/usr/src/bin/ps/ps.c

Bug Summary

File:	src/bin/ps/ps.c
Warning:	line 613, column 17 Use of memory allocated with size zero

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name ps.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/bin/ps/obj -resource-dir /usr/local/llvm16/lib/clang/16 -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/bin/ps/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/bin/ps/ps.c

1/*	$OpenBSD: ps.c,v 1.80 2023/11/10 09:17:02 kn Exp $	*/
2/*	$NetBSD: ps.c,v 1.15 1995/05/18 20:33:25 mycroft Exp $	*/

4/*-
* Copyright (c) 1990, 1993, 1994
*	The Regents of the University of California.  All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of the University nor the names of its contributors
*    may be used to endorse or promote products derived from this software
*    without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

33#include <sys/param.h>	/* NODEV */
34#include <sys/types.h>
35#include <sys/signal.h>
36#include <sys/sysctl.h>
37#include <sys/time.h>
38#include <sys/resource.h>
39#include <sys/proc.h>
40#include <sys/stat.h>
41#include <sys/ioctl.h>

43#include <ctype.h>
44#include <err.h>
45#include <errno(*__errno()).h>
46#include <fcntl.h>
47#include <kvm.h>
48#include <locale.h>
49#include <nlist.h>
50#include <paths.h>
51#include <pwd.h>
52#include <stdio.h>
53#include <stdlib.h>
54#include <string.h>
55#include <unistd.h>
56#include <limits.h>

58#include "ps.h"

60extern char *__progname;

62struct varent *vhead;

64int	eval;			/* exit value */
65int	sumrusage;		/* -S */
66int	termwidth;		/* width of screen (0 == infinity) */
67int	totwidth;		/* calculated width of requested variables */

69int	needcomm, needenv, neednlist, commandonly;

71enum sort { DEFAULT, SORTMEM, SORTCPU } sortby = DEFAULT;

73static char	*kludge_oldps_options(char *);
74static int	 pscomp(const void *, const void *);
75static void	 scanvars(void);
76static void	 forest_sort(struct pinfo *, int);
77static void	 usage(void);

79char dfmt[] = "pid tt state time command";
80char tfmt[] = "pid tid tt state time command";
81char jfmt[] = "user pid ppid pgid sess jobc state tt time command";
82char lfmt[] = "uid pid ppid cpu pri nice vsz rss wchan state tt time command";
83char   o1[] = "pid";
84char   o2[] = "tt state time command";
85char ufmt[] = "user pid %cpu %mem vsz rss tt state start time command";
86char vfmt[] = "pid state time sl re pagein vsz rss lim tsiz %cpu %mem command";

88kvm_t *kd;
89int kvm_sysctl_only;

91int
92main(int argc, char *argv[])
93{
struct kinfo_proc *kp;
struct pinfo *pinfo;
struct varent *vent;
struct winsize ws;
dev_t ttydev;
pid_t pid;
uid_t uid;
int all, ch, flag, i, fmt, lineno, nentries;
int prtheader, showthreads, wflag, kflag, what, Uflag, xflg;
int forest;
char *nlistf, *memf, *swapf, *cols, errbuf[_POSIX2_LINE_MAX2048];

setlocale(LC_CTYPE2, "");

termwidth = 0;
if ((cols = getenv("COLUMNS")) != NULL((void *)0))
termwidth = strtonum(cols, 1, INT_MAX0x7fffffff, NULL((void *)0));
if (termwidth == 0 &&
   (ioctl(STDOUT_FILENO1, TIOCGWINSZ((unsigned long)0x40000000 | ((sizeof(struct winsize) & 0x1fff
) << 16) | ((('t')) << 8) | ((104))), &ws) == 0 ||
   ioctl(STDERR_FILENO2, TIOCGWINSZ((unsigned long)0x40000000 | ((sizeof(struct winsize) & 0x1fff
) << 16) | ((('t')) << 8) | ((104))), &ws) == 0 ||
   ioctl(STDIN_FILENO0, TIOCGWINSZ((unsigned long)0x40000000 | ((sizeof(struct winsize) & 0x1fff
) << 16) | ((('t')) << 8) | ((104))), &ws) == 0) &&
   ws.ws_col > 0)
termwidth = ws.ws_col - 1;
if (termwidth == 0)
termwidth = 79;

if (argc > 1)
argv[1] = kludge_oldps_options(argv[1]);

all = fmt = prtheader = showthreads = wflag = kflag = Uflag = xflg = 0;
pid = -1;
uid = 0;
forest = 0;
ttydev = NODEV(dev_t)(-1);
memf = nlistf = swapf = NULL((void *)0);
while ((ch = getopt(argc, argv,
   "AaCcefgHhjkLlM:mN:O:o:p:rSTt:U:uvW:wx")) != -1)
switch (ch) {
case 'A':
	all = 1;
	xflg = 1;
	break;
case 'a':
	all = 1;
	break;
case 'C':
	break;			/* no-op */
case 'c':
	commandonly = 1;
	break;
case 'e':			/* XXX set ufmt */
	needenv = 1;
	break;
case 'f':
	forest = 1;
	break;
case 'g':
	break;			/* no-op */
case 'H':
	showthreads = 1;
	break;
case 'h':
	prtheader = ws.ws_row > 5 ? ws.ws_row : 22;
	break;
case 'j':
	parsefmt(jfmt);
	fmt = 1;
	jfmt[0] = '\0';
	break;
case 'k':
	kflag = 1;
	break;
case 'L':
	showkey();
	exit(0);
case 'l':
	parsefmt(lfmt);
	fmt = 1;
	lfmt[0] = '\0';
	break;
case 'M':
	memf = optarg;
	break;
case 'm':
	sortby = SORTMEM;
	break;
case 'N':
	nlistf = optarg;
	break;
case 'O':
	parsefmt(o1);
	parsefmt(optarg);
	parsefmt(o2);
	o1[0] = o2[0] = '\0';
	fmt = 1;
	break;
case 'o':
	parsefmt(optarg);
	fmt = 1;
	break;
case 'p':
	pid = atol(optarg);
	xflg = 1;
	break;
case 'r':
	sortby = SORTCPU;
	break;
case 'S':
	sumrusage = 1;
	break;
case 'T':
	if ((optarg = ttyname(STDIN_FILENO0)) == NULL((void *)0))
		errx(1, "stdin: not a terminal");
	/* FALLTHROUGH */
case 't': {
	struct stat sb;
	char *ttypath, pathbuf[PATH_MAX1024];

	if (strcmp(optarg, "co") == 0)
		ttypath = _PATH_CONSOLE"/dev/console";
	else if (*optarg != '/') {
		int r = snprintf(pathbuf, sizeof(pathbuf), "%s%s",
		    _PATH_TTY"/dev/tty", optarg);
		if (r < 0 || r > sizeof(pathbuf))
			errx(1, "%s: too long\n", optarg);
		ttypath = pathbuf;
	} else
		ttypath = optarg;
	if (stat(ttypath, &sb) == -1)
		err(1, "%s", ttypath);
	if (!S_ISCHR(sb.st_mode)((sb.st_mode & 0170000) == 0020000))
		errx(1, "%s: not a terminal", ttypath);
	ttydev = sb.st_rdev;
	break;
}
case 'U': {
	int found = 0;

	if (uid_from_user(optarg, &uid) == 0)
		found = 1;
	else {
		const char *errstr;

		uid = strtonum(optarg, 0, UID_MAX0xffffffffU, &errstr);
		if (errstr == NULL((void *)0) &&
		    user_from_uid(uid, 1) != NULL((void *)0))
			found = 1;
	}
	if (!found)
		errx(1, "%s: unknown user", optarg);
	Uflag = xflg = 1;
	break;
}
case 'u':
	parsefmt(ufmt);
	sortby = SORTCPU;
	fmt = 1;
	ufmt[0] = '\0';
	break;
case 'v':
	parsefmt(vfmt);
	sortby = SORTMEM;
	fmt = 1;
	vfmt[0] = '\0';
	break;
case 'W':
	swapf = optarg;
	break;
case 'w':
	if (wflag)
		termwidth = UNLIMITED0;
	else if (termwidth < 131)
		termwidth = 131;
	wflag = 1;
	break;
case 'x':
	xflg = 1;
	break;
default:
	usage();
}
argc -= optind;
argv += optind;

278#define	BACKWARD_COMPATIBILITY
279#ifdef	BACKWARD_COMPATIBILITY
if (*argv) {
nlistf = *argv;
if (*++argv) {
	memf = *argv;
	if (*++argv)
		swapf = *argv;
}
}
288#endif

if (nlistf == NULL((void *)0) && memf == NULL((void *)0) && swapf == NULL((void *)0)) {
kd = kvm_openfiles(NULL((void *)0), NULL((void *)0), NULL((void *)0), KVM_NO_FILES0x80000000, errbuf);
kvm_sysctl_only = 1;
} else {
kd = kvm_openfiles(nlistf, memf, swapf, O_RDONLY0x0000, errbuf);
}
if (kd == NULL((void *)0))
errx(1, "%s", errbuf);

if (unveil(_PATH_DEVDB"/var/run/dev.db", "r") == -1 && errno(*__errno()) != ENOENT2)
err(1, "unveil %s", _PATH_DEVDB"/var/run/dev.db");
if (unveil(_PATH_DEV"/dev/", "r") == -1 && errno(*__errno()) != ENOENT2)
err(1, "unveil %s", _PATH_DEV"/dev/");
if (swapf)
if (unveil(swapf, "r") == -1)
	err(1, "unveil %s", swapf);
if (nlistf)
if (unveil(nlistf, "r") == -1)
	err(1, "unveil %s", nlistf);
if (memf)
if (unveil(memf, "r") == -1)
	err(1, "unveil %s", memf);
if (pledge("stdio rpath getpw ps", NULL((void *)0)) == -1)
err(1, "pledge");

if (!fmt) {
if (showthreads)
	parsefmt(tfmt);
else
	parsefmt(dfmt);
}

/* XXX - should be cleaner */
if (!all && ttydev == NODEV(dev_t)(-1) && pid == -1 && !Uflag) {
uid = getuid();
Uflag = 1;
}

/*
* scan requested variables, noting what structures are needed,
* and adjusting header widths as appropriate.
*/
scanvars();

if (neednlist && !nlistread)
(void) donlist();

/*
* get proc list
*/
if (Uflag) {
what = KERN_PROC_UID5;
flag = uid;
} else if (ttydev != NODEV(dev_t)(-1)) {
what = KERN_PROC_TTY4;
flag = ttydev;
} else if (pid != -1) {
what = KERN_PROC_PID1;
flag = pid;
} else if (kflag) {
what = KERN_PROC_KTHREAD7;
flag = 0;
} else {
what = KERN_PROC_ALL0;
flag = 0;
}
if (showthreads)
what |= KERN_PROC_SHOW_THREADS0x40000000;

/*
* select procs
*/
kp = kvm_getprocs(kd, what, flag, sizeof(*kp), &nentries);
if (kp == NULL((void *)0))
errx(1, "%s", kvm_geterr(kd));

/*
* print header
*/
printheader();
if (nentries == 0)
exit(1);

if ((pinfo = calloc(nentries, sizeof(struct pinfo))) == NULL((void *)0))
err(1, NULL((void *)0));
for (i = 0; i < nentries; i++)
pinfo[i].ki = &kp[i];
qsort(pinfo, nentries, sizeof(struct pinfo), pscomp);

if (forest)
forest_sort(pinfo, nentries);

/*
* for each proc, call each variable output function.
*/
for (i = lineno = 0; i < nentries; i++) {
if (xflg == 0 && ((int)pinfo[i].ki->p_tdev == NODEV(dev_t)(-1) ||
    (pinfo[i].ki->p_psflags & PS_CONTROLT0x00000001 ) == 0))
	continue;
if (showthreads && pinfo[i].ki->p_tid == -1)
	continue;
for (vent = vhead; vent; vent = vent->next) {
	(vent->var->oproc)(&pinfo[i], vent);
	if (vent->next != NULL((void *)0))
		(void)putchar(' ')(!__isthreaded ? __sputc(' ', (&__sF[1])) : (putc)(' ', (
&__sF[1])));
}
(void)putchar('\n')(!__isthreaded ? __sputc('\n', (&__sF[1])) : (putc)('\n',
 (&__sF[1])));
if (prtheader && lineno++ == prtheader - 4) {
	(void)putchar('\n')(!__isthreaded ? __sputc('\n', (&__sF[1])) : (putc)('\n',
 (&__sF[1])));
	printheader();
	lineno = 0;
}
}
exit(eval);
404}

406static void
407scanvars(void)
408{
struct varent *vent;
VAR *v;
int i;

for (vent = vhead; vent; vent = vent->next) {
v = vent->var;
i = strlen(v->header);
if (v->width < i)
	v->width = i;
totwidth += v->width + 1;	/* +1 for space */
if (v->flag & COMM0x01)
	needcomm = 1;
if (v->flag & NLIST0x10)
	neednlist = 1;
}
totwidth--;
425}

427static int
428pscomp(const void *v1, const void *v2)
429{
const struct pinfo *p1 = (const struct pinfo *)v1;
const struct pinfo *p2 = (const struct pinfo *)v2;
const struct kinfo_proc *kp1 = p1->ki;
const struct kinfo_proc *kp2 = p2->ki;
int i;
435#define VSIZE(k)((k)->p_vm_dsize + (k)->p_vm_ssize + (k)->p_vm_tsize
) ((k)->p_vm_dsize + (k)->p_vm_ssize + (k)->p_vm_tsize)

if (sortby == SORTCPU && (i = getpcpu(kp2) - getpcpu(kp1)) != 0)
return (i);
if (sortby == SORTMEM && (i = VSIZE(kp2)((kp2)->p_vm_dsize + (kp2)->p_vm_ssize + (kp2)->p_vm_tsize
) - VSIZE(kp1)((kp1)->p_vm_dsize + (kp1)->p_vm_ssize + (kp1)->p_vm_tsize
)) != 0)
return (i);
if ((i = kp1->p_tdev - kp2->p_tdev) == 0 &&
   (i = kp1->p_ustart_sec - kp2->p_ustart_sec) == 0)
i = kp1->p_ustart_usec - kp2->p_ustart_usec;
return (i);
445}

447/*
* ICK (all for getopt), would rather hide the ugliness
* here than taint the main code.
*
*  ps foo -> ps -foo
*  ps 34 -> ps -p34
*
* The old convention that 't' with no trailing tty arg means the users
* tty, is only supported if argv[1] doesn't begin with a '-'.  This same
* feature is available with the option 'T', which takes no argument.
*/
458static char *
459kludge_oldps_options(char *s)
460{
size_t len;
char *newopts, *ns, *cp;

len = strlen(s);
if ((newopts = ns = malloc(2 + len + 1)) == NULL((void *)0))
err(1, NULL((void *)0));
/*
* options begin with '-'
*/
if (*s != '-')
*ns++ = '-';	/* add option flag */

/*
* gaze to end of argv[1]
*/
cp = s + len - 1;
/*
* if last letter is a 't' flag with no argument (in the context
* of the oldps options -- option string NOT starting with a '-' --
* then convert to 'T' (meaning *this* terminal, i.e. ttyname(0)).
*/
if (*cp == 't' && *s != '-')
*cp = 'T';
else {
/*
 * otherwise check for trailing number, which *may* be a
 * pid.
 */
while (cp >= s && isdigit((unsigned char)*cp))
	--cp;
}
cp++;
memmove(ns, s, (size_t)(cp - s));	/* copy up to trailing number */
ns += cp - s;
/*
* if there's a trailing number, and not a preceding 'p' (pid),
* 't' (tty) or 'U' (user) flag,
* then assume it's a pid and insert a 'p' flag.
*/
if (isdigit((unsigned char)*cp) &&
   (cp == s || (cp[-1] != 't' && cp[-1] != 'p' && cp[-1] != 'U' &&
   (cp - 1 == s || cp[-2] != 't'))))
*ns++ = 'p';
/* and append the number */
(void)strlcpy(ns, cp, newopts + len + 3 - ns);

return (newopts);
508}

510static void
511forest_sort(struct pinfo *ki, int items)
512{
int dst, lvl, maxlvl, n, ndst, nsrc, siblings, src;
unsigned char *path;
struct pinfo kn;

/*
* First, sort the entries by forest, tracking the forest
* depth in the level field.
*/
src = 0;
maxlvl = 0;
while (src < items) {
1
Assuming 'src' is < 'items'→
2
←
Loop condition is true.  Entering loop body→
5
←
 Execution continues on line 523→
6
←
Assuming 'src' is >= 'items'→
7
←
Loop condition is false. Execution continues on line 582→
if (ki[src].level) {
3
←
Assuming field 'level' is not equal to 0→
4
←
Taking true branch→
	src++;
	continue;
}
for (nsrc = 1; src + nsrc < items; nsrc++)
	if (!ki[src + nsrc].level)
		break;

for (dst = 0; dst < items; dst++) {
	if (ki[dst].ki->p_pid == ki[src].ki->p_pid)
		continue;
	if (ki[dst].ki->p_pid == ki[src].ki->p_ppid)
		break;
}

if (dst == items) {
	src += nsrc;
	continue;
}

for (ndst = 1; dst + ndst < items; ndst++)
	if (ki[dst + ndst].level <= ki[dst].level)
		break;

for (n = src; n < src + nsrc; n++) {
	ki[n].level += ki[dst].level + 1;
	if (maxlvl < ki[n].level)
		maxlvl = ki[n].level;
}

while (nsrc) {
	if (src < dst) {
		kn = ki[src];
		memmove(ki + src, ki + src + 1,
		    (dst - src + ndst - 1) * sizeof *ki);
		ki[dst + ndst - 1] = kn;
		nsrc--;
		dst--;
		ndst++;
	} else if (src != dst + ndst) {
		kn = ki[src];
		memmove(ki + dst + ndst + 1, ki + dst + ndst,
		    (src - dst - ndst) * sizeof *ki);
		ki[dst + ndst] = kn;
		ndst++;
		nsrc--;
		src++;
	} else {
		ndst += nsrc;
		src += nsrc;
		nsrc = 0;
	}
}
}
/*
* Now populate prefix (instead of level) with the command
* prefix used to show descendancies.
*/
path = calloc(1, (maxlvl + 7) / 8);
8
←
Memory is allocated→
if (path == NULL((void *)0))
9
←
Assuming 'path' is not equal to NULL→
10
←
Taking false branch→
err(1, NULL((void *)0));

for (src = 0; src < items; src++) {
11
←
Loop condition is true.  Entering loop body→
if ((lvl = ki[src].level) == 0) {
12
←
Taking false branch→
	ki[src].prefix = NULL((void *)0);
	continue;
}

if ((ki[src].prefix = malloc(lvl * 2 + 1)) == NULL((void *)0))
13
←
Assuming the condition is false→
14
←
Taking false branch→
	err(1, NULL((void *)0));

for (n = 0; n < lvl - 2; n++) {
15
←
Assuming the condition is false→
16
←
Loop condition is false. Execution continues on line 601→
	ki[src].prefix[n * 2] =
	    path[n / 8] & 1 << (n % 8) ? '|' : ' ';
	ki[src].prefix[n * 2 + 1] = ' ';

}
if (n == lvl - 2) {
17
←
Assuming the condition is true→
18
←
Taking true branch→
	/* Have I any more siblings? */
	for (siblings = 0, dst = src + 1; dst < items; dst++) {
19
←
Loop condition is false. Execution continues on line 610→
		if (ki[dst].level > lvl)
			continue;
		if (ki[dst].level == lvl)
			siblings = 1;
		break;
	}
	if (siblings19.1
'siblings' is 0
)
20
←
Taking false branch→
		path[n / 8] |= 1 << (n % 8);
	else
		path[n / 8] &= ~(1 << (n % 8));
21
←
Use of memory allocated with size zero
	ki[src].prefix[n * 2] = siblings ? '|' : '`';
	ki[src].prefix[n * 2 + 1] = '-';
	n++;
}
strlcpy(ki[src].prefix + n * 2, "- ", (lvl - n) * 2 + 1);
}
free(path);
621}

623static void
624usage(void)
625{
fprintf(stderr(&__sF[2]), "usage: %s [-AacefHhjkLlmrSTuvwx] [-M core] [-N system]"
   " [-O fmt] [-o fmt] [-p pid]\n", __progname);
fprintf(stderr(&__sF[2]), "%-*s[-t tty] [-U user] [-W swap]\n",
   (int)strlen(__progname) + 8, "");
exit(1);
631}