Bug Summary

File:src/usr.sbin/ripd/message.c
Warning:line 193, column 14
Use of memory after it is freed

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name message.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/ripd/obj -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/usr.sbin/ripd -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/ripd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/usr.sbin/ripd/message.c
1/* $OpenBSD: message.c,v 1.17 2023/07/03 10:34:08 claudio Exp $ */
2
3/*
4 * Copyright (c) 2006 Michele Marchetto <mydecay@openbeer.it>
5 *
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19#include <sys/types.h>
20#include <sys/socket.h>
21#include <netinet/in.h>
22#include <netinet/ip.h>
23#include <arpa/inet.h>
24#include <netinet/udp.h>
25
26#include <stdlib.h>
27#include <string.h>
28
29#include "ripd.h"
30#include "rip.h"
31#include "ripe.h"
32#include "log.h"
33
34extern struct ripd_conf *oeconf;
35
36void delete_entry(struct rip_route *);
37
38/* timers */
39void
40report_timer(int fd, short event, void *arg)
41{
42 struct timeval tv;
43
44 ripe_imsg_compose_rde(IMSG_FULL_RESPONSE, 0, 0, NULL((void *)0), 0);
45
46 /* restart report timer */
47 timerclear(&tv)(&tv)->tv_sec = (&tv)->tv_usec = 0;
48 tv.tv_sec = KEEPALIVE30 + arc4random_uniform(OFFSET10);
49 evtimer_add(&oeconf->report_timer, &tv)event_add(&oeconf->report_timer, &tv);
50}
51
52int
53start_report_timer(void)
54{
55 struct timeval tv;
56
57 timerclear(&tv)(&tv)->tv_sec = (&tv)->tv_usec = 0;
58 tv.tv_sec = KEEPALIVE30 + arc4random_uniform(OFFSET10);
59 return (evtimer_add(&oeconf->report_timer, &tv)event_add(&oeconf->report_timer, &tv));
60}
61
62/* list handlers */
63void
64add_entry(struct packet_head *r_list, struct rip_route *rr)
65{
66 struct packet_entry *re;
67
68 if (rr == NULL((void *)0))
69 fatalx("add_entry: no route report");
70
71 if ((re = calloc(1, sizeof(*re))) == NULL((void *)0))
72 fatal("add_entry");
73
74 TAILQ_INSERT_TAIL(r_list, re, entry)do { (re)->entry.tqe_next = ((void *)0); (re)->entry.tqe_prev
= (r_list)->tqh_last; *(r_list)->tqh_last = (re); (r_list
)->tqh_last = &(re)->entry.tqe_next; } while (0)
;
75 re->rr = rr;
76 rr->refcount++;
77}
78
79void
80delete_entry(struct rip_route *rr)
81{
82 if (--rr->refcount == 0)
83 free(rr);
84}
85
86void
87clear_list(struct packet_head *r_list)
88{
89 struct packet_entry *re;
90
91 while ((re = TAILQ_FIRST(r_list)((r_list)->tqh_first)) != NULL((void *)0)) {
92 TAILQ_REMOVE(r_list, re, entry)do { if (((re)->entry.tqe_next) != ((void *)0)) (re)->entry
.tqe_next->entry.tqe_prev = (re)->entry.tqe_prev; else (
r_list)->tqh_last = (re)->entry.tqe_prev; *(re)->entry
.tqe_prev = (re)->entry.tqe_next; ; ; } while (0)
;
93 delete_entry(re->rr);
94 free(re);
95 }
96}
97
98/* communications */
99int
100send_triggered_update(struct iface *iface, struct rip_route *rr)
101{
102 struct sockaddr_in dst;
103 struct ibuf *buf;
104 u_int16_t afi, route_tag;
105 u_int32_t address, netmask, nexthop, metric;
106
107 if (iface->passive)
108 return (0);
109
110 inet_aton(ALL_RIP_ROUTERS"224.0.0.9", &dst.sin_addr);
111
112 dst.sin_port = htons(RIP_PORT)(__uint16_t)(__builtin_constant_p(520) ? (__uint16_t)(((__uint16_t
)(520) & 0xffU) << 8 | ((__uint16_t)(520) & 0xff00U
) >> 8) : __swap16md(520))
;
113 dst.sin_family = AF_INET2;
114 dst.sin_len = sizeof(struct sockaddr_in);
115
116 if ((buf = ibuf_open(iface->mtu - sizeof(struct ip) -
117 sizeof(struct udphdr))) == NULL((void *)0))
118 fatal("send_triggered_update");
119
120 gen_rip_hdr(buf, COMMAND_RESPONSE2);
121
122 afi = htons(AF_INET)(__uint16_t)(__builtin_constant_p(2) ? (__uint16_t)(((__uint16_t
)(2) & 0xffU) << 8 | ((__uint16_t)(2) & 0xff00U
) >> 8) : __swap16md(2))
;
123 route_tag = 0;
124
125 address = rr->address.s_addr;
126 netmask = rr->mask.s_addr;
127 nexthop = rr->nexthop.s_addr;
128 metric = htonl(rr->metric)(__uint32_t)(__builtin_constant_p(rr->metric) ? (__uint32_t
)(((__uint32_t)(rr->metric) & 0xff) << 24 | ((__uint32_t
)(rr->metric) & 0xff00) << 8 | ((__uint32_t)(rr->
metric) & 0xff0000) >> 8 | ((__uint32_t)(rr->metric
) & 0xff000000) >> 24) : __swap32md(rr->metric))
;
129
130 ibuf_add(buf, &afi, sizeof(afi));
131 ibuf_add(buf, &route_tag, sizeof(route_tag));
132 ibuf_add(buf, &address, sizeof(address));
133 ibuf_add(buf, &netmask, sizeof(netmask));
134 ibuf_add(buf, &nexthop, sizeof(nexthop));
135 ibuf_add(buf, &metric, sizeof(metric));
136
137 send_packet(iface, ibuf_data(buf), ibuf_size(buf), &dst);
138 ibuf_free(buf);
139
140 return (0);
141}
142
143int
144send_request(struct packet_head *r_list, struct iface *i, struct nbr *nbr)
145{
146 struct ibuf *buf;
147 struct iface *iface;
148 struct packet_entry *entry;
149 struct sockaddr_in dst;
150 u_int8_t nentries;
151 u_int8_t single_entry = 0;
152 u_int32_t address, netmask, nexthop;
153 u_int16_t port, afi, route_tag;
154 u_int32_t metric;
155
156 if (i == NULL((void *)0)) {
1
Assuming 'i' is not equal to NULL
2
Taking false branch
157 /* directly to a nbr */
158 iface = nbr->iface;
159 dst.sin_addr = nbr->addr;
160 port = htons(nbr->port)(__uint16_t)(__builtin_constant_p(nbr->port) ? (__uint16_t
)(((__uint16_t)(nbr->port) & 0xffU) << 8 | ((__uint16_t
)(nbr->port) & 0xff00U) >> 8) : __swap16md(nbr->
port))
;
161 } else {
162 /* multicast on interface */
163 iface = i;
164 inet_aton(ALL_RIP_ROUTERS"224.0.0.9", &dst.sin_addr);
165 port = htons(RIP_PORT)(__uint16_t)(__builtin_constant_p(520) ? (__uint16_t)(((__uint16_t
)(520) & 0xffU) << 8 | ((__uint16_t)(520) & 0xff00U
) >> 8) : __swap16md(520))
;
3
'?' condition is true
166 }
167
168 if (iface->passive) {
4
Assuming field 'passive' is 0
5
Taking false branch
169 clear_list(r_list);
170 return (0);
171 }
172
173 dst.sin_port = port;
174 dst.sin_family = AF_INET2;
175 dst.sin_len = sizeof(struct sockaddr_in);
176
177 while (!TAILQ_EMPTY(r_list)(((r_list)->tqh_first) == ((void *)0))) {
6
Assuming field 'tqh_first' is not equal to null
7
Loop condition is true. Entering loop body
178 if ((buf = ibuf_open(iface->mtu - sizeof(struct ip) -
8
Assuming the condition is false
9
Taking false branch
179 sizeof(struct udphdr))) == NULL((void *)0))
180 fatal("send_request");
181
182 gen_rip_hdr(buf, COMMAND_REQUEST1);
183
184 route_tag = 0;
185 nentries = 0;
186
187 if (TAILQ_FIRST(r_list)((r_list)->tqh_first) == TAILQ_LAST(r_list, packet_head)(*(((struct packet_head *)((r_list)->tqh_last))->tqh_last
))
)
10
Assuming the condition is false
188 single_entry = 1;
189 while (((entry = TAILQ_FIRST(r_list)((r_list)->tqh_first)) != NULL((void *)0)) &&
190 nentries < MAX_RIP_ENTRIES25) {
191 afi = htons(AF_INET)(__uint16_t)(__builtin_constant_p(2) ? (__uint16_t)(((__uint16_t
)(2) & 0xffU) << 8 | ((__uint16_t)(2) & 0xff00U
) >> 8) : __swap16md(2))
;
11
Loop condition is true. Entering loop body
12
'?' condition is true
20
Loop condition is true. Entering loop body
21
'?' condition is true
192
193 address = entry->rr->address.s_addr;
22
Use of memory after it is freed
194 netmask = entry->rr->mask.s_addr;
195 nexthop = entry->rr->nexthop.s_addr;
196 metric = htonl(entry->rr->metric)(__uint32_t)(__builtin_constant_p(entry->rr->metric) ? (
__uint32_t)(((__uint32_t)(entry->rr->metric) & 0xff
) << 24 | ((__uint32_t)(entry->rr->metric) & 0xff00
) << 8 | ((__uint32_t)(entry->rr->metric) & 0xff0000
) >> 8 | ((__uint32_t)(entry->rr->metric) & 0xff000000
) >> 24) : __swap32md(entry->rr->metric))
;
13
'?' condition is false
197
198 if (metric == htonl(INFINITY)(__uint32_t)(__builtin_constant_p(16) ? (__uint32_t)(((__uint32_t
)(16) & 0xff) << 24 | ((__uint32_t)(16) & 0xff00
) << 8 | ((__uint32_t)(16) & 0xff0000) >> 8 |
((__uint32_t)(16) & 0xff000000) >> 24) : __swap32md
(16))
&& single_entry)
14
'?' condition is true
15
Assuming the condition is false
199 afi = AF_UNSPEC0;
200
201 ibuf_add(buf, &afi, sizeof(afi));
202 ibuf_add(buf, &route_tag, sizeof(route_tag));
203 ibuf_add(buf, &address, sizeof(address));
204 ibuf_add(buf, &netmask, sizeof(netmask));
205 ibuf_add(buf, &nexthop, sizeof(nexthop));
206 ibuf_add(buf, &metric, sizeof(metric));
207 nentries++;
208
209 TAILQ_REMOVE(r_list, entry, entry)do { if (((entry)->entry.tqe_next) != ((void *)0)) (entry)
->entry.tqe_next->entry.tqe_prev = (entry)->entry.tqe_prev
; else (r_list)->tqh_last = (entry)->entry.tqe_prev; *(
entry)->entry.tqe_prev = (entry)->entry.tqe_next; ; ; }
while (0)
;
16
Assuming field 'tqe_next' is equal to null
17
Taking false branch
18
Loop condition is false. Exiting loop
210 delete_entry(entry->rr);
211 free(entry);
19
Memory is released
212 }
213 send_packet(iface, ibuf_data(buf), ibuf_size(buf), &dst);
214 ibuf_free(buf);
215 }
216
217 return (0);
218}
219
220int
221send_response(struct packet_head *r_list, struct iface *i, struct nbr *nbr)
222{
223 struct ibuf *buf;
224 struct iface *iface;
225 struct packet_entry *entry;
226 struct sockaddr_in dst;
227 u_int8_t nentries;
228 u_int16_t port, afi, route_tag;
229 u_int32_t address, netmask, nexthop;
230 u_int32_t metric;
231
232 if (i == NULL((void *)0)) {
233 /* directly to a nbr */
234 iface = nbr->iface;
235 dst.sin_addr = nbr->addr;
236 port = htons(nbr->port)(__uint16_t)(__builtin_constant_p(nbr->port) ? (__uint16_t
)(((__uint16_t)(nbr->port) & 0xffU) << 8 | ((__uint16_t
)(nbr->port) & 0xff00U) >> 8) : __swap16md(nbr->
port))
;
237 } else {
238 /* multicast on interface */
239 iface = i;
240 inet_aton(ALL_RIP_ROUTERS"224.0.0.9", &dst.sin_addr);
241 port = htons(RIP_PORT)(__uint16_t)(__builtin_constant_p(520) ? (__uint16_t)(((__uint16_t
)(520) & 0xffU) << 8 | ((__uint16_t)(520) & 0xff00U
) >> 8) : __swap16md(520))
;
242 }
243
244 if (iface->passive) {
245 clear_list(r_list);
246 return (0);
247 }
248
249 dst.sin_port = port;
250 dst.sin_family = AF_INET2;
251 dst.sin_len = sizeof(struct sockaddr_in);
252
253 while (!TAILQ_EMPTY(r_list)(((r_list)->tqh_first) == ((void *)0))) {
254 if ((buf = ibuf_open(iface->mtu - sizeof(struct ip) -
255 sizeof(struct udphdr))) == NULL((void *)0))
256 fatal("send_response");
257
258 gen_rip_hdr(buf, COMMAND_RESPONSE2);
259
260 afi = htons(AF_INET)(__uint16_t)(__builtin_constant_p(2) ? (__uint16_t)(((__uint16_t
)(2) & 0xffU) << 8 | ((__uint16_t)(2) & 0xff00U
) >> 8) : __swap16md(2))
;
261 route_tag = 0;
262 nentries = 0;
263
264 if (iface->auth_type != AUTH_NONE) {
265 if (auth_gen(buf, iface) == -1) {
266 ibuf_free(buf);
267 return (-1);
268 }
269 nentries++;
270 }
271
272 while ((entry = TAILQ_FIRST(r_list)((r_list)->tqh_first)) != NULL((void *)0) &&
273 nentries < MAX_RIP_ENTRIES25) {
274 address = entry->rr->address.s_addr;
275 netmask = entry->rr->mask.s_addr;
276 nexthop = entry->rr->nexthop.s_addr;
277 metric = htonl(entry->rr->metric)(__uint32_t)(__builtin_constant_p(entry->rr->metric) ? (
__uint32_t)(((__uint32_t)(entry->rr->metric) & 0xff
) << 24 | ((__uint32_t)(entry->rr->metric) & 0xff00
) << 8 | ((__uint32_t)(entry->rr->metric) & 0xff0000
) >> 8 | ((__uint32_t)(entry->rr->metric) & 0xff000000
) >> 24) : __swap32md(entry->rr->metric))
;
278
279 if (entry->rr->ifindex == iface->ifindex) {
280 if (oeconf->options & OPT_SPLIT_HORIZON0x01)
281 goto free;
282 else if (oeconf->options & OPT_SPLIT_POISONED0x02)
283 metric = htonl(INFINITY)(__uint32_t)(__builtin_constant_p(16) ? (__uint32_t)(((__uint32_t
)(16) & 0xff) << 24 | ((__uint32_t)(16) & 0xff00
) << 8 | ((__uint32_t)(16) & 0xff0000) >> 8 |
((__uint32_t)(16) & 0xff000000) >> 24) : __swap32md
(16))
;
284 }
285
286 /* If the nexthop is not reachable through the
287 * outgoing interface set it to INADDR_ANY */
288 if ((nexthop & iface->mask.s_addr) !=
289 (iface->addr.s_addr & iface->mask.s_addr))
290 nexthop = INADDR_ANY((u_int32_t)(0x00000000));
291
292 ibuf_add(buf, &afi, sizeof(afi));
293 ibuf_add(buf, &route_tag, sizeof(route_tag));
294 ibuf_add(buf, &address, sizeof(address));
295 ibuf_add(buf, &netmask, sizeof(netmask));
296 ibuf_add(buf, &nexthop, sizeof(nexthop));
297 ibuf_add(buf, &metric, sizeof(metric));
298 nentries++;
299free:
300 TAILQ_REMOVE(r_list, entry, entry)do { if (((entry)->entry.tqe_next) != ((void *)0)) (entry)
->entry.tqe_next->entry.tqe_prev = (entry)->entry.tqe_prev
; else (r_list)->tqh_last = (entry)->entry.tqe_prev; *(
entry)->entry.tqe_prev = (entry)->entry.tqe_next; ; ; }
while (0)
;
301 delete_entry(entry->rr);
302 free(entry);
303 }
304
305 if (iface->auth_type == AUTH_CRYPT)
306 auth_add_trailer(buf, iface);
307
308 send_packet(iface, ibuf_data(buf), ibuf_size(buf), &dst);
309 ibuf_free(buf);
310 }
311
312 return (0);
313}
314
315void
316recv_request(struct iface *i, struct nbr *nbr, u_int8_t *buf, u_int16_t len)
317{
318 struct rip_entry *e;
319 struct rip_route rr;
320 int l = len;
321
322 bzero(&rr, sizeof(rr));
323
324 if (len < RIP_ENTRY_LENsizeof(struct rip_entry)) {
325 log_debug("recv_request: bad packet size, interface %s",
326 i->name);
327 return;
328 }
329
330 /*
331 * XXX is it guaranteed that bus is properly aligned.
332 * If not this will bomb on strict alignment archs.
333 * */
334 e = (struct rip_entry *)buf;
335
336 if (len > RIP_ENTRY_LENsizeof(struct rip_entry) * MAX_RIP_ENTRIES25) {
337 log_debug("recv_request: packet too long\n");
338 return;
339 }
340
341 l -= RIP_ENTRY_LENsizeof(struct rip_entry);
342
343 /*
344 * If there is exactly one entry in the request, and it has
345 * an address family identifier of zero and a metric of
346 * infinity (i.e., 16), then this is a request to send the
347 * entire routing table.
348 */
349 if (e->AFI == 0 && e->metric == ntohl(INFINITY)(__uint32_t)(__builtin_constant_p(16) ? (__uint32_t)(((__uint32_t
)(16) & 0xff) << 24 | ((__uint32_t)(16) & 0xff00
) << 8 | ((__uint32_t)(16) & 0xff0000) >> 8 |
((__uint32_t)(16) & 0xff000000) >> 24) : __swap32md
(16))
&& l == 0) {
350 ripe_imsg_compose_rde(IMSG_FULL_RESPONSE, nbr->peerid,
351 0, NULL((void *)0), 0);
352 return;
353 }
354
355 for ( ; l >= 0; l -= RIP_ENTRY_LENsizeof(struct rip_entry)) {
356 if (e->AFI != AF_INET2) {
357 log_debug("recv_request: AFI %d not supported\n",
358 e->AFI);
359 return;
360 }
361 rr.address.s_addr = e->address;
362 rr.mask.s_addr = e->mask;
363 rr.nexthop.s_addr = e->nexthop;
364 rr.metric = e->metric;
365 rr.ifindex = i->ifindex;
366
367 ripe_imsg_compose_rde(IMSG_ROUTE_REQUEST, nbr->peerid,
368 0, &rr, sizeof(rr));
369
370 e++;
371 }
372
373 ripe_imsg_compose_rde(IMSG_ROUTE_REQUEST_END, nbr->peerid,
374 0, NULL((void *)0), 0);
375}
376
377void
378recv_response(struct iface *i, struct nbr *nbr, u_int8_t *buf, u_int16_t len)
379{
380 struct rip_route r;
381 struct rip_entry *e;
382 int l;
383
384 if (len < RIP_ENTRY_LENsizeof(struct rip_entry)) {
385 log_debug("recv_response: bad packet size, interface %s",
386 i->name);
387 return;
388 }
389
390 /* We must double check the length, because the only entry
391 * can be stripped off by authentication code
392 */
393 if (len < RIP_ENTRY_LENsizeof(struct rip_entry)) {
394 /* If there are no entries, our work is finished here */
395 return;
396 }
397
398 /* XXX again */
399 e = (struct rip_entry *)buf;
400
401 if (len > RIP_ENTRY_LENsizeof(struct rip_entry) * MAX_RIP_ENTRIES25) {
402 log_debug("recv_response: packet too long\n");
403 return;
404 }
405
406 l = len - sizeof(*e);
407
408 for ( ; l >= 0; l -= RIP_ENTRY_LENsizeof(struct rip_entry)) {
409 if (ntohs(e->AFI)(__uint16_t)(__builtin_constant_p(e->AFI) ? (__uint16_t)((
(__uint16_t)(e->AFI) & 0xffU) << 8 | ((__uint16_t
)(e->AFI) & 0xff00U) >> 8) : __swap16md(e->AFI
))
!= AF_INET2) {
410 log_debug("recv_response: AFI %d not supported\n",
411 e->AFI);
412 return;
413 }
414
415 r.address.s_addr = e->address;
416 r.mask.s_addr = e->mask;
417
418 if (e->nexthop == INADDR_ANY((u_int32_t)(0x00000000)) ||
419 ((i->addr.s_addr & i->mask.s_addr) !=
420 (e->nexthop & i->mask.s_addr)))
421 r.nexthop.s_addr = nbr->addr.s_addr;
422 else
423 r.nexthop.s_addr = e->nexthop;
424
425 r.metric = ntohl(e->metric)(__uint32_t)(__builtin_constant_p(e->metric) ? (__uint32_t
)(((__uint32_t)(e->metric) & 0xff) << 24 | ((__uint32_t
)(e->metric) & 0xff00) << 8 | ((__uint32_t)(e->
metric) & 0xff0000) >> 8 | ((__uint32_t)(e->metric
) & 0xff000000) >> 24) : __swap32md(e->metric))
;
426 r.ifindex = i->ifindex;
427
428 ripe_imsg_compose_rde(IMSG_ROUTE_FEED, 0, 0, &r, sizeof(r));
429
430 e++;
431 }
432}