Bug Summary

File:src/sbin/badsect/badsect.c
Warning:line 115, column 2
Null pointer passed as 2nd argument to string copy function

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name badsect.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sbin/badsect/obj -resource-dir /usr/local/llvm16/lib/clang/16 -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/sbin/badsect/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/sbin/badsect/badsect.c
1/* $OpenBSD: badsect.c,v 1.29 2022/10/12 23:11:32 krw Exp $ */
2/* $NetBSD: badsect.c,v 1.10 1995/03/18 14:54:28 cgd Exp $ */
3
4/*
5 * Copyright (c) 1981, 1983, 1993
6 * The Regents of the University of California. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the University nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33/*
34 * badsect
35 *
36 * Badsect takes a list of file-system relative sector numbers
37 * and makes files containing the blocks of which these sectors are a part.
38 * It can be used to contain sectors which have problems. For instance,
39 * this program can be used if the driver for the file system in question
40 * does not support bad block forwarding.
41 */
42#include <sys/param.h> /* MAXBSIZE DEV_BSIZE isclr */
43#include <sys/stat.h>
44
45#include <ufs/ffs/fs.h>
46#include <ufs/ufs/dinode.h>
47
48#include <dirent.h>
49#include <fcntl.h>
50#include <paths.h>
51#include <stdio.h>
52#include <stdlib.h>
53#include <string.h>
54#include <unistd.h>
55#include <limits.h>
56#include <err.h>
57
58static int chkuse(daddr_t, int);
59static void rdfs(daddr_t, int, char *);
60
61static union {
62 struct fs fs;
63 char fsx[SBSIZE8192];
64} ufs;
65#define sblockufs.fs ufs.fs
66static union {
67 struct cg cg;
68 char cgx[MAXBSIZE(64 * 1024)];
69} ucg;
70#define acgucg.cg ucg.cg
71static struct fs *fs;
72static int fsi;
73static int errs;
74
75int
76main(int argc, char *argv[])
77{
78 daddr_t number;
79 struct stat stbuf, devstat;
80 struct dirent *dp;
81 DIR *dirp;
82 char name[BUFSIZ1024];
83 int len;
84
85 if (argc < 3) {
1
Assuming 'argc' is >= 3
→
86 fprintf(stderr(&__sF[2]), "usage: badsect bbdir sector ...\n");
87 exit(1);
88 }
89 if (chdir(argv[1]) == -1 || stat(".", &stbuf) == -1)
2
←
Assuming the condition is false
→
3
←
Assuming the condition is false
→
4
←
Taking false branch
→
90 err(2, "%s", argv[1]);
91
92 strlcpy(name, _PATH_DEV"/dev/", sizeof name);
93 len = strlen(name);
94 if ((dirp = opendir(name)) == NULL((void *)0))
5
←
Assuming the condition is false
→
6
←
Taking false branch
→
95 err(3, "%s", name);
96
97 while ((dp = readdir(dirp)) != NULL((void *)0)) {
7
←
Assuming the condition is false
→
8
←
Loop condition is false. Execution continues on line 114
→
98 strlcpy(&name[len], dp->d_name, sizeof name - len);
99 if (stat(name, &devstat) == -1)
100 err(4, "%s", name);
101
102 if (stbuf.st_dev == devstat.st_rdev &&
103 S_ISBLK(devstat.st_mode)((devstat.st_mode & 0170000) == 0060000))
104 break;
105 }
106
107 /*
108 * We've found the block device, but since the filesystem
109 * is mounted, we must write to the raw (character) device
110 * instead. This is not guaranteed to work if someone has a
111 * /dev that doesn't follow standard naming conventions, but
112 * it's all we've got.
113 */
114 name[len] = 'r';
115 strlcpy(&name[len+1], dp->d_name, sizeof name - (len+1));
9
←
Null pointer passed as 2nd argument to string copy function
116 closedir(dirp);
117 if (dp == NULL((void *)0))
118 err(5, "Cannot find dev 0%o corresponding to %s",
119 stbuf.st_rdev, argv[1]);
120
121 if ((fsi = open(name, O_RDONLY0x0000)) == -1)
122 err(6, "%s", name);
123
124 fs = &sblockufs.fs;
125 rdfs(SBOFF((off_t)(((off_t)(0)) + 8192)), SBSIZE8192, (char *)fs);
126 for (argc -= 2, argv += 2; argc > 0; argc--, argv++) {
127 number = strtonum(*argv, 0, QUAD_MAX0x7fffffffffffffffLL, NULL((void *)0));
128 if (chkuse(number, 1))
129 continue;
130 if (mknod(*argv, S_IFMT0170000|S_IRUSR0000400|S_IWUSR0000200,
131 dbtofsb(fs, number)((number) >> (fs)->fs_fsbtodb)) < 0) {
132 warn("%s", *argv);
133 errs++;
134 }
135 }
136 printf("Don't forget to run ``fsck %s''\n", name);
137 exit(errs);
138}
139
140static int
141chkuse(daddr_t blkno, int cnt)
142{
143 int cg;
144 daddr_t fsbn, bn;
145
146 fsbn = dbtofsb(fs, blkno)((blkno) >> (fs)->fs_fsbtodb);
147 if (fsbn+cnt > fs->fs_ffs1_size) {
148 fprintf(stderr(&__sF[2]), "block %lld out of range of file system\n",
149 (long long)blkno);
150 return (1);
151 }
152 cg = dtog(fs, fsbn)((fsbn) / (fs)->fs_fpg);
153 if (fsbn < cgdmin(fs, cg)((((daddr_t)(fs)->fs_fpg * (cg)) + (fs)->fs_cgoffset * (
(cg) & ~((fs)->fs_cgmask))) + (fs)->fs_dblkno)) {
154 if (cg == 0 || (fsbn+cnt) > cgsblock(fs, cg)((((daddr_t)(fs)->fs_fpg * (cg)) + (fs)->fs_cgoffset * (
(cg) & ~((fs)->fs_cgmask))) + (fs)->fs_sblkno)) {
155 fprintf(stderr(&__sF[2]), "block %lld in non-data area: cannot "
156 "attach\n", (long long)blkno);
157 return (1);
158 }
159 } else {
160 if ((fsbn+cnt) > cgbase(fs, cg+1)((daddr_t)(fs)->fs_fpg * (cg+1))) {
161 fprintf(stderr(&__sF[2]), "block %lld in non-data area: cannot "
162 "attach\n", (long long)blkno);
163 return (1);
164 }
165 }
166 rdfs(fsbtodb(fs, cgtod(fs, cg))((((((daddr_t)(fs)->fs_fpg * (cg)) + (fs)->fs_cgoffset *
((cg) & ~((fs)->fs_cgmask))) + (fs)->fs_cblkno)) <<
(fs)->fs_fsbtodb), (int)sblockufs.fs.fs_cgsize,
167 (char *)&acgucg.cg);
168 if (!cg_chkmagic(&acg)((&ucg.cg)->cg_magic == 0x090255 || ((struct ocg *)(&
ucg.cg))->cg_magic == 0x090255)) {
169 fprintf(stderr(&__sF[2]), "cg %d: bad magic number\n", cg);
170 errs++;
171 return (1);
172 }
173 bn = dtogd(fs, fsbn)((fsbn) % (fs)->fs_fpg);
174 if (isclr(cg_blksfree(&acg), bn)((((((&ucg.cg)->cg_magic != 0x090255) ? (((struct ocg *
)(&ucg.cg))->cg_free) : ((u_int8_t *)((u_int8_t *)(&
ucg.cg) + (&ucg.cg)->cg_freeoff))))[(bn)>>3] &
(1<<((bn)&(8 -1)))) == 0))
175 fprintf(stderr(&__sF[2]), "Warning: sector %lld is in use\n",
176 (long long)blkno);
177 return (0);
178}
179
180/*
181 * read a block from the file system
182 */
183static void
184rdfs(daddr_t bno, int size, char *bf)
185{
186 if (pread(fsi, bf, size, bno * DEV_BSIZE(1 << 9)) != size) {
187 fprintf(stderr(&__sF[2]), "read error: %lld\n", (long long)bno);
188 err(1, "rdfs");
189 }
190}