/usr/src/bin/csh/dol.c

Bug Summary

File:	src/bin/csh/dol.c
Warning:	line 521, column 18 Access to field 'vec' results in a dereference of a null pointer (loaded from variable 'vp')

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name dol.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/bin/csh/obj -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/bin/csh -I . -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/bin/csh/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/bin/csh/dol.c

1/*	$OpenBSD: dol.c,v 1.27 2023/03/08 04:43:04 guenther Exp $	*/
2/*	$NetBSD: dol.c,v 1.8 1995/09/27 00:38:38 jtc Exp $	*/

4/*-
* Copyright (c) 1980, 1991, 1993
*	The Regents of the University of California.  All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of the University nor the names of its contributors
*    may be used to endorse or promote products derived from this software
*    without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

33#include <sys/types.h>
34#include <fcntl.h>
35#include <errno(*__errno()).h>
36#include <stdlib.h>
37#include <string.h>
38#include <unistd.h>
39#include <stdarg.h>

41#include "csh.h"
42#include "extern.h"

44/*
* These routines perform variable substitution and quoting via ' and ".
* To this point these constructs have been preserved in the divided
* input words.  Here we expand variables and turn quoting via ' and " into
* QUOTE bits on characters (which prevent further interpretation).
* If the `:q' modifier was applied during history expansion, then
* some QUOTEing may have occurred already, so we dont "trim()" here.
*/

53static int Dpeekc, Dpeekrd;	/* Peeks for DgetC and Dreadc */
54static Char *Dcp, **Dvp;	/* Input vector for Dreadc */

56#define	DEOF-1	-1

58#define	unDgetC(c)Dpeekc = c	Dpeekc = c

60#define QUOTES(0x0001|0x0002|0x0040)		(_QF0x0001|_QB0x0002|_ESC0x0040)	/* \ ' " ` */

62/*
* The following variables give the information about the current
* $ expansion, recording the current word position, the remaining
* words within this expansion, the count of remaining words, and the
* information about any : modifier which is being applied.
*/
68#define MAXWLEN(1024 - 4) (BUFSIZ1024 - 4)
69#define MAXMOD(1024 - 4) MAXWLEN(1024 - 4)		/* This cannot overflow	*/
70static Char *dolp;		/* Remaining chars from this word */
71static Char **dolnxt;		/* Further words */
72static int dolcnt;		/* Count of further words */
73static Char dolmod[MAXMOD(1024 - 4)];	/* : modifier character */
74static int dolnmod;		/* Number of modifiers */
75static int dolmcnt;		/* :gx -> 10000, else 1 */
76static int dolwcnt;		/* :wx -> 10000, else 1 */

78static void	 Dfix2(Char **);
79static Char	*Dpack(Char *, Char *);
80static int	 Dword(void);
81static void	 dolerror(Char *);
82static int	 DgetC(int);
83static void	 Dgetdol(void);
84static void	 fixDolMod(void);
85static void	 setDolp(Char *);
86static void	 unDredc(int);
87static int	 Dredc(void);
88static void	 Dtestq(int);


91/*
* Fix up the $ expansions and quotations in the
* argument list to command t.
*/
95void
96Dfix(struct command *t)
97{
  Char **pp;
  Char *p;

  if (noexec)
return;
  /* Note that t_dcom isn't trimmed thus !...:q's aren't lost */
  for (pp = t->t_dcom; (p = *pp++) != NULL((void *)0);)
for (; *p; p++) {
   if (cmap(*p, _DOL | QUOTES)(((*p) & 0100000U) ? 0 : (_cmap[(unsigned char)(*p)] &
 (0x0080 | (0x0001|0x0002|0x0040))))) {	/* $, \, ', ", ` */
Dfix2(t->t_dcom);	/* found one */
blkfree(t->t_dcom);
t->t_dcom = gargv;
gargv = 0;
return;
   }
}
114}

116/*
* $ substitute one word, for i/o redirection
*/
119Char   *
120Dfix1(Char *cp)
121{
  Char   *Dv[2];

  if (noexec)
return (0);
  Dv[0] = cp;
  Dv[1] = NULL((void *)0);
  Dfix2(Dv);
  if (gargc != 1) {
setname(vis_str(cp))(bname = (vis_str(cp)));
stderror(ERR_NAME0x10000000 | ERR_AMBIG40);
  }
  cp = Strsave(gargv[0]);
  blkfree(gargv), gargv = 0;
  return (cp);
136}

138/*
* Subroutine to do actual fixing after state initialization.
*/
141static void
142Dfix2(Char **v)
143{
  ginit();			/* Initialize glob's area pointers */
  Dvp = v;
  Dcp = STRNULL;		/* Setup input vector for Dreadc */
  unDgetC(0)Dpeekc = 0;
  unDredc(0);			/* Clear out any old peeks (at error) */
  dolp = 0;
  dolcnt = 0;			/* Clear out residual $ expands (...) */
  while (Dword())
continue;
153}

155/*
* Pack up more characters in this word
*/
158static Char *
159Dpack(Char *wbuf, Char *wp)
160{
  int c;
  int i = MAXWLEN(1024 - 4) - (wp - wbuf);

  for (;;) {
c = DgetC(DODOL1);
if (c == '\\') {
   c = DgetC(0);
   if (c == DEOF-1) {
unDredc(c);
*wp = 0;
Gcat(STRNULL, wbuf);
return (NULL((void *)0));
   }
   if (c == '\n')
c = ' ';
   else
c |= QUOTE0100000U;
}
if (c == DEOF-1) {
   unDredc(c);
   *wp = 0;
   Gcat(STRNULL, wbuf);
   return (NULL((void *)0));
}
if (cmap(c, _SP | _NL | _QF | _QB)(((c) & 0100000U) ? 0 : (_cmap[(unsigned char)(c)] & (
0x0004 | 0x0008 | 0x0001 | 0x0002)))) {	/* sp \t\n'"` */
   unDgetC(c)Dpeekc = c;
   if (cmap(c, QUOTES)(((c) & 0100000U) ? 0 : (_cmap[(unsigned char)(c)] & (
(0x0001|0x0002|0x0040)))))
return (wp);
   *wp++ = 0;
   Gcat(STRNULL, wbuf);
   return (NULL((void *)0));
}
if (--i <= 0)
   stderror(ERR_WTOOLONG2);
*wp++ = c;
  }
197}

199/*
* Get a word.  This routine is analogous to the routine
* word() in sh.lex.c for the main lexical input.  One difference
* here is that we don't get a newline to terminate our expansion.
* Rather, DgetC will return a DEOF when we hit the end-of-input.
*/
205static int
206Dword(void)
207{
  int c, c1;
  Char    wbuf[BUFSIZ1024];
  Char *wp = wbuf;
  int i = MAXWLEN(1024 - 4);
  bool dolflg;
  bool    sofar = 0, done = 0;

  while (!done) {
done = 1;
c = DgetC(DODOL1);
switch (c) {

case DEOF-1:
   if (sofar == 0)
return (0);
   /* finish this word and catch the code above the next time */
   unDredc(c);
   /* fall into ... */

case '\n':
   *wp = 0;
   Gcat(STRNULL, wbuf);
   return (1);

case ' ':
case '\t':
   done = 0;
   break;

case '`':
   /* We preserve ` quotations which are done yet later */
   *wp++ = c, --i;
case '\'':
case '"':
   /*
    * Note that DgetC never returns a QUOTES character from an
    * expansion, so only true input quotes will get us here or out.
    */
   c1 = c;
   dolflg = c1 == '"' ? DODOL1 : 0;
   for (;;) {
c = DgetC(dolflg);
if (c == c1)
    break;
if (c == '\n' || c == DEOF-1)
    stderror(ERR_UNMATCHED52, c1);
if ((c & (QUOTE0100000U | TRIM0077777)) == ('\n' | QUOTE0100000U))
    --wp, ++i;
if (--i <= 0)
    stderror(ERR_WTOOLONG2);
switch (c1) {

case '"':
    /*
     * Leave any `s alone for later. Other chars are all
     * quoted, thus `...` can tell it was within "...".
     */
    *wp++ = c == '`' ? '`' : c | QUOTE0100000U;
    break;

case '\'':
    /* Prevent all further interpretation */
    *wp++ = c | QUOTE0100000U;
    break;

case '`':
    /* Leave all text alone for later */
    *wp++ = c;
    break;

default:
    break;
}
   }
   if (c1 == '`')
*wp++ = '`' /* i--; eliminated */;
   sofar = 1;
   if ((wp = Dpack(wbuf, wp)) == NULL((void *)0))
return (1);
   else {
i = MAXWLEN(1024 - 4) - (wp - wbuf);
done = 0;
   }
   break;

case '\\':
   c = DgetC(0);	/* No $ subst! */
   if (c == '\n' || c == DEOF-1) {
done = 0;
break;
   }
   c |= QUOTE0100000U;
   break;

default:
   break;
}
if (done) {
   unDgetC(c)Dpeekc = c;
   sofar = 1;
   if ((wp = Dpack(wbuf, wp)) == NULL((void *)0))
return (1);
   else {
i = MAXWLEN(1024 - 4) - (wp - wbuf);
done = 0;
   }
}
  }
  /* Really NOTREACHED */
  return (0);
318}


321/*
* Get a character, performing $ substitution unless flag is 0.
* Any QUOTES character which is returned from a $ expansion is
* QUOTEd so that it will not be recognized above.
*/
326static int
327DgetC(int flag)
328{
  int c;

331top:
  if ((c = Dpeekc) != '\0') {
Dpeekc = 0;
return (c);
  }
  if (lap) {
c = *lap++ & (QUOTE0100000U | TRIM0077777);
if (c == 0) {
   lap = 0;
   goto top;
}
342quotspec:
if (cmap(c, QUOTES)(((c) & 0100000U) ? 0 : (_cmap[(unsigned char)(c)] & (
(0x0001|0x0002|0x0040)))))
   return (c | QUOTE0100000U);
return (c);
  }
  if (dolp) {
if ((c = *dolp++ & (QUOTE0100000U | TRIM0077777)) != '\0')
   goto quotspec;
if (dolcnt > 0) {
   setDolp(*dolnxt++);
   --dolcnt;
   return (' ');
}
dolp = 0;
  }
  if (dolcnt > 0) {
setDolp(*dolnxt++);
--dolcnt;
goto top;
  }
  c = Dredc();
  if (c == '$' && flag) {
Dgetdol();
goto top;
  }
  return (c);
368}

370static Char *nulvec[] = {0};
371static struct varent nulargv = {nulvec, STRargv, { NULL((void *)0), NULL((void *)0), NULL((void *)0) }, 0};

373static void
374dolerror(Char *s)
375{
  setname(vis_str(s))(bname = (vis_str(s)));
  stderror(ERR_NAME0x10000000 | ERR_RANGE43);
378}

380/*
* Handle the multitudinous $ expansion forms.
* Ugh.
*/
384static void
385Dgetdol(void)
386{
  Char *np;
  struct varent *vp = NULL((void *)0);
1
'vp' initialized to a null pointer value→
  Char    name[4 * MAXVARLEN30 + 1];
  int     c, sc;
  int     subscr = 0, lwb = 1, upb = 0;
  bool    dimen = 0, bitset = 0;
  char    tnp;
  Char    wbuf[BUFSIZ1024];
  static Char *dolbang = NULL((void *)0);

  dolnmod = dolmcnt = dolwcnt = 0;
  c = sc = DgetC(0);
  if (c == '{')
2
←
Assuming the condition is false→
3
←
Taking false branch→
c = DgetC(0);		/* sc is { to take } later */
  if ((c & TRIM0077777) == '#')
4
←
Assuming the condition is false→
5
←
Taking false branch→
dimen++, c = DgetC(0);	/* $# takes dimension */
  else if (c == '?')
6
←
Assuming the condition is false→
7
←
Taking false branch→
bitset++, c = DgetC(0);	/* $? tests existence */
  switch (c) {
8
←
Control jumps to 'case 10:'  at line 448→

  case '!':
if (dimen || bitset)
   stderror(ERR_SYNTAX0);
if (backpid != 0) {
   free(dolbang);
   setDolp(dolbang = putn(backpid));
}
goto eatbrac;

  case '$':
if (dimen || bitset)
   stderror(ERR_SYNTAX0);
setDolp(doldol);
goto eatbrac;

  case '<' | QUOTE0100000U:
if (bitset)
   stderror(ERR_NOTALLOWED1, "$?<");
if (dimen)
   stderror(ERR_NOTALLOWED1, "$?#");
for (np = wbuf; read(OLDSTD, &tnp, 1) == 1; np++) {
   *np = (unsigned char) tnp;
   if (np >= &wbuf[BUFSIZ1024 - 1])
stderror(ERR_LTOOLONG3);
   if (tnp == '\n')
break;
}
*np = 0;
/*
* KLUDGE: dolmod is set here because it will cause setDolp to call
* domod and thus to copy wbuf. Otherwise setDolp would use it
* directly. If we saved it ourselves, no one would know when to free
* it. The actual function of the 'q' causes filename expansion not to
* be done on the interpolated value.
*/
dolmod[dolnmod++] = 'q';
dolmcnt = 10000;
setDolp(wbuf);
goto eatbrac;

  case DEOF-1:
  case '\n':
stderror(ERR_SYNTAX0);
/* NOTREACHED */
break;

  case '*':
(void) Strlcpy(name, STRargv, sizeof name/sizeof(Char));
vp = adrof(STRargv)adrof1(STRargv, &shvhed);
subscr = -1;		/* Prevent eating [...] */
break;

  default:
np = name;
if (Isdigit(c)(((c) & 0100000U) ? 0 : isdigit((unsigned char) (c)))) {
   if (dimen)
stderror(ERR_NOTALLOWED1, "$#<num>");
   subscr = 0;
   do {
subscr = subscr * 10 + c - '0';
c = DgetC(0);
   } while (Isdigit(c)(((c) & 0100000U) ? 0 : isdigit((unsigned char) (c))));
   unDredc(c);
   if (subscr < 0)
stderror(ERR_RANGE43);
   if (subscr == 0) {
if (bitset) {
    dolp = ffile ? STR1 : STR0;
    goto eatbrac;
}
if (ffile == 0)
    stderror(ERR_DOLZERO4);
fixDolMod();
setDolp(ffile);
goto eatbrac;
   }
   if (bitset)
stderror(ERR_DOLQUEST5);
   vp = adrof(STRargv)adrof1(STRargv, &shvhed);
   if (vp == 0) {
vp = &nulargv;
goto eatmod;
   }
   break;
}
if (!alnum(c)(((c) & 0100000U) ? 0 : (isalnum((unsigned char) (c)) || (
c) == '_')))
   stderror(ERR_VARALNUM32);
for (;;) {
   *np++ = c;
   c = DgetC(0);
   if (!alnum(c)(((c) & 0100000U) ? 0 : (isalnum((unsigned char) (c)) || (
c) == '_')))
break;
   if (np >= &name[MAXVARLEN30])
stderror(ERR_VARTOOLONG31);
}
*np++ = 0;
unDredc(c);
vp = adrof(name)adrof1(name, &shvhed);
  }
  if (bitset9.1
'bitset' is 0
) {
9
←
 Execution continues on line 506→
10
←
Taking false branch→
dolp = (vp || getenv(short2str(name))) ? STR1 : STR0;
goto eatbrac;
  }
  if (vp10.1
'vp' is equal to null
 == 0) {
11
←
Taking true branch→
np = str2short(getenv(short2str(name)));
12
←
Assuming the environment variable does not exist→
if (np) {
13
←
Assuming 'np' is null→
14
←
Taking false branch→
   fixDolMod();
   setDolp(np);
   goto eatbrac;
}
udvar(name);
/* NOTREACHED */
  }
  c = DgetC(0);
  upb = blklen(vp->vec);
15
←
Access to field 'vec' results in a dereference of a null pointer (loaded from variable 'vp')
  if (dimen == 0 && subscr == 0 && c == '[') {
np = name;
for (;;) {
   c = DgetC(DODOL1);	/* Allow $ expand within [ ] */
   if (c == ']')
break;
   if (c == '\n' || c == DEOF-1)
stderror(ERR_INCBR6);
   if (np >= &name[sizeof(name) / sizeof(Char) - 2])
stderror(ERR_VARTOOLONG31);
   *np++ = c;
}
*np = 0, np = name;
if (dolp || dolcnt)	/* $ exp must end before ] */
   stderror(ERR_EXPORD7);
if (!*np)
   stderror(ERR_SYNTAX0);
if (Isdigit(*np)(((*np) & 0100000U) ? 0 : isdigit((unsigned char) (*np)))) {
   int     i;

   for (i = 0; Isdigit(*np)(((*np) & 0100000U) ? 0 : isdigit((unsigned char) (*np))); i = i * 10 + *np++ - '0')
continue;
   if ((i < 0 || i > upb) && !any("-*", *np)) {
dolerror(vp->v_name);
return;
   }
   lwb = i;
   if (!*np)
upb = lwb, np = STRstar;
}
if (*np == '*')
   np++;
else if (*np != '-')
   stderror(ERR_MISSING51, '-');
else {
   int i = upb;

   np++;
   if (Isdigit(*np)(((*np) & 0100000U) ? 0 : isdigit((unsigned char) (*np)))) {
i = 0;
while (Isdigit(*np)(((*np) & 0100000U) ? 0 : isdigit((unsigned char) (*np))))
    i = i * 10 + *np++ - '0';
if (i < 0 || i > upb) {
    dolerror(vp->v_name);
    return;
}
   }
   if (i < lwb)
upb = lwb - 1;
   else
upb = i;
}
if (lwb == 0) {
   if (upb != 0) {
dolerror(vp->v_name);
return;
   }
   upb = -1;
}
if (*np)
   stderror(ERR_SYNTAX0);
  }
  else {
if (subscr > 0) {
   if (subscr > upb)
lwb = 1, upb = 0;
   else
lwb = upb = subscr;
}
unDredc(c);
  }
  if (dimen) {
Char   *cp = putn(upb - lwb + 1);

addla(cp);
free(cp);
  }
  else {
600eatmod:
fixDolMod();
dolnxt = &vp->vec[lwb - 1];
dolcnt = upb - lwb + 1;
  }
605eatbrac:
  if (sc == '{') {
c = Dredc();
if (c != '}')
   stderror(ERR_MISSING51, '}');
  }
611}

613static void
614fixDolMod(void)
615{
  int c;

  c = DgetC(0);
  if (c == ':') {
do {
   c = DgetC(0), dolmcnt = 1, dolwcnt = 1;
   if (c == 'g' || c == 'a') {
if (c == 'g')
    dolmcnt = 10000;
else
    dolwcnt = 10000;
c = DgetC(0);
   }
   if ((c == 'g' && dolmcnt != 10000) ||
(c == 'a' && dolwcnt != 10000)) {
if (c == 'g')
    dolmcnt = 10000;
else
    dolwcnt = 10000;
c = DgetC(0);
   }

   if (c == 's') {	/* [eichin:19910926.0755EST] */
int delimcnt = 2;
int delim = DgetC(0);
dolmod[dolnmod++] = c;
dolmod[dolnmod++] = delim;

if (!delim || letter(delim)(((delim) & 0100000U) ? 0 : (isalpha((unsigned char) (delim
)) || (delim) == '_'))
    || Isdigit(delim)(((delim) & 0100000U) ? 0 : isdigit((unsigned char) (delim
))) || any(" \t\n", delim)) {
    seterror(ERR_BADSUBST89);
    break;
}
while ((c = DgetC(0)) != (-1)) {
    dolmod[dolnmod++] = c;
    if(c == delim) delimcnt--;
    if(!delimcnt) break;
}
if(delimcnt) {
    seterror(ERR_BADSUBST89);
    break;
}
continue;
   }
   if (!any("htrqxes", c))
stderror(ERR_BADMOD8, c);
   dolmod[dolnmod++] = c;
   if (c == 'q')
dolmcnt = 10000;
}
while ((c = DgetC(0)) == ':');
unDredc(c);
  }
  else
unDredc(c);
671}

673static void
674setDolp(Char *cp)
675{
  Char *dp;
  int i;

  if (dolnmod == 0 || dolmcnt == 0) {
dolp = cp;
return;
  }
  dp = cp = Strsave(cp);
  for (i = 0; i < dolnmod; i++) {
/* handle s// [eichin:19910926.0510EST] */
if(dolmod[i] == 's') {
   int delim;
   Char *lhsub, *rhsub, *np;
   size_t lhlen = 0, rhlen = 0;
   int didmod = 0;

   delim = dolmod[++i];
   if (!delim || letter(delim)(((delim) & 0100000U) ? 0 : (isalpha((unsigned char) (delim
)) || (delim) == '_'))
|| Isdigit(delim)(((delim) & 0100000U) ? 0 : isdigit((unsigned char) (delim
))) || any(" \t\n", delim)) {
seterror(ERR_BADSUBST89);
break;
   }
   lhsub = &dolmod[++i];
   while(dolmod[i] != delim && dolmod[++i]) {
lhlen++;
   }
   dolmod[i] = 0;
   rhsub = &dolmod[++i];
   while(dolmod[i] != delim && dolmod[++i]) {
rhlen++;
   }
   dolmod[i] = 0;

   do {
dp = Strstr(cp, lhsub);
if (dp) {
    size_t len = Strlen(cp) + 1 - lhlen + rhlen;

    np = xreallocarray(NULL((void *)0), len, sizeof(Char));
    *dp = 0;
    (void) Strlcpy(np, cp, len);
    (void) Strlcat(np, rhsub, len);
    (void) Strlcat(np, dp + lhlen, len);

    free(cp);
    dp = cp = np;
    didmod = 1;
} else {
    /* should this do a seterror? */
    break;
}
   }
   while (dolwcnt == 10000);
   /*
    * restore dolmod for additional words
    */
   dolmod[i] = rhsub[-1] = delim;
   if (didmod)
dolmcnt--;
   else
break;
} else {
   int didmod = 0;

   do {
if ((dp = domod(cp, dolmod[i]))) {
    didmod = 1;
    if (Strcmp(cp, dp) == 0) {
	free(cp);
	cp = dp;
	break;
    }
    else {
	free(cp);
	cp = dp;
    }
}
else
    break;
   }
   while (dolwcnt == 10000);
   dp = cp;
   if (didmod)
dolmcnt--;
   else
break;
}
  }

  addla(cp);
  free(cp);

  dolp = STRNULL;
  if (seterr)
stderror(ERR_OLD0x40000000);
771}

773static void
774unDredc(int c)
775{

  Dpeekrd = c;
778}

780static int
781Dredc(void)
782{
  int c;

  if ((c = Dpeekrd) != '\0') {
Dpeekrd = 0;
return (c);
  }
  if (Dcp && (c = *Dcp++))
return (c & (QUOTE0100000U | TRIM0077777));
  if (*Dvp == 0) {
Dcp = 0;
return (DEOF-1);
  }
  Dcp = *Dvp++;
  return (' ');
797}

799static void
800Dtestq(int c)
801{

  if (cmap(c, QUOTES)(((c) & 0100000U) ? 0 : (_cmap[(unsigned char)(c)] & (
(0x0001|0x0002|0x0040)))))
gflag = 1;
805}

807/*
* Form a shell temporary file (in unit 0) from the words
* of the shell input up to EOF or a line the same as "term".
* Unit 0 should have been closed before this call.
*/
812void
813heredoc(Char *term)
814{
  int c;
  Char   *Dv[2];
  Char    obuf[BUFSIZ1024], lbuf[BUFSIZ1024], mbuf[BUFSIZ1024];
  int     ocnt, lcnt, mcnt;
  Char *lbp, *obp, *mbp;
  Char  **vp;
  bool    quoted;
  char   tmp[] = "/tmp/sh.XXXXXXXX";

  if (mkstemp(tmp) == -1)
stderror(ERR_SYSTEM55, tmp, strerror(errno(*__errno())));
  (void) unlink(tmp);		/* 0 0 inode! */
  Dv[0] = term;
  Dv[1] = NULL((void *)0);
  gflag = 0;
  trim(Dv);
  rscan(Dv, Dtestq);
  quoted = gflag;
  ocnt = BUFSIZ1024;
  obp = obuf;
  for (;;) {
/*
* Read up a line
*/
lbp = lbuf;
lcnt = BUFSIZ1024 - 4;
for (;;) {
   c = readc(1);	/* 1 -> Want EOF returns */
   if (c < 0 || c == '\n')
break;
   if ((c &= TRIM0077777) != '\0') {
*lbp++ = c;
if (--lcnt < 0) {
    setname("<<")(bname = ("<<"));
    stderror(ERR_NAME0x10000000 | ERR_OVERFLOW44);
}
   }
}
*lbp = 0;

/*
* Check for EOF or compare to terminator -- before expansion
*/
if (c < 0 || eq(lbuf, term)(Strcmp(lbuf, term) == 0)) {
   (void) write(STDIN_FILENO0, short2str(obuf), 
       (size_t) (BUFSIZ1024 - ocnt));
   (void) lseek(STDIN_FILENO0, (off_t) 0, SEEK_SET0);
   return;
}

/*
* If term was quoted or -n just pass it on
*/
if (quoted || noexec) {
   *lbp++ = '\n';
   *lbp = 0;
   for (lbp = lbuf; (c = *lbp++) != '\0';) {
*obp++ = c;
if (--ocnt == 0) {
    (void) write(STDIN_FILENO0, short2str(obuf), BUFSIZ1024);
    obp = obuf;
    ocnt = BUFSIZ1024;
}
   }
   continue;
}

/*
* Term wasn't quoted so variable and then command expand the input
* line
*/
Dcp = lbuf;
Dvp = Dv + 1;
mbp = mbuf;
mcnt = BUFSIZ1024 - 4;
for (;;) {
   c = DgetC(DODOL1);
   if (c == DEOF-1)
break;
   if ((c &= TRIM0077777) == 0)
continue;
   /* \ quotes \ $ ` here */
   if (c == '\\') {
c = DgetC(0);
if (!any("$\\`", c))
    unDgetC(c | QUOTE)Dpeekc = c | 0100000U, c = '\\';
else
    c |= QUOTE0100000U;
   }
   *mbp++ = c;
   if (--mcnt == 0) {
setname("<<")(bname = ("<<"));
stderror(ERR_NAME0x10000000 | ERR_OVERFLOW44);
   }
}
*mbp++ = 0;

/*
* If any ` in line do command substitution
*/
mbp = mbuf;
if (any(short2str(mbp), '`')) {
   /*
    * 1 arg to dobackp causes substitution to be literal. Words are
    * broken only at newlines so that all blanks and tabs are
    * preserved.  Blank lines (null words) are not discarded.
    */
   vp = dobackp(mbuf, 1);
}
else
   /* Setup trivial vector similar to return of dobackp */
   Dv[0] = mbp, Dv[1] = NULL((void *)0), vp = Dv;

/*
* Resurrect the words from the command substitution each separated by
* a newline.  Note that the last newline of a command substitution
* will have been discarded, but we put a newline after the last word
* because this represents the newline after the last input line!
*/
for (; *vp; vp++) {
   for (mbp = *vp; *mbp; mbp++) {
*obp++ = *mbp & TRIM0077777;
if (--ocnt == 0) {
    (void) write(STDIN_FILENO0, short2str(obuf), BUFSIZ1024);
    obp = obuf;
    ocnt = BUFSIZ1024;
}
   }
   *obp++ = '\n';
   if (--ocnt == 0) {
(void) write(STDIN_FILENO0, short2str(obuf), BUFSIZ1024);
obp = obuf;
ocnt = BUFSIZ1024;
   }
}
blkfree(pargv);
pargv = NULL((void *)0);
  }
953}