/usr/src/bin/csh/exec.c

Bug Summary

File:	src/bin/csh/exec.c
Warning:	line 131, column 22 Array access (from variable 'pv') results in a null pointer dereference

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name exec.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/bin/csh/obj -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/bin/csh -I . -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/bin/csh/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/bin/csh/exec.c

1/*	$OpenBSD: exec.c,v 1.22 2023/03/08 04:43:04 guenther Exp $	*/
2/*	$NetBSD: exec.c,v 1.9 1996/09/30 20:03:54 christos Exp $	*/

4/*-
* Copyright (c) 1980, 1991, 1993
*	The Regents of the University of California.  All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of the University nor the names of its contributors
*    may be used to endorse or promote products derived from this software
*    without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

33#include <sys/types.h>
34#include <dirent.h>
35#include <fcntl.h>
36#include <sys/stat.h>
37#include <errno(*__errno()).h>
38#include <stdlib.h>
39#include <string.h>
40#include <unistd.h>
41#include <limits.h>
42#include <stdarg.h>

44#include "csh.h"
45#include "extern.h"

47/*
* System level search and execute of a command.  We look in each directory
* for the specified command name.  If the name contains a '/' then we
* execute only the full path name.  If there is no search path then we
* execute only full path names.
*/
53extern char **environ;

55/*
* As we search for the command we note the first non-trivial error
* message for presentation to the user.  This allows us often
* to show that a file has the wrong mode/no access when the file
* is not in the last component of the search path, so we must
* go on after first detecting the error.
*/
62static char *exerr;		/* Execution error message */
63static Char *expath;		/* Path for exerr */

65/*
* Xhash is an array of HSHSIZ bits (HSHSIZ / 8 chars), which are used
* to hash execs.  If it is allocated (havhash true), then to tell
* whether ``name'' is (possibly) present in the i'th component
* of the variable path, you look at the bit in xhash indexed by
* hash(hashname("name"), i).  This is setup automatically
* after .login is executed, and recomputed whenever ``path'' is
* changed.
* The two part hash function is designed to let texec() call the
* more expensive hashname() only once and the simple hash() several
* times (once for each path component checked).
* Byte size is assumed to be 8.
*/
78#define	HSHSIZ8192		8192	/* 1k bytes */
79#define HSHMASK(8192 - 1)		(HSHSIZ8192 - 1)
80#define HSHMUL243		243
81static char xhash[HSHSIZ8192 / 8];

83#define hash(a, b)(((a) * 243 + (b)) & (8192 - 1))	(((a) * HSHMUL243 + (b)) & HSHMASK(8192 - 1))
84#define bit(h, b)((h)[(b) >> 3] & 1 << ((b) & 7))	((h)[(b) >> 3] & 1 << ((b) & 7))	/* bit test */
85#define bis(h, b)((h)[(b) >> 3] |= 1 << ((b) & 7))	((h)[(b) >> 3] |= 1 << ((b) & 7))	/* bit set */
86static int hits, misses;

88/* Dummy search path for just absolute search when no path */
89static Char *justabs[] = {STRNULL, 0};

91static void	pexerr(void);
92static void	texec(Char *, Char **);
93static int	hashname(Char *);
94static int	tellmewhat(struct wordent *, Char *, int len);
95static int	executable(Char *, Char *, bool);
96static int	iscommand(Char *);


99void
100doexec(Char **v, struct command *t)
101{
  Char *dp, **pv, **av, *sav;
  struct varent *pathv;
  bool slash;
  int hashval = 0, hashval1, i;
  Char   *blk[2];
  sigset_t sigset;

  /*
   * Glob the command name. We will search $path even if this does something,
   * as in sh but not in csh.  One special case: if there is no PATH, then we
   * execute only commands which start with '/'.
   */
  blk[0] = t->t_dcom[0];
  blk[1] = 0;
  gflag = 0, tglob(blk);
  if (gflag) {
5
←
Assuming 'gflag' is not equal to 0→
6
←
Taking true branch→
pv = globall(blk);
7
←
Value assigned to 'pv'→
if (pv == 0) {
8
←
Assuming 'pv' is equal to null→
9
←
Taking true branch→
   setname(vis_str(blk[0]))(bname = (vis_str(blk[0])));
   stderror(ERR_NAME0x10000000 | ERR_NOMATCH50);
}
gargv = 0;
  }
  else
pv = saveblk(blk);

  trim(pv);

  exerr = 0;
  expath = Strsave(pv[0]);
10
←
Array access (from variable 'pv') results in a null pointer dereference
  Vexpath = expath;

  pathv = adrof(STRpath)adrof1(STRpath, &shvhed);
  if (pathv == 0 && expath[0] != '/') {
blkfree(pv);
pexerr();
  }
  slash = any(short2str(expath), '/');

  /*
   * Glob the argument list, if necessary. Otherwise trim off the quote bits.
   */
  gflag = 0;
  av = &t->t_dcom[1];
  tglob(av);
  if (gflag) {
av = globall(av);
if (av == 0) {
   blkfree(pv);
   setname(vis_str(expath))(bname = (vis_str(expath)));
   stderror(ERR_NAME0x10000000 | ERR_NOMATCH50);
}
gargv = 0;
  }
  else
av = saveblk(av);

  blkfree(t->t_dcom);
  t->t_dcom = blkspl(pv, av);
  free(pv);
  free(av);
  av = t->t_dcom;
  trim(av);

  if (*av == NULL((void *)0) || **av == '\0')
pexerr();

  xechoit(av);		/* Echo command if -x */
  /*
   * Since all internal file descriptors are set to close on exec, we don't
   * need to close them explicitly here.  Just reorient ourselves for error
   * messages.
   */
  SHIN = 0;
  SHOUT = 1;
  SHERR = 2;
  OLDSTD = 0;
  /*
   * We must do this AFTER any possible forking (like `foo` in glob) so that
   * this shell can still do subprocesses.
   */
  sigemptyset(&sigset);
  sigprocmask(SIG_SETMASK3, &sigset, NULL((void *)0));
  /*
   * If no path, no words in path, or a / in the filename then restrict the
   * command search.
   */
  if (pathv == 0 || pathv->vec[0] == 0 || slash)
pv = justabs;
  else
pv = pathv->vec;
  sav = Strspl(STRslash, *av);/* / command name for postpending */
  Vsav = sav;
  if (havhash)
hashval = hashname(*av);
  i = 0;
  hits++;
  do {
/*
* Try to save time by looking at the hash table for where this command
* could be.  If we are doing delayed hashing, then we put the names in
* one at a time, as the user enters them.  This is kinda like Korn
* Shell's "tracked aliases".
*/
if (!slash && pv[0][0] == '/' && havhash) {
   hashval1 = hash(hashval, i)(((hashval) * 243 + (i)) & (8192 - 1));
   if (!bit(xhash, hashval1)((xhash)[(hashval1) >> 3] & 1 << ((hashval1) &
 7)))
goto cont;
}
if (pv[0][0] == 0 || eq(pv[0], STRdot)(Strcmp(pv[0], STRdot) == 0))	/* don't make ./xxx */
   texec(*av, av);
else {
   dp = Strspl(*pv, sav);
   Vdp = dp;
   texec(dp, av);
   Vdp = 0;
   free(dp);
}
misses++;
221cont:
pv++;
i++;
  } while (*pv);
  hits--;
  Vsav = 0;
  free(sav);
  pexerr();
229}

231static void
232pexerr(void)
233{
  /* Couldn't find the damn thing */
  if (expath) {
setname(vis_str(expath))(bname = (vis_str(expath)));
Vexpath = 0;
free(expath);
expath = 0;
  }
  else
setname("")(bname = (""));
  if (exerr)
stderror(ERR_NAME0x10000000 | ERR_STRING56, exerr);
  stderror(ERR_NAME0x10000000 | ERR_COMMAND14);
246}

248/*
* Execute command f, arg list t.
* Record error message if not found.
* Also do shell scripts here.
*/
253static void
254texec(Char *sf, Char **st)
255{
  char **t;
  char *f;
  struct varent *v;
  Char **vp;
  Char   *lastsh[2];
  int     fd;
  unsigned char c;
  Char   *st0, **ost;

  /* The order for the conversions is significant */
  t = short2blk(st);
  f = short2str(sf);
  Vt = t;
  errno(*__errno()) = 0;			/* don't use a previous error */
  (void) execve(f, t, environ);
  Vt = 0;
  blkfree((Char **) t);
  switch (errno(*__errno())) {

  case ENOEXEC8:
/*
* From: casper@fwi.uva.nl (Casper H.S. Dik) If we could not execute
* it, don't feed it to the shell if it looks like a binary!
*/
if ((fd = open(f, O_RDONLY0x0000)) != -1) {
   if (read(fd, (char *) &c, 1) == 1) {
if (!Isprint(c)(((c) & 0100000U) ? 0 : isprint((unsigned char) (c))) && (c != '\n' && c != '\t')) {
    (void) close(fd);
    /*
     * We *know* what ENOEXEC means.
     */
    stderror(ERR_ARCH107, f, strerror(errno(*__errno())));
}
   }
   else
c = '#';
   (void) close(fd);
}
/*
* If there is an alias for shell, then put the words of the alias in
* front of the argument list replacing the command name. Note no
* interpretation of the words at this point.
*/
v = adrof1(STRshell, &aliases);
if (v == 0) {
   vp = lastsh;
   vp[0] = adrof(STRshell)adrof1(STRshell, &shvhed) ? value(STRshell)value1(STRshell, &shvhed) : STR_SHELLPATH;
   vp[1] = NULL((void *)0);
   if (fd != -1 && c != '#')
vp[0] = STR_BSHELL;
}
else
   vp = v->vec;
st0 = st[0];
st[0] = sf;
ost = st;
st = blkspl(vp, st);	/* Splice up the new arglst */
ost[0] = st0;
sf = *st;
/* The order for the conversions is significant */
t = short2blk(st);
f = short2str(sf);
free(st);
Vt = t;
(void) execve(f, t, environ);
Vt = 0;
blkfree((Char **) t);
/* The sky is falling, the sky is falling! */

  case ENOMEM12:
stderror(ERR_SYSTEM55, f, strerror(errno(*__errno())));

  case ENOENT2:
break;

  default:
if (exerr == 0) {
   exerr = strerror(errno(*__errno()));
   if (expath)
free(expath);
   expath = Strsave(sf);
   Vexpath = expath;
}
  }
340}

342void
343execash(Char **t, struct command *kp)
344{
  int     saveIN, saveOUT, saveDIAG, saveSTD;
  int     oSHIN;
  int     oSHOUT;
  int     oSHERR;
  int     oOLDSTD;
  jmp_buf osetexit;
  int	    my_reenter;
  int     odidfds;
  sig_t   osigint, osigquit, osigterm;

  if (chkstop == 0 && setintr)
1
Assuming 'chkstop' is not equal to 0→
panystop(0);
  /*
   * Hmm, we don't really want to do that now because we might
   * fail, but what is the choice
   */
  rechist();

  osigint  = signal(SIGINT2, parintr);
  osigquit = signal(SIGQUIT3, parintr);
  osigterm = signal(SIGTERM15, parterm);

  odidfds = didfds;
  oSHIN = SHIN;
  oSHOUT = SHOUT;
  oSHERR = SHERR;
  oOLDSTD = OLDSTD;

  saveIN = dcopy(SHIN, -1);
  saveOUT = dcopy(SHOUT, -1);
  saveDIAG = dcopy(SHERR, -1);
  saveSTD = dcopy(OLDSTD, -1);

  lshift(kp->t_dcom, 1);

  getexit(osetexit)memcpy((osetexit), reslab, sizeof reslab);

  if ((my_reenter = setexit()(setjmp(reslab))) == 0) {
2
←
Assuming the condition is true→
3
←
Taking true branch→
SHIN = dcopy(0, -1);
SHOUT = dcopy(1, -1);
SHERR = dcopy(2, -1);
didfds = 0;
doexec(t, kp);
4
←
Calling 'doexec'→
  }

  (void) signal(SIGINT2, osigint);
  (void) signal(SIGQUIT3, osigquit);
  (void) signal(SIGTERM15, osigterm);

  doneinp = 0;
  didfds = odidfds;
  (void) close(SHIN);
  (void) close(SHOUT);
  (void) close(SHERR);
  (void) close(OLDSTD);
  SHIN = dmove(saveIN, oSHIN);
  SHOUT = dmove(saveOUT, oSHOUT);
  SHERR = dmove(saveDIAG, oSHERR);
  OLDSTD = dmove(saveSTD, oOLDSTD);

  resexit(osetexit)memcpy(reslab, (osetexit), sizeof reslab);
  if (my_reenter)
stderror(ERR_SILENT0x20000000);
408}

410void
411xechoit(Char **t)
412{
  if (adrof(STRecho)adrof1(STRecho, &shvhed)) {
(void) fflush(csherr);
blkpr(csherr, t);
(void) fputc('\n', csherr);
  }
418}

420void
421dohash(Char **v, struct command *t)
422{
  DIR    *dirp;
  struct dirent *dp;
  int cnt;
  int     i = 0;
  struct varent *pathv = adrof(STRpath)adrof1(STRpath, &shvhed);
  Char  **pv;
  int     hashval;

  havhash = 1;
  for (cnt = 0; cnt < sizeof xhash; cnt++)
xhash[cnt] = 0;
  if (pathv == 0)
return;
  for (pv = pathv->vec; *pv; pv++, i++) {
if (pv[0][0] != '/')
   continue;
dirp = opendir(short2str(*pv));
if (dirp == NULL((void *)0))
   continue;
while ((dp = readdir(dirp)) != NULL((void *)0)) {
   if (dp->d_inod_fileno == 0)
continue;
   if (dp->d_name[0] == '.' &&
(dp->d_name[1] == '\0' ||
 (dp->d_name[1] == '.' && dp->d_name[2] == '\0')))
continue;
   hashval = hash(hashname(str2short(dp->d_name)), i)(((hashname(str2short(dp->d_name))) * 243 + (i)) & (8192
 - 1));
   bis(xhash, hashval)((xhash)[(hashval) >> 3] |= 1 << ((hashval) &
 7));
   /* tw_add_comm_name (dp->d_name); */
}
(void) closedir(dirp);
  }
455}

457void
458dounhash(Char **v, struct command *t)
459{
  havhash = 0;
461}

463void
464hashstat(Char **v, struct command *t)
465{
  if (hits + misses)
(void) fprintf(cshout, "%d hits, %d misses, %d%%\n",
       hits, misses, 100 * hits / (hits + misses));
469}

471/*
* Hash a command name.
*/
474static int
475hashname(Char *cp)
476{
  long h = 0;

  while (*cp)
h = hash(h, *cp++)(((h) * 243 + (*cp++)) & (8192 - 1));
  return ((int) h);
482}

484static int
485iscommand(Char *name)
486{
  Char **pv;
  Char *sav;
  struct varent *v;
  bool slash = any(short2str(name), '/');
  int hashval = 0, hashval1, i;

  v = adrof(STRpath)adrof1(STRpath, &shvhed);
  if (v == 0 || v->vec[0] == 0 || slash)
pv = justabs;
  else
pv = v->vec;
  sav = Strspl(STRslash, name);	/* / command name for postpending */
  if (havhash)
hashval = hashname(name);
  i = 0;
  do {
if (!slash && pv[0][0] == '/' && havhash) {
   hashval1 = hash(hashval, i)(((hashval) * 243 + (i)) & (8192 - 1));
   if (!bit(xhash, hashval1)((xhash)[(hashval1) >> 3] & 1 << ((hashval1) &
 7)))
goto cont;
}
if (pv[0][0] == 0 || eq(pv[0], STRdot)(Strcmp(pv[0], STRdot) == 0)) {	/* don't make ./xxx */
   if (executable(NULL((void *)0), name, 0)) {
free(sav);
return i + 1;
   }
}
else {
   if (executable(*pv, sav, 0)) {
free(sav);
return i + 1;
   }
}
520cont:
pv++;
i++;
  } while (*pv);
  free(sav);
  return 0;
526}

528/* Also by:
*  Andreas Luik <luik@isaak.isa.de>
*  I S A  GmbH - Informationssysteme fuer computerintegrierte Automatisierung
*  Azenberstr. 35
*  D-7000 Stuttgart 1
*  West-Germany
* is the executable() routine below and changes to iscommand().
* Thanks again!!
*/

538/*
* executable() examines the pathname obtained by concatenating dir and name
* (dir may be NULL), and returns 1 either if it is executable by us, or
* if dir_ok is set and the pathname refers to a directory.
* This is a bit kludgy, but in the name of optimization...
*/
544static int
545executable(Char *dir, Char *name, bool dir_ok)
546{
  struct stat stbuf;
  Char    path[PATH_MAX1024], *dp, *sp;
  char   *strname;

  if (dir && *dir) {
for (dp = path, sp = dir; *sp; *dp++ = *sp++)
   if (dp == &path[PATH_MAX1024]) {
*--dp = '\0';
break;
   }
for (sp = name; *sp; *dp++ = *sp++)
   if (dp == &path[PATH_MAX1024]) {
*--dp = '\0';
break;
   }
*dp = '\0';
strname = short2str(path);
  }
  else
strname = short2str(name);
  return (stat(strname, &stbuf) != -1 &&
   ((S_ISREG(stbuf.st_mode)((stbuf.st_mode & 0170000) == 0100000) &&
  /* save time by not calling access() in the hopeless case */
     (stbuf.st_mode & (S_IXOTH0000001 | S_IXGRP0000010 | S_IXUSR0000100)) &&
     access(strname, X_OK0x01) == 0) ||
    (dir_ok && S_ISDIR(stbuf.st_mode)((stbuf.st_mode & 0170000) == 0040000))));
573}

575/* The dowhich() is by:
*  Andreas Luik <luik@isaak.isa.de>
*  I S A  GmbH - Informationssysteme fuer computerintegrierte Automatisierung
*  Azenberstr. 35
*  D-7000 Stuttgart 1
*  West-Germany
* Thanks!!
*/
583void
584dowhich(Char **v, struct command *c)
585{
  struct wordent lex[3];
  struct varent *vp;

  lex[0].next = &lex[1];
  lex[1].next = &lex[2];
  lex[2].next = &lex[0];

  lex[0].prev = &lex[2];
  lex[1].prev = &lex[0];
  lex[2].prev = &lex[1];

  lex[0].word = STRNULL;
  lex[2].word = STRret;

  while (*++v) {
if ((vp = adrof1(*v, &aliases)) != NULL((void *)0)) {
   (void) fprintf(cshout, "%s: \t aliased to ", vis_str(*v));
   blkpr(cshout, vp->vec);
   (void) fputc('\n', cshout);
   set(STRstatus, Strsave(STR0));
}
else {
   lex[1].word = *v;
   set(STRstatus, Strsave(tellmewhat(lex, NULL((void *)0), 0) ? STR0 : STR1));
}
  }
612}

614static int
615tellmewhat(struct wordent *lexp, Char *str, int len)
616{
  int i;
  struct biltins *bptr;
  struct wordent *sp = lexp->next;
  bool    aliased = 0, found;
  Char   *s0, *s1, *s2, *cmd;
  Char    qc;

  if (adrof1(sp->word, &aliases)) {
alias(lexp);
sp = lexp->next;
aliased = 1;
  }

  s0 = sp->word;		/* to get the memory freeing right... */

  /* handle quoted alias hack */
  if ((*(sp->word) & (QUOTE0100000U | TRIM0077777)) == QUOTE0100000U)
(sp->word)++;

  /* do quoting, if it hasn't been done */
  s1 = s2 = sp->word;
  while (*s2)
switch (*s2) {
case '\'':
case '"':
   qc = *s2++;
   while (*s2 && *s2 != qc)
*s1++ = *s2++ | QUOTE0100000U;
   if (*s2)
s2++;
   break;
case '\\':
   if (*++s2)
*s1++ = *s2++ | QUOTE0100000U;
   break;
default:
   *s1++ = *s2++;
}
  *s1 = '\0';

  for (bptr = bfunc; bptr < &bfunc[nbfunc]; bptr++) {
if (eq(sp->word, str2short(bptr->bname))(Strcmp(sp->word, str2short(bptr->bname)) == 0)) {
   if (str == NULL((void *)0)) {
       if (aliased)
        prlex(cshout, lexp);
       (void) fprintf(cshout, "%s: shell built-in command.\n",
	   vis_str(sp->word));
   }
   else
(void) Strlcpy(str, sp->word, len/sizeof(Char));
   sp->word = s0;	/* we save and then restore this */
   return 1;
}
  }

  sp->word = cmd = globone(sp->word, G_IGNORE1);

  if ((i = iscommand(sp->word)) != 0) {
Char **pv;
struct varent *v;
bool    slash = any(short2str(sp->word), '/');

v = adrof(STRpath)adrof1(STRpath, &shvhed);
if (v == 0 || v->vec[0] == 0 || slash)
   pv = justabs;
else
   pv = v->vec;

while (--i)
   pv++;
if (pv[0][0] == 0 || eq(pv[0], STRdot)(Strcmp(pv[0], STRdot) == 0)) {
   if (!slash) {
sp->word = Strspl(STRdotsl, sp->word);
prlex(cshout, lexp);
free(sp->word);
   }
   else
prlex(cshout, lexp);
}
else {
   s1 = Strspl(*pv, STRslash);
   sp->word = Strspl(s1, sp->word);
   free(s1);
   if (str == NULL((void *)0))
prlex(cshout, lexp);
   else
(void) Strlcpy(str, sp->word, len/sizeof(Char));
   free(sp->word);
      }
found = 1;
  }
  else {
if (str == NULL((void *)0)) {
   if (aliased)
prlex(cshout, lexp);
   (void) fprintf(csherr,
	   "%s: Command not found.\n", vis_str(sp->word));
}
else
   (void) Strlcpy(str, sp->word, len/sizeof(Char));
found = 0;
  }
  sp->word = s0;		/* we save and then restore this */
  free(cmd);
  return found;
722}