/usr/src/usr.bin/mail/quit.c

Bug Summary

File:	src/usr.bin/mail/quit.c
Warning:	line 261, column 7 Access to field '_r' results in a dereference of a null pointer (loaded from variable 'ibuf')

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name quit.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.bin/mail/obj -resource-dir /usr/local/llvm16/lib/clang/16 -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.bin/mail/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/usr.bin/mail/quit.c

1/*	$OpenBSD: quit.c,v 1.23 2016/07/19 06:43:27 deraadt Exp $	*/
2/*	$NetBSD: quit.c,v 1.6 1996/12/28 07:11:07 tls Exp $	*/

4/*
* Copyright (c) 1980, 1993
*	The Regents of the University of California.  All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of the University nor the names of its contributors
*    may be used to endorse or promote products derived from this software
*    without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

33#include "rcv.h"
34#include <fcntl.h>
35#include "extern.h"

37/*
* Rcv -- receive mail rationally.
*
* Termination processing.
*/

43/*
* The "quit" command.
*/
46int
47quitcmd(void *v)
48{
/*
* If we are sourcing, then return 1 so execute() can handle it.
* Otherwise, return -1 to abort command loop.
*/
if (sourcing)
return(1);
return(-1);
56}

58/*
* Save all of the undetermined messages at the top of "mbox"
* Save all untouched messages back in the system mailbox.
* Remove the system mailbox, if none saved there.
*/
63int
64quit(void)
65{
int mcount, p, modify, autohold, anystat, holdbit, nohold;
FILE *ibuf = NULL((void *)0), *obuf, *fbuf, *rbuf, *abuf;
1
'ibuf' initialized to a null pointer value→
struct message *mp;
int c, fd;
struct stat minfo;
char *mbox, tempname[PATHSIZE1024];

/*
* If we are read only, we can't do anything,
* so just return quickly.
*/
if (readonly)
2
←
Assuming 'readonly' is 0→
3
←
Taking false branch→
return(0);

/*
* If editing (not reading system mail box), then do the work
* in edstop()
*/
if (edit)
4
←
Assuming 'edit' is 0→
5
←
Taking false branch→
return(edstop());

/*
* See if there any messages to save in mbox.  If no, we
* can save copying mbox to /tmp and back.
*
* Check also to see if any files need to be preserved.
* Delete all untouched messages to keep them out of mbox.
* If all the messages are to be preserved, just exit with
* a message.
*/
fbuf = Fopen(mailname, "r+");
if (fbuf == NULL((void *)0))
6
←
Assuming 'fbuf' is not equal to NULL→
7
←
Taking false branch→
goto newmail;
if (flock(fileno(fbuf)(!__isthreaded ? ((fbuf)->_file) : (fileno)(fbuf)), LOCK_EX0x02) == -1) {
8
←
Assuming '__isthreaded' is 0→
9
←
'?' condition is true→
10
←
Assuming the condition is false→
11
←
Taking false branch→
warn("Unable to lock mailbox");
(void)Fclose(fbuf);
return(-1);
}
if (!spool_lock()) {
12
←
Assuming the condition is false→
13
←
Taking false branch→
(void)Fclose(fbuf);
return(-1);		/* lockspool printed the error for us */
}
rbuf = NULL((void *)0);
if (fstat(fileno(fbuf)(!__isthreaded ? ((fbuf)->_file) : (fileno)(fbuf)), &minfo) >= 0 && minfo.st_size > mailsize) {
14
←
Assuming '__isthreaded' is not equal to 0→
15
←
'?' condition is false→
16
←
Assuming the condition is false→
puts("New mail has arrived.");
(void)snprintf(tempname, sizeof(tempname),
    "%s/mail.RqXXXXXXXXXX", tmpdir);
if ((fd = mkstemp(tempname)) == -1 ||
    (rbuf = Fdopen(fd, "w")) == NULL((void *)0))
	goto newmail;
116#ifdef APPEND
fseek(fbuf, (long)mailsize, SEEK_SET0);
while ((c = getc(fbuf)(!__isthreaded ? (--(fbuf)->_r < 0 ? __srget(fbuf) : (int
)(*(fbuf)->_p++)) : (getc)(fbuf))) != EOF(-1))
	(void)putc(c, rbuf)(!__isthreaded ? __sputc(c, rbuf) : (putc)(c, rbuf));
120#else
p = minfo.st_size - mailsize;
while (p-- > 0) {
	c = getc(fbuf)(!__isthreaded ? (--(fbuf)->_r < 0 ? __srget(fbuf) : (int
)(*(fbuf)->_p++)) : (getc)(fbuf));
	if (c == EOF(-1))
		goto newmail;
	(void)putc(c, rbuf)(!__isthreaded ? __sputc(c, rbuf) : (putc)(c, rbuf));
}
128#endif
(void)Fclose(rbuf);
if ((rbuf = Fopen(tempname, "r")) == NULL((void *)0))
	goto newmail;
(void)rm(tempname);
}

/*
* Adjust the message flags in each message.
*/
anystat = 0;
autohold = value("hold") != NULL((void *)0);
17
←
Assuming the condition is false→
holdbit = autohold17.1
'autohold' is 0
 ? MPRESERVE(1<<4) : MBOX(1<<10);
18
←
'?' condition is false→
nohold = MBOX(1<<10)|MSAVED(1<<2)|MDELETED(1<<1)|MPRESERVE(1<<4);
if (value("keepsave") != NULL((void *)0))
19
←
Assuming the condition is false→
20
←
Taking false branch→
nohold &= ~MSAVED(1<<2);
for (mp = &message[0]; mp < &message[msgCount]; mp++) {
21
←
Loop condition is false. Execution continues on line 156→
if (mp->m_flag & MNEW(1<<7)) {
	mp->m_flag &= ~MNEW(1<<7);
	mp->m_flag |= MSTATUS(1<<9);
}
if (mp->m_flag & MSTATUS(1<<9))
	anystat++;
if ((mp->m_flag & MTOUCH(1<<3)) == 0)
	mp->m_flag |= MPRESERVE(1<<4);
if ((mp->m_flag & nohold) == 0)
	mp->m_flag |= holdbit;
}
modify = 0;
for (c = 0, p = 0, mp = &message[0]; mp < &message[msgCount]; mp++) {
22
←
Loop condition is true.  Entering loop body→
29
←
Assuming the condition is false→
if (mp->m_flag & MBOX(1<<10))
23
←
Assuming the condition is true→
24
←
Taking true branch→
	c++;
if (mp->m_flag & MPRESERVE(1<<4))
25
←
Assuming the condition is false→
26
←
Taking false branch→
	p++;
if (mp->m_flag & MODIFY(1<<6))
27
←
Assuming the condition is false→
28
←
Taking false branch→
	modify++;
}
if (p == msgCount && !modify && !anystat) {
30
←
Assuming 'p' is not equal to 'msgCount'→
printf("Held %d message%s in %s\n",
	p, p == 1 ? "" : "s", mailname);
(void)Fclose(fbuf);
spool_unlock();
return(0);
}
if (c30.1
'c' is not equal to 0
 == 0) {
31
←
Taking false branch→
if (p != 0) {
	writeback(rbuf);
	(void)Fclose(fbuf);
	spool_unlock();
	return(0);
}
goto cream;
}

/*
* Create another temporary file and copy user's mbox file
* darin.  If there is no mbox, copy nothing.
* If he has specified "append" don't copy his mailbox,
* just copy saveable entries at the end.
*/
mbox = expand("&");
mcount = c;
if (value("append") == NULL((void *)0)) {
32
←
Assuming the condition is false→
33
←
Taking false branch→
int fdx;

(void)snprintf(tempname, sizeof(tempname),
    "%s/mail.RmXXXXXXXXXX", tmpdir);
if ((fd = mkstemp(tempname)) == -1 ||
    (obuf = Fdopen(fd, "w")) == NULL((void *)0)) {
	warn("%s", tempname);
	(void)Fclose(fbuf);
	spool_unlock();
	return(-1);
}
if ((ibuf = Fopen(tempname, "r")) == NULL((void *)0)) {
	warn("%s", tempname);
	(void)rm(tempname);
	(void)Fclose(obuf);
	(void)Fclose(fbuf);
	spool_unlock();
	return(-1);
}
(void)rm(tempname);
if ((abuf = Fopen(mbox, "r")) != NULL((void *)0)) {
	while ((c = getc(abuf)(!__isthreaded ? (--(abuf)->_r < 0 ? __srget(abuf) : (int
)(*(abuf)->_p++)) : (getc)(abuf))) != EOF(-1))
		(void)putc(c, obuf)(!__isthreaded ? __sputc(c, obuf) : (putc)(c, obuf));
	(void)Fclose(abuf);
}
if (ferror(obuf)(!__isthreaded ? (((obuf)->_flags & 0x0040) != 0) : (ferror
)(obuf))) {
	warn("%s", tempname);
	(void)Fclose(ibuf);
	(void)Fclose(obuf);
	(void)Fclose(fbuf);
	spool_unlock();
	return(-1);
}
(void)Fclose(obuf);
if ((fdx = open(mbox, O_CREAT0x0200 | O_TRUNC0x0400 | O_WRONLY0x0001, 0600)) != -1)
	close(fdx);
if ((obuf = Fopen(mbox, "r+")) == NULL((void *)0)) {
	warn("%s", mbox);
	(void)Fclose(ibuf);
	(void)Fclose(fbuf);
	spool_unlock();
	return(-1);
}
} else {
if ((obuf = Fopen(mbox, "a")) == NULL((void *)0)) {
34
←
Assuming the condition is false→
35
←
Taking false branch→
	warn("%s", mbox);
	(void)Fclose(fbuf);
	spool_unlock();
	return(-1);
}
fchmod(fileno(obuf)(!__isthreaded ? ((obuf)->_file) : (fileno)(obuf)), 0600);
36
←
Assuming '__isthreaded' is 0→
37
←
'?' condition is true→
}
for (mp = &message[0]; mp < &message[msgCount]; mp++)
38
←
Loop condition is false. Execution continues on line 259→
if (mp->m_flag & MBOX(1<<10))
	if (sendmessage(mp, obuf, saveignore, NULL((void *)0)) < 0) {
		warn("%s", mbox);
		(void)Fclose(ibuf);
		(void)Fclose(obuf);
		(void)Fclose(fbuf);
		spool_unlock();
		return(-1);
	}

/*
* Copy the user's old mbox contents back
* to the end of the stuff we just saved.
* If we are appending, this is unnecessary.
*/
if (value("append") == NULL((void *)0)) {
39
←
Assuming the condition is true→
40
←
Taking true branch→
rewind(ibuf);
c = getc(ibuf)(!__isthreaded ? (--(ibuf)->_r < 0 ? __srget(ibuf) : (int
)(*(ibuf)->_p++)) : (getc)(ibuf));
41
←
Assuming '__isthreaded' is 0→
42
←
'?' condition is true→
43
←
Access to field '_r' results in a dereference of a null pointer (loaded from variable 'ibuf')
while (c != EOF(-1)) {
	(void)putc(c, obuf)(!__isthreaded ? __sputc(c, obuf) : (putc)(c, obuf));
	if (ferror(obuf)(!__isthreaded ? (((obuf)->_flags & 0x0040) != 0) : (ferror
)(obuf)))
		break;
	c = getc(ibuf)(!__isthreaded ? (--(ibuf)->_r < 0 ? __srget(ibuf) : (int
)(*(ibuf)->_p++)) : (getc)(ibuf));
}
(void)Fclose(ibuf);
fflush(obuf);
}
trunc(obuf)do { (void)fflush(obuf); (void)ftruncate((!__isthreaded ? ((obuf
)->_file) : (fileno)(obuf)), (off_t)ftell(obuf)); } while(
0);
if (ferror(obuf)(!__isthreaded ? (((obuf)->_flags & 0x0040) != 0) : (ferror
)(obuf))) {
warn("%s", mbox);
(void)Fclose(obuf);
(void)Fclose(fbuf);
spool_unlock();
return(-1);
}
(void)Fclose(obuf);
if (mcount == 1)
puts("Saved 1 message in mbox");
else
printf("Saved %d messages in mbox\n", mcount);

/*
* Now we are ready to copy back preserved files to
* the system mailbox, if any were requested.
*/
if (p != 0) {
writeback(rbuf);
(void)Fclose(fbuf);
spool_unlock();
return(0);
}

/*
* Finally, remove his /var/mail file.
* If new mail has arrived, copy it back.
*/
300cream:
if (rbuf != NULL((void *)0)) {
abuf = Fopen(mailname, "r+");
if (abuf == NULL((void *)0))
	goto newmail;
while ((c = getc(rbuf)(!__isthreaded ? (--(rbuf)->_r < 0 ? __srget(rbuf) : (int
)(*(rbuf)->_p++)) : (getc)(rbuf))) != EOF(-1))
	(void)putc(c, abuf)(!__isthreaded ? __sputc(c, abuf) : (putc)(c, abuf));
(void)Fclose(rbuf);
trunc(abuf)do { (void)fflush(abuf); (void)ftruncate((!__isthreaded ? ((abuf
)->_file) : (fileno)(abuf)), (off_t)ftell(abuf)); } while(
0);
(void)Fclose(abuf);
alter(mailname);
(void)Fclose(fbuf);
spool_unlock();
return(0);
}
demail();
(void)Fclose(fbuf);
spool_unlock();
return(0);

320newmail:
puts("Thou hast new mail.");
if (fbuf != NULL((void *)0)) {
(void)Fclose(fbuf);
spool_unlock();
}
return(0);
327}

329/*
* Preserve all the appropriate messages back in the system
* mailbox, and print a nice message indicated how many were
* saved.  On any error, just return -1.  Else return 0.
* Incorporate the any new mail that we found.
*/
335int
336writeback(FILE *res)
337{
struct message *mp;
int p, c;
FILE *obuf;

p = 0;
if ((obuf = Fopen(mailname, "r+")) == NULL((void *)0)) {
warn("%s", mailname);
return(-1);
}
347#ifndef APPEND
if (res != NULL((void *)0))
while ((c = getc(res)(!__isthreaded ? (--(res)->_r < 0 ? __srget(res) : (int
)(*(res)->_p++)) : (getc)(res))) != EOF(-1))
	(void)putc(c, obuf)(!__isthreaded ? __sputc(c, obuf) : (putc)(c, obuf));
351#endif
for (mp = &message[0]; mp < &message[msgCount]; mp++)
if ((mp->m_flag&MPRESERVE(1<<4))||(mp->m_flag&MTOUCH(1<<3))==0) {
	p++;
	if (sendmessage(mp, obuf, NULL((void *)0), NULL((void *)0)) < 0) {
		warn("%s", mailname);
		(void)Fclose(obuf);
		return(-1);
	}
}
361#ifdef APPEND
if (res != NULL((void *)0))
while ((c = getc(res)(!__isthreaded ? (--(res)->_r < 0 ? __srget(res) : (int
)(*(res)->_p++)) : (getc)(res))) != EOF(-1))
	(void)putc(c, obuf)(!__isthreaded ? __sputc(c, obuf) : (putc)(c, obuf));
365#endif
fflush(obuf);
trunc(obuf)do { (void)fflush(obuf); (void)ftruncate((!__isthreaded ? ((obuf
)->_file) : (fileno)(obuf)), (off_t)ftell(obuf)); } while(
0);
if (ferror(obuf)(!__isthreaded ? (((obuf)->_flags & 0x0040) != 0) : (ferror
)(obuf))) {
warn("%s", mailname);
(void)Fclose(obuf);
return(-1);
}
if (res != NULL((void *)0))
(void)Fclose(res);
(void)Fclose(obuf);
alter(mailname);
if (p == 1)
printf("Held 1 message in %s\n", mailname);
else
printf("Held %d messages in %s\n", p, mailname);
return(0);
382}

384/*
* Terminate an editing session by attempting to write out the user's
* file from the temporary.  Save any new stuff appended to the file.
*/
388int
389edstop(void)
390{
int gotcha, c;
struct message *mp;
FILE *obuf, *ibuf;
struct stat statb;
char tempname[PATHSIZE1024];

if (readonly)
return(0);
holdsigs();
for (mp = &message[0], gotcha = 0; mp < &message[msgCount]; mp++) {
if (mp->m_flag & MNEW(1<<7)) {
	mp->m_flag &= ~MNEW(1<<7);
	mp->m_flag |= MSTATUS(1<<9);
}
if (mp->m_flag & (MODIFY(1<<6)|MDELETED(1<<1)|MSTATUS(1<<9)))
	gotcha++;
}
if (!gotcha)
goto done;
ibuf = NULL((void *)0);
if (stat(mailname, &statb) >= 0 && statb.st_size > mailsize) {
int fd;

(void)snprintf(tempname, sizeof(tempname), "%s/mbox.XXXXXXXXXX",
    tmpdir);
if ((fd = mkstemp(tempname)) == -1 ||
    (obuf = Fdopen(fd, "w")) == NULL((void *)0)) {
	warn("%s", tempname);
	if (fd != -1)
		close(fd);
	relsesigs();
	return(-1);
}
if ((ibuf = Fopen(mailname, "r")) == NULL((void *)0)) {
	warn("%s", mailname);
	(void)Fclose(obuf);
	(void)rm(tempname);
	relsesigs();
	return(-1);
}
fseek(ibuf, (long)mailsize, SEEK_SET0);
while ((c = getc(ibuf)(!__isthreaded ? (--(ibuf)->_r < 0 ? __srget(ibuf) : (int
)(*(ibuf)->_p++)) : (getc)(ibuf))) != EOF(-1))
	(void)putc(c, obuf)(!__isthreaded ? __sputc(c, obuf) : (putc)(c, obuf));
(void)Fclose(ibuf);
(void)Fclose(obuf);
if ((ibuf = Fopen(tempname, "r")) == NULL((void *)0)) {
	warn("%s", tempname);
	(void)rm(tempname);
	relsesigs();
	return(-1);
}
(void)rm(tempname);
}
printf("\"%s\" ", mailname);
fflush(stdout(&__sF[1]));
if ((obuf = Fopen(mailname, "r+")) == NULL((void *)0)) {
warn("%s", mailname);
relsesigs();
return(-1);
}
trunc(obuf)do { (void)fflush(obuf); (void)ftruncate((!__isthreaded ? ((obuf
)->_file) : (fileno)(obuf)), (off_t)ftell(obuf)); } while(
0);
c = 0;
for (mp = &message[0]; mp < &message[msgCount]; mp++) {
if ((mp->m_flag & MDELETED(1<<1)) != 0)
	continue;
c++;
if (sendmessage(mp, obuf, NULL((void *)0), NULL((void *)0)) < 0) {
	warn("%s", mailname);
	relsesigs();
	return(-1);
}
}
gotcha = (c == 0 && ibuf == NULL((void *)0));
if (ibuf != NULL((void *)0)) {
while ((c = getc(ibuf)(!__isthreaded ? (--(ibuf)->_r < 0 ? __srget(ibuf) : (int
)(*(ibuf)->_p++)) : (getc)(ibuf))) != EOF(-1))
	(void)putc(c, obuf)(!__isthreaded ? __sputc(c, obuf) : (putc)(c, obuf));
(void)Fclose(ibuf);
}
fflush(obuf);
if (ferror(obuf)(!__isthreaded ? (((obuf)->_flags & 0x0040) != 0) : (ferror
)(obuf))) {
warn("%s", mailname);
relsesigs();
return(-1);
}
(void)Fclose(obuf);
if (gotcha) {
(void)rm(mailname);
puts("removed");
} else
puts("complete");
fflush(stdout(&__sF[1]));

483done:
relsesigs();
return(0);
486}