/usr/src/usr.bin/netstat/if.c

Bug Summary

File:	src/usr.bin/netstat/if.c
Warning:	line 592, column 19 Access to field 'ifi_ipackets' results in a dereference of an undefined pointer value (loaded from variable 'ifd')

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name if.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.bin/netstat/obj -resource-dir /usr/local/lib/clang/13.0.0 -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.bin/netstat/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.bin/netstat/if.c

1/*	$OpenBSD: if.c,v 1.78 2021/11/29 06:39:23 deraadt Exp $	*/
2/*	$NetBSD: if.c,v 1.16.4.2 1996/06/07 21:46:46 thorpej Exp $	*/

4/*
* Copyright (c) 1983, 1988, 1993
*	The Regents of the University of California.  All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of the University nor the names of its contributors
*    may be used to endorse or promote products derived from this software
*    without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

33#include <sys/types.h>
34#include <sys/ioctl.h>
35#include <sys/protosw.h>
36#include <sys/socket.h>
37#include <sys/sysctl.h>

39#include <net/if.h>
40#include <net/if_dl.h>
41#include <net/if_types.h>
42#include <net/route.h>
43#include <netinet/in.h>
44#include <netinet/in_var.h>
45#include <netinet/if_ether.h>
46#include <arpa/inet.h>

48#include <err.h>
49#include <limits.h>
50#include <signal.h>
51#include <stdio.h>
52#include <stdlib.h>
53#include <string.h>
54#include <unistd.h>
55#include <util.h>

57#define roundup(x, y)((((x)+((y)-1))/(y))*(y))   ((((x)+((y)-1))/(y))*(y))

59#include "netstat.h"

61static void print_addr(struct sockaddr *, struct sockaddr **, struct if_data *);
62static void sidewaysintpr(u_int, int);
63static void catchalarm(int);
64static void get_rtaddrs(int, struct sockaddr *, struct sockaddr **);
65static void fetchifs(void);

67struct iftot;

69struct if_show_err {
const char *name;
const char *iname;
const char *oname;
uint64_t (*count)(uint64_t, uint64_t);
74};

76static uint64_t	if_show_fails(uint64_t, uint64_t);
77static uint64_t	if_show_errors(uint64_t, uint64_t);
78static uint64_t	if_show_qdrops(uint64_t, uint64_t);

80static const struct if_show_err if_show_errs[] = {
[IF_SHOW_FAIL0] = { "fails", "Ifail", "Ofail", if_show_fails },
[IF_SHOW_ERRS1] = { "errs", "Ierrs", "Oerrs", if_show_errors },
[IF_SHOW_DROP2] = { "drops", "Idrop", "Odrop", if_show_qdrops },
84};
85static const struct if_show_err *if_errs = if_show_errs;

87/*
* Print a description of the network interfaces.
* NOTE: ifnetaddr is the location of the kernel global "ifnet",
* which is a TAILQ_HEAD.
*/
92void
93intpr(int interval, int repeatcount)
94{
struct if_msghdr ifm;
int mib[6] = { CTL_NET4, PF_ROUTE17, 0, 0, NET_RT_IFLIST3, 0 };
char name[IFNAMSIZ16 + 1];	/* + 1 for the '*' */
char *buf = NULL((void *)0), *next, *lim, *cp;
struct rt_msghdr *rtm;
struct ifa_msghdr *ifam;
struct if_data *ifd;
struct sockaddr *sa, *rti_info[RTAX_MAX15];
struct sockaddr_dl *sdl;
u_int64_t total = 0;
size_t len;

if_errs = &if_show_errs[dflag];

if (interval) {
1
Assuming 'interval' is not equal to 0→
2
←
Taking true branch→
sidewaysintpr((unsigned)interval, repeatcount);
3
←
Calling 'sidewaysintpr'→
return;
}

len = get_sysctl(mib, 6, &buf);

printf("%-7.7s %-5.5s %-11.11s %-17.17s ",
   "Name", "Mtu", "Network", "Address");
if (bflag)
printf("%10.10s %10.10s", "Ibytes", "Obytes");
else {
printf("%8.8s %5.5s %8.8s %5.5s %5.5s",
    "Ipkts", if_errs->iname,
    "Opkts", if_errs->oname, "Colls");
}
if (tflag)
printf(" %s", "Time");
putchar('\n')(!__isthreaded ? __sputc('\n', (&__sF[1])) : (putc)('\n',
 (&__sF[1])));

lim = buf + len;
for (next = buf; next < lim; next += rtm->rtm_msglen) {
rtm = (struct rt_msghdr *)next;
if (rtm->rtm_version != RTM_VERSION5)
	continue;
switch (rtm->rtm_type) {
case RTM_IFINFO0xe:
	total = 0;
	bcopy(next, &ifm, sizeof ifm);
	ifd = &ifm.ifm_data;

	sa = (struct sockaddr *)(next + rtm->rtm_hdrlen);
	get_rtaddrs(ifm.ifm_addrs, sa, rti_info);

	sdl = (struct sockaddr_dl *)rti_info[RTAX_IFP4];
	if (sdl == NULL((void *)0) || sdl->sdl_family != AF_LINK18)
		continue;
	bzero(name, sizeof(name));
	if (sdl->sdl_nlen >= IFNAMSIZ16)
		memcpy(name, sdl->sdl_data, IFNAMSIZ16 - 1);
	else if (sdl->sdl_nlen > 0) 
		memcpy(name, sdl->sdl_data, sdl->sdl_nlen);

	if (interface != 0 && strcmp(name, interface) != 0)
		continue;

	/* mark inactive interfaces with a '*' */
	cp = strchr(name, '\0');
	if ((ifm.ifm_flags & IFF_UP0x1) == 0)
		*cp++ = '*';
	*cp = '\0';

	if (qflag) {
		total = ifd->ifi_ibytes + ifd->ifi_obytes +
		    ifd->ifi_ipackets +
		    ifd->ifi_opackets +
		    ifd->ifi_collisions;
		total += if_errs->count(ifd->ifi_ierrors,
		    ifd->ifi_iqdrops);
		total += if_errs->count(ifd->ifi_oerrors,
		    ifd->ifi_oqdrops);
		if (tflag)
			total += 0; // XXX ifnet.if_timer;
		if (total == 0)
			continue;
	}

	printf("%-7s %-5d ", name, ifd->ifi_mtu);
	print_addr(rti_info[RTAX_IFP4], rti_info, ifd);
	break;
case RTM_NEWADDR0xc:
	if (qflag && total == 0)
		continue;
	if (interface != 0 && strcmp(name, interface) != 0)
		continue;

	ifam = (struct ifa_msghdr *)next;
	if ((ifam->ifam_addrs & (RTA_NETMASK0x4 | RTA_IFA0x20 |
	    RTA_BRD0x80)) == 0)
		break;

	sa = (struct sockaddr *)(next + rtm->rtm_hdrlen);
	get_rtaddrs(ifam->ifam_addrs, sa, rti_info);

	printf("%-7s %-5d ", name, ifd->ifi_mtu);
	print_addr(rti_info[RTAX_IFA5], rti_info, ifd);
	break;
}
}
free(buf);
199}

201static void
202print_addr(struct sockaddr *sa, struct sockaddr **rtinfo, struct if_data *ifd)
203{
struct sockaddr_dl *sdl;
struct sockaddr_in *sin;
struct sockaddr_in6 *sin6;
char *cp;
int m, n;

switch (sa->sa_family) {
case AF_UNSPEC0:
printf("%-11.11s ", "none");
printf("%-17.17s ", "none");
break;
case AF_INET2:
sin = (struct sockaddr_in *)sa;
cp = netname4(sin->sin_addr.s_addr,
    ((struct sockaddr_in *)rtinfo[RTAX_NETMASK2])->sin_addr.s_addr);
if (vflag)
	n = strlen(cp) < 11 ? 11 : strlen(cp);
else
	n = 11;
printf("%-*.*s ", n, n, cp);
cp = routename4(sin->sin_addr.s_addr);
if (vflag)
	n = strlen(cp) < 17 ? 17 : strlen(cp);
else
	n = 17;
printf("%-*.*s ", n, n, cp);

break;
case AF_INET624:
sin6 = (struct sockaddr_in6 *)sa;
234#ifdef __KAME__
if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)(((&sin6->sin6_addr)->__u6_addr.__u6_addr8[0] == 0xfe
) && (((&sin6->sin6_addr)->__u6_addr.__u6_addr8
[1] & 0xc0) == 0x80)) &&
    sin6->sin6_scope_id == 0) {
	sin6->sin6_scope_id =
	    ntohs(*(u_int16_t *)(__uint16_t)(__builtin_constant_p(*(u_int16_t *) &sin6->
sin6_addr.__u6_addr.__u6_addr8[2]) ? (__uint16_t)(((__uint16_t
)(*(u_int16_t *) &sin6->sin6_addr.__u6_addr.__u6_addr8
[2]) & 0xffU) << 8 | ((__uint16_t)(*(u_int16_t *) &
sin6->sin6_addr.__u6_addr.__u6_addr8[2]) & 0xff00U) >>
 8) : __swap16md(*(u_int16_t *) &sin6->sin6_addr.__u6_addr
.__u6_addr8[2]))
	    &sin6->sin6_addr.s6_addr[2])(__uint16_t)(__builtin_constant_p(*(u_int16_t *) &sin6->
sin6_addr.__u6_addr.__u6_addr8[2]) ? (__uint16_t)(((__uint16_t
)(*(u_int16_t *) &sin6->sin6_addr.__u6_addr.__u6_addr8
[2]) & 0xffU) << 8 | ((__uint16_t)(*(u_int16_t *) &
sin6->sin6_addr.__u6_addr.__u6_addr8[2]) & 0xff00U) >>
 8) : __swap16md(*(u_int16_t *) &sin6->sin6_addr.__u6_addr
.__u6_addr8[2]));
	sin6->sin6_addr.s6_addr__u6_addr.__u6_addr8[2] = 0;
	sin6->sin6_addr.s6_addr__u6_addr.__u6_addr8[3] = 0;
}
243#endif
cp = netname6(sin6,
    (struct sockaddr_in6 *)rtinfo[RTAX_NETMASK2]);
if (vflag)
	n = strlen(cp) < 11 ? 11 : strlen(cp);
else
	n = 11;
printf("%-*.*s ", n, n, cp);
cp = routename6(sin6);
if (vflag)
	n = strlen(cp) < 17 ? 17 : strlen(cp);
else
	n = 17;
printf("%-*.*s ", n, n, cp);
break;
case AF_LINK18:
sdl = (struct sockaddr_dl *)sa;
m = printf("%-11.11s ", "<Link>");
if (sdl->sdl_type == IFT_ETHER0x06 ||
    sdl->sdl_type == IFT_CARP0xf7 ||
    sdl->sdl_type == IFT_FDDI0x0f ||
    sdl->sdl_type == IFT_ISO880250x09)
	printf("%-17.17s ",
	    ether_ntoa((struct ether_addr *)LLADDR(sdl)((caddr_t)((sdl)->sdl_data + (sdl)->sdl_nlen))));
else {
	cp = (char *)LLADDR(sdl)((caddr_t)((sdl)->sdl_data + (sdl)->sdl_nlen));
	n = sdl->sdl_alen;
	goto hexprint;
}
break;
default:
m = printf("(%d)", sa->sa_family);
for (cp = sa->sa_len + (char *)sa;
	--cp > sa->sa_data && (*cp == 0);) {}
n = cp - sa->sa_data + 1;
cp = sa->sa_data;
279hexprint:
while (--n >= 0)
	m += printf("%x%c", *cp++ & 0xff,
		    n > 0 ? '.' : ' ');
m = 30 - m;
while (m-- > 0)
	putchar(' ')(!__isthreaded ? __sputc(' ', (&__sF[1])) : (putc)(' ', (
&__sF[1])));
break;
}
if (bflag) {
if (hflag) {
	char ibytes[FMT_SCALED_STRSIZE7];
	char obytes[FMT_SCALED_STRSIZE7];
	fmt_scaled(ifd->ifi_ibytes, ibytes);
	fmt_scaled(ifd->ifi_obytes, obytes);
	printf("%10s %10s", ibytes, obytes);
} else
	printf("%10llu %10llu",
	    ifd->ifi_ibytes, ifd->ifi_obytes);
} else
printf("%8llu %5llu %8llu %5llu %5llu",
    ifd->ifi_ipackets,
    if_errs->count(ifd->ifi_ierrors, ifd->ifi_iqdrops),
    ifd->ifi_opackets,
    if_errs->count(ifd->ifi_oerrors, ifd->ifi_oqdrops),
    ifd->ifi_collisions);
if (tflag)
printf(" %4d", 0 /* XXX ifnet.if_timer */);
putchar('\n')(!__isthreaded ? __sputc('\n', (&__sF[1])) : (putc)('\n',
 (&__sF[1])));
308}

310struct	iftot {
char	ift_name[IFNAMSIZ16];	/* interface name */
u_int64_t ift_ip;		/* input packets */
u_int64_t ift_ib;		/* input bytes */
u_int64_t ift_ie;		/* input errors */
u_int64_t ift_iq;		/* input qdrops */
u_int64_t ift_op;		/* output packets */
u_int64_t ift_ob;		/* output bytes */
u_int64_t ift_oe;		/* output errors */
u_int64_t ift_oq;		/* output qdrops */
u_int64_t ift_co;		/* collisions */
321} ip_cur, ip_old, sum_cur, sum_old;

323volatile sig_atomic_t signalled;	/* set if alarm goes off "early" */

325/*
* Print a running summary of interface statistics.
* Repeat display every interval seconds, showing statistics
* collected over that interval.  Assumes that interval is non-zero.
* First line printed at top of screen is always cumulative.
*/
331static void
332sidewaysintpr(unsigned int interval, int repeatcount)
333{
sigset_t emptyset;
int line;
char ibytes[FMT_SCALED_STRSIZE7];
char obytes[FMT_SCALED_STRSIZE7];

fetchifs();
4
←
Calling 'fetchifs'→
if (ip_cur.ift_name[0] == '\0') {
fprintf(stderr(&__sF[2]), "%s: %s: unknown interface\n",
    __progname, interface);
exit(1);
}

(void)signal(SIGALRM14, catchalarm);
signalled = 0;
(void)alarm(interval);
349banner:
if (bflag)
printf("%7.7s in %8.8s %6.6s out %5.5s",
    ip_cur.ift_name, " ",
    ip_cur.ift_name, " ");
else
printf("%5.5s in %5.5s%5.5s out %5.5s %5.5s",
    ip_cur.ift_name, " ",
    ip_cur.ift_name, " ", " ");

if (bflag)
printf("  %7.7s in %8.8s %6.6s out %5.5s",
    "total", " ", "total", " ");
else
printf("  %5.5s in %5.5s%5.5s out %5.5s %5.5s",
    "total", " ", "total", " ", " ");
putchar('\n')(!__isthreaded ? __sputc('\n', (&__sF[1])) : (putc)('\n',
 (&__sF[1])));
if (bflag)
printf("%10.10s %8.8s %10.10s %5.5s",
    "bytes", " ", "bytes", " ");
else
printf("%8.8s %5.5s %8.8s %5.5s %5.5s",
    "packets", if_errs->name,
    "packets", if_errs->name, "colls");

if (bflag)
printf("%10.10s %8.8s %10.10s %5.5s",
    "bytes", " ", "bytes", " ");
else
printf("  %8.8s %5.5s %8.8s %5.5s %5.5s",
    "packets", "errs", "packets", "errs", "colls");
putchar('\n')(!__isthreaded ? __sputc('\n', (&__sF[1])) : (putc)('\n',
 (&__sF[1])));
fflush(stdout(&__sF[1]));
line = 0;
bzero(&ip_old, sizeof(ip_old));
bzero(&sum_old, sizeof(sum_old));
385loop:
bzero(&sum_cur, sizeof(sum_cur));

fetchifs();

if (bflag) {
if (hflag) {
	fmt_scaled(ip_cur.ift_ib - ip_old.ift_ib, ibytes);
	fmt_scaled(ip_cur.ift_ob - ip_old.ift_ob, obytes);
	printf("%10s %8.8s %10s %5.5s",
	    ibytes, " ", obytes, " ");
} else
	printf("%10llu %8.8s %10llu %5.5s",
	    ip_cur.ift_ib - ip_old.ift_ib, " ",
	    ip_cur.ift_ob - ip_old.ift_ob, " ");
} else
printf("%8llu %5llu %8llu %5llu %5llu",
    ip_cur.ift_ip - ip_old.ift_ip,
    if_errs->count(ip_cur.ift_ie - ip_old.ift_ie,
     ip_cur.ift_iq - ip_old.ift_iq),
    ip_cur.ift_op - ip_old.ift_op,
    if_errs->count(ip_cur.ift_oe - ip_old.ift_oe,
     ip_cur.ift_oq - ip_old.ift_oq),
    ip_cur.ift_co - ip_old.ift_co);

ip_old = ip_cur;

if (bflag) {
if (hflag) {
	fmt_scaled(sum_cur.ift_ib - sum_old.ift_ib, ibytes);
	fmt_scaled(sum_cur.ift_ob - sum_old.ift_ob, obytes);
	printf("%10s %8.8s %10s %5.5s",
	    ibytes, " ", obytes, " ");
} else
	printf("%10llu %8.8s %10llu %5.5s",
	    sum_cur.ift_ib - sum_old.ift_ib, " ",
	    sum_cur.ift_ob - sum_old.ift_ob, " ");
} else
printf("%8llu %5llu %8llu %5llu %5llu",
    sum_cur.ift_ip - sum_old.ift_ip,
    if_errs->count(sum_cur.ift_ie - sum_old.ift_ie,
     sum_cur.ift_iq - sum_old.ift_iq),
    sum_cur.ift_op - sum_old.ift_op,
    if_errs->count(sum_cur.ift_oe - sum_old.ift_oe,
     sum_cur.ift_oq - sum_old.ift_oq),
    sum_cur.ift_co - sum_old.ift_co);

sum_old = sum_cur;

putchar('\n')(!__isthreaded ? __sputc('\n', (&__sF[1])) : (putc)('\n',
 (&__sF[1])));
fflush(stdout(&__sF[1]));
if (repeatcount && --repeatcount == 0)
return;
line++;
sigemptyset(&emptyset);
if (!signalled)
sigsuspend(&emptyset);
signalled = 0;
(void)alarm(interval);
if (line == 21 && isatty(STDOUT_FILENO1))
goto banner;
goto loop;
447}

449/*
* Called if an interval expires before sidewaysintpr has completed a loop.
* Sets a flag to not wait for the alarm.
*/
453/* ARGSUSED */
454static void
455catchalarm(int signo)
456{
signalled = 1;
458}

460static void
461get_rtaddrs(int addrs, struct sockaddr *sa, struct sockaddr **rti_info)
462{   
int i;

for (i = 0; i < RTAX_MAX15; i++) {
if (addrs & (1 << i)) {
	rti_info[i] = sa;
	sa = (struct sockaddr *)((char *)(sa) +
	    roundup(sa->sa_len, sizeof(long))((((sa->sa_len)+((sizeof(long))-1))/(sizeof(long)))*(sizeof
(long))));
} else 
	rti_info[i] = NULL((void *)0);
}
473}


476static int
477isegress(char *name)
478{
static int s = -1;
int len;
struct ifgroupreq ifgr;
struct ifg_req *ifg;
int rv = 0;

if (s == -1) {
if ((s = socket(AF_INET2, SOCK_DGRAM2, 0)) == -1)
	return 0;
}

memset(&ifgr, 0, sizeof(ifgr));
strlcpy(ifgr.ifgr_name, name, IFNAMSIZ16);

if (ioctl(s, SIOCGIFGROUP(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifgroupreq) & 0x1fff) << 16) | ((('i')) <<
 8) | ((136))), (caddr_t)&ifgr) == -1) {
return 0;
}

len = ifgr.ifgr_len;
ifgr.ifgr_groupsifgr_ifgru.ifgru_groups = calloc(len, 1);
if (ifgr.ifgr_groupsifgr_ifgru.ifgru_groups == NULL((void *)0))
err(1, "getifgroups");
if (ioctl(s, SIOCGIFGROUP(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifgroupreq) & 0x1fff) << 16) | ((('i')) <<
 8) | ((136))), (caddr_t)&ifgr) == -1)
err(1, "SIOCGIFGROUP");

ifg = ifgr.ifgr_groupsifgr_ifgru.ifgru_groups;
for (; ifg && len >= sizeof(struct ifg_req); ifg++) {
len -= sizeof(struct ifg_req);
if (strcmp(ifg->ifgrq_groupifgrq_ifgrqu.ifgrqu_group, IFG_EGRESS"egress") == 0)
	rv = 1;
}

free(ifgr.ifgr_groupsifgr_ifgru.ifgru_groups);
return rv;
513}

515static void
516fetchifs(void)
517{
struct if_msghdr ifm;
int mib[6] = { CTL_NET4, PF_ROUTE17, 0, 0, NET_RT_IFLIST3, 0 };
struct rt_msghdr *rtm;
struct if_data *ifd;
5
←
'ifd' declared without an initial value→
struct sockaddr *sa, *rti_info[RTAX_MAX15];
struct sockaddr_dl *sdl;
char *buf = NULL((void *)0), *next, *lim;
char name[IFNAMSIZ16];
size_t len;
int takeit = 0;
int foundone = 0;

len = get_sysctl(mib, 6, &buf);

memset(&ip_cur, 0, sizeof(ip_cur));
lim = buf + len;
for (next = buf; next < lim; next += rtm->rtm_msglen) {
6
←
Loop condition is false. Execution continues on line 589→
rtm = (struct rt_msghdr *)next;
if (rtm->rtm_version != RTM_VERSION5)
	continue;
switch (rtm->rtm_type) {
case RTM_IFINFO0xe:
	bcopy(next, &ifm, sizeof ifm);
	ifd = &ifm.ifm_data;

	sa = (struct sockaddr *)(next + rtm->rtm_hdrlen);
	get_rtaddrs(ifm.ifm_addrs, sa, rti_info);

	sdl = (struct sockaddr_dl *)rti_info[RTAX_IFP4];
	if (sdl == NULL((void *)0) || sdl->sdl_family != AF_LINK18)
		continue;
	bzero(name, sizeof(name));
	if (sdl->sdl_nlen >= IFNAMSIZ16)
		memcpy(name, sdl->sdl_data, IFNAMSIZ16 - 1);
	else if (sdl->sdl_nlen > 0) 
		memcpy(name, sdl->sdl_data, sdl->sdl_nlen);

	if (interface != NULL((void *)0) && !strcmp(name, interface)) {
		takeit = 1;
	} else if (interface == NULL((void *)0) && foundone == 0 &&
	    isegress(name)) {
		takeit = 1;
		foundone = 1;
	} else
		takeit = 0;
	if (takeit) {
		strlcpy(ip_cur.ift_name, name,
		    sizeof(ip_cur.ift_name));
		ip_cur.ift_ip = ifd->ifi_ipackets;
		ip_cur.ift_ib = ifd->ifi_ibytes;
		ip_cur.ift_ie = ifd->ifi_ierrors;
		ip_cur.ift_iq = ifd->ifi_iqdrops;
		ip_cur.ift_op = ifd->ifi_opackets;
		ip_cur.ift_ob = ifd->ifi_obytes;
		ip_cur.ift_oe = ifd->ifi_oerrors;
		ip_cur.ift_oq = ifd->ifi_oqdrops;
		ip_cur.ift_co = ifd->ifi_collisions;
	}

	sum_cur.ift_ip += ifd->ifi_ipackets;
	sum_cur.ift_ib += ifd->ifi_ibytes;
	sum_cur.ift_ie += ifd->ifi_ierrors;
	sum_cur.ift_iq += ifd->ifi_iqdrops;
	sum_cur.ift_op += ifd->ifi_opackets;
	sum_cur.ift_ob += ifd->ifi_obytes;
	sum_cur.ift_oe += ifd->ifi_oerrors;
	sum_cur.ift_oq += ifd->ifi_oqdrops;
	sum_cur.ift_co += ifd->ifi_collisions;
	break;
}
}
if (interface == NULL((void *)0) && foundone7.1
'foundone' is equal to 0
 == 0) {
7
←
Assuming 'interface' is equal to NULL→
8
←
Taking true branch→
strlcpy(ip_cur.ift_name, name,
    sizeof(ip_cur.ift_name));
ip_cur.ift_ip = ifd->ifi_ipackets;
9
←
Access to field 'ifi_ipackets' results in a dereference of an undefined pointer value (loaded from variable 'ifd')
ip_cur.ift_ib = ifd->ifi_ibytes;
ip_cur.ift_ie = ifd->ifi_ierrors;
ip_cur.ift_iq = ifd->ifi_iqdrops;
ip_cur.ift_op = ifd->ifi_opackets;
ip_cur.ift_ob = ifd->ifi_obytes;
ip_cur.ift_oe = ifd->ifi_oerrors;
ip_cur.ift_oq = ifd->ifi_oqdrops;
ip_cur.ift_co = ifd->ifi_collisions;
}
free(buf);
603}

605static uint64_t
606if_show_fails(uint64_t errors, uint64_t qdrops)
607{
return (errors + qdrops);
609}

611static uint64_t
612if_show_errors(uint64_t errors, uint64_t qdrops)
613{
return (errors);
615}

617static uint64_t
618if_show_qdrops(uint64_t errors, uint64_t qdrops)
619{
return (qdrops);
621}