/usr/src/usr.bin/rusers/rusers.c

Bug Summary

File:	src/usr.bin/rusers/rusers.c
Warning:	line 604, column 12 2nd function call argument is an uninitialized value

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name rusers.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.bin/rusers/obj -resource-dir /usr/local/lib/clang/13.0.0 -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.bin/rusers/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.bin/rusers/rusers.c

1/*	$OpenBSD: rusers.c,v 1.43 2020/12/29 19:52:16 benno Exp $	*/

3/*
* Copyright (c) 2001, 2003 Todd C. Miller <millert@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
* Sponsored in part by the Defense Advanced Research Projects
* Agency (DARPA) and Air Force Research Laboratory, Air Force
* Materiel Command, USAF, under agreement number F39502-99-1-0512.
*/
21/*-
*  Copyright (c) 1993 John Brezak
*  All rights reserved.
*
*  Redistribution and use in source and binary forms, with or without
*  modification, are permitted provided that the following conditions
*  are met:
*  1. Redistributions of source code must retain the above copyright
*     notice, this list of conditions and the following disclaimer.
*  2. Redistributions in binary form must reproduce the above copyright
*     notice, this list of conditions and the following disclaimer in the
*     documentation and/or other materials provided with the distribution.
*  3. The name of the author may not be used to endorse or promote products
*     derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/

49#include <sys/ioctl.h>
50#include <sys/socket.h>
51#include <sys/signal.h>
52#include <rpc/rpc.h>
53#include <rpc/pmap_prot.h>
54#include <rpc/pmap_rmt.h>
55#include <rpcsvc/rusers.h>
56#include <rpcsvc/rnusers.h>	/* Old protocol version */
57#include <arpa/inet.h>
58#include <net/if.h>
59#include <err.h>
60#include <errno(*__errno()).h>
61#include <ifaddrs.h>
62#include <netdb.h>
63#include <stdio.h>
64#include <stdlib.h>
65#include <string.h>
66#include <termios.h>
67#include <unistd.h>
68#include <limits.h>
69#include <poll.h>

71#define MINIMUM(a, b)(((a) < (b)) ? (a) : (b))	(((a) < (b)) ? (a) : (b))
72#define MAXIMUM(a, b)(((a) > (b)) ? (a) : (b))	(((a) > (b)) ? (a) : (b))

74/* Preferred formatting */
75#define HOST_WIDTH17 17
76#define LINE_WIDTH8 8
77#define NAME_WIDTH8 8

79#define MAX_BROADCAST_SIZE1400 1400

81struct host_info {
u_int count;
u_int idle;
char *host;
rusers_utmp *users;
86} *hostinfo;

88void print_entry(struct host_info *, int);
89void fmt_idle(int, char *, size_t);
90void onehost(char *);
91void allhosts(void);
92void sorthosts(void);
93void expandhosts(void);
94void alarmclock(int);
95char *estrndup(const char *, size_t);
96struct host_info *add_host(char *);
97int hcompare(const void *, const void *);
98int icompare(const void *, const void *);
99int ucompare(const void *, const void *);
100bool_tint32_t rusers_reply(char *, struct sockaddr_in *);
101bool_tint32_t rusers_reply_3(char *, struct sockaddr_in *);
102enum clnt_stat get_reply(int, in_port_t, u_long, struct rpc_msg *,
  struct rmtcallres *, bool_tint32_t (*)(char *, struct sockaddr_in *));
104enum clnt_stat rpc_setup(int *, XDR *, struct rpc_msg *,
  struct rmtcallargs *, AUTH *, char *);
106__dead__attribute__((__noreturn__)) void usage(void);

108int aflag, hflag, iflag, lflag, uflag;
109u_int nentries, maxentries;
110long termwidth;
111extern char *__progname;

113int
114main(int argc, char **argv)
115{
struct winsize win;
char *cp;
int ch;

while ((ch = getopt(argc, argv, "ahilu")) != -1)
1
Assuming the condition is false→
2
←
Loop condition is false. Execution continues on line 142→
switch (ch) {
case 'a':
	aflag = 1;
	break;
case 'h':
	hflag = 1;
	break;
case 'i':
	iflag = 1;
	break;
case 'l':
	lflag = 1;
	break;
case 'u':
	uflag = 1;
	break;
default:
	usage();
	/*NOTREACHED*/
}

if (hflag + iflag + uflag > 1)
3
←
Assuming the condition is false→
4
←
Taking false branch→
usage();

termwidth = 0;
if ((cp = getenv("COLUMNS")) != NULL((void *)0))
5
←
Assuming the condition is true→
6
←
Taking true branch→
termwidth = strtonum(cp, 1, LONG_MAX9223372036854775807L, NULL((void *)0));
if (termwidth == 0 && ioctl(STDOUT_FILENO1, TIOCGWINSZ((unsigned long)0x40000000 | ((sizeof(struct winsize) & 0x1fff
) << 16) | ((('t')) << 8) | ((104))), &win) == 0 &&
7
←
Assuming 'termwidth' is not equal to 0→
   win.ws_col > 0)
termwidth = win.ws_col;
if (termwidth7.1
'termwidth' is not equal to 0
 == 0)
8
←
Taking false branch→
termwidth = 80;

setvbuf(stdout(&__sF[1]), NULL((void *)0), _IOLBF1, 0);

if (argc == optind) {
9
←
Assuming 'argc' is equal to 'optind'→
10
←
Taking true branch→
if (hflag || iflag || uflag) {
11
←
Assuming 'hflag' is 0→
12
←
Assuming 'iflag' is 0→
13
←
Assuming 'uflag' is 0→
14
←
Taking false branch→
	puts("Collecting responses...");
	allhosts();
	sorthosts();
} else
	allhosts();
15
←
Calling 'allhosts'→
} else {
aflag = 1;
for (; optind < argc; optind++)
	(void) onehost(argv[optind]);
if (hflag || iflag || uflag)
	sorthosts();
}

exit(0);
172}

174struct host_info *
175add_host(char *host)
176{
int i;

for (i = 0; i < nentries; i++) {
/* Existing entry. */
if (strcmp(host, hostinfo[i].host) == 0)
	return(NULL((void *)0));
}

/* New entry, allocate space if needed and store. */
if (nentries == maxentries) {
maxentries += 128;
hostinfo = reallocarray(hostinfo, maxentries,
    sizeof(*hostinfo));
if (hostinfo == NULL((void *)0))
	err(1, NULL((void *)0));
}
if ((hostinfo[nentries].host = strdup(host)) == NULL((void *)0))
err(1, NULL((void *)0));
return(&hostinfo[nentries++]);
196}

198void
199fmt_idle(int idle, char *idle_time, size_t idle_time_len)
200{
int days, hours, minutes, seconds;

switch (idle) {
case 0:
*idle_time = '\0';
break;
case INT_MAX2147483647:
strlcpy(idle_time, "??", idle_time_len);
break;
default:
seconds = idle;
days = seconds / (60*60*24);
seconds %= (60*60*24);
hours = seconds / (60*60);
seconds %= (60*60);
minutes = seconds / 60;
seconds %= 60;
if (idle >= (24*60*60))
	snprintf(idle_time, idle_time_len,
	    "%d day%s, %d:%02d:%02d", days,
	    days > 1 ? "s" : "", hours, minutes, seconds);
else if (idle >= (60*60))
	snprintf(idle_time, idle_time_len, "%2d:%02d:%02d",
	    hours, minutes, seconds);
else if (idle > 60)
	snprintf(idle_time, idle_time_len, "%2d:%02d",
	    minutes, seconds);
else
	snprintf(idle_time, idle_time_len, "   :%02d", idle);
break;
}
232}

234bool_tint32_t
235rusers_reply(char *replyp, struct sockaddr_in *raddrp)
236{
utmpidlearr *up = (utmpidlearr *)replyp;
struct host_info *entry;
struct hostent *hp;
rusers_utmp *ut;
char *host;
int i;

if (!aflag && up->uia_cnt == 0)
return(0);

hp = gethostbyaddr((char *)&raddrp->sin_addr,
   sizeof(struct in_addr), AF_INET2);
if (hp)
host = hp->h_name;
else
host = inet_ntoa(raddrp->sin_addr);
if ((entry = add_host(host)) == NULL((void *)0))
return(0);

if (up->uia_cnt == 0)
ut = NULL((void *)0);
else if ((ut = calloc(up->uia_cnt, sizeof(*ut))) == NULL((void *)0))
err(1, NULL((void *)0));
entry->users = ut;
entry->count = up->uia_cnt;
entry->idle = UINT_MAX(2147483647 *2U +1U);
for (i = 0; i < up->uia_cnt; i++, ut++) {
ut->ut_user = estrndup(up->uia_arr[i]->ui_utmp.ut_name,
    RNUSERS_MAXUSERLEN8);
ut->ut_line = estrndup(up->uia_arr[i]->ui_utmp.ut_line,
    RNUSERS_MAXLINELEN8);
ut->ut_host = estrndup(up->uia_arr[i]->ui_utmp.ut_host,
    RNUSERS_MAXHOSTLEN16);
ut->ut_time = up->uia_arr[i]->ui_utmp.ut_time;
ut->ut_idle = up->uia_arr[i]->ui_idle;
if (ut->ut_idle < entry->idle)
	entry->idle = ut->ut_idle;
}

if (!hflag && !iflag && !uflag) {
print_entry(entry, lflag && entry->count);
for (i = 0, ut = entry->users; i < entry->count; i++, ut++) {
	free(ut->ut_user);
	free(ut->ut_line);
	free(ut->ut_host);
}
free(entry->users);
}

return(0);
287}

289bool_tint32_t
290rusers_reply_3(char *replyp, struct sockaddr_in *raddrp)
291{
utmp_array *up3 = (utmp_array *)replyp;
struct host_info *entry;
struct hostent *hp;
rusers_utmp *ut;
char *host;
int i;

if (!aflag && up3->utmp_array_len == 0)
return(0);

hp = gethostbyaddr((char *)&raddrp->sin_addr,
   sizeof(struct in_addr), AF_INET2);
if (hp)
host = hp->h_name;
else
host = inet_ntoa(raddrp->sin_addr);
if ((entry = add_host(host)) == NULL((void *)0))
return(0);

if (up3->utmp_array_len == 0)
ut = NULL((void *)0);
else if ((ut = calloc(up3->utmp_array_len, sizeof(*ut))) == NULL((void *)0))
err(1, NULL((void *)0));
entry->users = ut;
entry->count = up3->utmp_array_len;
entry->idle = UINT_MAX(2147483647 *2U +1U);
for (i = 0; i < up3->utmp_array_len; i++, ut++) {
ut->ut_user = estrndup(up3->utmp_array_val[i].ut_user,
    RUSERS_MAXUSERLEN32);
ut->ut_line = estrndup(up3->utmp_array_val[i].ut_line,
    RUSERS_MAXLINELEN32);
ut->ut_host = estrndup(up3->utmp_array_val[i].ut_host,
    RUSERS_MAXHOSTLEN257);
ut->ut_time = up3->utmp_array_val[i].ut_time;
ut->ut_idle = up3->utmp_array_val[i].ut_idle;
if (ut->ut_idle < entry->idle)
	entry->idle = ut->ut_idle;
}

if (!hflag && !iflag && !uflag) {
print_entry(entry, lflag && entry->count);
for (i = 0, ut = entry->users; i < entry->count; i++, ut++) {
	free(ut->ut_user);
	free(ut->ut_line);
	free(ut->ut_host);
}
free(entry->users);
}

return(0);
342}

344void
345onehost(char *host)
346{
utmpidlearr up;
utmp_array up3;
CLIENT *rusers_clnt;
struct sockaddr_in sin;
struct hostent *hp;
struct timeval tv = { 25, 0 };
int error;

memset(&sin, 0, sizeof sin);

hp = gethostbyname(host);
if (hp == NULL((void *)0))
errx(1, "unknown host \"%s\"", host);

/* Try version 3 first. */
rusers_clnt = clnt_create(host, RUSERSPROG((u_long)100002), RUSERSVERS_3((u_long)3), "udp");
if (rusers_clnt == NULL((void *)0)) {
clnt_pcreateerror(__progname);
exit(1);
}

memset(&up3, 0, sizeof(up3));
error = clnt_call(rusers_clnt, RUSERSPROC_NAMES, xdr_void, NULL,((*(rusers_clnt)->cl_ops->cl_call)(rusers_clnt, ((u_long
)2), xdr_void, (caddr_t)((void *)0), xdr_utmp_array, (caddr_t
)&up3, tv))
   xdr_utmp_array, &up3, tv)((*(rusers_clnt)->cl_ops->cl_call)(rusers_clnt, ((u_long
)2), xdr_void, (caddr_t)((void *)0), xdr_utmp_array, (caddr_t
)&up3, tv));
switch (error) {
case RPC_SUCCESS:
sin.sin_addr.s_addr = *(int *)hp->h_addrh_addr_list[0];
rusers_reply_3((char *)&up3, &sin);
clnt_destroy(rusers_clnt)((*(rusers_clnt)->cl_ops->cl_destroy)(rusers_clnt));
return;
case RPC_PROGVERSMISMATCH:
clnt_destroy(rusers_clnt)((*(rusers_clnt)->cl_ops->cl_destroy)(rusers_clnt));
break;
default:
clnt_perror(rusers_clnt, __progname);
clnt_destroy(rusers_clnt)((*(rusers_clnt)->cl_ops->cl_destroy)(rusers_clnt));
exit(1);
}

/* Fall back to version 2. */
rusers_clnt = clnt_create(host, RUSERSPROG((u_long)100002), RUSERSVERS_IDLE2, "udp");
if (rusers_clnt == NULL((void *)0)) {
clnt_pcreateerror(__progname);
exit(1);
}

memset(&up, 0, sizeof(up));
error = clnt_call(rusers_clnt, RUSERSPROC_NAMES, xdr_void, NULL,((*(rusers_clnt)->cl_ops->cl_call)(rusers_clnt, ((u_long
)2), xdr_void, (caddr_t)((void *)0), xdr_utmpidlearr, (caddr_t
)&up, tv))
   xdr_utmpidlearr, &up, tv)((*(rusers_clnt)->cl_ops->cl_call)(rusers_clnt, ((u_long
)2), xdr_void, (caddr_t)((void *)0), xdr_utmpidlearr, (caddr_t
)&up, tv));
if (error != RPC_SUCCESS) {
clnt_perror(rusers_clnt, __progname);
clnt_destroy(rusers_clnt)((*(rusers_clnt)->cl_ops->cl_destroy)(rusers_clnt));
exit(1);
}
sin.sin_addr.s_addr = *(int *)hp->h_addrh_addr_list[0];
rusers_reply((char *)&up, &sin);
clnt_destroy(rusers_clnt)((*(rusers_clnt)->cl_ops->cl_destroy)(rusers_clnt));
404}

406enum clnt_stat
407get_reply(int sock, in_port_t port, u_long xid, struct rpc_msg *msgp,
  struct rmtcallres *resp, bool_tint32_t (*callback)(char *, struct sockaddr_in *))
409{
ssize_t inlen;
socklen_t fromlen;
struct sockaddr_in raddr;
char inbuf[UDPMSGSIZE8800];
XDR xdr;

416retry:
msgp->acpted_rplyru.RM_rmb.ru.RP_ar.ar_verf = _null_auth;
msgp->acpted_rplyru.RM_rmb.ru.RP_ar.ar_resultsru.AR_results.where = (caddr_t)resp;
msgp->acpted_rplyru.RM_rmb.ru.RP_ar.ar_resultsru.AR_results.proc = xdr_rmtcallres;

fromlen = sizeof(raddr);
inlen = recvfrom(sock, inbuf, sizeof(inbuf), 0,
   (struct sockaddr *)&raddr, &fromlen);
if (inlen == -1) {
if (errno(*__errno()) == EINTR4)
	goto retry;
return (RPC_CANTRECV);
}
if (inlen < sizeof(u_int32_t))
goto retry;

/*
* If the reply we got matches our request, decode the
* replay and pass it to the callback function.
*/
xdrmem_create(&xdr, inbuf, (u_int)inlen, XDR_DECODE);
if (xdr_replymsg(&xdr, msgp)) {
if ((msgp->rm_xid == xid) &&
    (msgp->rm_replyru.RM_rmb.rp_stat == MSG_ACCEPTED) &&
    (msgp->acpted_rplyru.RM_rmb.ru.RP_ar.ar_stat == SUCCESS)) {
	raddr.sin_port = htons(port)(__uint16_t)(__builtin_constant_p(port) ? (__uint16_t)(((__uint16_t
)(port) & 0xffU) << 8 | ((__uint16_t)(port) & 0xff00U
) >> 8) : __swap16md(port));
	(void)(*callback)(resp->results_ptr, &raddr);
}
}
xdr.x_op = XDR_FREE;
msgp->acpted_rplyru.RM_rmb.ru.RP_ar.ar_resultsru.AR_results.proc = xdr_void;
(void)xdr_replymsg(&xdr, msgp);
(void)(*resp->xdr_results)(&xdr, resp->results_ptr);
xdr_destroy(&xdr)if ((&xdr)->x_ops->x_destroy) (*(&xdr)->x_ops
->x_destroy)(&xdr);

return(RPC_SUCCESS);
452}

454enum clnt_stat
455rpc_setup(int *fdp, XDR *xdr, struct rpc_msg *msg, struct rmtcallargs *args,
  AUTH *unix_auth, char *buf)
457{
int on = 1;

if ((*fdp = socket(AF_INET2, SOCK_DGRAM2, IPPROTO_UDP17)) == -1)
return(RPC_CANTSEND);

if (setsockopt(*fdp, SOL_SOCKET0xffff, SO_BROADCAST0x0020, &on, sizeof(on)) == -1)
return(RPC_CANTSEND);

msg->rm_xid = arc4random();
msg->rm_direction = CALL;
msg->rm_callru.RM_cmb.cb_rpcvers = RPC_MSG_VERSION((unsigned long) 2);
msg->rm_callru.RM_cmb.cb_prog = PMAPPROG((unsigned long)100000);
msg->rm_callru.RM_cmb.cb_vers = PMAPVERS((unsigned long)2);
msg->rm_callru.RM_cmb.cb_proc = PMAPPROC_CALLIT((unsigned long)5);
msg->rm_callru.RM_cmb.cb_cred = unix_auth->ah_cred;
msg->rm_callru.RM_cmb.cb_verf = unix_auth->ah_verf;

xdrmem_create(xdr, buf, MAX_BROADCAST_SIZE1400, XDR_ENCODE);
if (!xdr_callmsg(xdr, msg) || !xdr_rmtcall_args(xdr, args))
return(RPC_CANTENCODEARGS);

return(RPC_SUCCESS);
480}

482void
483allhosts(void)
484{
enum clnt_stat stat;
struct itimerval timeout;
AUTH *unix_auth;
size_t outlen[2];
int sock[2] = { -1, -1 };
int i, rval;
u_long xid[2], port[2];
struct pollfd pfd[2];
struct sockaddr_in *sin, baddr;
struct rmtcallargs args;
struct rmtcallres res[2];
struct rpc_msg msg[2];
struct ifaddrs *ifa, *ifap = NULL((void *)0);
char buf[2][MAX_BROADCAST_SIZE1400];
utmpidlearr up;
utmp_array up3;
XDR xdr;

if ((unix_auth = authunix_create_default()) == NULL((void *)0))
16
←
Assuming the condition is false→
17
←
Taking false branch→
err(1, "can't create auth handle");

if (getifaddrs(&ifap) != 0)
18
←
Assuming the condition is false→
19
←
Taking false branch→
err(1, "can't get list of interface addresses");

memset(&up, 0, sizeof(up));
memset(&up3, 0, sizeof(up3));
memset(&baddr, 0, sizeof(baddr));
memset(&res, 0, sizeof(res));
memset(&msg, 0, sizeof(msg));
memset(&timeout, 0, sizeof(timeout));

args.prog = RUSERSPROG((u_long)100002);
args.vers = RUSERSVERS_IDLE2;
args.proc = RUSERSPROC_NAMES((u_long)2);
args.xdr_args = xdr_void;
args.args_ptr = NULL((void *)0);

stat = rpc_setup(&sock[0], &xdr, &msg[0], &args, unix_auth, buf[0]);
if (stat19.1
'stat' is equal to RPC_SUCCESS
 != RPC_SUCCESS)
20
←
Taking false branch→
goto cleanup;
xid[0] = msg[0].rm_xid;
outlen[0] = xdr_getpos(&xdr)(*(&xdr)->x_ops->x_getpostn)(&xdr);
xdr_destroy(&xdr)if ((&xdr)->x_ops->x_destroy) (*(&xdr)->x_ops
->x_destroy)(&xdr);
21
←
Assuming field 'x_destroy' is null→
22
←
Taking false branch→

args.vers = RUSERSVERS_3((u_long)3);
stat = rpc_setup(&sock[1], &xdr, &msg[1], &args, unix_auth, buf[1]);
if (stat22.1
'stat' is equal to RPC_SUCCESS
 != RPC_SUCCESS)
23
←
Taking false branch→
goto cleanup;
xid[1] = msg[1].rm_xid;
outlen[1] = xdr_getpos(&xdr)(*(&xdr)->x_ops->x_getpostn)(&xdr);
xdr_destroy(&xdr)if ((&xdr)->x_ops->x_destroy) (*(&xdr)->x_ops
->x_destroy)(&xdr);
24
←
Assuming field 'x_destroy' is null→
25
←
Taking false branch→

baddr.sin_family = AF_INET2;
baddr.sin_port = htons(PMAPPORT)(__uint16_t)(__builtin_constant_p(((unsigned short)111)) ? (__uint16_t
)(((__uint16_t)(((unsigned short)111)) & 0xffU) << 8
 | ((__uint16_t)(((unsigned short)111)) & 0xff00U) >>
 8) : __swap16md(((unsigned short)111)));
26
←
'?' condition is true→
baddr.sin_addr.s_addr = htonl(INADDR_ANY)(__uint32_t)(__builtin_constant_p(((u_int32_t)(0x00000000))) ?
 (__uint32_t)(((__uint32_t)(((u_int32_t)(0x00000000))) & 0xff
) << 24 | ((__uint32_t)(((u_int32_t)(0x00000000))) &
 0xff00) << 8 | ((__uint32_t)(((u_int32_t)(0x00000000))
) & 0xff0000) >> 8 | ((__uint32_t)(((u_int32_t)(0x00000000
))) & 0xff000000) >> 24) : __swap32md(((u_int32_t)(
0x00000000))));
27
←
'?' condition is true→

res[0].port_ptr = &port[0];
res[0].xdr_results = xdr_utmpidlearr;
res[0].results_ptr = (caddr_t)&up;

res[1].port_ptr = &port[1];
res[1].xdr_results = xdr_utmp_array;
res[1].results_ptr = (caddr_t)&up3;

(void)signal(SIGALRM14, alarmclock);

/*
* We do 6 runs through the loop.  On even runs we send
* a version 3 broadcast.  On odd ones we send a version 2
* broadcast.  This should give version 3 replies enough
* of an 'edge' over the old version 2 ones in most cases.
* We poll() waiting for replies for 5 seconds in between
* each broadcast.
*/
for (i = 0; i < 6; i++) {
28
←
Loop condition is true.  Entering loop body→
for (ifa = ifap; ifa; ifa = ifa->ifa_next) {
29
←
Loop condition is false. Execution continues on line 588→
	if (ifa->ifa_addr == NULL((void *)0) ||
	    ifa->ifa_addr->sa_family != AF_INET2 ||
	    !(ifa->ifa_flags & IFF_BROADCAST0x2) ||
	    !(ifa->ifa_flags & IFF_UP0x1) ||
	    ifa->ifa_broadaddrifa_dstaddr == NULL((void *)0) ||
	    ifa->ifa_broadaddrifa_dstaddr->sa_family != AF_INET2)
		continue;
	sin = (struct sockaddr_in *)ifa->ifa_broadaddrifa_dstaddr;
	baddr.sin_addr = sin->sin_addr;

	/* use protocol 2 or 3 depending on i (odd or even) */
	if (i & 1) {
		if (sendto(sock[0], buf[0], outlen[0], 0,
		    (struct sockaddr *)&baddr,
		    sizeof(baddr)) != outlen[0])
			err(1, "can't send broadcast packet");
	} else {
		if (sendto(sock[1], buf[1], outlen[1], 0,
		    (struct sockaddr *)&baddr,
		    sizeof(baddr)) != outlen[1])
			err(1, "can't send broadcast packet");
	}
}

/*
 * We stay in the poll loop for ~5 seconds
 */
timeout.it_value.tv_sec = 5;
timeout.it_value.tv_usec = 0;
while (timerisset(&timeout.it_value)((&timeout.it_value)->tv_sec || (&timeout.it_value
)->tv_usec)) {
	pfd[0].fd = sock[0];
	pfd[0].events = POLLIN0x0001;
	pfd[1].fd = sock[1];
	pfd[1].events = POLLIN0x0001;
	setitimer(ITIMER_REAL0, &timeout, NULL((void *)0));
	rval = poll(pfd, 2, 0);
	setitimer(ITIMER_REAL0, NULL((void *)0), &timeout);
	if (rval == -1) {
30
←
Assuming the condition is false→
31
←
Taking false branch→
		if (errno(*__errno()) == EINTR4)
			break;
		err(1, "poll");	/* shouldn't happen */
	}
	if (pfd[1].revents & POLLIN0x0001) {
32
←
Assuming the condition is true→
33
←
Taking true branch→
		stat = get_reply(sock[1], (in_port_t)port[1],
34
←
2nd function call argument is an uninitialized value
		    xid[1], &msg[1], &res[1], rusers_reply_3);
		if (stat != RPC_SUCCESS)
			goto cleanup;
	}
	if (pfd[0].revents & POLLIN0x0001) {
		stat = get_reply(sock[0], (in_port_t)port[0],
		    xid[0], &msg[0], &res[0], rusers_reply);
		if (stat != RPC_SUCCESS)
			goto cleanup;
	}
}
}
617cleanup:
if (ifap != NULL((void *)0))
freeifaddrs(ifap);
if (sock[0] >= 0)
(void)close(sock[0]);
if (sock[1] >= 0)
(void)close(sock[1]);
AUTH_DESTROY(unix_auth)((*((unix_auth)->ah_ops->ah_destroy))(unix_auth));
if (stat != RPC_SUCCESS) {
clnt_perrno(stat);
exit(1);
}
629}

631void
632print_entry(struct host_info *entry, int longfmt)
633{
char date[32], idle_time[64];
char remote[RUSERS_MAXHOSTLEN257 + 3];
struct rusers_utmp *ut;
int i, len;

if (!longfmt)
printf("%-*.*s ", HOST_WIDTH17, HOST_WIDTH17, entry->host);

for (i = 0, ut = entry->users; i < entry->count; i++, ut++) {
if (longfmt) {
	time_t tim = ut->ut_time;
	strftime(date, sizeof(date), "%h %d %R",
	    localtime(&tim));
	date[sizeof(date) - 1] = '\0';
	fmt_idle(ut->ut_idle, idle_time, sizeof(idle_time));
	len = termwidth -
	    (MAXIMUM(strlen(ut->ut_user), NAME_WIDTH)(((strlen(ut->ut_user)) > (8)) ? (strlen(ut->ut_user
)) : (8)) + 1 +
	    HOST_WIDTH17 + 1 + LINE_WIDTH8 + 1 + strlen(date) +
	    1 + MAXIMUM(8, strlen(idle_time))(((8) > (strlen(idle_time))) ? (8) : (strlen(idle_time))) + 1 + 2);
	if (len > 0 && ut->ut_host[0] != '\0')
		snprintf(remote, sizeof(remote), "(%.*s)",
		    MINIMUM(len, RUSERS_MAXHOSTLEN)(((len) < (257)) ? (len) : (257)), ut->ut_host);
	else
		remote[0] = '\0';
	len = HOST_WIDTH17 - MINIMUM(HOST_WIDTH, strlen(entry->host))(((17) < (strlen(entry->host))) ? (17) : (strlen(entry->
host))) +
	    LINE_WIDTH8 - MINIMUM(LINE_WIDTH, strlen(ut->ut_line))(((8) < (strlen(ut->ut_line))) ? (8) : (strlen(ut->ut_line
)));
	printf("%-*s %.*s:%.*s%-*s %-12s %8s %s\n",
	    NAME_WIDTH8, ut->ut_user, HOST_WIDTH17, entry->host,
	    LINE_WIDTH8, ut->ut_line, len, "", date,
	    idle_time, remote);
} else {
	fputs(ut->ut_user, stdout(&__sF[1]));
	putchar(' ')(!__isthreaded ? __sputc(' ', (&__sF[1])) : (putc)(' ', (
&__sF[1])));
}
}
if (!longfmt)
putchar('\n')(!__isthreaded ? __sputc('\n', (&__sF[1])) : (putc)('\n',
 (&__sF[1])));
671}

673void
674expandhosts(void)
675{
struct host_info *new_hostinfo, *entry;
u_int count;
int i, j;

for (i = 0, count = 0; i < nentries; i++)
count += hostinfo[i].count;

new_hostinfo = calloc(sizeof(*entry), count);
if (new_hostinfo == NULL((void *)0))
err(1, NULL((void *)0));
for (i = 0, entry = new_hostinfo; i < nentries; i++) {
for (j = 0; j < hostinfo[i].count; j++) {
	memcpy(entry, &hostinfo[i], sizeof(*entry));
	entry->users = &hostinfo[i].users[j];
	entry->idle = entry->users->ut_idle;
	entry->count = 1;
	entry++;
}
}
free(hostinfo);
hostinfo = new_hostinfo;
nentries = maxentries = count;
698}

700void
701sorthosts(void)
702{
int i;
int (*compar)(const void *, const void *);

if (iflag && lflag)
expandhosts();

if (hflag)
compar = hcompare;
else if (iflag)
compar = icompare;
else
compar = ucompare;
qsort(hostinfo, nentries, sizeof(*hostinfo), compar);

for (i = 0; i < nentries; i++)
print_entry(&hostinfo[i], lflag && hostinfo[i].count);
719}

721int
722hcompare(const void *aa, const void *bb)
723{
const struct host_info *a = (struct host_info *)aa;
const struct host_info *b = (struct host_info *)bb;
int rval;

if ((rval = strcasecmp(a->host, b->host)) != 0)
return(rval);

if (a->idle < b->idle)
return(-1);
else if (a->idle > b->idle)
return(1);

if (a->count > b->count)
return(-1);
else if (a->count < b->count)
return(1);

return(0);
742}

744int
745icompare(const void *aa, const void *bb)
746{
const struct host_info *a = (struct host_info *)aa;
const struct host_info *b = (struct host_info *)bb;

if (a->idle < b->idle)
return(-1);
else if (a->idle > b->idle)
return(1);

if (a->count > b->count)
return(-1);
else if (a->count < b->count)
return(1);

return(strcasecmp(a->host, b->host));
761}

763int
764ucompare(const void *aa, const void *bb)
765{
const struct host_info *a = (struct host_info *)aa;
const struct host_info *b = (struct host_info *)bb;

if (a->count > b->count)
return(-1);
else if (a->count < b->count)
return(1);

if (a->idle < b->idle)
return(-1);
else if (a->idle > b->idle)
return(1);

return(strcasecmp(a->host, b->host));
780}

782void
783alarmclock(int signo)
784{

;		/* just interrupt */
787}

789char *
790estrndup(const char *src, size_t len)
791{
char *dst, *end;

if ((end = memchr(src, '\0', len)) != NULL((void *)0))
len = end - src;

if ((dst = malloc(len + 1)) == NULL((void *)0))
err(1, NULL((void *)0));
memcpy(dst, src, len);
dst[len] = '\0';

return(dst);
803}

805void
806usage(void)
807{

fprintf(stderr(&__sF[2]), "usage: %s [-al] [-h | -i | -u] [hosts ...]\n",
   __progname);
exit(1);
812}