/usr/src/usr.bin/ftp/small.c

Bug Summary

File:	src/usr.bin/ftp/small.c
Warning:	line 296, column 2 Address of stack memory associated with local variable 'tmpbuf' is still referred to by the stack variable 'xargv' upon returning to the caller. This will be a dangling reference

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name small.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.bin/ftp/obj -resource-dir /usr/local/llvm16/lib/clang/16 -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.bin/ftp/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/usr.bin/ftp/small.c

1/*	$OpenBSD: small.c,v 1.13 2023/03/08 04:43:11 guenther Exp $	*/
2/*	$NetBSD: cmds.c,v 1.27 1997/08/18 10:20:15 lukem Exp $	*/

4/*
* Copyright (C) 1997 and 1998 WIDE Project.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of the project nor the names of its contributors
*    may be used to endorse or promote products derived from this software
*    without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

33/*
* Copyright (c) 1985, 1989, 1993, 1994
*	The Regents of the University of California.  All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of the University nor the names of its contributors
*    may be used to endorse or promote products derived from this software
*    without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

62/*
* FTP User Program -- Command Routines.
*/
65#include <sys/types.h>
66#include <sys/socket.h>
67#include <sys/stat.h>
68#include <sys/wait.h>
69#include <arpa/ftp.h>

71#include <ctype.h>
72#include <err.h>
73#include <fnmatch.h>
74#include <glob.h>
75#include <netdb.h>
76#include <stdio.h>
77#include <stdlib.h>
78#include <string.h>
79#include <unistd.h>
80#include <errno(*__errno()).h>

82#include "ftp_var.h"
83#include "pathnames.h"
84#include "small.h"

86jmp_buf	jabort;
87char   *mname;
88char   *home = "/";

90struct	types {
char	*t_name;
char	*t_mode;
int	t_type;
94} types[] = {
{ "ascii",	"A",	TYPE_A1 },
{ "binary",	"I",	TYPE_I3 },
{ "image",	"I",	TYPE_I3 },
{ NULL((void *)0) }
99};

101/*
* Set transfer type.
*/
104void
105settype(int argc, char *argv[])
106{
struct types *p;
int comret;

if (argc > 2) {
char *sep;

fprintf(ttyout, "usage: %s [", argv[0]);
sep = "";
for (p = types; p->t_name; p++) {
	fprintf(ttyout, "%s%s", sep, p->t_name);
	sep = " | ";
}
fputs("]\n", ttyout);
code = -1;
return;
}
if (argc < 2) {
fprintf(ttyout, "Using %s mode to transfer files.\n", typename);
code = 0;
return;
}
for (p = types; p->t_name; p++)
if (strcmp(argv[1], p->t_name) == 0)
	break;
if (p->t_name == 0) {
fprintf(ttyout, "%s: unknown mode.\n", argv[1]);
code = -1;
return;
}
comret = command("TYPE %s", p->t_mode);
if (comret == COMPLETE2) {
(void)strlcpy(typename, p->t_name, sizeof typename);
curtype = type = p->t_type;
}
141}

143/*
* Internal form of settype; changes current type in use with server
* without changing our notion of the type for data transfers.
* Used to change to and from ascii for listings.
*/
148void
149changetype(int newtype, int show)
150{
struct types *p;
int comret, oldverbose = verbose;

if (newtype == 0)
newtype = TYPE_I3;
if (newtype == curtype)
return;
if (
159#ifndef SMALL
   !debug &&
161#endif /* !SMALL */
   show == 0)
verbose = 0;
for (p = types; p->t_name; p++)
if (newtype == p->t_type)
	break;
if (p->t_name == 0) {
warnx("internal error: unknown type %d.", newtype);
return;
}
if (newtype == TYPE_L4 && bytename[0] != '\0')
comret = command("TYPE %s %s", p->t_mode, bytename);
else
comret = command("TYPE %s", p->t_mode);
if (comret == COMPLETE2)
curtype = newtype;
verbose = oldverbose;
178}

180char *stype[] = {
"type",
"",
0
184};

186/*
* Set binary transfer type.
*/
189void
190setbinary(int argc, char *argv[])
191{

stype[1] = "binary";
settype(2, stype);
195}

197void
198get(int argc, char *argv[])
199{

(void)getit(argc, argv, 0, restart_point ? "a+w" : "w" );
202}

204/*
* Receive one file.
*/
207int
208getit(int argc, char *argv[], int restartit, const char *mode)
209{
int loc = 0;
int rval = 0;
char *oldargv1, *oldargv2, *globargv2;

if (argc19.1
'argc' is equal to 2
 == 2) {
20
←
Taking true branch→
argc++;
argv[2] = argv[1];
loc++;
}
219#ifndef SMALL
if (argc20.1
'argc' is >= 2
 < 2 && !another(&argc, &argv, "remote-file"))
goto usage;
if ((argc20.2
'argc' is >= 3
 < 3 && !another(&argc, &argv, "local-file")) || argc20.3
'argc' is <= 3
 > 3) {
21
←
Taking false branch→
223usage:
fprintf(ttyout, "usage: %s remote-file [local-file]\n",
    argv[0]);
code = -1;
return (0);
}
229#endif /* !SMALL */
oldargv1 = argv[1];
oldargv2 = argv[2];
if (!globulize(&argv[2])) {
22
←
Assuming the condition is false→
23
←
Taking false branch→
code = -1;
return (0);
}
globargv2 = argv[2];
if (loc23.1
'loc' is 1
 && mcase) {
24
←
Assuming 'mcase' is not equal to 0→
25
←
Taking true branch→
char *tp = argv[1], *tp2, tmpbuf[PATH_MAX1024];

while (*tp && !islower((unsigned char)*tp)) {
26
←
Assuming the condition is false→
	tp++;
}
if (!*tp) {
27
←
Taking true branch→
	tp = argv[2];
	tp2 = tmpbuf;
	while ((*tp2 = *tp) != '\0') {
28
←
Assuming the condition is false→
29
←
Loop condition is false. Execution continues on line 253→
		if (isupper((unsigned char)*tp2)) {
			*tp2 = tolower((unsigned char)*tp2);
		}
		tp++;
		tp2++;
	}
	argv[2] = tmpbuf;
}
}
if (loc29.1
'loc' is 1
 && ntflag)
30
←
Assuming 'ntflag' is 0→
argv[2] = dotrans(argv[2]);
if (loc30.1
'loc' is 1
 && mapflag)
31
←
Assuming 'mapflag' is 0→
32
←
Taking false branch→
argv[2] = domap(argv[2]);
260#ifndef SMALL
if (restartit32.1
'restartit' is 0
) {
33
←
Taking false branch→
struct stat stbuf;
int ret;

ret = stat(argv[2], &stbuf);
if (restartit == 1) {
	restart_point = (ret < 0) ? 0 : stbuf.st_size;
} else {
	if (ret == 0) {
		time_t mtime;

		mtime = remotemodtime(argv[1], 0);
		if (mtime == -1)
			goto freegetit;
		if (stbuf.st_mtimest_mtim.tv_sec >= mtime) {
			rval = 1;
			fprintf(ttyout,
				"Local file \"%s\" is newer "\
				"than remote file \"%s\".\n",
				argv[2], argv[1]);
			goto freegetit;
		}
	}
}
}
286#endif /* !SMALL */

recvrequest("RETR", argv[2], argv[1], mode,
   argv[1] != oldargv1 || argv[2] != oldargv2 || !interactive, loc);
34
←
Assuming the condition is true→
restart_point = 0;
291#ifndef SMALL
292freegetit:
293#endif
if (oldargv2 != globargv2)	/* free up after globulize() */
35
←
Assuming 'oldargv2' is equal to 'globargv2'→
36
←
Taking false branch→
free(globargv2);
return (rval);
37
←
Address of stack memory associated with local variable 'tmpbuf' is still referred to by the stack variable 'xargv' upon returning to the caller.  This will be a dangling reference
297}

299/* XXX - Signal race. */
300void
301mabort(int signo)
302{
int save_errno = errno(*__errno());

alarmtimer(0);
(void) write(fileno(ttyout)(!__isthreaded ? ((ttyout)->_file) : (fileno)(ttyout)), "\n\r", 2);
307#ifndef SMALL
if (mflag && fromatty) {
/* XXX signal race, crazy unbelievable stdio misuse */
if (confirm(mname, NULL((void *)0))) {
	errno(*__errno()) = save_errno;
	longjmp(jabort, 1);
}
}
315#endif /* !SMALL */
mflag = 0;
errno(*__errno()) = save_errno;
longjmp(jabort, 1);
319}

321/*
* Get multiple files.
*/
324void
325mget(int argc, char *argv[])
326{
extern int optind, optreset;
sig_t oldintr;
int xargc = 2;
char *cp, localcwd[PATH_MAX1024], *xargv[] = { argv[0], NULL((void *)0), NULL((void *)0) };
static int restartit = 0;
332#ifndef SMALL
extern char *optarg;
const char *errstr;
int ch, i = 1;
char type = 0, *dummyargv[] = { argv[0], ".", NULL((void *)0) };
FILE *ftemp = NULL((void *)0);
static int depth = 0, max_depth = 0;

optind = optreset = 1;

if (depth0.1
'depth' is 0
)
1
Taking false branch→
depth++;

while ((ch = getopt(argc, argv, "cd:nr")) != -1) {
2
←
Assuming the condition is false→
switch(ch) {
case 'c':
	restartit = 1;
	break;
case 'd':
	max_depth = strtonum(optarg, 0, INT_MAX0x7fffffff, &errstr);
	if (errstr != NULL((void *)0)) {
		fprintf(ttyout, "bad depth value, %s: %s\n",
		    errstr, optarg);
		code = -1;
		return;
	}
	break;
case 'n':
	restartit = -1;
	break;
case 'r':
	depth = 1;
	break;
default:
	goto usage;
}
}

if (argc - optind < 1 && !another(&argc, &argv, "remote-files")) {
3
←
Assuming the condition is false→
371usage:
fprintf(ttyout, "usage: %s [-cnr] [-d depth] remote-files\n",
    argv[0]);
code = -1;
return;
}

argv[optind - 1] = argv[0];
argc -= optind - 1;
argv += optind - 1;
381#endif /* !SMALL */

mname = argv[0];
mflag = 1;
if (getcwd(localcwd, sizeof(localcwd)) == NULL((void *)0))
4
←
Assuming the condition is false→
5
←
Taking false branch→
err(1, "can't get cwd");

oldintr = signal(SIGINT2, mabort);
(void)setjmp(jabort);
while ((cp =
7
←
Assuming the condition is true→
391#ifdef SMALL
   remglob(argv, proxy, NULL((void *)0))) != NULL((void *)0)
   ) {
394#else /* SMALL */
   depth5.1
'depth' is 0
 ? remglob2(dummyargv, proxy, NULL((void *)0), &ftemp, &type) :
6
←
'?' condition is false→
   remglob(argv, proxy, NULL((void *)0))) != NULL((void *)0)
   || (mflag && depth && ++i < argc)
   ) {
if (cp7.1
'cp' is not equal to NULL
 == NULL((void *)0))
8
←
Taking false branch→
	continue;
401#endif /* SMALL */
if (*cp == '\0') {
9
←
Assuming the condition is false→
10
←
Taking false branch→
	mflag = 0;
	continue;
}
if (!mflag)
11
←
Assuming 'mflag' is not equal to 0→
	continue;
408#ifndef SMALL
if (depth11.1
'depth' is 0
 && fnmatch(argv[i], cp, FNM_PATHNAME0x02) != 0)
	continue;
411#endif /* !SMALL */
if (!fileindir(cp, localcwd)) {
12
←
Assuming the condition is false→
	fprintf(ttyout, "Skipping non-relative filename `%s'\n",
	    cp);
	continue;
}
417#ifndef SMALL
if (type == 'd' && depth == max_depth)
	continue;
if (!confirm(argv[0], cp))
13
←
Assuming the condition is false→
14
←
Taking false branch→
	continue;
if (type == 'd') {
15
←
Taking false branch→
	mkdir(cp, 0755);
	if (chdir(cp) != 0) {
		warn("local: %s", cp);
		continue;
	}

	xargv[1] = cp;
	cd(xargc, xargv);
	if (dirchange != 1)
		goto out;

	xargv[1] = "*";
	mget(xargc, xargv);

	xargv[1] = "..";
	cd(xargc, xargv);
	if (dirchange != 1) {
		mflag = 0;
		goto out;
	}

444out:
	if (chdir("..") != 0) {
		warn("local: %s", cp);
		mflag = 0;
	}
	continue;
}
if (type == 's')
16
←
Taking false branch→
	/* Currently ignored. */
	continue;
454#endif /* !SMALL */
xargv[1] = cp;
(void)getit(xargc, xargv, restartit,
19
←
Calling 'getit'→
    (restartit16.1
'restartit' is not equal to 1
 == 1 || restart_point) ? "a+w" : "w");
17
←
Assuming 'restart_point' is 0→
18
←
'?' condition is false→
458#ifndef SMALL
if (!mflag && fromatty) {
	if (confirm(argv[0], NULL((void *)0)))
		mflag = 1;
}
463#endif /* !SMALL */
}
(void)signal(SIGINT2, oldintr);
466#ifndef SMALL
if (depth)
depth--;
if (depth == 0 || mflag == 0)
depth = max_depth = mflag = restartit = 0;
471#else /* !SMALL */
mflag = 0;
473#endif /* !SMALL */
474}

476/*
* Set current working directory on remote machine.
*/
479void
480cd(int argc, char *argv[])
481{
int r;

484#ifndef SMALL
if ((argc < 2 && !another(&argc, &argv, "remote-directory")) ||
   argc > 2) {
fprintf(ttyout, "usage: %s remote-directory\n", argv[0]);
code = -1;
return;
}
491#endif /* !SMALL */
r = command("CWD %s", argv[1]);
if (r == ERROR5 && code == 500) {
if (verbose)
	fputs("CWD command not recognized, trying XCWD.\n", ttyout);
r = command("XCWD %s", argv[1]);
}
if (r == ERROR5 && code == 550) {
dirchange = 0;
return;
}
if (r == COMPLETE2)
dirchange = 1;
504}

506/*
* Terminate session, but don't exit.
*/
509void
510disconnect(int argc, char *argv[])
511{

if (!connected)
return;
(void)command("QUIT");
if (cout) {
(void)fclose(cout);
}
cout = NULL((void *)0);
connected = 0;
data = -1;
522#ifndef SMALL
if (!proxy) {
macnum = 0;
}
526#endif /* !SMALL */
527}

529char *
530dotrans(char *name)
531{
static char new[PATH_MAX1024];
char *cp1, *cp2 = new;
int i, ostop, found;

for (ostop = 0; *(ntout + ostop) && ostop < 16; ostop++)
continue;
for (cp1 = name; *cp1; cp1++) {
found = 0;
for (i = 0; *(ntin + i) && i < 16; i++) {
	if (*cp1 == *(ntin + i)) {
		found++;
		if (i < ostop) {
			*cp2++ = *(ntout + i);
		}
		break;
	}
}
if (!found) {
	*cp2++ = *cp1;
}
}
*cp2 = '\0';
return (new);
555}

557char *
558domap(char *name)
559{
static char new[PATH_MAX1024];
char *cp1 = name, *cp2 = mapin;
char *tp[9], *te[9];
int i, toks[9], toknum = 0, match = 1;

for (i=0; i < 9; ++i) {
toks[i] = 0;
}
while (match && *cp1 && *cp2) {
switch (*cp2) {
	case '\\':
		if (*++cp2 != *cp1) {
			match = 0;
		}
		break;
	case '$':
		if (*(cp2+1) >= '1' && (*cp2+1) <= '9') {
			if (*cp1 != *(++cp2+1)) {
				toks[toknum = *cp2 - '1']++;
				tp[toknum] = cp1;
				while (*++cp1 && *(cp2+1)
					!= *cp1);
				te[toknum] = cp1;
			}
			cp2++;
			break;
		}
		/* FALLTHROUGH */
	default:
		if (*cp2 != *cp1) {
			match = 0;
		}
		break;
}
if (match && *cp1) {
	cp1++;
}
if (match && *cp2) {
	cp2++;
}
}
if (!match && *cp1) /* last token mismatch */
{
toks[toknum] = 0;
}
cp1 = new;
*cp1 = '\0';
cp2 = mapout;
while (*cp2) {
match = 0;
switch (*cp2) {
	case '\\':
		if (*(cp2 + 1)) {
			*cp1++ = *++cp2;
		}
		break;
	case '[':
617LOOP:
		if (*++cp2 == '$' && isdigit((unsigned char)*(cp2 + 1))) {
			if (*++cp2 == '0') {
				char *cp3 = name;

				while (*cp3) {
					*cp1++ = *cp3++;
				}
				match = 1;
			} else if (toks[toknum = *cp2 - '1']) {
				char *cp3 = tp[toknum];

				while (cp3 != te[toknum]) {
					*cp1++ = *cp3++;
				}
				match = 1;
			}
		} else {
			while (*cp2 && *cp2 != ',' &&
			    *cp2 != ']') {
				if (*cp2 == '\\') {
					cp2++;
				} else if (*cp2 == '$' &&
				    isdigit((unsigned char)*(cp2 + 1))) {
					if (*++cp2 == '0') {
					   char *cp3 = name;

					   while (*cp3) {
						*cp1++ = *cp3++;
					   }
					} else if (toks[toknum =
					    *cp2 - '1']) {
						char *cp3=tp[toknum];

						while (cp3 !=
						    te[toknum]) {
							*cp1++ = *cp3++;
						}
					}
				} else if (*cp2) {
					*cp1++ = *cp2++;
				}
			}
			if (!*cp2) {
				fputs(
662"nmap: unbalanced brackets.\n", ttyout);
				return (name);
			}
			match = 1;
			cp2--;
		}
		if (match) {
			while (*++cp2 && *cp2 != ']') {
				if (*cp2 == '\\' && *(cp2 + 1)) {
					cp2++;
				}
			}
			if (!*cp2) {
				fputs(
676"nmap: unbalanced brackets.\n", ttyout);
				return (name);
			}
			break;
		}
		switch (*++cp2) {
			case ',':
				goto LOOP;
			case ']':
				break;
			default:
				cp2--;
				goto LOOP;
		}
		break;
	case '$':
		if (isdigit((unsigned char)*(cp2 + 1))) {
			if (*++cp2 == '0') {
				char *cp3 = name;

				while (*cp3) {
					*cp1++ = *cp3++;
				}
			} else if (toks[toknum = *cp2 - '1']) {
				char *cp3 = tp[toknum];

				while (cp3 != te[toknum]) {
					*cp1++ = *cp3++;
				}
			}
			break;
		}
		/* FALLTHROUGH */
	default:
		*cp1++ = *cp2;
		break;
}
cp2++;
}
*cp1 = '\0';
if (!*new) {
return (name);
}
return (new);
720}
