/usr/src/lib/libc/gen/login_cap.c

Bug Summary

File:	src/lib/libc/gen/login_cap.c
Warning:	line 607, column 7 Access to field 'pw_gid' results in a dereference of a null pointer (loaded from variable 'pwd')

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name login_cap.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/lib/libc/obj -resource-dir /usr/local/llvm16/lib/clang/16 -include namespace.h -I /usr/src/lib/libc/include -I /usr/src/lib/libc/hidden -D __LIBC__ -D APIWARN -D YP -I /usr/src/lib/libc/yp -I /usr/src/lib/libc -I /usr/src/lib/libc/gdtoa -I /usr/src/lib/libc/arch/amd64/gdtoa -D INFNAN_CHECK -D MULTIPLE_THREADS -D NO_FENV_H -D USE_LOCALE -I /usr/src/lib/libc -I /usr/src/lib/libc/citrus -D RESOLVSORT -D FLOATING_POINT -D PRINTF_WIDE_CHAR -D SCANF_WIDE_CHAR -D FUTEX -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/lib/libc/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/lib/libc/gen/login_cap.c

1/*	$OpenBSD: login_cap.c,v 1.46 2022/12/27 17:10:06 jmc Exp $	*/

3/*
* Copyright (c) 2000-2004 Todd C. Miller <millert@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
18/*-
* Copyright (c) 1995,1997 Berkeley Software Design, Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
*    must display the following acknowledgement:
*	This product includes software developed by Berkeley Software Design,
*	Inc.
* 4. The name of Berkeley Software Design, Inc.  may not be used to endorse
*    or promote products derived from this software without specific prior
*    written permission.
*
* THIS SOFTWARE IS PROVIDED BY BERKELEY SOFTWARE DESIGN, INC. ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL BERKELEY SOFTWARE DESIGN, INC. BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
*	BSDI $From: login_cap.c,v 2.16 2000/03/22 17:10:55 donn Exp $
*/
51#include <sys/types.h>
52#include <sys/stat.h>
53#include <sys/time.h>
54#include <sys/resource.h>
55#include <sys/socket.h>

57#include <err.h>
58#include <errno(*__errno()).h>
59#include <fcntl.h>
60#include <limits.h>
61#include <login_cap.h>
62#include <paths.h>
63#include <pwd.h>
64#include <stdio.h>
65#include <stdlib.h>
66#include <string.h>
67#include <syslog.h>
68#include <unistd.h>


71static	char *_authtypes[] = { LOGIN_DEFSTYLE"passwd", 0 };
72static	char *expandstr(const char *, const struct passwd *, int);
73static	int login_setenv(char *, char *, const struct passwd *, int);
74static	int setuserenv(login_cap_t *, const struct passwd *);
75static	int setuserpath(login_cap_t *, const struct passwd *);
76static	u_quad_t multiply(u_quad_t, u_quad_t);
77static	u_quad_t strtolimit(char *, char **, int);
78static	u_quad_t strtosize(char *, char **, int);
79static	int gsetrl(login_cap_t *, int, char *, int);

81login_cap_t *
82login_getclass(char *class)
83{
char *classfiles[] = { NULL((void *)0), NULL((void *)0), NULL((void *)0) };
char classpath[PATH_MAX1024];
login_cap_t *lc;
int res, i = 0;

if ((lc = calloc(1, sizeof(login_cap_t))) == NULL((void *)0)) {
2
←
Assuming the condition is false→
syslog(LOG_ERR3, "%s:%d malloc: %m", __FILE__"/usr/src/lib/libc/gen/login_cap.c", __LINE__90);
return (0);
}

if (class == NULL((void *)0) || class[0] == '\0')
3
←
Assuming 'class' is equal to NULL→
class = LOGIN_DEFCLASS"default";
else {
res = snprintf(classpath, PATH_MAX1024, "%s/%s",
	_PATH_LOGIN_CONF_D"/etc/login.conf.d", class);
if (res >= 0 && res < PATH_MAX1024)
	classfiles[i++] = classpath;
}

classfiles[i++] = _PATH_LOGIN_CONF"/etc/login.conf";
classfiles[i] = NULL((void *)0);

  	if ((lc->lc_class = strdup(class)) == NULL((void *)0)) {
4
←
Assuming the condition is false→
5
←
Taking false branch→
syslog(LOG_ERR3, "%s:%d strdup: %m", __FILE__"/usr/src/lib/libc/gen/login_cap.c", __LINE__107);
free(lc);
return (0);
}

if ((res = cgetent(&lc->lc_cap, classfiles, lc->lc_class)) != 0) {
6
←
Assuming the condition is false→
7
←
Taking false branch→
lc->lc_cap = 0;
switch (res) {
case 1: 
	syslog(LOG_ERR3, "%s: couldn't resolve 'tc'",
		lc->lc_class);
	break;
case -1:
	if ((res = open(_PATH_LOGIN_CONF"/etc/login.conf", O_RDONLY0x0000)) >= 0)
		close(res);
	if (strcmp(lc->lc_class, LOGIN_DEFCLASS"default") == 0 &&
	    res < 0)
		return (lc);
	syslog(LOG_ERR3, "%s: unknown class", lc->lc_class);
	break;
case -2:
	/*
	 * A missing login.conf file is not an error condition.
	 * The individual routines deal reasonably with missing
	 * capabilities and use default values.
	 */
	if (errno(*__errno()) == ENOENT2)
		return (lc);
	syslog(LOG_ERR3, "%s: getting class information: %m",
	    lc->lc_class);
	break;
case -3:
	syslog(LOG_ERR3, "%s: 'tc' reference loop",
		lc->lc_class);
	break;
default:
	syslog(LOG_ERR3, "%s: unexpected cgetent error",
		lc->lc_class);
	break;
}
free(lc->lc_class);
free(lc);
return (0);
}
return (lc);
8
←
Returning pointer (loaded from 'lc'), which participates in a condition later→
152}
153DEF_WEAK(login_getclass)__asm__(".weak " "login_getclass" " ; " "login_getclass" " = "
 "_libc_login_getclass");

155char *
156login_getstyle(login_cap_t *lc, char *style, char *atype)
157{
  	char **authtypes = _authtypes;
char *auths, *ta;
  	char *f1 = NULL((void *)0), **f2 = NULL((void *)0);
int i;

/* Silently convert 's/key' -> 'skey' */
if (style && strcmp(style, "s/key") == 0)
style = "skey";

free(lc->lc_style);
lc->lc_style = NULL((void *)0);

  	if (!atype || !(auths = login_getcapstr(lc, atype, NULL((void *)0), NULL((void *)0))))
auths = login_getcapstr(lc, "auth", NULL((void *)0), NULL((void *)0));

if (auths) {
f1 = ta = auths;	/* auths malloced by login_getcapstr */
i = 2;
while (*ta)
	if (*ta++ == ',')
		++i;
f2 = authtypes = calloc(sizeof(char *), i);
if (!authtypes) {
	syslog(LOG_ERR3, "malloc: %m");
	free(f1);
	return (0);
}
i = 0;
while (*auths) {
	authtypes[i] = auths;
	while (*auths && *auths != ',')
		++auths;
	if (*auths)
		*auths++ = 0;
	if (!*authtypes[i])
		authtypes[i] = LOGIN_DEFSTYLE"passwd";
	++i;
}
authtypes[i] = 0;
}

if (!style)
style = authtypes[0];

while (*authtypes && strcmp(style, *authtypes))
++authtypes;

if (*authtypes) {
lc->lc_style = strdup(*authtypes);
if (lc->lc_style == NULL((void *)0))
	syslog(LOG_ERR3, "strdup: %m");
}
free(f1);
free(f2);
return (lc->lc_style);
213}
214DEF_WEAK(login_getstyle)__asm__(".weak " "login_getstyle" " ; " "login_getstyle" " = "
 "_libc_login_getstyle");

216char *
217login_getcapstr(login_cap_t *lc, char *cap, char *def, char *e)
218{
char *res = NULL((void *)0), *str = e;
int stat;

errno(*__errno()) = 0;

  	if (!lc->lc_cap)
return (def);

switch (stat = cgetstr(lc->lc_cap, cap, &res)) {
case -1:
str = def;
break;
case -2:
syslog(LOG_ERR3, "%s: getting capability %s: %m",
    lc->lc_class, cap);
break;
default:
if (stat >= 0)
	str = res;
else
	syslog(LOG_ERR3,
	    "%s: unexpected error with capability %s",
	    lc->lc_class, cap);
break;
}

if (res != NULL((void *)0) && str != res)
free(res);
return(str);
248}
249DEF_WEAK(login_getcapstr)__asm__(".weak " "login_getcapstr" " ; " "login_getcapstr" " = "
 "_libc_login_getcapstr");

251quad_t
252login_getcaptime(login_cap_t *lc, char *cap, quad_t def, quad_t e)
253{
char *ep;
char *res = NULL((void *)0), *sres;
int stat;
quad_t q, r;

errno(*__errno()) = 0;

  	if (!lc->lc_cap)
return (def);

switch (stat = cgetstr(lc->lc_cap, cap, &res)) {
case -1:
free(res);
return (def);
case -2:
free(res);
syslog(LOG_ERR3, "%s: getting capability %s: %m",
    lc->lc_class, cap);
errno(*__errno()) = ERANGE34;
return (e);
default:
if (stat >= 0) 
	break;
free(res);
syslog(LOG_ERR3, "%s: unexpected error with capability %s",
    lc->lc_class, cap);
errno(*__errno()) = ERANGE34;
return (e);
}

errno(*__errno()) = 0;

if (strcasecmp(res, "infinity") == 0) {
free(res);
return (RLIM_INFINITY(((rlim_t)1 << 63) - 1));
}

q = 0;
sres = res;
while (*res) {
r = strtoll(res, &ep, 0);
if (!ep || ep == res ||
    ((r == QUAD_MIN(-0x7fffffffffffffffLL-1) || r == QUAD_MAX0x7fffffffffffffffLL) && errno(*__errno()) == ERANGE34)) {
297invalid:
	syslog(LOG_ERR3, "%s:%s=%s: invalid time",
	    lc->lc_class, cap, sres);
	free(sres);
	errno(*__errno()) = ERANGE34;
	return (e);
}
switch (*ep++) {
case '\0':
	--ep;
	break;
case 's': case 'S':
	break;
case 'm': case 'M':
	r *= 60;
	break;
case 'h': case 'H':
	r *= 60 * 60;
	break;
case 'd': case 'D':
	r *= 60 * 60 * 24;
	break;
case 'w': case 'W':
	r *= 60 * 60 * 24 * 7;
	break;
case 'y': case 'Y':	/* Pretty absurd */
	r *= 60 * 60 * 24 * 365;
	break;
default:
	goto invalid;
}
res = ep;
q += r;
}
free(sres);
return (q);
333}
334DEF_WEAK(login_getcaptime)__asm__(".weak " "login_getcaptime" " ; " "login_getcaptime" " = "
 "_libc_login_getcaptime");

336quad_t
337login_getcapnum(login_cap_t *lc, char *cap, quad_t def, quad_t e)
338{
char *ep;
char *res = NULL((void *)0);
int stat;
quad_t q;

errno(*__errno()) = 0;

  	if (!lc->lc_cap)
return (def);

switch (stat = cgetstr(lc->lc_cap, cap, &res)) {
case -1:
free(res);
return (def);
case -2:
free(res);
syslog(LOG_ERR3, "%s: getting capability %s: %m",
    lc->lc_class, cap);
errno(*__errno()) = ERANGE34;
return (e);
default:
if (stat >= 0) 
	break;
free(res);
syslog(LOG_ERR3, "%s: unexpected error with capability %s",
    lc->lc_class, cap);
errno(*__errno()) = ERANGE34;
return (e);
}

errno(*__errno()) = 0;

if (strcasecmp(res, "infinity") == 0) {
free(res);
return (RLIM_INFINITY(((rlim_t)1 << 63) - 1));
}

  	q = strtoll(res, &ep, 0);
if (!ep || ep == res || ep[0] ||
   ((q == QUAD_MIN(-0x7fffffffffffffffLL-1) || q == QUAD_MAX0x7fffffffffffffffLL) && errno(*__errno()) == ERANGE34)) {
syslog(LOG_ERR3, "%s:%s=%s: invalid number",
    lc->lc_class, cap, res);
free(res);
errno(*__errno()) = ERANGE34;
return (e);
}
free(res);
return (q);
387}
388DEF_WEAK(login_getcapnum)__asm__(".weak " "login_getcapnum" " ; " "login_getcapnum" " = "
 "_libc_login_getcapnum");

390quad_t
391login_getcapsize(login_cap_t *lc, char *cap, quad_t def, quad_t e)
392{
char *ep;
char *res = NULL((void *)0);
int stat;
quad_t q;

errno(*__errno()) = 0;

  	if (!lc->lc_cap)
return (def);

switch (stat = cgetstr(lc->lc_cap, cap, &res)) {
case -1:
free(res);
return (def);
case -2:
free(res);
syslog(LOG_ERR3, "%s: getting capability %s: %m",
    lc->lc_class, cap);
errno(*__errno()) = ERANGE34;
return (e);
default:
if (stat >= 0) 
	break;
free(res);
syslog(LOG_ERR3, "%s: unexpected error with capability %s",
    lc->lc_class, cap);
errno(*__errno()) = ERANGE34;
return (e);
}

errno(*__errno()) = 0;
q = strtolimit(res, &ep, 0);
if (!ep || ep == res || (ep[0] && ep[1]) ||
   ((q == QUAD_MIN(-0x7fffffffffffffffLL-1) || q == QUAD_MAX0x7fffffffffffffffLL) && errno(*__errno()) == ERANGE34)) {
syslog(LOG_ERR3, "%s:%s=%s: invalid size",
    lc->lc_class, cap, res);
free(res);
errno(*__errno()) = ERANGE34;
return (e);
}
free(res);
return (q);
435}
436DEF_WEAK(login_getcapsize)__asm__(".weak " "login_getcapsize" " ; " "login_getcapsize" " = "
 "_libc_login_getcapsize");

438int
439login_getcapbool(login_cap_t *lc, char *cap, u_int def)
440{
  	if (!lc->lc_cap)
return (def);

return (cgetcap(lc->lc_cap, cap, ':') != NULL((void *)0));
445}
446DEF_WEAK(login_getcapbool)__asm__(".weak " "login_getcapbool" " ; " "login_getcapbool" " = "
 "_libc_login_getcapbool");

448void
449login_close(login_cap_t *lc)
450{
if (lc) {
free(lc->lc_class);
free(lc->lc_cap);
free(lc->lc_style);
free(lc);
}
457}
458DEF_WEAK(login_close)__asm__(".weak " "login_close" " ; " "login_close" " = " "_libc_login_close"
);

460#define	CTIME1	1
461#define	CSIZE2	2
462#define	CNUMB3	3

464static struct {
int	what;
int	type;
char *	name;
468} r_list[] = {
{ RLIMIT_CPU0,		CTIME1, "cputime", },
{ RLIMIT_FSIZE1,		CSIZE2, "filesize", },
{ RLIMIT_DATA2,		CSIZE2, "datasize", },
{ RLIMIT_STACK3,		CSIZE2, "stacksize", },
{ RLIMIT_RSS5,		CSIZE2, "memoryuse", },
{ RLIMIT_MEMLOCK6,	CSIZE2, "memorylocked", },
{ RLIMIT_NPROC7,		CNUMB3, "maxproc", },
{ RLIMIT_NOFILE8,	CNUMB3, "openfiles", },
{ RLIMIT_CORE4,		CSIZE2, "coredumpsize", },
478#ifdef RLIMIT_VMEM
{ RLIMIT_VMEM,		CSIZE2, "vmemoryuse", },
480#endif
{ -1, 0, 0 }
482};

484static int
485gsetrl(login_cap_t *lc, int what, char *name, int type)
486{
struct rlimit rl;
struct rlimit r;
char name_cur[32];
char name_max[32];
  	char *v;
int len;

/*
* If we have no capabilities then there is nothing to do and
* we can just return success.
*/
if (lc->lc_cap == NULL((void *)0))
return (0);

len = snprintf(name_cur, sizeof name_cur, "%s-cur", name);
if (len < 0 || len >= sizeof name_cur) {
syslog(LOG_ERR3, "current resource limit name too large");
return (-1);
}
len = snprintf(name_max, sizeof name_max, "%s-max", name);
if (len < 0 || len >= sizeof name_max) {
syslog(LOG_ERR3, "max resource limit name too large");
return (-1);
}

if (getrlimit(what, &r)) {
syslog(LOG_ERR3, "getting resource limit: %m");
return (-1);
}

/*
* We need to pre-fetch the 3 possible strings we will look
* up to see what order they come in.  If the one without
* the -cur or -max comes in first then we ignore any later
* -cur or -max entries.
* Note that the cgetent routines will always return failure
* on the entry "".  This will cause our login_get* routines
* to use the default entry.
*/
if ((v = cgetcap(lc->lc_cap, name, '=')) != NULL((void *)0)) {
if (v < cgetcap(lc->lc_cap, name_cur, '='))
	name_cur[0] = '\0';
if (v < cgetcap(lc->lc_cap, name_max, '='))
	name_max[0] = '\0';
}

533#define	RCUR	r.rlim_cur
534#define	RMAX	r.rlim_max

switch (type) {
case CTIME1:
RCUR = (rlim_t)login_getcaptime(lc, name, RCUR, RCUR);
RMAX = (rlim_t)login_getcaptime(lc, name, RMAX, RMAX);
rl.rlim_cur = (rlim_t)login_getcaptime(lc, name_cur, RCUR, RCUR);
rl.rlim_max = (rlim_t)login_getcaptime(lc, name_max, RMAX, RMAX);
break;
case CSIZE2:
RCUR = (rlim_t)login_getcapsize(lc, name, RCUR, RCUR);
RMAX = (rlim_t)login_getcapsize(lc, name, RMAX, RMAX);
rl.rlim_cur = (rlim_t)login_getcapsize(lc, name_cur, RCUR, RCUR);
rl.rlim_max = (rlim_t)login_getcapsize(lc, name_max, RMAX, RMAX);
break;
case CNUMB3:
RCUR = (rlim_t)login_getcapnum(lc, name, RCUR, RCUR);
RMAX = (rlim_t)login_getcapnum(lc, name, RMAX, RMAX);
rl.rlim_cur = (rlim_t)login_getcapnum(lc, name_cur, RCUR, RCUR);
rl.rlim_max = (rlim_t)login_getcapnum(lc, name_max, RMAX, RMAX);
break;
default:
return (-1);
}

if (setrlimit(what, &rl)) {
syslog(LOG_ERR3, "%s: setting resource limit %s: %m",
    lc->lc_class, name);
return (-1);
}
564#undef	RCUR
565#undef	RMAX
return (0);
567}

569int
570setclasscontext(char *class, u_int flags)
571{
int ret;
login_cap_t *lc;

flags &= LOGIN_SETRESOURCES0x0010 | LOGIN_SETPRIORITY0x0008 | LOGIN_SETUMASK0x0020 |
   LOGIN_SETPATH0x0004 | LOGIN_SETRTABLE0x0100;

lc = login_getclass(class);
1
Calling 'login_getclass'→
9
←
Returning from 'login_getclass'→
ret = lc9.1
'lc' is non-null
 ? setusercontext(lc, NULL((void *)0), 0, flags) : -1;
10
←
'?' condition is true→
11
←
Passing null pointer value via 2nd parameter 'pwd'→
12
←
Calling 'setusercontext'→
login_close(lc);
return (ret);
582}

584int
585setusercontext(login_cap_t *lc, struct passwd *pwd, uid_t uid, u_int flags)
586{
login_cap_t *flc;
quad_t p, rtable;
int i;

flc = NULL((void *)0);

if (!lc12.1
'lc' is non-null
 && !(flc = lc = login_getclass(pwd ? pwd->pw_class : NULL((void *)0))))
return (-1);

/*
* Without the pwd entry being passed we cannot set either
* the group or the login.  We could complain about it.
*/
if (pwd12.2
'pwd' is equal to NULL
 == NULL((void *)0))
13
←
Taking true branch→
flags &= ~(LOGIN_SETGROUP0x0001|LOGIN_SETLOGIN0x0002);

/*
* Verify that we haven't been given invalid values.
*/
if (flags & LOGIN_SETGROUP0x0001) {
14
←
Assuming the condition is true→
15
←
Taking true branch→
if (pwd->pw_gid == -1) {
16
←
Access to field 'pw_gid' results in a dereference of a null pointer (loaded from variable 'pwd')
	syslog(LOG_ERR3, "setusercontext with invalid gid");
	login_close(flc);
	return (-1);
}
}
if (flags & LOGIN_SETUSER0x0040) {
if (uid == -1) {
	syslog(LOG_ERR3, "setusercontext with invalid uid");
	login_close(flc);
	return (-1);
}
}

if (flags & LOGIN_SETRESOURCES0x0010)
for (i = 0; r_list[i].name; ++i) 
	if (gsetrl(lc, r_list[i].what, r_list[i].name,
	    r_list[i].type))
		/* XXX - call syslog()? */;

if (flags & LOGIN_SETPRIORITY0x0008) {
p = login_getcapnum(lc, "priority", 0, 0);

if (setpriority(PRIO_PROCESS0, 0, (int)p) == -1)
	syslog(LOG_ERR3, "%s: setpriority: %m", lc->lc_class);
}

if (flags & LOGIN_SETUMASK0x0020) {
p = login_getcapnum(lc, "umask", LOGIN_DEFUMASK022,LOGIN_DEFUMASK022);
umask((mode_t)p);
}

if (flags & LOGIN_SETRTABLE0x0100) {
rtable = login_getcapnum(lc, "rtable", -1, -1);

if (rtable >= 0 && setrtable((int)rtable) == -1)
	syslog(LOG_ERR3, "%s: setrtable: %m", lc->lc_class);
}

if (flags & LOGIN_SETGROUP0x0001) {
if (setresgid(pwd->pw_gid, pwd->pw_gid, pwd->pw_gid) == -1) {
	syslog(LOG_ERR3, "setresgid(%u,%u,%u): %m",
	    pwd->pw_gid, pwd->pw_gid, pwd->pw_gid);
	login_close(flc);
	return (-1);
}

if (initgroups(pwd->pw_name, pwd->pw_gid) == -1) {
	syslog(LOG_ERR3, "initgroups(%s,%u): %m",
	    pwd->pw_name, pwd->pw_gid);
	login_close(flc);
	return (-1);
}
}

if (flags & LOGIN_SETLOGIN0x0002)
if (setlogin(pwd->pw_name) == -1) {
	syslog(LOG_ERR3, "setlogin(%s) failure: %m",
	    pwd->pw_name);
	login_close(flc);
	return (-1);
}

if (flags & LOGIN_SETUSER0x0040) {
if (setresuid(uid, uid, uid) == -1) {
	syslog(LOG_ERR3, "setresuid(%u,%u,%u): %m",
	    uid, uid, uid);
	login_close(flc);
	return (-1);
}
}

if (flags & LOGIN_SETENV0x0080) {
if (setuserenv(lc, pwd) == -1) {
	syslog(LOG_ERR3, "could not set user environment: %m");
	login_close(flc);
	return (-1);
}
}

if (flags & LOGIN_SETPATH0x0004) {
if (setuserpath(lc, pwd) == -1) {
	syslog(LOG_ERR3, "could not set PATH: %m");
	login_close(flc);
	return (-1);
}
}

login_close(flc);
return (0);
697}
698DEF_WEAK(setusercontext)__asm__(".weak " "setusercontext" " ; " "setusercontext" " = "
 "_libc_setusercontext");

700/*
* Look up "path" for this user in login.conf and replace whitespace
* with ':' while expanding '~' and '$'.  Sets the PATH environment
* variable to the result or _PATH_DEFPATH on error.
*/
705static int
706setuserpath(login_cap_t *lc, const struct passwd *pwd)
707{
char *path = NULL((void *)0), *opath = NULL((void *)0), *op, *np;
int len, error;

/*
* If we have no capabilities then set _PATH_DEFPATH.
*/
if (lc->lc_cap == NULL((void *)0))
goto setit;

if ((len = cgetustr(lc->lc_cap, "path", &opath)) <= 0)
goto setit;

if ((path = malloc(len + 1)) == NULL((void *)0))
goto setit;

/* Convert opath from space-separated to colon-separated path. */
for (op = opath, np = path; *op != '\0'; ) {
switch (*op) {
case ' ':
case '\t':
	/*
	 * Collapse consecutive spaces and trim any space
	 * at the very end.
	 */
	do {
		op++;
	} while (*op == ' ' || *op == '\t');
	if (*op != '\0')
		*np++ = ':';
	break;
case '\\':
	/* check for escaped whitespace */
	if (*(op + 1) == ' ' || *(op + 1) == '\t')
		*np++ = *op++;
	/* FALLTHROUGH */
default:
	*np++ = *op++;
	break;
}

}
*np = '\0';
750setit:
error = login_setenv("PATH", path ? path : _PATH_DEFPATH"/usr/bin:/bin:/usr/sbin:/sbin:/usr/X11R6/bin:/usr/local/bin:/usr/local/sbin", pwd, 1);
free(opath);
free(path);
return (error);
755}

757/*
* Look up "setenv" for this user in login.conf and set the comma-separated
* list of environment variables, expanding '~' and '$'.
*/
761static int
762setuserenv(login_cap_t *lc, const struct passwd *pwd)
763{
char *beg, *end, *ep, *list, *value;
int len, error;

/*
* If we have no capabilities then there is nothing to do and
* we can just return success.
*/
if (lc->lc_cap == NULL((void *)0))
return (0);

if ((len = cgetustr(lc->lc_cap, "setenv", &list)) <= 0)
return (0);

for (beg = end = list, ep = list + len + 1; end < ep; end++) {
switch (*end) {
case '\\':
	if (*(end + 1) == ',')
		end++;	/* skip escaped comma */
	continue;
case ',':
case '\0':
	*end = '\0';
	if (beg == end) {
		beg++;
		continue;
	}
	break;
default:
	continue;
}

if ((value = strchr(beg, '=')) != NULL((void *)0))
	*value++ = '\0';
else
	value = "";
if ((error = login_setenv(beg, value, pwd, 0)) != 0) {
	free(list);
	return (error);
}
beg = end + 1;
}
free(list);
return (0);
807}

809/*
* Set an environment variable, substituting for ~ and $
*/
812static int
813login_setenv(char *name, char *ovalue, const struct passwd *pwd, int ispath)
814{
char *value = NULL((void *)0);
int error;

if (*ovalue != '\0')
value = expandstr(ovalue, pwd, ispath);
error = setenv(name, value ? value : ovalue, 1);
free(value);
return (error);
823}

825/*
* Convert an expression of the following forms
* 	1) A number.
*	2) A number followed by a b (mult by 512).
*	3) A number followed by a k (mult by 1024).
*	5) A number followed by a m (mult by 1024 * 1024).
*	6) A number followed by a g (mult by 1024 * 1024 * 1024).
*	7) A number followed by a t (mult by 1024 * 1024 * 1024 * 1024).
*	8) Two or more numbers (with/without k,b,m,g, or t).
*	   separated by x (also * for backwards compatibility), specifying
*	   the product of the indicated values.
*/
837static
838u_quad_t
839strtosize(char *str, char **endptr, int radix)
840{
u_quad_t num, num2;
char *expr, *expr2;

errno(*__errno()) = 0;
num = strtoull(str, &expr, radix);
if (errno(*__errno()) || expr == str) {
if (endptr)
	*endptr = expr;
return (num);
}

switch(*expr) {
case 'b': case 'B':
num = multiply(num, (u_quad_t)512);
++expr;
break;
case 'k': case 'K':
num = multiply(num, (u_quad_t)1024);
++expr;
break;
case 'm': case 'M':
num = multiply(num, (u_quad_t)1024 * 1024);
++expr;
break;
case 'g': case 'G':
num = multiply(num, (u_quad_t)1024 * 1024 * 1024);
++expr;
break;
case 't': case 'T':
num = multiply(num, (u_quad_t)1024 * 1024);
num = multiply(num, (u_quad_t)1024 * 1024);
++expr;
break;
}

if (errno(*__errno()))
goto erange;

switch(*expr) {
case '*':			/* Backward compatible. */
case 'x':
num2 = strtosize(expr+1, &expr2, radix);
if (errno(*__errno())) {
	expr = expr2;
	goto erange;
}

if (expr2 == expr + 1) {
	if (endptr)
		*endptr = expr;
	return (num);
}
expr = expr2;
num = multiply(num, num2);
if (errno(*__errno()))
	goto erange;
break;
}
if (endptr)
*endptr = expr;
return (num);
902erange:
if (endptr)
*endptr = expr;
errno(*__errno()) = ERANGE34;
return (UQUAD_MAX0xffffffffffffffffULL);
907}

909static
910u_quad_t
911strtolimit(char *str, char **endptr, int radix)
912{
if (strcasecmp(str, "infinity") == 0 || strcasecmp(str, "inf") == 0) {
if (endptr)
	*endptr = str + strlen(str);
return ((u_quad_t)RLIM_INFINITY(((rlim_t)1 << 63) - 1));
}
return (strtosize(str, endptr, radix));
919}

921static u_quad_t
922multiply(u_quad_t n1, u_quad_t n2)
923{
static int bpw = 0;
u_quad_t m;
u_quad_t r;
int b1, b2;

/*
* Get rid of the simple cases
*/
if (n1 == 0 || n2 == 0)
return (0);
if (n1 == 1)
return (n2);
if (n2 == 1)
return (n1);

/*
* sizeof() returns number of bytes needed for storage.
* This may be different from the actual number of useful bits.
*/
if (!bpw) {
bpw = sizeof(u_quad_t) * 8;
while (((u_quad_t)1 << (bpw-1)) == 0)
	--bpw;
}

/*
* First check the magnitude of each number.  If the sum of the
* magnitude is way to high, reject the number.  (If this test
* is not done then the first multiply below may overflow.)
*/
for (b1 = bpw; (((u_quad_t)1 << (b1-1)) & n1) == 0; --b1)
; 
for (b2 = bpw; (((u_quad_t)1 << (b2-1)) & n2) == 0; --b2)
; 
if (b1 + b2 - 2 > bpw) {
errno(*__errno()) = ERANGE34;
return (UQUAD_MAX0xffffffffffffffffULL);
}

/*
* Decompose the multiplication to be:
* h1 = n1 & ~1
* h2 = n2 & ~1
* l1 = n1 & 1
* l2 = n2 & 1
* (h1 + l1) * (h2 + l2)
* (h1 * h2) + (h1 * l2) + (l1 * h2) + (l1 * l2)
*
* Since h1 && h2 do not have the low bit set, we can then say:
*
* (h1>>1 * h2>>1 * 4) + ...
*
* So if (h1>>1 * h2>>1) > (1<<(bpw - 2)) then the result will
* overflow.
*
* Finally, if MAX - ((h1 * l2) + (l1 * h2) + (l1 * l2)) < (h1*h2)
* then adding in residual amount will cause an overflow.
*/

m = (n1 >> 1) * (n2 >> 1);

if (m >= ((u_quad_t)1 << (bpw-2))) {
errno(*__errno()) = ERANGE34;
return (UQUAD_MAX0xffffffffffffffffULL);
}

m *= 4;

r = (n1 & n2 & 1)
 + (n2 & 1) * (n1 & ~(u_quad_t)1)
 + (n1 & 1) * (n2 & ~(u_quad_t)1);

if ((u_quad_t)(m + r) < m) {
errno(*__errno()) = ERANGE34;
return (UQUAD_MAX0xffffffffffffffffULL);
}
m += r;

return (m);
1003}

1005/*
* Check whether or not a tilde in a string should be expanded.
* We only do expansion for things like "~", "~/...", ~me", "~me/...".
* Additionally, for paths the tilde must be a the beginning.
*/
1010#define tilde_valid(s, b, u, l, ip)((!(ip) || (s) == (b) || (s)[-1] == ':') && ((s)[1] ==
 '/' || (s)[1] == '\0' || (strncmp((s)+1, u, l) == 0 &&
 ((s)[l+1] == '/' || (s)[l+1] == '\0')))) \
  ((!(ip) || (s) == (b) || (s)[-1] == ':') && \
  ((s)[1] == '/' || (s)[1] == '\0' || \
  (strncmp((s)+1, u, l) == 0 && ((s)[l+1] == '/' || (s)[l+1] == '\0'))))

1015/*
* Make a copy of a string, expanding '~' to the user's homedir, '$' to the
* login name and other escape sequences as per cgetstr(3).
*/
1019static char *
1020expandstr(const char *ostr, const struct passwd *pwd, int ispath)
1021{
size_t n, olen, nlen, ulen, dlen;
const char *ep, *eo, *op;
char *nstr, *np;
int ch;

if (pwd != NULL((void *)0)) {
ulen = strlen(pwd->pw_name);
dlen = strlen(pwd->pw_dir);
}

/* calculate the size of the new string */
olen = nlen = strlen(ostr);
for (op = ostr, ep = ostr + olen; op < ep; op++) {
switch (*op) {
case '~':
	if (pwd == NULL((void *)0) ||
	    !tilde_valid(op, ostr, pwd->pw_name, ulen, ispath)((!(ispath) || (op) == (ostr) || (op)[-1] == ':') && (
(op)[1] == '/' || (op)[1] == '\0' || (strncmp((op)+1, pwd->
pw_name, ulen) == 0 && ((op)[ulen+1] == '/' || (op)[ulen
+1] == '\0')))))
		break;
	if (op[1] != '/' && op[1] != '\0') {
		op += ulen;	/* ~username */
		nlen = nlen - ulen - 1 + dlen;
	} else
		nlen += dlen - 1;
	break;
case '$':
	if (pwd != NULL((void *)0))
		nlen += ulen - 1;
	break;
case '^':
	/* control char */
	if (*++op != '\0')
		nlen--;
	break;
case '\\':
	if (op[1] == '\0')
		break;
	/*
	 * Byte in octal notation (\123) or an escaped char (\t)
	 */
	eo = op + 4;
	do {
		op++;
		nlen--;
	} while (op < eo && *op >= '0' && *op <= '7');
	break;
}
}
if ((np = nstr = malloc(++nlen)) == NULL((void *)0))
return (NULL((void *)0));

for (op = ostr, ep = ostr + olen; op < ep; op++) {
switch ((ch = *op)) {
case '~':
	if (pwd == NULL((void *)0) ||
	    !tilde_valid(op, ostr, pwd->pw_name, ulen, ispath)((!(ispath) || (op) == (ostr) || (op)[-1] == ':') && (
(op)[1] == '/' || (op)[1] == '\0' || (strncmp((op)+1, pwd->
pw_name, ulen) == 0 && ((op)[ulen+1] == '/' || (op)[ulen
+1] == '\0')))))
		break;
	if (op[1] != '/' && op[1] != '\0')
		op += ulen;	/* ~username */
	strlcpy(np, pwd->pw_dir, nlen);
	nlen -= dlen;
	np += dlen;
	continue;
case '$':
	if (pwd == NULL((void *)0))
		break;
	strlcpy(np, pwd->pw_name, nlen);
	nlen -= ulen;
	np += ulen;
	continue;
case '^':
	if (op[1] != '\0')
		ch = *++op & 037;
	break;
case '\\':
	if (op[1] == '\0')
		break;
	switch(*++op) {
	case '0': case '1': case '2': case '3':
	case '4': case '5': case '6': case '7':
		/* byte in octal up to 3 digits long */
		ch = 0;
		n = 3;
		do {
			ch = ch * 8 + (*op++ - '0');
		} while (--n && *op >= '0' && *op <= '7');
		break;
	case 'b': case 'B':
		ch = '\b';
		break;
	case 't': case 'T':
		ch = '\t';
		break;
	case 'n': case 'N':
		ch = '\n';
		break;
	case 'f': case 'F':
		ch = '\f';
		break;
	case 'r': case 'R':
		ch = '\r';
		break;
	case 'e': case 'E':
		ch = '\033';
		break;
	case 'c': case 'C':
		ch = ':';
		break;
	default:
		ch = *op;
		break;
	}
	break;
}
*np++ = ch;
nlen--;
}
*np = '\0';
return (nstr);
1140}