/usr/src/usr.bin/cvs/cvs.c

Bug Summary

File:	src/usr.bin/cvs/cvs.c
Warning:	line 306, column 6 Access to field 'cr_dir' results in a dereference of a null pointer (loaded from variable 'current_cvsroot')

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name cvs.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.bin/cvs/obj -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/usr.bin/cvs -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.bin/cvs/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/usr.bin/cvs/cvs.c

1/*	$OpenBSD: cvs.c,v 1.160 2021/01/27 07:18:16 deraadt Exp $	*/
2/*
* Copyright (c) 2006, 2007 Joris Vink <joris@openbsd.org>
* Copyright (c) 2004 Jean-Francois Brousseau <jfb@openbsd.org>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. The name of the author may not be used to endorse or promote products
*    derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
* THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
* EXEMPLARY, OR CONSEQUENTIAL  DAMAGES (INCLUDING, BUT NOT LIMITED TO,
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
* OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

28#include <sys/stat.h>

30#include <ctype.h>
31#include <errno(*__errno()).h>
32#include <pwd.h>
33#include <stdlib.h>
34#include <string.h>
35#include <time.h>
36#include <unistd.h>
37#include <err.h>

39#include "cvs.h"
40#include "remote.h"
41#include "hash.h"

43extern char *__progname;

45/* verbosity level: 0 = really quiet, 1 = quiet, 2 = verbose */
46int verbosity = 2;

48/* compression level used with zlib, 0 meaning no compression taking place */
49int	cvs_compress = 0;
50int	cvs_readrc = 1;		/* read .cvsrc on startup */
51int	cvs_trace = 0;
52int	cvs_nolog = 0;
53int	cvs_readonly = 0;
54int	cvs_readonlyfs = 0;
55int	cvs_nocase = 0;	/* set to 1 to disable filename case sensitivity */
56int	cvs_noexec = 0;	/* set to 1 to disable disk operations (-n option) */
57int	cvs_cmdop;
58int	cvs_umask = CVS_UMASK_DEFAULT002;
59int	cvs_server_active = 0;

61char	*cvs_tagname = NULL((void *)0);
62char	*cvs_defargs;		/* default global arguments from .cvsrc */
63char	*cvs_rootstr;
64char	*cvs_rsh = CVS_RSH_DEFAULT"ssh";
65char	*cvs_editor = CVS_EDITOR_DEFAULT"vi";
66char	*cvs_homedir = NULL((void *)0);
67char	*cvs_tmpdir = CVS_TMPDIR_DEFAULT"/tmp";

69struct cvsroot *current_cvsroot = NULL((void *)0);
70struct cvs_cmd *cmdp;			/* struct of command we are running */

72int		cvs_getopt(int, char **);
73__dead__attribute__((__noreturn__)) void	usage(void);
74static void	cvs_read_rcfile(void);

76struct cvs_varhead cvs_variables;

78struct wklhead temp_files;

80void sighandler(int);
81volatile sig_atomic_t cvs_quit = 0;
82volatile sig_atomic_t sig_received = 0;

84extern CVSENTRIES *current_list;

86struct hash_table created_directories;
87struct hash_table created_cvs_directories;

89void
90sighandler(int sig)
91{
sig_received = sig;

switch (sig) {
case SIGINT2:
case SIGTERM15:
case SIGPIPE13:
cvs_quit = 1;
break;
default:
break;
}
103}

105void
106cvs_cleanup(void)
107{
cvs_log(LP_TRACE4, "cvs_cleanup: removing locks");
worklist_run(&repo_locks, worklist_unlink);

cvs_log(LP_TRACE4, "cvs_cleanup: removing temp files");
worklist_run(&temp_files, worklist_unlink);

if (cvs_server_path != NULL((void *)0)) {
if (cvs_rmdir(cvs_server_path) == -1)
	cvs_log(LP_ERR1,
	    "warning: failed to remove server directory: %s",
	    cvs_server_path);
free(cvs_server_path);
cvs_server_path = NULL((void *)0);
}

if (current_list != NULL((void *)0))
cvs_ent_close(current_list, ENT_SYNC1);
125}

127__dead__attribute__((__noreturn__)) void
128usage(void)
129{
(void)fprintf(stderr(&__sF[2]),
   "usage: %s [-flnQqRrtvw] [-d root] [-e editor] [-s var=val]\n"
   "           [-T tmpdir] [-z level] command ...\n", __progname);
exit(1);
134}

136int
137cvs_build_cmd(char ***cmd_argv, char **argv, int argc)
138{
int cmd_argc, i, cur;
char *cp, *linebuf, *lp;

if (cmdp->cmd_defargs == NULL((void *)0)) {
*cmd_argv = argv;
return argc;
}

cur = argc + 2;
cmd_argc = 0;
*cmd_argv = xcalloc(cur, sizeof(char *));
(*cmd_argv)[cmd_argc++] = argv[0];

linebuf = xstrdup(cmdp->cmd_defargs);
for (lp = linebuf; lp != NULL((void *)0);) {
cp = strsep(&lp, " \t\b\f\n\r\t\v");
if (cp == NULL((void *)0))
	break;
if (*cp == '\0')
	continue;

if (cmd_argc == cur) {
	cur += 8;
	*cmd_argv = xreallocarray(*cmd_argv, cur,
	    sizeof(char *));
}

(*cmd_argv)[cmd_argc++] = cp;
}

if (cmd_argc + argc > cur) {
cur = cmd_argc + argc + 1;
*cmd_argv = xreallocarray(*cmd_argv, cur,
    sizeof(char *));
      }

for (i = 1; i < argc; i++)
(*cmd_argv)[cmd_argc++] = argv[i];

(*cmd_argv)[cmd_argc] = NULL((void *)0);

return cmd_argc;
181}

183int
184main(int argc, char **argv)
185{
char *envstr, **cmd_argv, **targv;
int i, ret, cmd_argc;
struct passwd *pw;
struct stat st;
char fpath[PATH_MAX1024];

if (pledge("stdio rpath wpath cpath fattr getpw proc exec", NULL((void *)0)) == -1)
1
Assuming the condition is false→
2
←
Taking false branch→
err(1, "pledge");

tzset();

TAILQ_INIT(&cvs_variables)do { (&cvs_variables)->tqh_first = ((void *)0); (&
cvs_variables)->tqh_last = &(&cvs_variables)->tqh_first
; } while (0);
3
←
Loop condition is false.  Exiting loop→
SLIST_INIT(&repo_locks){ ((&repo_locks)->slh_first) = ((void *)0); };
SLIST_INIT(&temp_files){ ((&temp_files)->slh_first) = ((void *)0); };

hash_table_init(&created_directories, 100);
hash_table_init(&created_cvs_directories, 100);

/* check environment so command-line options override it */
if ((envstr = getenv("CVS_RSH")) != NULL((void *)0))
4
←
Assuming the environment variable does not exist→
cvs_rsh = envstr;

if (((envstr = getenv("CVSEDITOR")) != NULL((void *)0)) ||
5
←
Assuming the environment variable exists→
   ((envstr = getenv("VISUAL")) != NULL((void *)0)) ||
   ((envstr = getenv("EDITOR")) != NULL((void *)0)))
cvs_editor = envstr;

if ((envstr = getenv("CVSREAD")) != NULL((void *)0))
6
←
Assuming the environment variable does not exist→
7
←
Taking false branch→
cvs_readonly = 1;

if ((envstr = getenv("CVSREADONLYFS")) != NULL((void *)0)) {
8
←
Assuming the environment variable does not exist→
9
←
Taking false branch→
cvs_readonlyfs = 1;
cvs_nolog = 1;
}

if ((cvs_homedir = getenv("HOME")) == NULL((void *)0)) {
10
←
Assuming the environment variable exists→
11
←
Taking false branch→
if ((pw = getpwuid(getuid())) != NULL((void *)0))
	cvs_homedir = pw->pw_dir;
}

if ((envstr = getenv("TMPDIR")) != NULL((void *)0))
12
←
Assuming the environment variable does not exist→
13
←
Taking false branch→
cvs_tmpdir = envstr;

ret = cvs_getopt(argc, argv);

argc -= ret;
argv += ret;
if (argc == 0)
14
←
Assuming 'argc' is not equal to 0→
15
←
Taking false branch→
usage();

cmdp = cvs_findcmd(argv[0]);
if (cmdp == NULL((void *)0)) {
16
←
Assuming 'cmdp' is not equal to NULL→
17
←
Taking false branch→
fprintf(stderr(&__sF[2]), "Unknown command: `%s'\n\n", argv[0]);
fprintf(stderr(&__sF[2]), "CVS commands are:\n");
for (i = 0; cvs_cdt[i] != NULL((void *)0); i++)
	fprintf(stderr(&__sF[2]), "\t%-16s%s\n",
	    cvs_cdt[i]->cmd_name, cvs_cdt[i]->cmd_descr);
exit(1);
}

/*
* check the tmp dir, either specified through
* the environment variable TMPDIR, or via
* the global option -T <dir>
*/
if (stat(cvs_tmpdir, &st) == -1)
18
←
Assuming the condition is false→
19
←
Taking false branch→
fatal("stat failed on `%s': %s", cvs_tmpdir, strerror(errno(*__errno())));
else if (!S_ISDIR(st.st_mode)((st.st_mode & 0170000) == 0040000))
20
←
Assuming the condition is true→
fatal("`%s' is not valid temporary directory", cvs_tmpdir);

if (cvs_readrc20.1
'cvs_readrc' is equal to 1
 == 1 && cvs_homedir20.2
'cvs_homedir' is equal to NULL
 != NULL((void *)0)) {
21
←
Taking false branch→
cvs_read_rcfile();

if (cvs_defargs != NULL((void *)0)) {
	if ((targv = cvs_makeargv(cvs_defargs, &i)) == NULL((void *)0))
		fatal("failed to load default arguments to %s",
		    __progname);

	cvs_getopt(i, targv);
	cvs_freeargv(targv, i);
	free(targv);
}
}

/* setup signal handlers */
signal(SIGTERM15, sighandler);
signal(SIGINT2, sighandler);
signal(SIGHUP1, sighandler);
signal(SIGABRT6, sighandler);
signal(SIGALRM14, sighandler);
signal(SIGPIPE13, sighandler);

cvs_cmdop = cmdp->cmd_op;

cmd_argc = cvs_build_cmd(&cmd_argv, argv, argc);

cvs_file_init();

if (cvs_cmdop == CVS_OP_SERVER20) {
22
←
Assuming 'cvs_cmdop' is not equal to CVS_OP_SERVER→
23
←
Taking false branch→
cmdp->cmd(cmd_argc, cmd_argv);
cvs_cleanup();
return (0);
}

cvs_umask = umask(0);
umask(cvs_umask);

if ((current_cvsroot = cvsroot_get(".")) == NULL((void *)0)) {
24
←
Assuming the condition is false→
25
←
Taking false branch→
cvs_log(LP_ERR1,
    "No CVSROOT specified! Please use the '-d' option");
fatal("or set the CVSROOT environment variable.");
}

if (cvsroot_is_remote()) {
26
←
Null pointer value stored to 'current_cvsroot'→
27
←
Assuming the condition is false→
28
←
Taking false branch→
cmdp->cmd(cmd_argc, cmd_argv);
cvs_cleanup();
return (0);
}

(void)xsnprintf(fpath, sizeof(fpath), "%s/%s",
   current_cvsroot->cr_dir, CVS_PATH_ROOT"CVSROOT");
29
←
Access to field 'cr_dir' results in a dereference of a null pointer (loaded from variable 'current_cvsroot')

if (stat(fpath, &st) == -1 && cvs_cmdop != CVS_OP_INIT12) {
if (errno(*__errno()) == ENOENT2)
	fatal("repository '%s' does not exist",
	    current_cvsroot->cr_dir);
else
	fatal("%s: %s", current_cvsroot->cr_dir,
	    strerror(errno(*__errno())));
} else {
if (!S_ISDIR(st.st_mode)((st.st_mode & 0170000) == 0040000))
	fatal("'%s' is not a directory",
	    current_cvsroot->cr_dir);
}

if (cvs_cmdop != CVS_OP_INIT12) {
cvs_parse_configfile();
cvs_parse_modules();
}

cmdp->cmd(cmd_argc, cmd_argv);
cvs_cleanup();

return (0);
330}

332int
333cvs_getopt(int argc, char **argv)
334{
int ret;
char *ep;
const char *errstr;

while ((ret = getopt(argc, argv, "b:d:e:flnQqRrs:T:tvwxz:")) != -1) {
switch (ret) {
case 'b':
	/*
	 * We do not care about the bin directory for RCS files
	 * as this program has no dependencies on RCS programs,
	 * so it is only here for backwards compatibility.
	 */
	cvs_log(LP_NOTICE0, "the -b argument is obsolete");
	break;
case 'd':
	cvs_rootstr = optarg;
	break;
case 'e':
	cvs_editor = optarg;
	break;
case 'f':
	cvs_readrc = 0;
	break;
case 'l':
	cvs_nolog = 1;
	break;
case 'n':
	cvs_noexec = 1;
	cvs_nolog = 1;
	break;
case 'Q':
	verbosity = 0;
	break;
case 'q':
	if (verbosity > 1)
		verbosity = 1;
	break;
case 'R':
	cvs_readonlyfs = 1;
	cvs_nolog = 1;
	break;
case 'r':
	cvs_readonly = 1;
	break;
case 's':
	ep = strchr(optarg, '=');
	if (ep == NULL((void *)0)) {
		cvs_log(LP_ERR1, "no = in variable assignment");
		exit(1);
	}
	*(ep++) = '\0';
	if (cvs_var_set(optarg, ep) < 0)
		exit(1);
	break;
case 'T':
	cvs_tmpdir = optarg;
	break;
case 't':
	cvs_trace = 1;
	break;
case 'v':
	printf("%s\n", CVS_VERSION"OpenCVS 4.5");
	exit(0);
	/* NOTREACHED */
case 'w':
	cvs_readonly = 0;
	break;
case 'x':
	/*
	 * Kerberos encryption support, kept for compatibility
	 */
	break;
case 'z':
	cvs_compress = strtonum(optarg, 0, 9, &errstr);
	if (errstr != NULL((void *)0))
		fatal("cvs_compress: %s", errstr);
	break;
default:
	usage();
	/* NOTREACHED */
}
}

ret = optind;
optind = 1;
optreset = 1;	/* for next call */

return (ret);
423}

425/*
* cvs_read_rcfile()
*
* Read the CVS `.cvsrc' file in the user's home directory.  If the file
* exists, it should contain a list of arguments that should always be given
* implicitly to the specified commands.
*/
432static void
433cvs_read_rcfile(void)
434{
char rcpath[PATH_MAX1024], *buf, *lbuf, *lp, *p;
int cmd_parsed, cvs_parsed, i, linenum;
size_t len, pos;
struct cvs_cmd *tcmdp;
FILE *fp;

linenum = 0;

i = snprintf(rcpath, PATH_MAX1024, "%s/%s", cvs_homedir, CVS_PATH_RC".cvsrc");
if (i < 0 || i >= PATH_MAX1024) {
cvs_log(LP_ERRNO2, "%s", rcpath);
return;
}

fp = fopen(rcpath, "r");
if (fp == NULL((void *)0)) {
if (errno(*__errno()) != ENOENT2)
	cvs_log(LP_NOTICE0, "failed to open `%s': %s", rcpath,
	    strerror(errno(*__errno())));
return;
}

cmd_parsed = cvs_parsed = 0;
lbuf = NULL((void *)0);
while ((buf = fgetln(fp, &len)) != NULL((void *)0)) {
if (buf[len - 1] == '\n') {
	buf[len - 1] = '\0';
} else {
	lbuf = xmalloc(len + 1);
	memcpy(lbuf, buf, len);
	lbuf[len] = '\0';
	buf = lbuf;
}

linenum++;

/* skip any whitespaces */
p = buf;
while (*p == ' ')
	p++;

/*
 * Allow comments.
 * GNU cvs stops parsing a line if it encounters a \t
 * in front of a command, stick at this behaviour for
 * compatibility.
 */
if (*p == '#' || *p == '\t')
	continue;

pos = strcspn(p, " \t");
if (pos == strlen(p)) {
	lp = NULL((void *)0);
} else {
	lp = p + pos;
	*lp = '\0';
}

if (strcmp(p, "cvs") == 0 && !cvs_parsed) {
	/*
	 * Global default options.  In the case of cvs only,
	 * we keep the 'cvs' string as first argument because
	 * getopt() does not like starting at index 0 for
	 * argument processing.
	 */
	if (lp != NULL((void *)0)) {
		*lp = ' ';
		cvs_defargs = xstrdup(p);
	}
	cvs_parsed = 1;
} else {
	tcmdp = cvs_findcmd(p);
	if (tcmdp == NULL((void *)0) && verbosity == 2)
		cvs_log(LP_NOTICE0,
		    "unknown command `%s' in `%s:%d'",
		    p, rcpath, linenum);

	if (tcmdp != cmdp || cmd_parsed)
		continue;

	if (lp != NULL((void *)0)) {
		lp++;
		cmdp->cmd_defargs = xstrdup(lp);
	}
	cmd_parsed = 1;
}
}
free(lbuf);

if (ferror(fp)(!__isthreaded ? (((fp)->_flags & 0x0040) != 0) : (ferror
)(fp))) {
cvs_log(LP_NOTICE0, "failed to read line from `%s'", rcpath);
}

(void)fclose(fp);
529}

531/*
* cvs_var_set()
*
* Set the value of the variable <var> to <val>.  If there is no such variable,
* a new entry is created, otherwise the old value is overwritten.
* Returns 0 on success, or -1 on failure.
*/
538int
539cvs_var_set(const char *var, const char *val)
540{
const char *cp;
struct cvs_var *vp;

if (var == NULL((void *)0) || *var == '\0') {
cvs_log(LP_ERR1, "no variable name");
return (-1);
}

/* sanity check on the name */
for (cp = var; *cp != '\0'; cp++)
if (!isalnum((unsigned char)*cp) && (*cp != '_')) {
	cvs_log(LP_ERR1,
	    "variable name `%s' contains invalid characters",
	    var);
	return (-1);
}

TAILQ_FOREACH(vp, &cvs_variables, cv_link)for((vp) = ((&cvs_variables)->tqh_first); (vp) != ((void
 *)0); (vp) = ((vp)->cv_link.tqe_next))
if (strcmp(vp->cv_name, var) == 0)
	break;

if (vp == NULL((void *)0)) {
vp = xcalloc(1, sizeof(*vp));

vp->cv_name = xstrdup(var);
TAILQ_INSERT_TAIL(&cvs_variables, vp, cv_link)do { (vp)->cv_link.tqe_next = ((void *)0); (vp)->cv_link
.tqe_prev = (&cvs_variables)->tqh_last; *(&cvs_variables
)->tqh_last = (vp); (&cvs_variables)->tqh_last = &
(vp)->cv_link.tqe_next; } while (0);

} else	/* free the previous value */
free(vp->cv_val);

vp->cv_val = xstrdup(val);

return (0);
574}

576/*
* cvs_var_unset()
*
* Remove any entry for the variable <var>.
* Returns 0 on success, or -1 on failure.
*/
582int
583cvs_var_unset(const char *var)
584{
struct cvs_var *vp;

TAILQ_FOREACH(vp, &cvs_variables, cv_link)for((vp) = ((&cvs_variables)->tqh_first); (vp) != ((void
 *)0); (vp) = ((vp)->cv_link.tqe_next))
if (strcmp(vp->cv_name, var) == 0) {
	TAILQ_REMOVE(&cvs_variables, vp, cv_link)do { if (((vp)->cv_link.tqe_next) != ((void *)0)) (vp)->
cv_link.tqe_next->cv_link.tqe_prev = (vp)->cv_link.tqe_prev
; else (&cvs_variables)->tqh_last = (vp)->cv_link.tqe_prev
; *(vp)->cv_link.tqe_prev = (vp)->cv_link.tqe_next; ; ;
 } while (0);
	free(vp->cv_name);
	free(vp->cv_val);
	free(vp);
	return (0);
}

return (-1);
597}

599/*
* cvs_var_get()
*
* Get the value associated with the variable <var>.  Returns a pointer to the
* value string on success, or NULL if the variable does not exist.
*/

606const char *
607cvs_var_get(const char *var)
608{
struct cvs_var *vp;

TAILQ_FOREACH(vp, &cvs_variables, cv_link)for((vp) = ((&cvs_variables)->tqh_first); (vp) != ((void
 *)0); (vp) = ((vp)->cv_link.tqe_next))
if (strcmp(vp->cv_name, var) == 0)
	return (vp->cv_val);

return (NULL((void *)0));
616}