/usr/src/gnu/usr.bin/texinfo/info/search.c

Bug Summary

File:	src/gnu/usr.bin/texinfo/info/search.c
Warning:	line 422, column 7 Array access (from variable 'string') results in a null pointer dereference

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name search.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/gnu/usr.bin/texinfo/obj/info -resource-dir /usr/local/lib/clang/13.0.0 -D HAVE_CONFIG_H -D LOCALEDIR="/usr/share/locale" -D INFODIR="/usr/share/info" -D INFODIR2="/usr/share/info" -I . -I /usr/src/gnu/usr.bin/texinfo/info -I .. -I . -I /usr/src/gnu/usr.bin/texinfo/lib -I ../intl -I .. -I /usr/src/gnu/usr.bin/texinfo/info -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/gnu/usr.bin/texinfo/obj/info -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/gnu/usr.bin/texinfo/info/search.c

1/* search.c -- searching large bodies of text.
 $Id: search.c,v 1.1.1.5 2006/07/17 16:03:43 espie Exp $

 Copyright (C) 1993, 1997, 1998, 2002, 2004 Free Software Foundation, Inc.

 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2, or (at your option)
 any later version.

 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.

 You should have received a copy of the GNU General Public License
 along with this program; if not, write to the Free Software
 Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.

 Written by Brian Fox (bfox@ai.mit.edu). */

22#include "info.h"

24#include "search.h"
25#include "nodes.h"

27/* The search functions take two arguments:

   1) a string to search for, and

   2) a pointer to a SEARCH_BINDING which contains the buffer, start,
      and end of the search.

 They return a long, which is the offset from the start of the buffer
 at which the match was found.  An offset of -1 indicates failure. */

37/* A function which makes a binding with buffer and bounds. */
38SEARCH_BINDING *
39make_binding (char *buffer, long int start, long int end)
40{
SEARCH_BINDING *binding;

binding = (SEARCH_BINDING *)xmalloc (sizeof (SEARCH_BINDING));
binding->buffer = buffer;
binding->start = start;
binding->end = end;
binding->flags = 0;

return (binding);
50}

52/* Make a copy of BINDING without duplicating the data. */
53SEARCH_BINDING *
54copy_binding (SEARCH_BINDING *binding)
55{
SEARCH_BINDING *copy;

copy = make_binding (binding->buffer, binding->start, binding->end);
copy->flags = binding->flags;
return (copy);
61}

63
64/* **************************************************************** */
65/*                                                                  */
66/*                 The Actual Searching Functions                   */
67/*                                                                  */
68/* **************************************************************** */

70/* Search forwards or backwards for the text delimited by BINDING.
 The search is forwards if BINDING->start is greater than BINDING->end. */
72long
73search (char *string, SEARCH_BINDING *binding)
74{
long result;

/* If the search is backwards, then search backwards, otherwise forwards. */
if (binding->start > binding->end)
  result = search_backward (string, binding);
else
  result = search_forward (string, binding);

return (result);
84}

86/* Search forwards for STRING through the text delimited in BINDING. */
87long
88search_forward (char *string, SEARCH_BINDING *binding)
89{
register int c, i, len;
register char *buff, *end;
char *alternate = (char *)NULL((void *)0);

len = strlen (string);

/* We match characters in the search buffer against STRING and ALTERNATE.
   ALTERNATE is a case reversed version of STRING; this is cheaper than
   case folding each character before comparison.   Alternate is only
   used if the case folding bit is turned on in the passed BINDING. */

if (binding->flags & S_FoldCase0x01)
  {
    alternate = xstrdup (string);

    for (i = 0; i < len; i++)
      {
        if (islower (alternate[i]))
          alternate[i] = toupper (alternate[i]);
        else if (isupper (alternate[i]))
          alternate[i] = tolower (alternate[i]);
      }
  }

buff = binding->buffer + binding->start;
end = binding->buffer + binding->end + 1;

while (buff < (end - len))
  {
    for (i = 0; i < len; i++)
      {
        c = buff[i];

        if ((c != string[i]) && (!alternate || c != alternate[i]))
          break;
      }

    if (!string[i])
      {
        if (alternate)
          free (alternate);
        if (binding->flags & S_SkipDest0x02)
          buff += len;
        return ((long) (buff - binding->buffer));
      }

    buff++;
  }

if (alternate)
  free (alternate);

return ((long) -1);
143}

145/* Search for STRING backwards through the text delimited in BINDING. */
146long
147search_backward (char *input_string, SEARCH_BINDING *binding)
148{
register int c, i, len;
register char *buff, *end;
char *string;
char *alternate = (char *)NULL((void *)0);

len = strlen (input_string);

/* Reverse the characters in the search string. */
string = (char *)xmalloc (1 + len);
for (c = 0, i = len - 1; input_string[c]; c++, i--)
  string[i] = input_string[c];

string[c] = '\0';

/* We match characters in the search buffer against STRING and ALTERNATE.
   ALTERNATE is a case reversed version of STRING; this is cheaper than
   case folding each character before comparison.   ALTERNATE is only
   used if the case folding bit is turned on in the passed BINDING. */

if (binding->flags & S_FoldCase0x01)
  {
    alternate = xstrdup (string);

    for (i = 0; i < len; i++)
      {
        if (islower (alternate[i]))
          alternate[i] = toupper (alternate[i]);
        else if (isupper (alternate[i]))
          alternate[i] = tolower (alternate[i]);
      }
  }

buff = binding->buffer + binding->start - 1;
end = binding->buffer + binding->end;

while (buff > (end + len))
  {
    for (i = 0; i < len; i++)
      {
        c = *(buff - i);

        if (c != string[i] && (!alternate || c != alternate[i]))
          break;
      }

    if (!string[i])
      {
        free (string);
        if (alternate)
          free (alternate);

        if (binding->flags & S_SkipDest0x02)
          buff -= len;
        return ((long) (1 + (buff - binding->buffer)));
      }

    buff--;
  }

free (string);
if (alternate)
  free (alternate);

return ((long) -1);
213}

215/* Find STRING in LINE, returning the offset of the end of the string.
 Return an offset of -1 if STRING does not appear in LINE.  The search
 is bound by the end of the line (i.e., either NEWLINE or 0). */
218int
219string_in_line (char *string, char *line)
220{
register int end;
SEARCH_BINDING binding;

/* Find the end of the line. */
for (end = 0; line[end] && line[end] != '\n'; end++);

/* Search for STRING within these confines. */
binding.buffer = line;
binding.start = 0;
binding.end = end;
binding.flags = S_FoldCase0x01 | S_SkipDest0x02;

return (search_forward (string, &binding));
234}

236/* Return non-zero if STRING is the first text to appear at BINDING. */
237int
238looking_at (char *string, SEARCH_BINDING *binding)
239{
long search_end;

search_end = search (string, binding);

/* If the string was not found, SEARCH_END is -1.  If the string was found,
   but not right away, SEARCH_END is != binding->start.  Otherwise, the
   string was found at binding->start. */
return (search_end == binding->start);
248}
249
250/* **************************************************************** */
251/*                                                                  */
252/*                    Small String Searches                         */
253/*                                                                  */
254/* **************************************************************** */

256/* Function names that start with "skip" are passed a string, and return
 an offset from the start of that string.  Function names that start
 with "find" are passed a SEARCH_BINDING, and return an absolute position
 marker of the item being searched for.  "Find" functions return a value
 of -1 if the item being looked for couldn't be found. */

262/* Return the index of the first non-whitespace character in STRING. */
263int
264skip_whitespace (char *string)
265{
register int i;

for (i = 0; string && whitespace (string[i])((string[i] == ' ') || (string[i] == '\t')); i++);
return (i);
270}

272/* Return the index of the first non-whitespace or newline character in
 STRING. */
274int
275skip_whitespace_and_newlines (char *string)
276{
register int i;

for (i = 0; string && whitespace_or_newline (string[i])(((string[i] == ' ') || (string[i] == '\t')) || (string[i] ==
 '\n')); i++);
return (i);
281}

283/* Return the index of the first whitespace character in STRING. */
284int
285skip_non_whitespace (char *string)
286{
register int i;

for (i = 0; string && string[i] && !whitespace (string[i])((string[i] == ' ') || (string[i] == '\t')); i++);
return (i);
291}

293/* Return the index of the first non-node character in STRING.  Note that
 this function contains quite a bit of hair to ignore periods in some
 special cases.  This is because we here at GNU ship some info files which
 contain nodenames that contain periods.  No such nodename can start with
 a period, or continue with whitespace, newline, or ')' immediately following
 the period.  If second argument NEWLINES_OKAY is non-zero, newlines should
 be skipped while parsing out the nodename specification. */
300int
301skip_node_characters (char *string, int newlines_okay)
302{
register int c, i = 0;
int paren_seen = 0;
int paren = 0;

/* Handle special case.  This is when another function has parsed out the
   filename component of the node name, and we just want to parse out the
   nodename proper.  In that case, a period at the start of the nodename
   indicates an empty nodename. */
if (string && *string == '.')
  return (0);

if (string && *string == '(')
  {
    paren++;
    paren_seen++;
    i++;
  }

for (; string && (c = string[i]); i++)
  {
    if (paren)
      {
        if (c == '(')
          paren++;
        else if (c == ')')
          paren--;

        continue;
      }
    
    /* If the character following the close paren is a space or period,
       then this node name has no more characters associated with it. */
    if (c == '\t' ||
        c == ','  ||
        c == INFO_TAGSEP'\177' ||
        ((!newlines_okay) && (c == '\n')) ||
        ((paren_seen && string[i - 1] == ')') &&
         (c == ' ' || c == '.')) ||
        (c == '.' &&
         (
343#if 0
344/* This test causes a node name ending in a period, like `This.', not to
 be found.  The trailing . is stripped.  This occurs in the jargon
 file (`I see no X here.' is a node name).  */
         (!string[i + 1]) ||
348#endif
          (whitespace_or_newline (string[i + 1])(((string[i + 1] == ' ') || (string[i + 1] == '\t')) || (string
[i + 1] == '\n'))) ||
          (string[i + 1] == ')'))))
      break;
  }
return (i);
354}

356
357/* **************************************************************** */
358/*                                                                  */
359/*                   Searching FILE_BUFFER's                        */
360/*                                                                  */
361/* **************************************************************** */

363/* Return the absolute position of the first occurence of a node separator in
 BINDING-buffer.  The search starts at BINDING->start.  Return -1 if no node
 separator was found. */
366long
367find_node_separator (SEARCH_BINDING *binding)
368{
register long i;
char *body;

body = binding->buffer;

/* A node is started by [^L]^_[^L]\n.  That is to say, the C-l's are
   optional, but the DELETE and NEWLINE are not.  This separator holds
   true for all separated elements in an Info file, including the tags
   table (if present) and the indirect tags table (if present). */
for (i = binding->start; i < binding->end - 1; i++)
  if (((body[i] == INFO_FF'\014' && body[i + 1] == INFO_COOKIE'\037') &&
       (body[i + 2] == '\n' ||
        (body[i + 2] == INFO_FF'\014' && body[i + 3] == '\n'))) ||
      ((body[i] == INFO_COOKIE'\037') &&
       (body[i + 1] == '\n' ||
        (body[i + 1] == INFO_FF'\014' && body[i + 2] == '\n'))))
    return (i);
return (-1);
387}

389/* Return the length of the node separator characters that BODY is
 currently pointing at. */
391int
392skip_node_separator (char *body)
393{
register int i;

i = 0;

if (body[i] == INFO_FF'\014')
  i++;

if (body[i++] != INFO_COOKIE'\037')
  return (0);

if (body[i] == INFO_FF'\014')
  i++;

if (body[i++] != '\n')
  return (0);

return (i);
411}

413/* Return the number of characters from STRING to the start of
 the next line. */
415int
416skip_line (char *string)
417{
register int i;

for (i = 0; string && string[i] && string[i] != '\n'; i++);
1
Assuming 'string' is null→

if (string[i] == '\n')
2
←
Array access (from variable 'string') results in a null pointer dereference
  i++;

return (i);
426}

428/* Return the absolute position of the beginning of a tags table in this
 binding starting the search at binding->start. */
430long
431find_tags_table (SEARCH_BINDING *binding)
432{
SEARCH_BINDING tmp_search;
long position;

tmp_search.buffer = binding->buffer;
tmp_search.start = binding->start;
tmp_search.end = binding->end;
tmp_search.flags = S_FoldCase0x01;

while ((position = find_node_separator (&tmp_search)) != -1 )
  {
    tmp_search.start = position;
    tmp_search.start += skip_node_separator (tmp_search.buffer
        + tmp_search.start);

    if (looking_at (TAGS_TABLE_BEG_LABEL"Tag Table:\n", &tmp_search))
      return (position);
  }
return (-1);
451}

453/* Return the absolute position of the node named NODENAME in BINDING.
 This is a brute force search, and we wish to avoid it when possible.
 This function is called when a tag (indirect or otherwise) doesn't
 really point to the right node.  It returns the absolute position of
 the separator preceding the node. */
458long
459find_node_in_binding (char *nodename, SEARCH_BINDING *binding)
460{
long position;
int offset, namelen;
SEARCH_BINDING tmp_search;

namelen = strlen (nodename);

tmp_search.buffer = binding->buffer;
tmp_search.start = binding->start;
tmp_search.end = binding->end;
tmp_search.flags = 0;

while ((position = find_node_separator (&tmp_search)) != -1)
  {
    tmp_search.start = position;
    tmp_search.start += skip_node_separator
      (tmp_search.buffer + tmp_search.start);

    offset = string_in_line
      (INFO_NODE_LABEL"Node:", tmp_search.buffer + tmp_search.start);

    if (offset == -1)
      continue;

    tmp_search.start += offset;
    tmp_search.start += skip_whitespace (tmp_search.buffer + tmp_search.start);
    offset = skip_node_characters
      (tmp_search.buffer + tmp_search.start, DONT_SKIP_NEWLINES0);

    /* Notice that this is an exact match.  You cannot grovel through
       the buffer with this function looking for random nodes. */
     if ((offset == namelen) &&
         (tmp_search.buffer[tmp_search.start] == nodename[0]) &&
         (strncmp (tmp_search.buffer + tmp_search.start, nodename, offset) == 0))
       return (position);
  }
return (-1);
497}