIMEOUT(fsm_timeout, f)untimeout((fsm_timeout), (f));	/* Cancel timeout */
/* fall through */
  case STOPPED3:
f->state = STOPPED3;
if( f->callbacks->finished )
   (*f->callbacks->finished)(f);
break;

  case OPENED9:
if( f->callbacks->down )
   (*f->callbacks->down)(f);

/* Init restart counter, send Terminate-Request */
f->retransmits = f->maxtermtransmits;
fsm_sdata(f, TERMREQ5, f->reqid = ++f->id,
  (u_char *) f->term_reason, f->term_reason_len);
TIMEOUT(fsm_timeout, f, f->timeouttime)timeout((fsm_timeout), (f), (f->timeouttime));
--f->retransmits;

f->state = STOPPING5;
break;

  default:
FSMDEBUG((LOG_INFO, "%s: Protocol-reject event in state %d!",
  PROTO_NAME(f), f->state));
  }
735}


738/*
* fsm_sconfreq - Send a Configure-Request.
*/
741static void
742fsm_sconfreq(f, retransmit)
  fsm *f;
  int retransmit;
745{
  u_char *outp;
  int cilen;

  if( f->state != REQSENT6 && f->state != ACKRCVD7 && f->state != ACKSENT8 ){
/* Not currently negotiating - reset options */
if( f->callbacks->resetci )
   (*f->callbacks->resetci)(f);
f->nakloops = 0;
  }

  if( !retransmit ){
/* New request - reset retransmission counter, use new ID */
f->retransmits = f->maxconfreqtransmits;
f->reqid = ++f->id;
  }

  f->seen_ack = 0;

  /*
   * Make up the request packet
   */
  outp = outpacket_buf + PPP_HDRLEN4 + HEADERLEN(sizeof (u_char) + sizeof (u_char) + sizeof (u_short));
  if( f->callbacks->cilen && f->callbacks->addci ){
cilen = (*f->callbacks->cilen)(f);
if( cilen > peer_mru[f->unit] - HEADERLEN(sizeof (u_char) + sizeof (u_char) + sizeof (u_short)) )
   cilen = peer_mru[f->unit] - HEADERLEN(sizeof (u_char) + sizeof (u_char) + sizeof (u_short));
if (f->callbacks->addci)
   (*f->callbacks->addci)(f, outp, &cilen);
  } else
cilen = 0;

  /* send the request to our peer */
  fsm_sdata(f, CONFREQ1, f->reqid, outp, cilen);

  /* start the retransmit timer */
  --f->retransmits;
  TIMEOUT(fsm_timeout, f, f->timeouttime)timeout((fsm_timeout), (f), (f->timeouttime));

  FSMDEBUG((LOG_INFO, "%s: sending Configure-Request, id %d",
     PROTO_NAME(f), f->reqid));
786}


789/*
* fsm_sdata - Send some data.
*
* Used for all packets sent to our peer by this module.
*/
794void
795fsm_sdata(f, code, id, data, datalen)
  fsm *f;
  u_char code, id;
  u_char *data;
  int datalen;
800{
  u_char *outp;
  int outlen;

  /* Adjust length to be smaller than MTU */
  outp = outpacket_buf;
  if (datalen > peer_mru[f->unit] - HEADERLEN(sizeof (u_char) + sizeof (u_char) + sizeof (u_short)))
10
←
Assuming the condition is true→
11
←
Taking true branch→
datalen = peer_mru[f->unit] - HEADERLEN(sizeof (u_char) + sizeof (u_char) + sizeof (u_short));
  if (datalen && data != outp + PPP_HDRLEN4 + HEADERLEN(sizeof (u_char) + sizeof (u_char) + sizeof (u_short)))
12
←
Assuming 'datalen' is not equal to 0→
13
←
Taking true branch→
BCOPY(data, outp + PPP_HDRLEN + HEADERLEN, datalen)memcpy(outp + 4 + (sizeof (u_char) + sizeof (u_char) + sizeof
 (u_short)), data, datalen);
14
←
Null pointer passed as 2nd argument to memory copy function
  outlen = datalen + HEADERLEN(sizeof (u_char) + sizeof (u_char) + sizeof (u_short));
  MAKEHEADER(outp, f->protocol){ { *(outp)++ = (u_char) (0xff); }; { *(outp)++ = (u_char) (0x03
); }; { *(outp)++ = (u_char) ((f->protocol) >> 8); *
(outp)++ = (u_char) (f->protocol); }; };
  PUTCHAR(code, outp){ *(outp)++ = (u_char) (code); };
  PUTCHAR(id, outp){ *(outp)++ = (u_char) (id); };
  PUTSHORT(outlen, outp){ *(outp)++ = (u_char) ((outlen) >> 8); *(outp)++ = (u_char
) (outlen); };
  output(f->unit, outpacket_buf, outlen + PPP_HDRLEN4);

  FSMDEBUG((LOG_INFO, "fsm_sdata(%s): Sent code %d, id %d.",
     PROTO_NAME(f), code, id));
819}