Bug Summary

File:src/lib/libc/stdio/fvwrite.c
Warning:line 57, column 7
Although the value stored to 'len' is used in the enclosing expression, the value is never actually read from 'len'

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name fvwrite.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/lib/libc/obj -resource-dir /usr/local/llvm16/lib/clang/16 -include namespace.h -I /usr/src/lib/libc/include -I /usr/src/lib/libc/hidden -D __LIBC__ -D APIWARN -D YP -I /usr/src/lib/libc/yp -I /usr/src/lib/libc -I /usr/src/lib/libc/gdtoa -I /usr/src/lib/libc/arch/amd64/gdtoa -D INFNAN_CHECK -D MULTIPLE_THREADS -D NO_FENV_H -D USE_LOCALE -I /usr/src/lib/libc -I /usr/src/lib/libc/citrus -D RESOLVSORT -D FLOATING_POINT -D PRINTF_WIDE_CHAR -D SCANF_WIDE_CHAR -D FUTEX -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/lib/libc/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/lib/libc/stdio/fvwrite.c
1/* $OpenBSD: fvwrite.c,v 1.21 2023/10/06 16:41:02 millert Exp $ */
2/*-
3 * Copyright (c) 1990, 1993
4 * The Regents of the University of California. All rights reserved.
5 *
6 * This code is derived from software contributed to Berkeley by
7 * Chris Torek.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the University nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#include <stdio.h>
35#include <stdlib.h>
36#include <string.h>
37#include <unistd.h>
38#include "local.h"
39#include "fvwrite.h"
40
41/*
42 * Write some memory regions. Return zero on success, EOF on error.
43 *
44 * This routine is large and unsightly, but most of the ugliness due
45 * to the three different kinds of output buffering is handled here.
46 */
47int
48__sfvwrite(FILE *fp, struct __suio *uio)
49{
50 size_t len;
51 char *p;
52 struct __siov *iov;
53 int w, s;
54 char *nl;
55 int nlknown, nldist;
56
57 if ((len = uio->uio_resid) == 0)
Although the value stored to 'len' is used in the enclosing expression, the value is never actually read from 'len'
58 return (0);
59 /* make sure we can write */
60 if (cantwrite(fp)((((fp)->_flags & 0x0008) == 0 || (fp)->_bf._base ==
((void *)0)) && __swsetup(fp))
)
61 return (EOF(-1));
62
63#define MIN(a, b)((a) < (b) ? (a) : (b)) ((a) < (b) ? (a) : (b))
64#define COPY(n)(void)memcpy(fp->_p, p, n) (void)memcpy(fp->_p, p, n)
65
66 iov = uio->uio_iov;
67 p = iov->iov_base;
68 len = iov->iov_len;
69 iov++;
70#define GETIOV(extra_work)while (len == 0) { extra_work; p = iov->iov_base; len = iov
->iov_len; iov++; }
\
71 while (len == 0) { \
72 extra_work; \
73 p = iov->iov_base; \
74 len = iov->iov_len; \
75 iov++; \
76 }
77 if (fp->_flags & __SNBF0x0002) {
78 /*
79 * Unbuffered: write up to BUFSIZ bytes at a time.
80 */
81 do {
82 GETIOV(;)while (len == 0) { ;; p = iov->iov_base; len = iov->iov_len
; iov++; }
;
83 w = (*fp->_write)(fp->_cookie, p, MIN(len, BUFSIZ)((len) < (1024) ? (len) : (1024)));
84 if (w <= 0)
85 goto err;
86 p += w;
87 len -= w;
88 } while ((uio->uio_resid -= w) != 0);
89 } else if ((fp->_flags & __SLBF0x0001) == 0) {
90 /*
91 * Fully buffered: fill partially full buffer, if any,
92 * and then flush. If there is no partial buffer, write
93 * one _bf._size byte chunk directly (without copying).
94 *
95 * String output is a special case: write as many bytes
96 * as fit, but pretend we wrote everything. This makes
97 * snprintf() return the number of bytes needed, rather
98 * than the number used, and avoids its write function
99 * (so that the write function can be invalid).
100 */
101 do {
102 GETIOV(;)while (len == 0) { ;; p = iov->iov_base; len = iov->iov_len
; iov++; }
;
103 if ((fp->_flags & (__SALC0x4000 | __SSTR0x0200)) ==
104 (__SALC0x4000 | __SSTR0x0200) && fp->_w < len) {
105 size_t blen = fp->_p - fp->_bf._base;
106 int pgmsk = getpagesize() - 1;
107 unsigned char *_base;
108 int _size;
109
110 /* Round up to nearest page. */
111 _size = ((blen + len + 1 + pgmsk) & ~pgmsk) - 1;
112 _base = recallocarray(fp->_bf._base,
113 fp->_bf._size + 1, _size + 1, 1);
114 if (_base == NULL((void *)0))
115 goto err;
116 fp->_w += _size - fp->_bf._size;
117 fp->_bf._base = _base;
118 fp->_bf._size = _size;
119 fp->_p = _base + blen;
120 }
121 w = fp->_w;
122 if (fp->_flags & __SSTR0x0200) {
123 if (len < w)
124 w = len;
125 COPY(w)(void)memcpy(fp->_p, p, w); /* copy MIN(fp->_w,len), */
126 fp->_w -= w;
127 fp->_p += w;
128 w = len; /* but pretend copied all */
129 } else if (fp->_p > fp->_bf._base && len > w) {
130 /* fill and flush */
131 COPY(w)(void)memcpy(fp->_p, p, w);
132 /* fp->_w -= w; */ /* unneeded */
133 fp->_p += w;
134 if (__sflush(fp))
135 goto err;
136 } else if (len >= (w = fp->_bf._size)) {
137 /* write directly */
138 w = (*fp->_write)(fp->_cookie, p, w);
139 if (w <= 0)
140 goto err;
141 } else {
142 /* fill and done */
143 w = len;
144 COPY(w)(void)memcpy(fp->_p, p, w);
145 fp->_w -= w;
146 fp->_p += w;
147 }
148 p += w;
149 len -= w;
150 } while ((uio->uio_resid -= w) != 0);
151 } else {
152 /*
153 * Line buffered: like fully buffered, but we
154 * must check for newlines. Compute the distance
155 * to the first newline (including the newline),
156 * or `infinity' if there is none, then pretend
157 * that the amount to write is MIN(len,nldist).
158 */
159 nlknown = 0;
160 nldist = 0; /* XXX just to keep gcc happy */
161 do {
162 GETIOV(nlknown = 0)while (len == 0) { nlknown = 0; p = iov->iov_base; len = iov
->iov_len; iov++; }
;
163 if (!nlknown) {
164 nl = memchr(p, '\n', len);
165 nldist = nl ? nl + 1 - p : len + 1;
166 nlknown = 1;
167 }
168 s = MIN(len, nldist)((len) < (nldist) ? (len) : (nldist));
169 w = fp->_w + fp->_bf._size;
170 if (fp->_p > fp->_bf._base && s > w) {
171 COPY(w)(void)memcpy(fp->_p, p, w);
172 /* fp->_w -= w; */
173 fp->_p += w;
174 if (__sflush(fp))
175 goto err;
176 } else if (s >= (w = fp->_bf._size)) {
177 w = (*fp->_write)(fp->_cookie, p, w);
178 if (w <= 0)
179 goto err;
180 } else {
181 w = s;
182 COPY(w)(void)memcpy(fp->_p, p, w);
183 fp->_w -= w;
184 fp->_p += w;
185 }
186 if ((nldist -= w) == 0) {
187 /* copied the newline: flush and forget */
188 if (__sflush(fp))
189 goto err;
190 nlknown = 0;
191 }
192 p += w;
193 len -= w;
194 } while ((uio->uio_resid -= w) != 0);
195 }
196 return (0);
197
198err:
199 fp->_flags |= __SERR0x0040;
200 return (EOF(-1));
201}