/usr/src/games/arithmetic/arithmetic.c

Bug Summary

File:	src/games/arithmetic/arithmetic.c
Warning:	line 207, column 13 The left operand of '<' is a garbage value

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name arithmetic.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/games/arithmetic/obj -resource-dir /usr/local/lib/clang/13.0.0 -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/games/arithmetic/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/games/arithmetic/arithmetic.c

1/*	$OpenBSD: arithmetic.c,v 1.28 2018/12/27 17:27:23 tedu Exp $	*/

3/*
* Copyright (c) 1989, 1993
*	The Regents of the University of California.  All rights reserved.
*
* This code is derived from software contributed to Berkeley by
* Eamonn McManus of Trinity College Dublin.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of the University nor the names of its contributors
*    may be used to endorse or promote products derived from this software
*    without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

35/*
* By Eamonn McManus, Trinity College Dublin <emcmanus@cs.tcd.ie>.
*
* The operation of this program mimics that of the standard Unix game
* `arithmetic'.  I've made it as close as I could manage without examining
* the source code.  The principal differences are:
*
* The method of biasing towards numbers that had wrong answers in the past
* is different; original `arithmetic' seems to retain the bias forever,
* whereas this program lets the bias gradually decay as it is used.
*
* Original `arithmetic' delays for some period (3 seconds?) after printing
* the score.  I saw no reason for this delay, so I scrapped it.
*
* There is no longer a limitation on the maximum range that can be supplied
* to the program.  The original program required it to be less than 100.
* Anomalous results may occur with this program if ranges big enough to
* allow overflow are given.
*
* I have obviously not attempted to duplicate bugs in the original.  It
* would go into an infinite loop if invoked as `arithmetic / 0'.  It also
* did not recognise an EOF in its input, and would continue trying to read
* after it.  It did not check that the input was a valid number, treating any
* garbage as 0.  Finally, it did not flush stdout after printing its prompt,
* so in the unlikely event that stdout was not a terminal, it would not work
* properly.
*/

63#include <err.h>
64#include <ctype.h>
65#include <limits.h>
66#include <signal.h>
67#include <stdio.h>
68#include <stdlib.h>
69#include <string.h>
70#include <time.h>
71#include <unistd.h>

73int	getrandom(uint32_t, int, int);
74__dead__attribute__((__noreturn__)) void	intr(int);
75int	opnum(int);
76void	penalise(int, int, int);
77int	problem(void);
78void	showstats(void);
79__dead__attribute__((__noreturn__)) void	usage(void);

81const char keylist[] = "+-x/";
82const char defaultkeys[] = "+-";
83const char *keys = defaultkeys;
84int nkeys = sizeof(defaultkeys) - 1;
85uint32_t rangemax = 10;
86int nright, nwrong;
87time_t qtime;
88#define	NQUESTS20	20

90/*
* Select keys from +-x/ to be asked addition, subtraction, multiplication,
* and division problems.  More than one key may be given.  The default is
* +-.  Specify a range to confine the operands to 0 - range.  Default upper
* bound is 10.  After every NQUESTS questions, statistics on the performance
* so far are printed.
*/
97int
98main(int argc, char *argv[])
99{
int ch, cnt;
const char *errstr;

if (pledge("stdio", NULL((void *)0)) == -1)
1
Assuming the condition is false→
2
←
Taking false branch→
err(1, "pledge");

while ((ch = getopt(argc, argv, "hr:o:")) != -1)
3
←
Assuming the condition is false→
4
←
Loop condition is false. Execution continues on line 126→
switch(ch) {
case 'o': {
	const char *p;

	for (p = keys = optarg; *p; ++p)
		if (!strchr(keylist, *p))
			errx(1, "unknown key.");
	nkeys = p - optarg;
	break;
}
case 'r':
	rangemax = strtonum(optarg, 1, (1ULL<<31)-1, &errstr);
	if (errstr)
		errx(1, "invalid range, %s: %s", errstr, optarg);
	break;
case 'h':
default:
	usage();
}
if (argc -= optind)
5
←
Assuming the condition is false→
6
←
Taking false branch→
usage();

(void)signal(SIGINT2, intr);

/* Now ask the questions. */
for (;;) {
7
←
Loop condition is true.  Entering loop body→
for (cnt = NQUESTS20; cnt--;)
8
←
Loop condition is true.  Entering loop body→
	if (problem() == EOF(-1))
9
←
Calling 'problem'→
		intr(0);   /* Print score and exit */
showstats();
}
138}

140/* Handle interrupt character.  Print score and exit. */
141void
142intr(int dummy)
143{
showstats();
_exit(0);
146}

148/* Print score.  Original `arithmetic' had a delay after printing it. */
149void
150showstats(void)
151{
if (nright + nwrong > 0) {
(void)printf("\n\nRights %d; Wrongs %d; Score %d%%",
    nright, nwrong, (int)(100L * nright / (nright + nwrong)));
if (nright > 0)
(void)printf("\nTotal time %ld seconds; %.1f seconds per problem\n\n",
	    (long)qtime, (float)qtime / nright);
}
(void)printf("\n");
160}

162/*
* Pick a problem and ask it.  Keeps asking the same problem until supplied
* with the correct answer, or until EOF or interrupt is typed.  Problems are
* selected such that the right operand and either the left operand (for +, x)
* or the correct result (for -, /) are in the range 0 to rangemax.  Each wrong
* answer causes the numbers in the problem to be penalised, so that they are
* more likely to appear in subsequent problems.
*/
170int
171problem(void)
172{
char *p;
time_t start, finish;
int left, op, right, result;
10
←
'result' declared without an initial value→
char line[80];

op = keys[arc4random_uniform(nkeys)];
if (op != '/')
11
←
Assuming the condition is true→
12
←
Taking true branch→
right = getrandom(rangemax + 1, op, 1);
181retry:
/* Get the operands. */
switch (op) {
13
←
'Default' branch taken. Execution continues on line 207→
case '+':
left = getrandom(rangemax + 1, op, 0);
result = left + right;
break;
case '-':
result = getrandom(rangemax + 1, op, 0);
left = right + result;
break;
case 'x':
left = getrandom(rangemax + 1, op, 0);
result = left * right;
break;
case '/':
right = getrandom(rangemax, op, 1) + 1;
result = getrandom(rangemax + 1, op, 0);
left = right * result + arc4random_uniform(right);
break;
}

/*
* A very big maxrange could cause negative values to pop
* up, owing to overflow.
*/
if (result < 0 || left < 0)
14
←
The left operand of '<' is a garbage value
goto retry;

(void)printf("%d %c %d =   ", left, op, right);
(void)fflush(stdout(&__sF[1]));
(void)time(&start);

/*
* Keep looping until the correct answer is given, or until EOF or
* interrupt is typed.
*/
for (;;) {
if (!fgets(line, sizeof(line), stdin(&__sF[0]))) {
	(void)printf("\n");
	return(EOF(-1));
}
for (p = line; isspace((unsigned char)*p); ++p);
if (!isdigit((unsigned char)*p)) {
	(void)printf("Please type a number.\n");
	continue;
}
if (atoi(p) == result) {
	(void)printf("Right!\n");
	++nright;
	break;
}
/* Wrong answer; penalise and ask again. */
(void)printf("What?\n");
++nwrong;
penalise(right, op, 1);
if (op == 'x' || op == '+')
	penalise(left, op, 0);
else
	penalise(result, op, 0);
}

/*
* Accumulate the time taken.  Obviously rounding errors happen here;
* however they should cancel out, because some of the time you are
* charged for a partially elapsed second at the start, and some of
* the time you are not charged for a partially elapsed second at the
* end.
*/
(void)time(&finish);
qtime += finish - start;
return(0);
253}

255/*
* Here is the code for accumulating penalties against the numbers for which
* a wrong answer was given.  The right operand and either the left operand
* (for +, x) or the result (for -, /) are stored in a list for the particular
* operation, and each becomes more likely to appear again in that operation.
* Initially, each number is charged a penalty of WRONGPENALTY, giving it that
* many extra chances of appearing.  Each time it is selected because of this,
* its penalty is decreased by one; it is removed when it reaches 0.
*
* The penalty[] array gives the sum of all penalties in the list for
* each operation and each operand.  The penlist[] array has the lists of
* penalties themselves.
*/

269uint32_t penalty[sizeof(keylist) - 1][2];
270struct penalty {
int value;		/* Penalised value. */
uint32_t penalty;	/* Its penalty. */
struct penalty *next;
274} *penlist[sizeof(keylist) - 1][2];

276#define	WRONGPENALTY5	5	/* Perhaps this should depend on maxrange. */

278/*
* Add a penalty for the number `value' to the list for operation `op',
* operand number `operand' (0 or 1).  If we run out of memory, we just
* forget about the penalty (how likely is this, anyway?).
*/
283void
284penalise(int value, int op, int operand)
285{
struct penalty *p;

op = opnum(op);
if ((p = malloc(sizeof(*p))) == NULL((void *)0))
return;
p->next = penlist[op][operand];
penlist[op][operand] = p;
penalty[op][operand] += p->penalty = WRONGPENALTY5;
p->value = value;
295}

297/*
* Select a random value from 0 to maxval - 1 for operand `operand' (0 or 1)
* of operation `op'.  The random number we generate is either used directly
* as a value, or represents a position in the penalty list.  If the latter,
* we find the corresponding value and return that, decreasing its penalty.
*/
303int
304getrandom(uint32_t maxval, int op, int operand)
305{
uint32_t value;
struct penalty **pp, *p;

op = opnum(op);
value = arc4random_uniform(maxval + penalty[op][operand]);

/*
* 0 to maxval - 1 is a number to be used directly; bigger values
* are positions to be located in the penalty list.
*/
if (value < maxval)
return((int)value);
value -= maxval;

/*
* Find the penalty at position `value'; decrement its penalty and
* delete it if it reaches 0; return the corresponding value.
*/
for (pp = &penlist[op][operand]; (p = *pp) != NULL((void *)0); pp = &p->next) {
if (p->penalty > value) {
	value = p->value;
	penalty[op][operand]--;
	if (--(p->penalty) <= 0) {
		p = p->next;
		(void)free((char *)*pp);
		*pp = p;
	}
	return(value);
}
value -= p->penalty;
}
/*
* We can only get here if the value from the penalty[] array doesn't
* correspond to the actual sum of penalties in the list.  Provide an
* obscure message.
*/
errx(1, "bug: inconsistent penalties.");
343}

345/* Return an index for the character op, which is one of [+-x/]. */
346int
347opnum(int op)
348{
char *p;

if (op == 0 || (p = strchr(keylist, op)) == NULL((void *)0))
errx(1, "bug: op %c not in keylist %s.", op, keylist);
return(p - keylist);
354}

356/* Print usage message and quit. */
357void
358usage(void)
359{
extern char *__progname;
(void)fprintf(stderr(&__sF[2]), "usage: %s [-o +-x/] [-r range]\n",  __progname);
exit(1);
363}