/usr/src/lib/libedit/readline.c

Bug Summary

File:	src/lib/libedit/readline.c
Warning:	line 976, column 3 Potential leak of memory pointed to by 'result'
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name readline.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/lib/libedit/obj -resource-dir /usr/local/lib/clang/13.0.0 -I . -I /usr/src/lib/libedit -I . -I /usr/src/lib/libedit -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/lib/libedit/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/lib/libedit/readline.c
1/*	$OpenBSD: readline.c,v 1.29 2019/08/14 08:31:00 asou Exp $	*/
2/*	$NetBSD: readline.c,v 1.91 2010/08/28 15:44:59 christos Exp $	*/

4/*-
* Copyright (c) 1997 The NetBSD Foundation, Inc.
* All rights reserved.
*
* This code is derived from software contributed to The NetBSD Foundation
* by Jaromir Dolecek.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/

33#include "config.h"

35#include <sys/types.h>
36#include <sys/stat.h>
37#include <ctype.h>
38#include <dirent.h>
39#include <errno(*__errno()).h>
40#include <fcntl.h>
41#include <limits.h>
42#include <pwd.h>
43#include <setjmp.h>
44#include <stdint.h>
45#include <stdio.h>
46#include <stdlib.h>
47#include <string.h>
48#include <unistd.h>
49#ifdef HAVE_VIS_H1
50#include <vis.h>
51#else
52#include "np/vis.h"
53#endif
54#include "readline/readline.h"
55#include "el.h"
56#include "fcns.h"
57#include "filecomplete.h"

59void rl_prep_terminal(int);
60void rl_deprep_terminal(void);

62/* for rl_complete() */
63#define TAB'\r'		'\r'

65/* see comment at the #ifdef for sense of this */
66/* #define GDB_411_HACK */

68/* readline compatibility stuff - look at readline sources/documentation */
69/* to see what these variables mean */
70const char *rl_library_version = "EditLine wrapper";
71int rl_readline_version = RL_READLINE_VERSION0x0402;
72static char empty[] = { '\0' };
73static char expand_chars[] = { ' ', '\t', '\n', '=', '(', '\0' };
74static char break_chars[] = { ' ', '\t', '\n', '"', '\\', '\'', '`', '@', '$',
  '>', '<', '=', ';', '|', '&', '{', '(', '\0' };
76char *rl_readline_name = empty;
77FILE *rl_instream = NULL((void *)0);
78FILE *rl_outstream = NULL((void *)0);
79int rl_point = 0;
80int rl_end = 0;
81char *rl_line_buffer = NULL((void *)0);
82VCPFunction *rl_linefunc = NULL((void *)0);
83int rl_done = 0;
84VFunction *rl_event_hook = NULL((void *)0);
85KEYMAP_ENTRY_ARRAY emacs_standard_keymap,
  emacs_meta_keymap,
  emacs_ctlx_keymap;

89int history_base = 1;		/* probably never subject to change */
90int history_length = 0;
91int max_input_history = 0;
92char history_expansion_char = '!';
93char history_subst_char = '^';
94char *history_no_expand_chars = expand_chars;
95Function *history_inhibit_expansion_function = NULL((void *)0);
96char *history_arg_extract(int start, int end, const char *str);

98int rl_inhibit_completion = 0;
99int rl_attempted_completion_over = 0;
100char *rl_basic_word_break_characters = break_chars;
101char *rl_completer_word_break_characters = NULL((void *)0);
102char *rl_completer_quote_characters = NULL((void *)0);
103Function *rl_completion_entry_function = NULL((void *)0);
104CPPFunction *rl_attempted_completion_function = NULL((void *)0);
105Function *rl_pre_input_hook = NULL((void *)0);
106Function *rl_startup1_hook = NULL((void *)0);
107int (*rl_getc_function)(FILE *) = NULL((void *)0);
108char *rl_terminal_name = NULL((void *)0);
109int rl_already_prompted = 0;
110int rl_filename_completion_desired = 0;
111int rl_ignore_completion_duplicates = 0;
112int rl_catch_signals = 1;
113int readline_echoing_p = 1;
114int _rl_print_completions_horizontally = 0;
115VFunction *rl_redisplay_function = NULL((void *)0);
116Function *rl_startup_hook = NULL((void *)0);
117VFunction *rl_completion_display_matches_hook = NULL((void *)0);
118VFunction *rl_prep_term_function = (VFunction *)rl_prep_terminal;
119VFunction *rl_deprep_term_function = (VFunction *)rl_deprep_terminal;
120KEYMAP_ENTRY_ARRAY emacs_meta_keymap;

122/*
* The current prompt string.
*/
125char *rl_prompt = NULL((void *)0);
126/*
* This is set to character indicating type of completion being done by
* rl_complete_internal(); this is available for application completion
* functions.
*/
131int rl_completion_type = 0;

133/*
* If more than this number of items results from query for possible
* completions, we ask user if they are sure to really display the list.
*/
137int rl_completion_query_items = 100;

139/*
* List of characters which are word break characters, but should be left
* in the parsed text when it is passed to the completion function.
* Shell uses this to help determine what kind of completing to do.
*/
144char *rl_special_prefixes = NULL((void *)0);

146/*
* This is the character appended to the completed words if at the end of
* the line. Default is ' ' (a space).
*/
150int rl_completion_append_character = ' ';

152/*
* When the history cursor is on the newest element and next_history()
* is called, GNU readline moves the cursor beyond the newest element.
* The editline library does not provide data structures to express
* that state, so we need a local flag.
*/
158static int current_history_valid = 1;

160/* stuff below is used internally by libedit for readline emulation */

162static History *h = NULL((void *)0);
163static EditLine *e = NULL((void *)0);
164static Function *map[256];
165static jmp_buf topbuf;

167/* internal functions */
168static unsigned char	 _el_rl_complete(EditLine *, int);
169static unsigned char	 _el_rl_tstp(EditLine *, int);
170static char		*_get_prompt(EditLine *);
171static int		 _getc_function(EditLine *, wchar_t *);
172static HIST_ENTRY	*_move_history(int);
173static int		 _history_expand_command(const char *, size_t, size_t,
  char **);
175static char		*_rl_compat_sub(const char *, const char *,
  const char *, int);
177static int		 _rl_event_read_char(EditLine *, wchar_t *);
178static void		 _rl_update_pos(void);


181/* ARGSUSED */
182static char *
183_get_prompt(EditLine *el __attribute__((__unused__)))
184{
rl_already_prompted = 1;
return rl_prompt;
187}


190/*
* generic function for moving around history
*/
193static HIST_ENTRY *
194_move_history(int op)
195{
HistEvent ev;
static HIST_ENTRY rl_he;

if (history(h, &ev, op) != 0)
return NULL((void *)0);

rl_he.line = ev.str;
rl_he.data = NULL((void *)0);

return &rl_he;
206}


209/*
* read one key from user defined input function
*/
212static int
213/*ARGSUSED*/
214_getc_function(EditLine *el __attribute__((__unused__)), wchar_t *c)
215{
int i;

i = (*rl_getc_function)(NULL((void *)0));
if (i == -1)
return 0;
*c = (wchar_t)i;
return 1;
223}

225static void
226_resize_fun(EditLine *el, void *a)
227{
const LineInfo *li;
char **ap = a;

li = el_line(el);
/* a cheesy way to get rid of const cast. */
*ap = memchr(li->buffer, *li->buffer, 1);
234}

236static const char _dothistory[] = "/.history";

238static const char *
239_default_history_file(void)
240{
struct passwd *p;
static char path[PATH_MAX1024];

if (*path)
return path;
if ((p = getpwuid(getuid())) == NULL((void *)0))
return NULL((void *)0);
strlcpy(path, p->pw_dir, PATH_MAX1024);
strlcat(path, _dothistory, PATH_MAX1024);
return path;
251}

253/*
* READLINE compatibility stuff
*/

257/*
* Set the prompt
*/
260int
261rl_set_prompt(const char *prompt)
262{
char *p;

if (!prompt)
prompt = "";
if (rl_prompt != NULL((void *)0) && strcmp(rl_prompt, prompt) == 0)
return 0;
if (rl_prompt)
free(rl_prompt);
rl_prompt = strdup(prompt);
if (rl_prompt == NULL((void *)0))
return -1;

while ((p = strchr(rl_prompt, RL_PROMPT_END_IGNORE'\2')) != NULL((void *)0))
*p = RL_PROMPT_START_IGNORE'\1';

return 0;
279}

281/*
* initialize rl compat stuff
*/
284int
285rl_initialize(void)
286{
HistEvent ev;
int editmode = 1;
struct termios t;

current_history_valid = 1;

if (e != NULL((void *)0))
el_end(e);
if (h != NULL((void *)0))
history_end(h);

if (!rl_instream)
rl_instream = stdin(&__sF[0]);
if (!rl_outstream)
rl_outstream = stdout(&__sF[1]);

/*
* See if we don't really want to run the editor
*/
if (tcgetattr(fileno(rl_instream)(!__isthreaded ? ((rl_instream)->_file) : (fileno)(rl_instream
)), &t) != -1 && (t.c_lflag & ECHO0x00000008) == 0)
editmode = 0;

e = el_init(rl_readline_name, rl_instream, rl_outstream, stderr(&__sF[2]));

if (!editmode)
el_set(e, EL_EDITMODE11, 0);

h = history_init();
if (!e || !h)
return -1;

history(h, &ev, H_SETSIZE1, INT_MAX2147483647);	/* unlimited */
history_length = 0;
max_input_history = INT_MAX2147483647;
el_set(e, EL_HIST10, history, h);

/* Setup resize function */
el_set(e, EL_RESIZE23, _resize_fun, &rl_line_buffer);

/* setup getc function if valid */
if (rl_getc_function)
el_set(e, EL_GETCFN13, _getc_function);

/* for proper prompt printing in readline() */
if (rl_set_prompt("") == -1) {
history_end(h);
el_end(e);
return -1;
}
el_set(e, EL_PROMPT0, _get_prompt, RL_PROMPT_START_IGNORE'\1');
el_set(e, EL_SIGNAL3, rl_catch_signals);

/* set default mode to "emacs"-style and read setting afterwards */
/* so this can be overriden */
el_set(e, EL_EDITOR2, "emacs");
if (rl_terminal_name != NULL((void *)0))
el_set(e, EL_TERMINAL1, rl_terminal_name);
else
el_get(e, EL_TERMINAL1, &rl_terminal_name);

/*
* Word completion - this has to go AFTER rebinding keys
* to emacs-style.
*/
el_set(e, EL_ADDFN9, "rl_complete",
   "ReadLine compatible completion function",
   _el_rl_complete);
el_set(e, EL_BIND4, "^I", "rl_complete", NULL((void *)0));

/*
* Send TSTP when ^Z is pressed.
*/
el_set(e, EL_ADDFN9, "rl_tstp",
   "ReadLine compatible suspend function",
   _el_rl_tstp);
el_set(e, EL_BIND4, "^Z", "rl_tstp", NULL((void *)0));

/* read settings from configuration file */
el_source(e, NULL((void *)0));

/*
* Unfortunately, some applications really do use rl_point
* and rl_line_buffer directly.
*/
_resize_fun(e, &rl_line_buffer);
_rl_update_pos();

if (rl_startup_hook)
(*rl_startup_hook)(NULL((void *)0), 0);

return 0;
378}


381/*
* read one line from input stream and return it, chomping
* trailing newline (if there is any)
*/
385char *
386readline(const char *p)
387{
HistEvent ev;
const char * volatile prompt = p;
int count;
const char *ret;
char *buf;
static int used_event_hook;

if (e == NULL((void *)0) || h == NULL((void *)0))
rl_initialize();

rl_done = 0;

(void)setjmp(topbuf);

/* update prompt accordingly to what has been passed */
if (rl_set_prompt(prompt) == -1)
return NULL((void *)0);

if (rl_pre_input_hook)
(*rl_pre_input_hook)(NULL((void *)0), 0);

if (rl_event_hook && !(e->el_flags&NO_TTY0x02)) {
el_set(e, EL_GETCFN13, _rl_event_read_char);
used_event_hook = 1;
}

if (!rl_event_hook && used_event_hook) {
el_set(e, EL_GETCFN13, EL_BUILTIN_GETCFN(((void *)0)));
used_event_hook = 0;
}

rl_already_prompted = 0;

/* get one line from input stream */
ret = el_gets(e, &count);

if (ret && count > 0) {
int lastidx;

buf = strdup(ret);
if (buf == NULL((void *)0))
	return NULL((void *)0);
lastidx = count - 1;
if (buf[lastidx] == '\n')
	buf[lastidx] = '\0';
} else
buf = NULL((void *)0);

history(h, &ev, H_GETSIZE2);
history_length = ev.num;

return buf;
440}

442/*
* history functions
*/

446/*
* is normally called before application starts to use
* history expansion functions
*/
450void
451using_history(void)
452{
if (h == NULL((void *)0) || e == NULL((void *)0))
rl_initialize();
455}


458/*
* substitute ``what'' with ``with'', returning resulting string; if
* globally == 1, substitutes all occurrences of what, otherwise only the
* first one
*/
463static char *
464_rl_compat_sub(const char *str, const char *what, const char *with,
  int globally)
466{
const	char	*s;
char	*r, *result;
size_t	len, with_len, what_len;

len = strlen(str);
with_len = strlen(with);
what_len = strlen(what);

/* calculate length we need for result */
s = str;
while (*s) {
if (*s == *what && !strncmp(s, what, what_len)) {
	len += with_len - what_len;
	if (!globally)
		break;
	s += what_len;
} else
	s++;
}
r = result = malloc(len + 1);
if (result == NULL((void *)0))
return NULL((void *)0);
s = str;
while (*s) {
if (*s == *what && !strncmp(s, what, what_len)) {
	(void)strncpy(r, with, with_len);
	r += with_len;
	s += what_len;
	if (!globally) {
		(void)strlcpy(r, s, len);
		return result;
	}
} else
	*r++ = *s++;
}
*r = '\0';
return result;
504}

506static	char	*last_search_pat;	/* last !?pat[?] search pattern */
507static	char	*last_search_match;	/* last !?pat[?] that matched */

509const char *
510get_history_event(const char *cmd, int *cindex, int qchar)
511{
int idx, sign, sub, num, begin, ret;
size_t len;
char	*pat;
const char *rptr;
HistEvent ev;

idx = *cindex;
if (cmd[idx++] != history_expansion_char)
return NULL((void *)0);

/* find out which event to take */
if (cmd[idx] == history_expansion_char || cmd[idx] == '\0') {
if (history(h, &ev, H_FIRST3) != 0)
	return NULL((void *)0);
*cindex = cmd[idx]? (idx + 1):idx;
return ev.str;
}
sign = 0;
if (cmd[idx] == '-') {
sign = 1;
idx++;
}

if ('0' <= cmd[idx] && cmd[idx] <= '9') {
HIST_ENTRY *rl_he;

num = 0;
while (cmd[idx] && '0' <= cmd[idx] && cmd[idx] <= '9') {
	num = num * 10 + cmd[idx] - '0';
	idx++;
}
if (sign)
	num = history_length - num + 1;

if (!(rl_he = history_get(num)))
	return NULL((void *)0);

*cindex = idx;
return rl_he->line;
}
sub = 0;
if (cmd[idx] == '?') {
sub = 1;
idx++;
}
begin = idx;
while (cmd[idx]) {
if (cmd[idx] == '\n')
	break;
if (sub && cmd[idx] == '?')
	break;
if (!sub && (cmd[idx] == ':' || cmd[idx] == ' '
		    || cmd[idx] == '\t' || cmd[idx] == qchar))
	break;
idx++;
}
len = idx - begin;
if (sub && cmd[idx] == '?')
idx++;
if (sub && len == 0 && last_search_pat && *last_search_pat)
pat = last_search_pat;
else if (len == 0)
return NULL((void *)0);
else {
if ((pat = malloc(len + 1)) == NULL((void *)0))
	return NULL((void *)0);
(void)strncpy(pat, cmd + begin, len);
pat[len] = '\0';
}

if (history(h, &ev, H_CURR8) != 0) {
if (pat != last_search_pat)
	free(pat);
return NULL((void *)0);
}
num = ev.num;

if (sub) {
if (pat != last_search_pat) {
	if (last_search_pat)
		free(last_search_pat);
	last_search_pat = pat;
}
ret = history_search(pat, -1);
} else
ret = history_search_prefix(pat, -1);

if (ret == -1) {
/* restore to end of list on failed search */
history(h, &ev, H_FIRST3);
(void)fprintf(rl_outstream, "%s: Event not found\n", pat);
if (pat != last_search_pat)
	free(pat);
return NULL((void *)0);
}

if (sub && len) {
if (last_search_match && last_search_match != pat)
	free(last_search_match);
last_search_match = pat;
}

if (pat != last_search_pat)
free(pat);

if (history(h, &ev, H_CURR8) != 0)
return NULL((void *)0);
*cindex = idx;
rptr = ev.str;

/* roll back to original position */
(void)history(h, &ev, H_SET7, num);

return rptr;
626}

628/*
* the real function doing history expansion - takes as argument command
* to do and data upon which the command should be executed
* does expansion the way I've understood readline documentation
*
* returns 0 if data was not modified, 1 if it was and 2 if the string
* should be only printed and not executed; in case of error,
* returns -1 and *result points to NULL
* it's the caller's responsibility to free() the string returned in *result
*/
638static int
639_history_expand_command(const char *command, size_t offs, size_t cmdlen,
  char **result)
641{
char *tmp, *search = NULL((void *)0), *aptr;
const char *ptr, *cmd;
static char *from = NULL((void *)0), *to = NULL((void *)0);
int start, end, idx, has_mods = 0;
int p_on = 0, g_on = 0;

*result = NULL((void *)0);
aptr = NULL((void *)0);
ptr = NULL((void *)0);

/* First get event specifier */
idx = 0;

if (strchr(":^*$", command[offs + 1])) {
char str[4];
/*
* "!:" is shorthand for "!!:".
* "!^", "!*" and "!$" are shorthand for
* "!!:^", "!!:*" and "!!:$" respectively.
*/
str[0] = str[1] = '!';
str[2] = '0';
ptr = get_history_event(str, &idx, 0);
idx = (command[offs + 1] == ':')? 1:0;
has_mods = 1;
} else {
if (command[offs + 1] == '#') {
	/* use command so far */
	if ((aptr = malloc(offs + 1)) == NULL((void *)0))
		return -1;
	(void)strncpy(aptr, command, offs);
	aptr[offs] = '\0';
	idx = 1;
} else {
	int	qchar;

	qchar = (offs > 0 && command[offs - 1] == '"')? '"':0;
	ptr = get_history_event(command + offs, &idx, qchar);
}
has_mods = command[offs + idx] == ':';
}

if (ptr == NULL((void *)0) && aptr == NULL((void *)0))
return -1;

if (!has_mods) {
*result = strdup(aptr ? aptr : ptr);
if (aptr)
	free(aptr);
if (*result == NULL((void *)0))
	return -1;
return 1;
}

cmd = command + offs + idx + 1;

/* Now parse any word designators */

if (*cmd == '%')	/* last word matched by ?pat? */
tmp = strdup(last_search_match? last_search_match:"");
else if (strchr("^*$-0123456789", *cmd)) {
start = end = -1;
if (*cmd == '^')
	start = end = 1, cmd++;
else if (*cmd == '$')
	start = -1, cmd++;
else if (*cmd == '*')
	start = 1, cmd++;
      else if (*cmd == '-' || isdigit((unsigned char) *cmd)) {
	start = 0;
	while (*cmd && '0' <= *cmd && *cmd <= '9')
		start = start * 10 + *cmd++ - '0';

	if (*cmd == '-') {
		if (isdigit((unsigned char) cmd[1])) {
			cmd++;
			end = 0;
			while (*cmd && '0' <= *cmd && *cmd <= '9')
				end = end * 10 + *cmd++ - '0';
		} else if (cmd[1] == '$') {
			cmd += 2;
			end = -1;
		} else {
			cmd++;
			end = -2;
		}
	} else if (*cmd == '*')
		end = -1, cmd++;
	else
		end = start;
}
tmp = history_arg_extract(start, end, aptr? aptr:ptr);
if (tmp == NULL((void *)0)) {
	(void)fprintf(rl_outstream, "%s: Bad word specifier",
	    command + offs + idx);
	if (aptr)
		free(aptr);
	return -1;
}
} else
tmp = strdup(aptr? aptr:ptr);

if (aptr)
free(aptr);

if (*cmd == '\0' || ((size_t)(cmd - (command + offs)) >= cmdlen)) {
*result = tmp;
return 1;
}

for (; *cmd; cmd++) {
if (*cmd == ':')
	continue;
else if (*cmd == 'h') {		/* remove trailing path */
	if ((aptr = strrchr(tmp, '/')) != NULL((void *)0))
		*aptr = '\0';
} else if (*cmd == 't') {	/* remove leading path */
	if ((aptr = strrchr(tmp, '/')) != NULL((void *)0)) {
		aptr = strdup(aptr + 1);
		free(tmp);
		tmp = aptr;
	}
} else if (*cmd == 'r') {	/* remove trailing suffix */
	if ((aptr = strrchr(tmp, '.')) != NULL((void *)0))
		*aptr = '\0';
} else if (*cmd == 'e') {	/* remove all but suffix */
	if ((aptr = strrchr(tmp, '.')) != NULL((void *)0)) {
		aptr = strdup(aptr);
		free(tmp);
		tmp = aptr;
	}
} else if (*cmd == 'p')		/* print only */
	p_on = 1;
else if (*cmd == 'g')
	g_on = 2;
else if (*cmd == 's' || *cmd == '&') {
	char *what, *with, delim;
	size_t len, from_len;
	size_t size;

	if (*cmd == '&' && (from == NULL((void *)0) || to == NULL((void *)0)))
		continue;
	else if (*cmd == 's') {
		delim = *(++cmd), cmd++;
		size = 16;
		what = realloc(from, size);
		if (what == NULL((void *)0)) {
			free(from);
			free(tmp);
			return 0;
		}
		len = 0;
		for (; *cmd && *cmd != delim; cmd++) {
			if (*cmd == '\\' && cmd[1] == delim)
				cmd++;
			if (len >= size) {
				char *nwhat;
				nwhat = reallocarray(what,
				    size, 2);
				if (nwhat == NULL((void *)0)) {
					free(what);
					free(tmp);
					return 0;
				}
				size *= 2;
				what = nwhat;
			}
			what[len++] = *cmd;
		}
		what[len] = '\0';
		from = what;
		if (*what == '\0') {
			free(what);
			if (search) {
				from = strdup(search);
				if (from == NULL((void *)0)) {
					free(tmp);
					return 0;
				}
			} else {
				from = NULL((void *)0);
				free(tmp);
				return -1;
			}
		}
		cmd++;	/* shift after delim */
		if (!*cmd)
			continue;

		size = 16;
		with = realloc(to, size);
		if (with == NULL((void *)0)) {
			free(to);
			free(tmp);
			return -1;
		}
		len = 0;
		from_len = strlen(from);
		for (; *cmd && *cmd != delim; cmd++) {
			if (len + from_len + 1 >= size) {
				char *nwith;
				size += from_len + 1;
				nwith = realloc(with, size);
				if (nwith == NULL((void *)0)) {
					free(with);
					free(tmp);
					return -1;
				}
				with = nwith;
			}
			if (*cmd == '&') {
				/* safe */
				(void)strlcpy(&with[len], from,
				    size - len);
				len += from_len;
				continue;
			}
			if (*cmd == '\\'
			    && (*(cmd + 1) == delim
				|| *(cmd + 1) == '&'))
				cmd++;
			with[len++] = *cmd;
		}
		with[len] = '\0';
		to = with;
	}

	aptr = _rl_compat_sub(tmp, from, to, g_on);
	if (aptr) {
		free(tmp);
		tmp = aptr;
	}
	g_on = 0;
}
}
*result = tmp;
return p_on? 2:1;
879}


882/*
* csh-style history expansion
*/
885int
886history_expand(char *str, char **output)
887{
int ret = 0;
size_t idx, i, size;
char *tmp, *result;

if (h == NULL((void *)0) || e == NULL((void *)0))
1
Assuming 'h' is not equal to NULL→
2
←
Assuming 'e' is not equal to NULL→
3
←
Taking false branch→
rl_initialize();

if (history_expansion_char == 0) {
4
←
Assuming 'history_expansion_char' is not equal to 0→
5
←
Taking false branch→
*output = strdup(str);
return 0;
}

*output = NULL((void *)0);
if (str[0] == history_subst_char) {
6
←
Assuming the condition is false→
7
←
Taking false branch→
/* ^foo^foo2^ is equivalent to !!:s^foo^foo2^ */
size_t sz = 4 + strlen(str) + 1;
*output = malloc(sz);
if (*output == NULL((void *)0))
	return 0;
(*output)[0] = (*output)[1] = history_expansion_char;
(*output)[2] = ':';
(*output)[3] = 's';
(void)strlcpy((*output) + 4, str, sz - 4);
str = *output;
} else {
*output = strdup(str);
if (*output == NULL((void *)0))
8
←
Assuming the condition is false→
9
←
Taking false branch→
	return 0;
}

918#define ADD_STRING(what, len, fr){ if (idx + len + 1 > size) { char *nresult = realloc(result
, (size += len + 1)); if (nresult == ((void *)0)) { free(*output
); if ( fr) free(tmp); return 0; } result = nresult; } (void)
strncpy(&result[idx], what, len); idx += len; result[idx]
 = '\0'; }					\
{								\
if (idx + len + 1 > size) {				\
	char *nresult = realloc(result, (size += len + 1));\
	if (nresult == NULL((void *)0)) {				\
		free(*output);				\
		if (/*CONSTCOND*/fr)			\
			free(tmp);			\
		return 0;				\
	}						\
	result = nresult;				\
}							\
(void)strncpy(&result[idx], what, len);			\
idx += len;						\
result[idx] = '\0';					\
}

result = NULL((void *)0);
size = idx = 0;
tmp = NULL((void *)0);
for (i = 0; str[i];) {
10
←
Loop condition is true.  Entering loop body→
44
←
Loop condition is true.  Entering loop body→
int qchar, loop_again;
size_t len, start, j;

qchar = 0;
loop_again = 1;
start = j = i;
945loop:
for (; str[j]; j++) {
11
←
Loop condition is true.  Entering loop body→
25
←
Loop condition is true.  Entering loop body→
45
←
Loop condition is true.  Entering loop body→
	if (str[j] == '\\' &&
12
←
Assuming the condition is false→
26
←
Assuming the condition is false→
	    str[j + 1] == history_expansion_char) {
		size_t sz = strlen(&str[j]) + 1;
		(void)strlcpy(&str[j], &str[j + 1], sz);
		continue;
	}
	if (!loop_again12.1
'loop_again' is 1
1
'loop_again' is 0
1
'loop_again' is 1
) {
13
←
Taking false branch→
27
←
Taking true branch→
46
←
Taking false branch→
		if (isspace((unsigned char) str[j])
		    || str[j] == qchar)
			break;
28
←
 Execution continues on line 966→
	}
	if (str[j] == history_expansion_char
14
←
Assuming the condition is true→
18
←
Taking true branch→
47
←
Assuming the condition is true→
51
←
Taking true branch→
	    && !strchr(history_no_expand_chars, str[j + 1])
15
←
Assuming the condition is true→
48
←
Assuming the condition is true→
	    && (!history_inhibit_expansion_function ||
16
←
Assuming 'history_inhibit_expansion_function' is non-null→
49
←
Assuming 'history_inhibit_expansion_function' is non-null→
	    (*history_inhibit_expansion_function)(str,
17
←
Assuming the condition is true→
50
←
Assuming the condition is true→
	    (int)j) == 0))
		break;
19
←
 Execution continues on line 966→
52
←
 Execution continues on line 966→
}

if (str[j] && loop_again20.1
'loop_again' is 1
1
'loop_again' is 0
) {
20
←
Assuming the condition is true→
21
←
Taking true branch→
29
←
Taking false branch→
53
←
Assuming the condition is false→
	i = j;
	qchar = (j21.1
'j' is <= 0
 > 0 && str[j - 1] == '"' )? '"':0;
	j++;
	if (str[j] == history_expansion_char)
22
←
Assuming the condition is false→
23
←
Taking false branch→
		j++;
	loop_again = 0;
	goto loop;
24
←
Control jumps to line 946→
}
len = i - start;
ADD_STRING(&str[start], len, 0){ if (idx + len + 1 > size) { char *nresult = realloc(result
, (size += len + 1)); if (nresult == ((void *)0)) { free(*output
); if ( 0) free(tmp); return 0; } result = nresult; } (void)strncpy
(&result[idx], &str[start], len); idx += len; result[
idx] = '\0'; };
30
←
Taking true branch→
31
←
Assuming 'nresult' is not equal to null→
32
←
Taking false branch→
54
←
Assuming the condition is true→
55
←
Taking true branch→
56
←
Attempt to reallocate memory→
57
←
Assuming 'nresult' is equal to null→
58
←
Reallocation failed→
59
←
Taking true branch→
60
←
Potential leak of memory pointed to by 'result'

if (str[i] == '\0' || str[i] != history_expansion_char) {
33
←
Assuming the condition is false→
34
←
Taking false branch→
	len = j - i;
	ADD_STRING(&str[i], len, 0){ if (idx + len + 1 > size) { char *nresult = realloc(result
, (size += len + 1)); if (nresult == ((void *)0)) { free(*output
); if ( 0) free(tmp); return 0; } result = nresult; } (void)strncpy
(&result[idx], &str[i], len); idx += len; result[idx]
 = '\0'; };
	if (start == 0)
		ret = 0;
	else
		ret = 1;
	break;
}
ret = _history_expand_command (str, i, (j - i), &tmp);
if (ret > 0 && tmp) {
35
←
Assuming 'ret' is > 0→
36
←
Assuming 'tmp' is non-null→
37
←
Taking true branch→
	len = strlen(tmp);
	ADD_STRING(tmp, len, 1){ if (idx + len + 1 > size) { char *nresult = realloc(result
, (size += len + 1)); if (nresult == ((void *)0)) { free(*output
); if ( 1) free(tmp); return 0; } result = nresult; } (void)strncpy
(&result[idx], tmp, len); idx += len; result[idx] = '\0';
 };
38
←
Assuming the condition is true→
39
←
Taking true branch→
40
←
Memory is allocated→
41
←
Assuming 'nresult' is not equal to null→
42
←
Taking false branch→
}
if (tmp42.1
'tmp' is non-null
) {
43
←
Taking true branch→
	free(tmp);
	tmp = NULL((void *)0);
}
i = j;
}

/* ret is 2 for "print only" option */
if (ret == 2) {
add_history(result);
1002#ifdef GDB_411_HACK
/* gdb 4.11 has been shipped with readline, where */
/* history_expand() returned -1 when the line	  */
/* should not be executed; in readline 2.1+	  */
/* it should return 2 in such a case		  */
ret = -1;
1008#endif
}
free(*output);
*output = result;

return ret;
1014}

1016/*
1017* Return a string consisting of arguments of "str" from "start" to "end".
1018*/
1019char *
1020history_arg_extract(int start, int end, const char *str)
1021{
size_t  i, len, max;
char	**arr, *result = NULL((void *)0);

arr = history_tokenize(str);
if (!arr)
return NULL((void *)0);
if (arr && *arr == NULL((void *)0))
goto out;

for (max = 0; arr[max]; max++)
continue;
max--;

if (start == '$')
start = (int)max;
if (end == '$')
end = (int)max;
if (end < 0)
end = (int)max + end + 1;
if (start < 0)
start = end;

if (start < 0 || end < 0 || (size_t)start > max ||
   (size_t)end > max || start > end)
goto out;

for (i = start, len = 0; i <= (size_t)end; i++)
len += strlen(arr[i]) + 1;
len++;
max = len;
result = malloc(len);
if (result == NULL((void *)0))
goto out;

for (i = start, len = 0; i <= (size_t)end; i++) {
(void)strlcpy(result + len, arr[i], max - len);
len += strlen(arr[i]);
if (i < (size_t)end)
	result[len++] = ' ';
}
result[len] = '\0';

1064out:
for (i = 0; arr[i]; i++)
free(arr[i]);
free(arr);

return result;
1070}

1072/*
* Parse the string into individual tokens,
* similar to how shell would do it.
*/
1076char **
1077history_tokenize(const char *str)
1078{
int size = 1, idx = 0, i, start;
size_t len;
char **result = NULL((void *)0), *temp, delim = '\0';

for (i = 0; str[i];) {
while (isspace((unsigned char) str[i]))
	i++;
start = i;
for (; str[i];) {
	if (str[i] == '\\') {
		if (str[i+1] != '\0')
			i++;
	} else if (str[i] == delim)
		delim = '\0';
	else if (!delim &&
		    (isspace((unsigned char) str[i]) ||
		strchr("()<>;&|$", str[i])))
		break;
	else if (!delim && strchr("'`\"", str[i]))
		delim = str[i];
	if (str[i])
		i++;
}

if (idx + 2 >= size) {
	char **nresult;
	nresult = reallocarray(result, size,
	    2 * sizeof(char *));
	if (nresult == NULL((void *)0)) {
		free(result);
		return NULL((void *)0);
	}
	size *= 2;
	result = nresult;
}
len = i - start;
temp = malloc(len + 1);
if (temp == NULL((void *)0)) {
	for (i = 0; i < idx; i++)
		free(result[i]);
	free(result);
	return NULL((void *)0);
}
(void)strncpy(temp, &str[start], len);
temp[len] = '\0';
result[idx++] = temp;
result[idx] = NULL((void *)0);
if (str[i])
	i++;
}
return result;
1130}


1133/*
* limit size of history record to ``max'' events
*/
1136void
1137stifle_history(int max)
1138{
HistEvent ev;
HIST_ENTRY *he;
int i, len;

if (h == NULL((void *)0) || e == NULL((void *)0))
rl_initialize();

len = history_length;
if (history(h, &ev, H_SETSIZE1, max) == 0) {
max_input_history = max;
if (max < len)
	history_base += len - max;
for (i = 0; i < len - max; i++) {
	he = remove_history(0);
	free(he->data);
	free((void *)he->line);
	free(he);
}
}
1158}


1161/*
* "unlimit" size of history - set the limit to maximum allowed int value
*/
1164int
1165unstifle_history(void)
1166{
HistEvent ev;
int omax;

history(h, &ev, H_SETSIZE1, INT_MAX2147483647);
omax = max_input_history;
max_input_history = INT_MAX2147483647;
return omax;		/* some value _must_ be returned */
1174}


1177int
1178history_is_stifled(void)
1179{

/* cannot return true answer */
return max_input_history != INT_MAX2147483647;
1183}

1185static const char _history_tmp_template[] = "/tmp/.historyXXXXXX";

1187int
1188history_truncate_file (const char *filename, int nlines)
1189{
int ret = 0;
FILE *fp, *tp;
char template[sizeof(_history_tmp_template)];
char buf[4096];
int fd;
char *cp;
off_t off;
int count = 0;
ssize_t left = 0;

if (filename == NULL((void *)0) && (filename = _default_history_file()) == NULL((void *)0))
return errno(*__errno());
if ((fp = fopen(filename, "r+")) == NULL((void *)0))
return errno(*__errno());
strlcpy(template, _history_tmp_template, sizeof(template));
if ((fd = mkstemp(template)) == -1) {
ret = errno(*__errno());
goto out1;
}

if ((tp = fdopen(fd, "r+")) == NULL((void *)0)) {
close(fd);
ret = errno(*__errno());
goto out2;
}

for(;;) {
if (fread(buf, sizeof(buf), 1, fp) != 1) {
	if (ferror(fp)(!__isthreaded ? (((fp)->_flags & 0x0040) != 0) : (ferror
)(fp))) {
		ret = errno(*__errno());
		break;
	}
	if (fseeko(fp, (off_t)sizeof(buf) * count, SEEK_SET0) ==
	    (off_t)-1) {
		ret = errno(*__errno());
		break;
	}
	left = fread(buf, 1, sizeof(buf), fp);
	if (ferror(fp)(!__isthreaded ? (((fp)->_flags & 0x0040) != 0) : (ferror
)(fp))) {
		ret = errno(*__errno());
		break;
	}
	if (left == 0) {
		count--;
		left = sizeof(buf);
	} else if (fwrite(buf, (size_t)left, 1, tp) != 1) {
		ret = errno(*__errno());
		break;
	}
	fflush(tp);
	break;
}
if (fwrite(buf, sizeof(buf), 1, tp) != 1) {
	ret = errno(*__errno());
	break;
}
count++;
}
if (ret)
goto out3;
cp = buf + left - 1;
if(*cp != '\n')
cp++;
for(;;) {
while (--cp >= buf) {
	if (*cp == '\n') {
		if (--nlines == 0) {
			if (++cp >= buf + sizeof(buf)) {
				count++;
				cp = buf;
			}
			break;
		}
	}
}
if (nlines <= 0 || count == 0)
	break;
count--;
if (fseeko(tp, (off_t)sizeof(buf) * count, SEEK_SET0) == -1) {
	ret = errno(*__errno());
	break;
}
if (fread(buf, sizeof(buf), 1, tp) != 1) {
	if (ferror(tp)(!__isthreaded ? (((tp)->_flags & 0x0040) != 0) : (ferror
)(tp))) {
		ret = errno(*__errno());
		break;
	}
	ret = EAGAIN35;
	break;
}
cp = buf + sizeof(buf);
}

if (ret || nlines > 0)
goto out3;

if (fseeko(fp, 0, SEEK_SET0) == (off_t)-1) {
ret = errno(*__errno());
goto out3;
}

if (fseeko(tp, (off_t)sizeof(buf) * count + (cp - buf), SEEK_SET0) ==
   (off_t)-1) {
ret = errno(*__errno());
goto out3;
}

for(;;) {
if ((left = fread(buf, 1, sizeof(buf), tp)) == 0) {
	if (ferror(fp)(!__isthreaded ? (((fp)->_flags & 0x0040) != 0) : (ferror
)(fp)))
		ret = errno(*__errno());
	break;
}
if (fwrite(buf, (size_t)left, 1, fp) != 1) {
	ret = errno(*__errno());
	break;
}
}
fflush(fp);
if((off = ftello(fp)) > 0)
(void)ftruncate(fileno(fp)(!__isthreaded ? ((fp)->_file) : (fileno)(fp)), off);
1311out3:
fclose(tp);
1313out2:
unlink(template);
1315out1:
fclose(fp);

return ret;
1319}


1322/*
* read history from a file given
*/
1325int
1326read_history(const char *filename)
1327{
HistEvent ev;

if (h == NULL((void *)0) || e == NULL((void *)0))
rl_initialize();
if (filename == NULL((void *)0) && (filename = _default_history_file()) == NULL((void *)0))
return errno(*__errno());
return history(h, &ev, H_LOAD17, filename) == -1 ?
   (errno(*__errno()) ? errno(*__errno()) : EINVAL22) : 0;
1336}


1339/*
* write history to a file given
*/
1342int
1343write_history(const char *filename)
1344{
HistEvent ev;

if (h == NULL((void *)0) || e == NULL((void *)0))
rl_initialize();
if (filename == NULL((void *)0) && (filename = _default_history_file()) == NULL((void *)0))
return errno(*__errno());
return history(h, &ev, H_SAVE18, filename) == -1 ?
   (errno(*__errno()) ? errno(*__errno()) : EINVAL22) : 0;
1353}


1356/*
* returns history ``num''th event
*
* returned pointer points to static variable
*/
1361HIST_ENTRY *
1362history_get(int num)
1363{
static HIST_ENTRY she;
HistEvent ev;
int curr_num;

if (h == NULL((void *)0) || e == NULL((void *)0))
rl_initialize();

if (num < history_base)
return NULL((void *)0);

/* save current position */
if (history(h, &ev, H_CURR8) != 0)
return NULL((void *)0);
curr_num = ev.num;

/*
* use H_DELDATA to set to nth history (without delete) by passing
* (void **)-1  -- as in history_set_pos
*/
if (history(h, &ev, H_DELDATA24, num - history_base, (void **)-1) != 0)
goto out;

/* get current entry */
if (history(h, &ev, H_CURR8) != 0)
goto out;
if (history(h, &ev, H_NEXT_EVDATA23, ev.num, &she.data) != 0)
goto out;
she.line = ev.str;

/* restore pointer to where it was */
(void)history(h, &ev, H_SET7, curr_num);

return &she;

1398out:
/* restore pointer to where it was */
(void)history(h, &ev, H_SET7, curr_num);
return NULL((void *)0);
1402}


1405/*
* add the line to history table
*/
1408int
1409add_history(const char *line)
1410{
HistEvent ev;

if (h == NULL((void *)0) || e == NULL((void *)0))
rl_initialize();

(void)history(h, &ev, H_ENTER10, line);
if (history(h, &ev, H_GETSIZE2) == 0)
history_length = ev.num;
current_history_valid = 1;

return !(history_length > 0); /* return 0 if all is okay */
1422}


1425/*
* remove the specified entry from the history list and return it.
*/
1428HIST_ENTRY *
1429remove_history(int num)
1430{
HIST_ENTRY *he;
HistEvent ev;

if (h == NULL((void *)0) || e == NULL((void *)0))
rl_initialize();

if ((he = malloc(sizeof(*he))) == NULL((void *)0))
return NULL((void *)0);

if (history(h, &ev, H_DELDATA24, num, &he->data) != 0) {
free(he);
return NULL((void *)0);
}

he->line = ev.str;
if (history(h, &ev, H_GETSIZE2) == 0)
history_length = ev.num;

return he;
1450}


1453/*
* replace the line and data of the num-th entry
*/
1456HIST_ENTRY *
1457replace_history_entry(int num, const char *line, histdata_t data)
1458{
HIST_ENTRY *he;
HistEvent ev;
int curr_num;

if (h == NULL((void *)0) || e == NULL((void *)0))
rl_initialize();

/* save current position */
if (history(h, &ev, H_CURR8) != 0)
return NULL((void *)0);
curr_num = ev.num;

/* start from the oldest */
if (history(h, &ev, H_LAST4) != 0)
return NULL((void *)0);	/* error */

if ((he = malloc(sizeof(*he))) == NULL((void *)0))
return NULL((void *)0);

/* look forwards for event matching specified offset */
if (history(h, &ev, H_NEXT_EVDATA23, num, &he->data))
goto out;

he->line = strdup(ev.str);
if (he->line == NULL((void *)0))
goto out;

if (history(h, &ev, H_REPLACE25, line, data))
goto out;

/* restore pointer to where it was */
if (history(h, &ev, H_SET7, curr_num))
goto out;

return he;
1494out:
free(he);
return NULL((void *)0);
1497}

1499/*
* clear the history list - delete all entries
*/
1502void
1503clear_history(void)
1504{
HistEvent ev;

(void)history(h, &ev, H_CLEAR19);
history_length = 0;
current_history_valid = 1;
1510}


1513/*
* returns offset of the current history event
*/
1516int
1517where_history(void)
1518{
HistEvent ev;
int curr_num, off;

if (history(h, &ev, H_CURR8) != 0)
return 0;
curr_num = ev.num;

/* start from the oldest */
(void)history(h, &ev, H_LAST4);

/* position is zero-based */
off = 0;
while (ev.num != curr_num && history(h, &ev, H_PREV5) == 0)
off++;

return off;
1535}


1538/*
* returns current history event or NULL if there is no such event
*/
1541HIST_ENTRY *
1542current_history(void)
1543{

return current_history_valid ? _move_history(H_CURR8) : NULL((void *)0);
1546}


1549/*
* returns total number of bytes history events' data are using
*/
1552int
1553history_total_bytes(void)
1554{
HistEvent ev;
int curr_num;
size_t size;

if (history(h, &ev, H_CURR8) != 0)
return -1;
curr_num = ev.num;

(void)history(h, &ev, H_FIRST3);
size = 0;
do
size += strlen(ev.str) * sizeof(*ev.str);
while (history(h, &ev, H_NEXT6) == 0);

/* get to the same position as before */
history(h, &ev, H_PREV_EVENT16, curr_num);

return (int)size;
1573}


1576/*
* sets the position in the history list to ``pos''
*/
1579int
1580history_set_pos(int pos)
1581{
HistEvent ev;
int curr_num;

if (pos >= history_length || pos < 0)
return 0;

(void)history(h, &ev, H_CURR8);
curr_num = ev.num;
current_history_valid = 1;

/*
* use H_DELDATA to set to nth history (without delete) by passing
* (void **)-1
*/
if (history(h, &ev, H_DELDATA24, pos, (void **)-1)) {
(void)history(h, &ev, H_SET7, curr_num);
return 0;
}
return 1;
1601}


1604/*
* returns previous event in history and shifts pointer accordingly
* Note that readline and editline define directions in opposite ways.
*/
1608HIST_ENTRY *
1609previous_history(void)
1610{

if (current_history_valid == 0) {
current_history_valid = 1;
return _move_history(H_CURR8);
}
return _move_history(H_NEXT6);
1617}


1620/*
* returns next event in history and shifts pointer accordingly
*/
1623HIST_ENTRY *
1624next_history(void)
1625{
HIST_ENTRY *he;

he = _move_history(H_PREV5);
if (he == NULL((void *)0))
current_history_valid = 0;
return he;
1632}


1635/*
* searches for first history event containing the str
*/
1638int
1639history_search(const char *str, int direction)
1640{
HistEvent ev;
const char *strp;
int curr_num;

if (history(h, &ev, H_CURR8) != 0)
return -1;
curr_num = ev.num;

for (;;) {
if ((strp = strstr(ev.str, str)) != NULL((void *)0))
	return (int)(strp - ev.str);
if (history(h, &ev, direction < 0 ? H_NEXT6:H_PREV5) != 0)
	break;
}
(void)history(h, &ev, H_SET7, curr_num);
return -1;
1657}


1660/*
* searches for first history event beginning with str
*/
1663int
1664history_search_prefix(const char *str, int direction)
1665{
HistEvent ev;

return (history(h, &ev, direction < 0 ?
   H_PREV_STR14 : H_NEXT_STR13, str));
1670}


1673/*
* search for event in history containing str, starting at offset
* abs(pos); continue backward, if pos<0, forward otherwise
*/
1677/* ARGSUSED */
1678int
1679history_search_pos(const char *str,
   int direction __attribute__((__unused__)), int pos)
1681{
HistEvent ev;
int curr_num, off;

off = (pos > 0) ? pos : -pos;
pos = (pos > 0) ? 1 : -1;

if (history(h, &ev, H_CURR8) != 0)
return -1;
curr_num = ev.num;

if (!history_set_pos(off) || history(h, &ev, H_CURR8) != 0)
return -1;

for (;;) {
if (strstr(ev.str, str))
	return off;
if (history(h, &ev, (pos < 0) ? H_PREV5 : H_NEXT6) != 0)
	break;
}

/* set "current" pointer back to previous state */
(void)history(h, &ev,
   pos < 0 ? H_NEXT_EVENT15 : H_PREV_EVENT16, curr_num);

return -1;
1707}


1710/********************************/
1711/* completion functions */

1713char *
1714tilde_expand(char *name)
1715{
return fn_tilde_expand(name);
1717}

1719char *
1720filename_completion_function(const char *name, int state)
1721{
return fn_filename_completion_function(name, state);
1723}

1725/*
* a completion generator for usernames; returns _first_ username
* which starts with supplied text
* text contains a partial username preceded by random character
* (usually '~'); state is ignored
* it's the caller's responsibility to free the returned value
*/
1732char *
1733username_completion_function(const char *text, int state)
1734{
struct passwd *pwd;

if (text[0] == '\0')
return NULL((void *)0);

if (*text == '~')
text++;

if (state == 0)
setpwent();

while ((pwd = getpwent()) != NULL((void *)0) && text[0] == pwd->pw_name[0]
   && strcmp(text, pwd->pw_name) == 0);

if (pwd == NULL((void *)0)) {
endpwent();
return NULL((void *)0);
}
return strdup(pwd->pw_name);
1754}


1757/*
* el-compatible wrapper to send TSTP on ^Z
*/
1760/* ARGSUSED */
1761static unsigned char
1762_el_rl_tstp(EditLine *el __attribute__((__unused__)), int ch __attribute__((__unused__)))
1763{
(void)kill(0, SIGTSTP18);
return CC_NORM0;
1766}

1768/*
* Display list of strings in columnar format on readline's output stream.
* 'matches' is list of strings, 'len' is number of strings in 'matches',
* 'max' is maximum length of string in 'matches'.
*/
1773void
1774rl_display_match_list(char **matches, int len, int max)
1775{

fn_display_match_list(e, matches, (size_t)len, (size_t)max);
1778}

1780static const char *
1781/*ARGSUSED*/
1782_rl_completion_append_character_function(const char *dummy
  __attribute__((__unused__)))
1784{
static char buf[2];
buf[0] = rl_completion_append_character;
buf[1] = '\0';
return buf;
1789}


1792/*
* complete word at current point
*/
1795/* ARGSUSED */
1796int
1797rl_complete(int ignore __attribute__((__unused__)), int invoking_key)
1798{
static ct_buffer_t wbreak_conv, sprefix_conv;

if (h == NULL((void *)0) || e == NULL((void *)0))
rl_initialize();

if (rl_inhibit_completion) {
char arr[2];
arr[0] = (char)invoking_key;
arr[1] = '\0';
el_insertstr(e, arr);
return CC_REFRESH4;
}

/* Just look at how many global variables modify this operation! */
return fn_complete(e,
   (CPFunction *)rl_completion_entry_function,
   rl_attempted_completion_function,
   ct_decode_string(rl_basic_word_break_characters, &wbreak_conv),
   ct_decode_string(rl_special_prefixes, &sprefix_conv),
   _rl_completion_append_character_function,
   (size_t)rl_completion_query_items,
   &rl_completion_type, &rl_attempted_completion_over,
   &rl_point, &rl_end);


1824}


1827/* ARGSUSED */
1828static unsigned char
1829_el_rl_complete(EditLine *el __attribute__((__unused__)), int ch)
1830{
return (unsigned char)rl_complete(0, ch);
1832}

1834/*
* misc other functions
*/

1838/*
* bind key c to readline-type function func
*/
1841int
1842rl_bind_key(int c, rl_command_func_t *func)
1843{
int retval = -1;

if (h == NULL((void *)0) || e == NULL((void *)0))
rl_initialize();

if (func == rl_insert) {
/* XXX notice there is no range checking of ``c'' */
e->el_map.key[c] = ED_INSERT9;
retval = 0;
}
return retval;
1855}


1858/*
* read one key from input - handles chars pushed back
* to input stream also
*/
1862int
1863rl_read_key(void)
1864{
char fooarr[2 * sizeof(int)];

if (e == NULL((void *)0) || h == NULL((void *)0))
rl_initialize();

return el_getc(e, fooarr);
1871}


1874/*
* reset the terminal
*/
1877/* ARGSUSED */
1878void
1879rl_reset_terminal(const char *p __attribute__((__unused__)))
1880{

if (h == NULL((void *)0) || e == NULL((void *)0))
rl_initialize();
el_reset(e);
1885}


1888/*
* insert character ``c'' back into input stream, ``count'' times
*/
1891int
1892rl_insert(int count, int c)
1893{
char arr[2];

if (h == NULL((void *)0) || e == NULL((void *)0))
rl_initialize();

/* XXX - int -> char conversion can lose on multichars */
arr[0] = c;
arr[1] = '\0';

for (; count > 0; count--)
el_push(e, arr);

return 0;
1907}

1909int
1910rl_insert_text(const char *text)
1911{
if (!text || *text == 0)
return 0;

if (h == NULL((void *)0) || e == NULL((void *)0))
rl_initialize();

if (el_insertstr(e, text) < 0)
return 0;
return (int)strlen(text);
1921}

1923/*ARGSUSED*/
1924int
1925rl_newline(int count, int c)
1926{
/*
* Readline-4.0 appears to ignore the args.
*/
return rl_insert(1, '\n');
1931}

1933/*ARGSUSED*/
1934static unsigned char
1935rl_bind_wrapper(EditLine *el, unsigned char c)
1936{
if (map[c] == NULL((void *)0))
   return CC_ERROR6;

_rl_update_pos();

(*map[c])(NULL((void *)0), c);

/* If rl_done was set by the above call, deal with it here */
if (rl_done)
return CC_EOF2;

return CC_NORM0;
1949}

1951int
1952rl_add_defun(const char *name, Function *fun, int c)
1953{
char dest[8];
if ((size_t)c >= sizeof(map) / sizeof(map[0]) || c < 0)
return -1;
map[(unsigned char)c] = fun;
el_set(e, EL_ADDFN9, name, name, rl_bind_wrapper);
vis(dest, c, VIS_WHITE(0x04 | 0x08 | 0x10)|VIS_NOSLASH0x40, 0);
el_set(e, EL_BIND4, dest, name, NULL((void *)0));
return 0;
1962}

1964void
1965rl_callback_read_char()
1966{
int count = 0, done = 0;
const char *buf = el_gets(e, &count);
char *wbuf;

if (buf == NULL((void *)0) || count-- <= 0)
return;
if (count == 0 && buf[0] == e->el_tty.t_c[TS_IO2][C_EOF4])
done = 1;
if (buf[count] == '\n' || buf[count] == '\r')
done = 2;

if (done && rl_linefunc != NULL((void *)0)) {
el_set(e, EL_UNBUFFERED15, 0);
if (done == 2) {
    if ((wbuf = strdup(buf)) != NULL((void *)0))
	wbuf[count] = '\0';
} else
	wbuf = NULL((void *)0);
(*(void (*)(const char *))rl_linefunc)(wbuf);
//el_set(e, EL_UNBUFFERED, 1);
}
1988}

1990void
1991rl_callback_handler_install(const char *prompt, VCPFunction *linefunc)
1992{
if (e == NULL((void *)0)) {
rl_initialize();
}
(void)rl_set_prompt(prompt);
rl_linefunc = linefunc;
el_set(e, EL_UNBUFFERED15, 1);
1999}

2001void
2002rl_callback_handler_remove(void)
2003{
el_set(e, EL_UNBUFFERED15, 0);
rl_linefunc = NULL((void *)0);
2006}

2008void
2009rl_redisplay(void)
2010{
char a[2];
a[0] = e->el_tty.t_c[TS_IO2][C_REPRINT15];
a[1] = '\0';
el_push(e, a);
2015}

2017int
2018rl_get_previous_history(int count, int key)
2019{
char a[2];
a[0] = key;
a[1] = '\0';
while (count--)
el_push(e, a);
return 0;
2026}

2028void
2029/*ARGSUSED*/
2030rl_prep_terminal(int meta_flag)
2031{
el_set(e, EL_PREP_TERM16, 1);
2033}

2035void
2036rl_deprep_terminal(void)
2037{
el_set(e, EL_PREP_TERM16, 0);
2039}

2041int
2042rl_read_init_file(const char *s)
2043{
return el_source(e, s);
2045}

2047int
2048rl_parse_and_bind(const char *line)
2049{
const char **argv;
int argc;
Tokenizer *tok;

tok = tok_init(NULL((void *)0));
tok_str(tok, line, &argc, &argv);
argc = el_parse(e, argc, argv);
tok_end(tok);
return argc ? 1 : 0;
2059}

2061int
2062rl_variable_bind(const char *var, const char *value)
2063{
/*
* The proper return value is undocument, but this is what the
* readline source seems to do.
*/
return el_set(e, EL_BIND4, "", var, value, NULL((void *)0)) == -1 ? 1 : 0;
2069}

2071void
2072rl_stuff_char(int c)
2073{
char buf[2];

buf[0] = c;
buf[1] = '\0';
el_insertstr(e, buf);
2079}

2081static int
2082_rl_event_read_char(EditLine *el, wchar_t *wc)
2083{
char	ch;
int	n;
ssize_t num_read = 0;

ch = '\0';
*wc = L'\0';
while (rl_event_hook) {

(*rl_event_hook)();

2094#if defined(FIONREAD((unsigned long)0x40000000 | ((sizeof(int) & 0x1fff) <<
 16) | ((('f')) << 8) | ((127))))
if (ioctl(el->el_infd, FIONREAD((unsigned long)0x40000000 | ((sizeof(int) & 0x1fff) <<
 16) | ((('f')) << 8) | ((127))), &n) == -1)
	return -1;
if (n)
	num_read = read(el->el_infd, &ch, 1);
else
	num_read = 0;
2101#elif defined(F_SETFL4) && defined(O_NDELAY0x0004)
if ((n = fcntl(el->el_infd, F_GETFL3)) == -1)
	return -1;
if (fcntl(el->el_infd, F_SETFL4, n|O_NDELAY0x0004) == -1)
	return -1;
num_read = read(el->el_infd, &ch, 1);
if (fcntl(el->el_infd, F_SETFL4, n))
	return -1;
2109#else
/* not non-blocking, but what you gonna do? */
num_read = read(el->el_infd, &ch, 1);
return -1;
2113#endif

if (num_read == -1 && errno(*__errno()) == EAGAIN35)
	continue;
if (num_read == 0)
	continue;
break;
}
if (!rl_event_hook)
el_set(el, EL_GETCFN13, EL_BUILTIN_GETCFN(((void *)0)));
*wc = (wchar_t)ch;
return (int)num_read;
2125}

2127static void
2128_rl_update_pos(void)
2129{
const LineInfo *li = el_line(e);

rl_point = (int)(li->cursor - li->buffer);
rl_end = (int)(li->lastchar - li->buffer);
2134}

2136void
2137rl_get_screen_size(int *rows, int *cols)
2138{
if (rows)
el_get(e, EL_GETTC17, "li", rows);
if (cols)
el_get(e, EL_GETTC17, "co", cols);
2143}

2145void
2146rl_set_screen_size(int rows, int cols)
2147{
char buf[64];
(void)snprintf(buf, sizeof(buf), "%d", rows);
el_set(e, EL_SETTC6, "li", buf, NULL((void *)0));
(void)snprintf(buf, sizeof(buf), "%d", cols);
el_set(e, EL_SETTC6, "co", buf, NULL((void *)0));
2153}

2155char **
2156rl_completion_matches(const char *str, rl_compentry_func_t *fun)
2157{
size_t len, max, i, j, min;
char **list, *match, *a, *b;

len = 1;
max = 10;
if ((list = reallocarray(NULL((void *)0), max, sizeof(*list))) == NULL((void *)0))
return NULL((void *)0);

while ((match = (*fun)(str, (int)(len - 1))) != NULL((void *)0)) {
list[len++] = match;
if (len == max) {
	char **nl;
	max += 10;
	if ((nl = reallocarray(list, max, sizeof(*nl))) == NULL((void *)0))
		goto out;
	list = nl;
}
}
if (len == 1)
goto out;
list[len] = NULL((void *)0);
if (len == 2) {
if ((list[0] = strdup(list[1])) == NULL((void *)0))
	goto out;
return list;
}
qsort(&list[1], len - 1, sizeof(*list),
   (int (*)(const void *, const void *)) strcmp);
min = SIZE_MAX0xffffffffffffffffUL;
for (i = 1, a = list[i]; i < len - 1; i++, a = b) {
b = list[i + 1];
for (j = 0; a[j] && a[j] == b[j]; j++)
	continue;
if (min > j)
	min = j;
}
if (min == 0 && *str) {
if ((list[0] = strdup(str)) == NULL((void *)0))
	goto out;
} else {
if ((list[0] = malloc(min + 1)) == NULL((void *)0))
	goto out;
(void)memcpy(list[0], list[1], min);
list[0][min] = '\0';
}
return list;

2205out:
free(list);
return NULL((void *)0);
2208}

2210char *
2211rl_filename_completion_function (const char *text, int state)
2212{
return fn_filename_completion_function(text, state);
2214}

2216void
2217rl_forced_update_display(void)
2218{
el_set(e, EL_REFRESH20);
2220}

2222int
2223_rl_abort_internal(void)
2224{
el_beep(e);
longjmp(topbuf, 1);
/*NOTREACHED*/
2228}

2230int
2231_rl_qsort_string_compare(char **s1, char **s2)
2232{
return strcoll(*s1, *s2);
2234}

2236HISTORY_STATE *
2237history_get_history_state(void)
2238{
HISTORY_STATE *hs;

if ((hs = malloc(sizeof(HISTORY_STATE))) == NULL((void *)0))
return NULL((void *)0);
hs->length = history_length;
return hs;
2245}

2247int
2248/*ARGSUSED*/
2249rl_kill_text(int from, int to)
2250{
return 0;
2252}

2254Keymap
2255rl_make_bare_keymap(void)
2256{
return NULL((void *)0);
2258}

2260Keymap
2261rl_get_keymap(void)
2262{
return NULL((void *)0);
2264}

2266void
2267/*ARGSUSED*/
2268rl_set_keymap(Keymap k)
2269{
2270}

2272int
2273/*ARGSUSED*/
2274rl_generic_bind(int type, const char * keyseq, const char * data, Keymap k)
2275{
return 0;
2277}

2279int
2280/*ARGSUSED*/
2281rl_bind_key_in_map(int key, rl_command_func_t *fun, Keymap k)
2282{
return 0;
2284}

2286/* unsupported, but needed by python */
2287void
2288rl_cleanup_after_signal(void)
2289{
2290}

2292int
2293rl_on_new_line(void)
2294{
return 0;
2296}

2298int
2299/*ARGSUSED*/
2300rl_set_keyboard_input_timeout(int u __attribute__((__unused__)))
2301{
return 0;
2303}