/usr/src/usr.bin/usbhidctl/usbhid.c

Bug Summary

File:	src/usr.bin/usbhidctl/usbhid.c
Warning:	line 715, column 20 Access to field 'status' results in a dereference of a null pointer (loaded from variable 'repptr')

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name usbhid.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.bin/usbhidctl/obj -resource-dir /usr/local/llvm16/lib/clang/16 -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.bin/usbhidctl/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/usr.bin/usbhidctl/usbhid.c

1/*	$OpenBSD: usbhid.c,v 1.20 2023/03/07 17:43:59 guenther Exp $	*/
2/*      $NetBSD: usbhid.c,v 1.22 2002/02/20 20:30:42 christos Exp $ */

4/*
* Copyright (c) 2001 The NetBSD Foundation, Inc.
* All rights reserved.
*
* This code is derived from software contributed to The NetBSD Foundation
* by David Sainty <David.Sainty@dtsp.co.nz>
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/

33#include <sys/types.h>

35#include <dev/usb/usb.h>
36#include <dev/usb/usbhid.h>

38#include <ctype.h>
39#include <err.h>
40#include <errno(*__errno()).h>
41#include <fcntl.h>
42#include <limits.h>
43#include <stdio.h>
44#include <stdlib.h>
45#include <string.h>
46#include <unistd.h>
47#include <usbhid.h>

49/*
* Zero if not in a verbose mode.  Greater levels of verbosity
* are indicated by values larger than one.
*/
53unsigned int verbose;

55/* Parser tokens */
56#define DELIM_USAGE'.' '.'
57#define DELIM_PAGE':' ':'
58#define DELIM_SET'=' '='

60static int reportid;

62struct Susbvar {
/* Variable name, not NUL terminated */
char const *variable;
size_t varlen;

char const *value; /* Value to set variable to */

69#define MATCH_ALL(1 << 0)		(1 << 0)
70#define MATCH_COLLECTIONS(1 << 1)	(1 << 1)
71#define MATCH_NODATA(1 << 2)		(1 << 2)
72#define MATCH_CONSTANTS(1 << 3)		(1 << 3)
73#define MATCH_WASMATCHED(1 << 4)	(1 << 4)
74#define MATCH_SHOWPAGENAME(1 << 5)	(1 << 5)
75#define MATCH_SHOWNUMERIC(1 << 6)	(1 << 6)
76#define MATCH_WRITABLE(1 << 7)		(1 << 7)
77#define MATCH_SHOWVALUES(1 << 8)	(1 << 8)
unsigned int mflags;

/* Workspace for hidmatch() */
ssize_t matchindex;

int (*opfunc)(struct hid_item *item, struct Susbvar *var,
      u_int32_t const *collist, size_t collen, u_char *buf);
85};

87struct Sreport {
struct usb_ctl_report *buffer;

enum {srs_uninit, srs_clean, srs_dirty} status;
int report_id;
size_t size;
93};

95static struct {
int uhid_report;
hid_kind_t hid_kind;
char const *name;
99} const reptoparam[] = {
100#define REPORT_INPUT0 0
{ UHID_INPUT_REPORT0x01, hid_input, "input" },
102#define REPORT_OUTPUT1 1
{ UHID_OUTPUT_REPORT0x02, hid_output, "output" },
104#define REPORT_FEATURE2 2
{ UHID_FEATURE_REPORT0x03, hid_feature, "feature" }
106#define REPORT_MAXVAL2 2
107};

109/*
* Extract 16-bit unsigned usage ID from a numeric string.  Returns -1
* if string failed to parse correctly.
*/
113static int
114strtousage(const char *nptr, size_t nlen)
115{
char *endptr;
long result;
char numstr[16];

if (nlen >= sizeof(numstr) || !isdigit((unsigned char)*nptr))
return -1;

/*
* We use strtol() here, but unfortunately strtol() requires a
* NUL terminated string - which we don't have - at least not
* officially.
*/
memcpy(numstr, nptr, nlen);
numstr[nlen] = '\0';

result = strtol(numstr, &endptr, 0);

if (result < 0 || result > 0xffff || endptr != &numstr[nlen])
return -1;

return result;
137}

139struct usagedata {
char const *page_name;
char const *usage_name;
size_t page_len;
size_t usage_len;
int isfinal;
u_int32_t usage_id;
146};

148/*
* Test a rule against the current usage data.  Returns -1 on no
* match, 0 on partial match and 1 on complete match.
*/
152static int
153hidtestrule(struct Susbvar *var, struct usagedata *cache)
154{
char const *varname;
ssize_t matchindex, pagesplit;
size_t strind, varlen;
int numusage;
u_int32_t usage_id;

matchindex = var->matchindex;
varname = var->variable;
varlen = var->varlen;

usage_id = cache->usage_id;

/*
* Parse the current variable name, locating the end of the
* current 'usage', and possibly where the usage page name
* ends.
*/
pagesplit = -1;
for (strind = matchindex; strind < varlen; strind++) {
if (varname[strind] == DELIM_USAGE'.')
	break;
if (varname[strind] == DELIM_PAGE':')
	pagesplit = strind;
}

if (cache->isfinal && strind != varlen)
/*
 * Variable name is too long (hit delimiter instead of
 * end-of-variable).
 */
return -1;

if (pagesplit >= 0) {
/*
 * Page name was specified, determine whether it was
 * symbolic or numeric.  
 */
char const *strstart;
int numpage;

strstart = &varname[matchindex];

numpage = strtousage(strstart, pagesplit - matchindex);

if (numpage >= 0) {
	/* Valid numeric */

	if (numpage != HID_PAGE(usage_id)(((usage_id) >> 16) & 0xffff))
		/* Numeric didn't match page ID */
		return -1;
} else {
	/* Not a valid numeric */

	/*
	 * Load and cache the page name if and only if
	 * it hasn't already been loaded (it's a
	 * fairly expensive operation).
	 */
	if (cache->page_name == NULL((void *)0)) {
		cache->page_name = hid_usage_page(HID_PAGE(usage_id)(((usage_id) >> 16) & 0xffff));
		cache->page_len = strlen(cache->page_name);
	}

	/*
	 * Compare specified page name to actual page
	 * name.
	 */
	if (cache->page_len !=
	    (size_t)(pagesplit - matchindex) ||
	    memcmp(cache->page_name,
		   &varname[matchindex],
		   cache->page_len) != 0)
		/* Mismatch, page name wrong */
		return -1;
}

/* Page matches, discard page name */
matchindex = pagesplit + 1;
}

numusage = strtousage(&varname[matchindex], strind - matchindex);

if (numusage >= 0) {
/* Valid numeric */

if (numusage != HID_USAGE(usage_id)((usage_id) & 0xffff))
	/* Numeric didn't match usage ID */
	return -1;
} else {
/* Not a valid numeric */

/* Load and cache the usage name */
if (cache->usage_name == NULL((void *)0)) {
	cache->usage_name = hid_usage_in_page(usage_id);
	cache->usage_len = strlen(cache->usage_name);
}

/*
 * Compare specified usage name to actual usage name
 */
if (cache->usage_len != (size_t)(strind - matchindex) ||
    memcmp(cache->usage_name, &varname[matchindex],
	   cache->usage_len) != 0)
	/* Mismatch, usage name wrong */
	return -1;
}

if (cache->isfinal)
/* Match */
return 1;

/*
* Partial match: Move index past this usage string +
* delimiter
*/
var->matchindex = strind + 1;

return 0;
273}

275/*
* hidmatch() determines whether the item specified in 'item', and
* nested within a hierarchy of collections specified in 'collist'
* matches any of the rules in the list 'varlist'.  Returns the
* matching rule on success, or NULL on no match.
*/
281static struct Susbvar*
282hidmatch(u_int32_t const *collist, size_t collen, struct hid_item *item,
struct Susbvar *varlist, size_t vlsize)
284{
size_t colind, vlactive, vlind;
int iscollection;

/*
* Keep track of how many variables are still "active".  When
* the active count reaches zero, don't bother to continue
* looking for matches.
*/
vlactive = vlsize;

iscollection = item->kind == hid_collection ||
item->kind == hid_endcollection;

for (vlind = 0; vlind < vlsize; vlind++) {
struct Susbvar *var;

var = &varlist[vlind];

var->matchindex = 0;

if (!(var->mflags & MATCH_COLLECTIONS(1 << 1)) && iscollection) {
	/* Don't match collections for this variable */
	var->matchindex = -1;
	vlactive--;
} else if (!iscollection && !(var->mflags & MATCH_CONSTANTS(1 << 3)) &&
	   (item->flags & HIO_CONST0x001)) {
	/*
	 * Don't match constants for this variable,
	 * but ignore the constant bit on collections.
	 */
	var->matchindex = -1;
	vlactive--;
} else if ((var->mflags & MATCH_WRITABLE(1 << 7)) &&
	   ((item->kind != hid_output &&
	     item->kind != hid_feature) ||
	    (item->flags & HIO_CONST0x001))) {
	/*
	 * If we are only matching writable items, if
	 * this is not an output or feature kind, or
	 * it is a constant, reject it.
	 */
	var->matchindex = -1;
	vlactive--;
} else if (var->mflags & MATCH_ALL(1 << 0)) {
	/* Match immediately */
	return &varlist[vlind];
}
}

/*
* Loop through each usage in the collection list, including
* the 'item' itself on the final iteration.  For each usage,
* test which variables named in the rule list are still
* applicable - if any.
*/
for (colind = 0; vlactive > 0 && colind <= collen; colind++) {
struct usagedata cache;

cache.isfinal = (colind == collen);
if (cache.isfinal)
	cache.usage_id = item->usage;
else
	cache.usage_id = collist[colind];

cache.usage_name = NULL((void *)0);
cache.page_name = NULL((void *)0);

/*
 * Loop through each rule, testing whether the rule is
 * still applicable or not.  For each rule,
 * 'matchindex' retains the current match state as an
 * index into the variable name string, or -1 if this
 * rule has been proven not to match.
 */
for (vlind = 0; vlind < vlsize; vlind++) {
	struct Susbvar *var;
	int matchres;

	var = &varlist[vlind];

	if (var->matchindex < 0)
		/* Mismatch at a previous level */
		continue;

	matchres = hidtestrule(var, &cache);

	if (matchres < 0) {
		/* Bad match */
		var->matchindex = -1;
		vlactive--;
		continue;
	} else if (matchres > 0) {
		/* Complete match */
		return var;
	}
}
}

return NULL((void *)0);
384}

386static void
387allocreport(struct Sreport *report, report_desc_t rd, int repindex)
388{
int reptsize;

reptsize = hid_report_size(rd, reptoparam[repindex].hid_kind, reportid);
if (reptsize < 0)
errx(1, "Negative report size");
report->size = reptsize;

if (report->size > 0) {
report->buffer = malloc(sizeof(*report->buffer));
if (report->buffer == NULL((void *)0))
	err(1, NULL((void *)0));
} else
report->buffer = NULL((void *)0);

report->status = srs_clean;
404}

406static void
407freereport(struct Sreport *report)
408{
free(report->buffer);
report->status = srs_uninit;
411}

413static void
414getreport(struct Sreport *report, int hidfd, report_desc_t rd, int repindex)
415{
if (report->status == srs_uninit) {
allocreport(report, rd, repindex);
if (report->size == 0)
	return;

report->buffer->ucr_report = reptoparam[repindex].uhid_report;
if (ioctl(hidfd, USB_GET_REPORT(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct usb_ctl_report) & 0x1fff) << 16) | ((('U'))
 << 8) | ((23))), report->buffer) == -1)
	err(1, "USB_GET_REPORT (probably not supported by "
	    "device)");
}
426}

428static void
429setreport(struct Sreport *report, int hidfd, int repindex)
430{
if (report->status == srs_dirty) {
report->buffer->ucr_report = reptoparam[repindex].uhid_report;

if (ioctl(hidfd, USB_SET_REPORT((unsigned long)0x80000000 | ((sizeof(struct usb_ctl_report) &
 0x1fff) << 16) | ((('U')) << 8) | ((24))), report->buffer) == -1)
	err(1, "USB_SET_REPORT(%s)",
	    reptoparam[repindex].name);

report->status = srs_clean;
}
440}

442static int
443varop_value(struct hid_item *item, struct Susbvar *var,
   u_int32_t const *collist, size_t collen, u_char *buf)
445{
printf("%d\n", hid_get_data(buf, item));
return 0;
448}

450static int
451varop_display(struct hid_item *item, struct Susbvar *var,
     u_int32_t const *collist, size_t collen, u_char *buf)
453{
size_t colitem;
int val, i;

for (i = 0; i < item->report_count; i++) {
for (colitem = 0; colitem < collen; colitem++) {
	if (var->mflags & MATCH_SHOWPAGENAME(1 << 5))
		printf("%s:",
		    hid_usage_page(HID_PAGE(collist[colitem])(((collist[colitem]) >> 16) & 0xffff)));
	printf("%s.", hid_usage_in_page(collist[colitem]));
}
if (var->mflags & MATCH_SHOWPAGENAME(1 << 5))
	printf("%s:", hid_usage_page(HID_PAGE(item->usage)(((item->usage) >> 16) & 0xffff)));
val = hid_get_data(buf, item);
item->pos += item->report_size;
if (item->usage_minimum != 0 || item->usage_maximum != 0) {
	val += item->usage_minimum;
	printf("%s=1", hid_usage_in_page(val));
} else {
	printf("%s=%d%s", hid_usage_in_page(item->usage),
	       val, item->flags & HIO_CONST0x001 ? " (const)" : "");
}
if (item->report_count > 1)
	printf(" [%d]", i);
printf("\n");
}
return 0;
480}

482static int
483varop_modify(struct hid_item *item, struct Susbvar *var,
    u_int32_t const *collist, size_t collen, u_char *buf)
485{
u_int dataval;

dataval = (u_int)strtol(var->value, NULL((void *)0), 10);

hid_set_data(buf, item, dataval);

if (var->mflags & MATCH_SHOWVALUES(1 << 8))
/* Display set value */
varop_display(item, var, collist, collen, buf);

return 1;
497}

499static void
500reportitem(char const *label, struct hid_item const *item, unsigned int mflags)
501{
int isconst = item->flags & HIO_CONST0x001,
   isvar = item->flags & HIO_VARIABLE0x002;
printf("%s size=%d count=%d%s%s page=%s", label,
      item->report_size, item->report_count,
      isconst ? " Const" : "",
      !isvar && !isconst ? " Array" : "",
      hid_usage_page(HID_PAGE(item->usage)(((item->usage) >> 16) & 0xffff)));
if (item->usage_minimum != 0 || item->usage_maximum != 0) {
printf(" usage=%s..%s", hid_usage_in_page(item->usage_minimum),
       hid_usage_in_page(item->usage_maximum));
if (mflags & MATCH_SHOWNUMERIC(1 << 6))
	printf(" (%u:0x%x..%u:0x%x)",
	       HID_PAGE(item->usage_minimum)(((item->usage_minimum) >> 16) & 0xffff),
	       HID_USAGE(item->usage_minimum)((item->usage_minimum) & 0xffff),
	       HID_PAGE(item->usage_maximum)(((item->usage_maximum) >> 16) & 0xffff),
	       HID_USAGE(item->usage_maximum)((item->usage_maximum) & 0xffff));
} else {
printf(" usage=%s", hid_usage_in_page(item->usage));
if (mflags & MATCH_SHOWNUMERIC(1 << 6))
	printf(" (%u:0x%x)",
	       HID_PAGE(item->usage)(((item->usage) >> 16) & 0xffff), HID_USAGE(item->usage)((item->usage) & 0xffff));
}
printf(", logical range %d..%d",
      item->logical_minimum, item->logical_maximum);
if (item->physical_minimum != item->physical_maximum)
printf(", physical range %d..%d",
       item->physical_minimum, item->physical_maximum);
if (item->unit)
printf(", unit=0x%02x exp=%d", item->unit,
       item->unit_exponent);
printf("\n");
533}

535static int
536varop_report(struct hid_item *item, struct Susbvar *var,
    u_int32_t const *collist, size_t collen, u_char *buf)
538{
switch (item->kind) {
case hid_collection:
printf("Collection page=%s usage=%s",
       hid_usage_page(HID_PAGE(item->usage)(((item->usage) >> 16) & 0xffff)),
       hid_usage_in_page(item->usage));
if (var->mflags & MATCH_SHOWNUMERIC(1 << 6))
	printf(" (%u:0x%x)\n",
	       HID_PAGE(item->usage)(((item->usage) >> 16) & 0xffff), HID_USAGE(item->usage)((item->usage) & 0xffff));
else
	printf("\n");
break;
case hid_endcollection:
printf("End collection\n");
break;
case hid_input:
reportitem("Input  ", item, var->mflags);
break;
case hid_output:
reportitem("Output ", item, var->mflags);
break;
case hid_feature:
reportitem("Feature", item, var->mflags);
break;
}

return 0;
565}

567static void
568devloop(int hidfd, report_desc_t rd, struct Susbvar *varlist, size_t vlsize)
569{
u_char *dbuf;
struct hid_data *hdata;
size_t collind, dlen;
struct hid_item hitem;
u_int32_t colls[128];
struct Sreport inreport;

allocreport(&inreport, rd, REPORT_INPUT0);

if (inreport.size <= 0)
errx(1, "Input report descriptor invalid length");

dlen = inreport.size;
dbuf = inreport.buffer->ucr_data;

for (;;) {
ssize_t readlen;

readlen = read(hidfd, dbuf, dlen);
if (readlen == -1)
	err(1, "Device read error");
if (dlen != (size_t)readlen)
	errx(1, "Unexpected response length: %lu != %lu",
	     (unsigned long)readlen, (unsigned long)dlen);

collind = 0;
hdata = hid_start_parse(rd, 1 << hid_input, reportid);
if (hdata == NULL((void *)0))
	errx(1, "Failed to start parser");

while (hid_get_item(hdata, &hitem)) {
	struct Susbvar *matchvar;

	switch (hitem.kind) {
	case hid_collection:
		if (collind >= (sizeof(colls) / sizeof(*colls)))
			errx(1, "Excessive nested collections");
		colls[collind++] = hitem.usage;
		break;
	case hid_endcollection:
		if (collind == 0)
			errx(1, "Excessive collection ends");
		collind--;
		break;
	case hid_input:
		break;
	case hid_output:
	case hid_feature:
		errx(1, "Unexpected non-input item returned");
	}

	if (reportid != -1 && hitem.report_ID != reportid)
		continue;

	matchvar = hidmatch(colls, collind, &hitem,
			    varlist, vlsize);

	if (matchvar != NULL((void *)0))
		matchvar->opfunc(&hitem, matchvar,
				 colls, collind,
				 inreport.buffer->ucr_data);
}
hid_end_parse(hdata);
printf("\n");
}
/* NOTREACHED */
636}

638static void
639devshow(int hidfd, report_desc_t rd, struct Susbvar *varlist, size_t vlsize,
int kindset)
641{
struct hid_data *hdata;
size_t collind, repind, vlind;
struct hid_item hitem;
u_int32_t colls[128];
struct Sreport reports[REPORT_MAXVAL2 + 1];


for (repind = 0; repind < (sizeof(reports) / sizeof(*reports));
40
←
Loop condition is true.  Entering loop body→
41
←
Loop condition is true.  Entering loop body→
42
←
Loop condition is true.  Entering loop body→
43
←
Loop condition is false. Execution continues on line 655→
    repind++) {
reports[repind].status = srs_uninit;
reports[repind].buffer = NULL((void *)0);
}

collind = 0;
hdata = hid_start_parse(rd, kindset, reportid);
if (hdata == NULL((void *)0))
44
←
Assuming 'hdata' is not equal to NULL→
45
←
Taking false branch→
errx(1, "Failed to start parser");

while (hid_get_item(hdata, &hitem)) {
46
←
Loop condition is true.  Entering loop body→
struct Susbvar *matchvar;
int repindex;

if (verbose46.1
'verbose' is <= 3
 > 3)
47
←
Taking false branch→
	printf("item: kind=%d repid=%d usage=0x%x\n",
	       hitem.kind, hitem.report_ID, hitem.usage);
repindex = -1;
switch (hitem.kind) {
48
←
Control jumps to 'case hid_collection:'  at line 669→
case hid_collection:
	if (collind >= (sizeof(colls) / sizeof(*colls)))
49
←
Taking false branch→
		errx(1, "Excessive nested collections");
	colls[collind++] = hitem.usage;
	break;
50
←
 Execution continues on line 690→
case hid_endcollection:
	if (collind == 0)
		errx(1, "Excessive collection ends");
	collind--;
	break;
case hid_input:
	repindex = REPORT_INPUT0;
	break;
case hid_output:
	repindex = REPORT_OUTPUT1;
	break;
case hid_feature:
	repindex = REPORT_FEATURE2;
	break;
}

if (reportid != -1 && hitem.report_ID != reportid)
	continue;

matchvar = hidmatch(colls, collind, &hitem, varlist, vlsize);

if (matchvar != NULL((void *)0)) {
51
←
Assuming 'matchvar' is not equal to NULL→
52
←
Taking true branch→
	u_char *bufdata;
	struct Sreport *repptr;

	matchvar->mflags |= MATCH_WASMATCHED(1 << 4);

	if (repindex52.1
'repindex' is < 0
 >= 0)
53
←
Taking false branch→
		repptr = &reports[repindex];
	else
		repptr = NULL((void *)0);
54
←
Null pointer value stored to 'repptr'→

	if (repptr54.1
'repptr' is equal to NULL
 != NULL((void *)0) &&
	    !(matchvar->mflags & MATCH_NODATA(1 << 2)))
		getreport(repptr, hidfd, rd, repindex);

	bufdata = (repptr54.2
'repptr' is equal to NULL
 == NULL((void *)0) || repptr->buffer == NULL((void *)0)) ?
		NULL((void *)0) : repptr->buffer->ucr_data;

	if (matchvar->opfunc(&hitem, matchvar, colls, collind,
55
←
Assuming the condition is true→
56
←
Taking true branch→
			     bufdata))
		repptr->status = srs_dirty;
57
←
Access to field 'status' results in a dereference of a null pointer (loaded from variable 'repptr')
}
}
hid_end_parse(hdata);

for (repind = 0; repind < (sizeof(reports) / sizeof(*reports));
    repind++) {
setreport(&reports[repind], hidfd, repind);
freereport(&reports[repind]);
}

/* Warn about any items that we couldn't find a match for */
for (vlind = 0; vlind < vlsize; vlind++) {
struct Susbvar *var;

var = &varlist[vlind];

if (var->variable != NULL((void *)0) &&
    !(var->mflags & MATCH_WASMATCHED(1 << 4)))
	warnx("Failed to match: %.*s", (int)var->varlen,
	      var->variable);
}
737}

739static void
740usage(void)
741{
extern char *__progname;

fprintf(stderr(&__sF[2]), "usage: %s -f device [-t table] [-alv]\n",
   __progname);
fprintf(stderr(&__sF[2]), "       %s -f device [-t table] [-v] -r\n",
   __progname);
fprintf(stderr(&__sF[2]),
   "       %s -f device [-t table] [-lnv] name ...\n",
   __progname);
fprintf(stderr(&__sF[2]),
   "       %s -f device [-t table] -w name=value ...\n",
   __progname);
fprintf(stderr(&__sF[2]), "       %s -f device -R\n", __progname);
exit(1);
756}

758int
759main(int argc, char **argv)
760{
char const *dev;
char const *table;
size_t varnum;
uint32_t repsize;
int aflag, lflag, nflag, rflag, Rflag, wflag;
int ch, hidfd, x;
uint8_t *repdata;
report_desc_t repdesc;
char devnamebuf[PATH_MAX1024];
struct Susbvar variables[128];

wflag = aflag = nflag = verbose = rflag = Rflag = lflag = 0;
dev = NULL((void *)0);
table = NULL((void *)0);
while ((ch = getopt(argc, argv, "af:lnRrt:vw")) != -1) {
1
Assuming the condition is true→
2
←
Loop condition is true.  Entering loop body→
4
←
 Execution continues on line 775→
5
←
Assuming the condition is false→
6
←
Loop condition is false. Execution continues on line 809→
switch (ch) {
3
←
Control jumps to 'case 102:'  at line 780→
case 'a':
	aflag = 1;
	break;
case 'f':
	dev = optarg;
	break;
case 'l':
	lflag = 1;
	break;
case 'n':
	nflag = 1;
	break;
case 'r':
	rflag = 1;
	break;
case 'R':
	Rflag = 1;
	break;
case 't':
	table = optarg;
	break;
case 'v':
	verbose++;
	break;
case 'w':
	wflag = 1;
	break;
default:
	usage();
	/* NOTREACHED */
}
}
argc -= optind;
argv += optind;
if (dev == NULL((void *)0) || (lflag7.1
'lflag' is 0
 && (wflag || rflag || Rflag)) ||
7
←
Assuming 'dev' is not equal to NULL→
   (rflag7.2
'rflag' is 0
 && Rflag)) {
/*
 * No device specified, or attempting to loop and set
 * or dump report at the same time
 */
usage();
/* NOTREACHED */
}

if (argc == 0 && rflag == 0)
8
←
Assuming 'argc' is not equal to 0→
aflag = 1;

for (varnum = 0; varnum < (size_t)argc; varnum++) {
9
←
Assuming 'varnum' is < 'argc'→
10
←
Loop condition is true.  Entering loop body→
16
←
Assuming 'varnum' is >= 'argc'→
char const *name, *valuesep;
struct Susbvar *svar;

svar = &variables[varnum];
name = argv[varnum];
valuesep = strchr(name, DELIM_SET'=');

svar->variable = name;
svar->mflags = 0;

if (valuesep == NULL((void *)0)) {
11
←
Assuming 'valuesep' is equal to NULL→
12
←
Taking true branch→
	/* Read variable */
	if (wflag12.1
'wflag' is 0
)
13
←
Taking false branch→
		errx(1, "Must not specify -w to read variables");
	svar->value = NULL((void *)0);
	svar->varlen = strlen(name);

	if (nflag13.1
'nflag' is 0
) {
14
←
Taking false branch→
		/* Display value of variable only */
		svar->opfunc = varop_value;
	} else {
		/* Display name and value of variable */
		svar->opfunc = varop_display;

		if (verbose14.1
'verbose' is < 1
 >= 1)
15
←
Taking false branch→
			/* Show page names in verbose modes */
			svar->mflags |= MATCH_SHOWPAGENAME(1 << 5);
	}
} else {
	/* Write variable */
	if (!wflag)
		errx(2, "Must specify -w to set variables");
	svar->mflags |= MATCH_WRITABLE(1 << 7);
	if (verbose >= 1)
		/*
		 * Allow displaying of set value in
		 * verbose mode.  This isn't
		 * particularly useful though, so
		 * don't bother documenting it.
		 */
		svar->mflags |= MATCH_SHOWVALUES(1 << 8);
	svar->varlen = valuesep - name;
	svar->value = valuesep + 1;
	svar->opfunc = varop_modify;
}
}

if (aflag16.1
'aflag' is 0
 || rflag16.2
'rflag' is 0
) {
17
←
Taking false branch→
struct Susbvar *svar;

svar = &variables[varnum++];

svar->variable = NULL((void *)0);
svar->mflags = MATCH_ALL(1 << 0);

if (rflag) {
	/*
	 * Dump report descriptor.  Do dump collection
	 * items also, and hint that it won't be
	 * necessary to get the item status.
	 */
	svar->opfunc = varop_report;
	svar->mflags |= MATCH_COLLECTIONS(1 << 1) | MATCH_NODATA(1 << 2);

	switch (verbose) {
	default:
		/* Level 2: Show item numerics and constants */
		svar->mflags |= MATCH_SHOWNUMERIC(1 << 6);
		/* FALLTHROUGH */
	case 1:
		/* Level 1: Just show constants */
		svar->mflags |= MATCH_CONSTANTS(1 << 3);
		/* FALLTHROUGH */
	case 0:
		break;
	}
} else {
	/* Display name and value of variable */
	svar->opfunc = varop_display;

	switch (verbose) {
	default:
		/* Level 2: Show constants and page names */
		svar->mflags |= MATCH_CONSTANTS(1 << 3);
		/* FALLTHROUGH */
	case 1:
		/* Level 1: Just show page names */
		svar->mflags |= MATCH_SHOWPAGENAME(1 << 5);
		/* FALLTHROUGH */
	case 0:
		break;
	}
}
}

if (varnum17.1
'varnum' is not equal to 0
 == 0) {
18
←
Taking false branch→
/* Nothing to do...  Display usage information. */
usage();
/* NOTREACHED */
}

if (hid_start(table) == -1)
19
←
Assuming the condition is false→
20
←
Taking false branch→
errx(1, "hid_init");

if (dev[0] != '/') {
21
←
Assuming the condition is false→
22
←
Taking false branch→
snprintf(devnamebuf, sizeof(devnamebuf), "/dev/%s%s",
	 isdigit((unsigned char)dev[0]) ? "uhid" : "", dev);
dev = devnamebuf;
}

hidfd = open(dev, wflag22.1
'wflag' is 0
 ? O_RDWR0x0002 : O_RDONLY0x0000);
23
←
'?' condition is false→
if (hidfd == -1)
24
←
Assuming the condition is false→
25
←
Taking false branch→
err(1, "%s", dev);

if (unveil("/", "") == -1)
26
←
Assuming the condition is false→
27
←
Taking false branch→
err(1, "unveil /");
if (unveil(NULL((void *)0), NULL((void *)0)) == -1)
28
←
Assuming the condition is false→
29
←
Taking false branch→
err(1, "unveil");

if (ioctl(hidfd, USB_GET_REPORT_ID((unsigned long)0x40000000 | ((sizeof(int) & 0x1fff) <<
 16) | ((('U')) << 8) | ((25))), &reportid) == -1)
30
←
Assuming the condition is true→
31
←
Taking true branch→
reportid = -1;
if (verbose31.1
'verbose' is <= 1
 > 1)
32
←
Taking false branch→
printf("report ID=%d\n", reportid);
repdesc = hid_get_report_desc(hidfd);
if (repdesc == 0)
33
←
Assuming 'repdesc' is not equal to null→
34
←
Taking false branch→
errx(1, "USB_GET_REPORT_DESC");

if (Rflag34.1
'Rflag' is 0
) {
35
←
Taking false branch→
hid_get_report_desc_data(repdesc, &repdata, &repsize);

for (x = 0; x < repsize; x++)
	printf("%s0x%02x", x > 0 ? " " : "", repdata[x]);
printf("\n");
}

if (lflag35.1
'lflag' is 0
) {
36
←
Taking false branch→
devloop(hidfd, repdesc, variables, varnum);
/* NOTREACHED */
}

if (rflag36.1
'rflag' is 0
)
37
←
Taking false branch→
/* Report mode header */
printf("Report descriptor:\n");

if (!Rflag37.1
'Rflag' is 0
)
38
←
Taking true branch→
devshow(hidfd, repdesc, variables, varnum,
39
←
Calling 'devshow'→
	1 << hid_input |
	1 << hid_output |
	1 << hid_feature);

if (rflag) {
/* Report mode trailer */
size_t repindex;
for (repindex = 0;
     repindex < (sizeof(reptoparam) / sizeof(*reptoparam));
     repindex++) {
	int size;
	size = hid_report_size(repdesc,
			       reptoparam[repindex].hid_kind,
			       reportid);
	printf("Total %7s size %d bytes\n",
	       reptoparam[repindex].name, size);
}
}

hid_dispose_report_desc(repdesc);
exit(0);
/* NOTREACHED */
993}