/usr/src/usr.bin/sed/process.c

Bug Summary

File:	src/usr.bin/sed/process.c
Warning:	line 613, column 28 Array access (via field 'space') results in a null pointer dereference

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name process.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.bin/sed/obj -resource-dir /usr/local/lib/clang/13.0.0 -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.bin/sed/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.bin/sed/process.c

1/*	$OpenBSD: process.c,v 1.34 2018/11/14 10:59:33 martijn Exp $	*/

3/*-
* Copyright (c) 1992 Diomidis Spinellis.
* Copyright (c) 1992, 1993
*	The Regents of the University of California.  All rights reserved.
*
* This code is derived from software contributed to Berkeley by
* Diomidis Spinellis of Imperial College, University of London.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of the University nor the names of its contributors
*    may be used to endorse or promote products derived from this software
*    without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

36#include <sys/types.h>
37#include <sys/stat.h>
38#include <sys/uio.h>

40#include <ctype.h>
41#include <errno(*__errno()).h>
42#include <fcntl.h>
43#include <limits.h>
44#include <regex.h>
45#include <stdio.h>
46#include <stdlib.h>
47#include <string.h>
48#include <unistd.h>

50#include "defs.h"
51#include "extern.h"

53static SPACE HS, PS, SS;
54#define	pdPS.deleted		PS.deleted
55#define	psPS.space		PS.space
56#define	pslPS.len		PS.len
57#define	psanlPS.append_newline		PS.append_newline
58#define	hsHS.space		HS.space
59#define	hslHS.len		HS.len

61static inline int	 applies(struct s_command *);
62static void		 flush_appends(void);
63static void		 lputs(char *);
64static inline int	 regexec_e(regex_t *, const char *, int, int, size_t,
	     size_t);
66static void		 regsub(SPACE *, char *, char *);
67static int		 substitute(struct s_command *);

69struct s_appends *appends;	/* Array of pointers to strings to append. */
70static size_t appendx;		/* Index into appends array. */
71size_t appendnum;		/* Size of appends array. */

73static int lastaddr;		/* Set by applies if last address of a range. */
74static int sdone;		/* If any substitutes since last line input. */
		/* Iov structure for 'w' commands. */
76static regex_t *defpreg;
77size_t maxnsub;
78regmatch_t *match;

80#define OUT()do { fwrite(PS.space, 1, PS.len, outfile); if (PS.append_newline
) fputc('\n', outfile);} while (0) do {\
fwrite(psPS.space, 1, pslPS.len, outfile);\
if (psanlPS.append_newline) fputc('\n', outfile);\
83} while (0)

85void
86process(void)
87{
struct s_command *cp;
SPACE tspace;
size_t len, oldpsl;
char *p;

for (linenum = 0; mf_fgets(&PS, REPLACE);) {
1
Value assigned to 'HS.space'→
2
←
Loop condition is true.  Entering loop body→
pdPS.deleted = 0;
95top:
cp = prog;
97redirect:
while (cp != NULL((void *)0)) {
3
←
Assuming 'cp' is not equal to NULL→
4
←
Loop condition is true.  Entering loop body→
	if (!applies(cp)) {
5
←
Taking false branch→
		cp = cp->next;
		continue;
	}
	switch (cp->code) {
6
←
Control jumps to 'case 120:'  at line 236→
	case '{':
		cp = cp->u.c;
		goto redirect;
	case 'a':
		if (appendx >= appendnum) {
			appends = xreallocarray(appends,
			    appendnum,
			    2 * sizeof(struct s_appends));
			appendnum *= 2;
		}
		appends[appendx].type = AP_STRING;
		appends[appendx].s = cp->t;
		appends[appendx].len = strlen(cp->t);
		appendx++;
		break;
	case 'b':
		cp = cp->u.c;
		goto redirect;
	case 'c':
		pdPS.deleted = 1;
		pslPS.len = 0;
		if (cp->a2 == NULL((void *)0) || lastaddr || lastline())
			(void)fprintf(outfile, "%s", cp->t);
		break;
	case 'd':
		pdPS.deleted = 1;
		goto new;
	case 'D':
		if (pdPS.deleted)
			goto new;
		if (pslPS.len == 0 ||
		    (p = memchr(psPS.space, '\n', pslPS.len)) == NULL((void *)0)) {
			pdPS.deleted = 1;
			goto new;
		} else {
			pslPS.len -= (p + 1) - psPS.space;
			memmove(psPS.space, p + 1, pslPS.len);
			goto top;
		}
	case 'g':
		cspace(&PS, hsHS.space, hslHS.len, REPLACE);
		break;
	case 'G':
		cspace(&PS, "\n", 1, 0);
		cspace(&PS, hsHS.space, hslHS.len, 0);
		break;
	case 'h':
		cspace(&HS, psPS.space, pslPS.len, REPLACE);
		break;
	case 'H':
		cspace(&HS, "\n", 1, 0);
		cspace(&HS, psPS.space, pslPS.len, 0);
		break;
	case 'i':
		(void)fprintf(outfile, "%s", cp->t);
		break;
	case 'l':
		lputs(psPS.space);
		break;
	case 'n':
		if (!nflag && !pdPS.deleted)
			OUT()do { fwrite(PS.space, 1, PS.len, outfile); if (PS.append_newline
) fputc('\n', outfile);} while (0);
		flush_appends();
		if (!mf_fgets(&PS, REPLACE))
			exit(0);
		pdPS.deleted = 0;
		break;
	case 'N':
		flush_appends();
		cspace(&PS, "\n", 1, 0);
		if (!mf_fgets(&PS, 0))
			exit(0);
		break;
	case 'p':
		if (pdPS.deleted)
			break;
		OUT()do { fwrite(PS.space, 1, PS.len, outfile); if (PS.append_newline
) fputc('\n', outfile);} while (0);
		break;
	case 'P':
		if (pdPS.deleted)
			break;
		if ((p = memchr(psPS.space, '\n', pslPS.len)) != NULL((void *)0)) {
			oldpsl = pslPS.len;
			pslPS.len = p - psPS.space;
			psanlPS.append_newline = 1;
			OUT()do { fwrite(PS.space, 1, PS.len, outfile); if (PS.append_newline
) fputc('\n', outfile);} while (0);
			pslPS.len = oldpsl;
		} else {
			OUT()do { fwrite(PS.space, 1, PS.len, outfile); if (PS.append_newline
) fputc('\n', outfile);} while (0);
		}
		break;
	case 'q':
		if (!nflag && !pdPS.deleted)
			OUT()do { fwrite(PS.space, 1, PS.len, outfile); if (PS.append_newline
) fputc('\n', outfile);} while (0);
		flush_appends();
		finish_file();
		exit(0);
	case 'r':
		if (appendx >= appendnum) {
			appends = xreallocarray(appends,
			    appendnum,
			    2 * sizeof(struct s_appends));
			appendnum *= 2;
		}
		appends[appendx].type = AP_FILE;
		appends[appendx].s = cp->t;
		appends[appendx].len = strlen(cp->t);
		appendx++;
		break;
	case 's':
		sdone |= substitute(cp);
		break;
	case 't':
		if (sdone) {
			sdone = 0;
			cp = cp->u.c;
			goto redirect;
		}
		break;
	case 'w':
		if (pdPS.deleted)
			break;
		if (cp->u.fd == -1 && (cp->u.fd = open(cp->t,
		    O_WRONLY0x0001|O_APPEND0x0008|O_CREAT0x0200|O_TRUNC0x0400,
		    DEFFILEMODE(0000400|0000200|0000040|0000020|0000004|0000002))) == -1)
			error(FATAL1, "%s: %s",
			    cp->t, strerror(errno(*__errno())));
		if ((size_t)write(cp->u.fd, psPS.space, pslPS.len) != pslPS.len ||
		    write(cp->u.fd, "\n", 1) != 1)
			error(FATAL1, "%s: %s",
			    cp->t, strerror(errno(*__errno())));
		break;
	case 'x':
		if (hsHS.space == NULL((void *)0))
7
←
Assuming field 'space' is equal to NULL→
8
←
Taking true branch→
			cspace(&HS, "", 0, REPLACE);
9
←
Calling 'cspace'→
		tspace = PS;
		PS = HS;
		psanlPS.append_newline = tspace.append_newline;
		HS = tspace;
		break;
	case 'y':
		if (pdPS.deleted || pslPS.len == 0)
			break;
		for (p = psPS.space, len = pslPS.len; len--; ++p)
			*p = cp->u.y[(unsigned char)*p];
		break;
	case ':':
	case '}':
		break;
	case '=':
		(void)fprintf(outfile, "%lu\n", linenum);
	}
	cp = cp->next;
} /* for all cp */

259new:		if (!nflag && !pdPS.deleted)
	OUT()do { fwrite(PS.space, 1, PS.len, outfile); if (PS.append_newline
) fputc('\n', outfile);} while (0);
flush_appends();
} /* for all lines */
263}

265/*
* TRUE if the address passed matches the current program state
* (lastline, linenumber, ps).
*/
269#define	MATCH(a)(a)->type == AT_RE ? regexec_e((a)->u.r, PS.space, 0, 1
, 0, PS.len) : (a)->type == AT_LINE ? linenum == (a)->u
.l : lastline()						\
(a)->type == AT_RE ? regexec_e((a)->u.r, psPS.space, 0, 1, 0, pslPS.len) :	\
   (a)->type == AT_LINE ? linenum == (a)->u.l : lastline()

273/*
* Return TRUE if the command applies to the current line.  Sets the inrange
* flag to process ranges.  Interprets the non-select (``!'') flag.
*/
277static inline int
278applies(struct s_command *cp)
279{
int r;

lastaddr = 0;
if (cp->a1 == NULL((void *)0) && cp->a2 == NULL((void *)0))
r = 1;
else if (cp->a2)
if (cp->inrange) {
	if (MATCH(cp->a2)(cp->a2)->type == AT_RE ? regexec_e((cp->a2)->u.r
, PS.space, 0, 1, 0, PS.len) : (cp->a2)->type == AT_LINE
 ? linenum == (cp->a2)->u.l : lastline()) {
		cp->inrange = 0;
		lastaddr = 1;
	}
	r = 1;
} else if (MATCH(cp->a1)(cp->a1)->type == AT_RE ? regexec_e((cp->a1)->u.r
, PS.space, 0, 1, 0, PS.len) : (cp->a1)->type == AT_LINE
 ? linenum == (cp->a1)->u.l : lastline()) {
	/*
	 * If the second address is a number less than or
	 * equal to the line number first selected, only
	 * one line shall be selected.
	 *	-- POSIX 1003.2
	 */
	if (cp->a2->type == AT_LINE &&
	    linenum >= cp->a2->u.l)
		lastaddr = 1;
	else
		cp->inrange = 1;
	r = 1;
} else
	r = 0;
else
r = MATCH(cp->a1)(cp->a1)->type == AT_RE ? regexec_e((cp->a1)->u.r
, PS.space, 0, 1, 0, PS.len) : (cp->a1)->type == AT_LINE
 ? linenum == (cp->a1)->u.l : lastline();
return (cp->nonsel ? !r : r);
310}

312/*
* Reset all inrange markers.
*/
315void
316resetstate(void)
317{
struct s_command *cp;

free(HS.back);
memset(&HS, 0, sizeof(HS));

for (cp = prog; cp; cp = cp->code == '{' ? cp->u.c : cp->next)
if (cp->a2)
	cp->inrange = 0;
326}

328/*
* substitute --
*	Do substitutions in the pattern space.  Currently, we build a
*	copy of the new pattern space in the substitute space structure
*	and then swap them.
*/
334static int
335substitute(struct s_command *cp)
336{
SPACE tspace;
regex_t *re;
regoff_t slen;
int n, lastempty;
regoff_t le = 0;
char *s;

s = psPS.space;
re = cp->u.s->re;
if (re == NULL((void *)0)) {
if (defpreg != NULL((void *)0) && cp->u.s->maxbref > defpreg->re_nsub) {
	linenum = cp->u.s->linenum;
	error(COMPILE2, "\\%d not defined in the RE",
	    cp->u.s->maxbref);
}
}
if (!regexec_e(re, psPS.space, 0, 0, 0, pslPS.len))
return (0);

SS.len = 0;				/* Clean substitute space. */
slen = pslPS.len;
n = cp->u.s->n;
lastempty = 1;

do {
/* Copy the leading retained string. */
if (n <= 1 && (match[0].rm_so > le))
	cspace(&SS, s, match[0].rm_so - le, APPEND);

/* Skip zero-length matches right after other matches. */
if (lastempty || (match[0].rm_so - le) ||
    match[0].rm_so != match[0].rm_eo) {
	if (n <= 1) {
		/* Want this match: append replacement. */
		regsub(&SS, psPS.space, cp->u.s->new);
		if (n == 1)
			n = -1;
	} else {
		/* Want a later match: append original. */
		if (match[0].rm_eo - le)
			cspace(&SS, s, match[0].rm_eo - le,
			    APPEND);
		n--;
	}
}

/* Move past this match. */
s = psPS.space + match[0].rm_eo;
slen = pslPS.len - match[0].rm_eo;
le = match[0].rm_eo;

/*
 * After a zero-length match, advance one byte,
 * and at the end of the line, terminate.
 */
if (match[0].rm_so == match[0].rm_eo) {
	if (*s == '\0' || *s == '\n')
		slen = -1;
	else
		slen--;
	if (*s != '\0') {
		cspace(&SS, s++, 1, APPEND);
		le++;
	}
	lastempty = 1;
} else
	lastempty = 0;

} while (n >= 0 && slen >= 0 &&
   regexec_e(re, psPS.space, REG_NOTBOL00001, 0, le, pslPS.len));

/* Did not find the requested number of matches. */
if (n > 0)
return (0);

/* Copy the trailing retained string. */
if (slen > 0)
cspace(&SS, s, slen, APPEND);

/*
* Swap the substitute space and the pattern space, and make sure
* that any leftover pointers into stdio memory get lost.
*/
tspace = PS;
PS = SS;
psanlPS.append_newline = tspace.append_newline;
SS = tspace;
SS.space = SS.back;

/* Handle the 'p' flag. */
if (cp->u.s->p)
OUT()do { fwrite(PS.space, 1, PS.len, outfile); if (PS.append_newline
) fputc('\n', outfile);} while (0);

/* Handle the 'w' flag. */
if (cp->u.s->wfile && !pdPS.deleted) {
if (cp->u.s->wfd == -1 && (cp->u.s->wfd = open(cp->u.s->wfile,
    O_WRONLY0x0001|O_APPEND0x0008|O_CREAT0x0200|O_TRUNC0x0400, DEFFILEMODE(0000400|0000200|0000040|0000020|0000004|0000002))) == -1)
	error(FATAL1, "%s: %s", cp->u.s->wfile, strerror(errno(*__errno())));
if ((size_t)write(cp->u.s->wfd, psPS.space, pslPS.len) != pslPS.len ||
    write(cp->u.s->wfd, "\n", 1) != 1)
	error(FATAL1, "%s: %s", cp->u.s->wfile, strerror(errno(*__errno())));
}
return (1);
440}

442/*
* Flush append requests.  Always called before reading a line,
* therefore it also resets the substitution done (sdone) flag.
*/
446static void
447flush_appends(void)
448{
FILE *f;
size_t count, idx;
char buf[8 * 1024];

for (idx = 0; idx < appendx; idx++)
switch (appends[idx].type) {
case AP_STRING:
	fwrite(appends[idx].s, sizeof(char), appends[idx].len,
	    outfile);
	break;
case AP_FILE:
	/*
	 * Read files probably shouldn't be cached.  Since
	 * it's not an error to read a non-existent file,
	 * it's possible that another program is interacting
	 * with the sed script through the file system.  It
	 * would be truly bizarre, but possible.  It's probably
	 * not that big a performance win, anyhow.
	 */
	if ((f = fopen(appends[idx].s, "r")) == NULL((void *)0))
		break;
	while ((count = fread(buf, sizeof(char), sizeof(buf), f)))
		(void)fwrite(buf, sizeof(char), count, outfile);
	(void)fclose(f);
	break;
}
if (ferror(outfile)(!__isthreaded ? (((outfile)->_flags & 0x0040) != 0) :
 (ferror)(outfile)))
error(FATAL1, "%s: %s", outfname, strerror(errno(*__errno()) ? errno(*__errno()) : EIO5));
appendx = sdone = 0;
478}

480static void
481lputs(char *s)
482{
int count;
extern int termwidth;
const char *escapes;
char *p;

for (count = 0; *s; ++s) {
if (count >= termwidth) {
	(void)fprintf(outfile, "\\\n");
	count = 0;
}
if (isascii((unsigned char)*s) && isprint((unsigned char)*s)
    && *s != '\\') {
	(void)fputc(*s, outfile);
	count++;
} else if (*s == '\n') {
	(void)fputc('$', outfile);
	(void)fputc('\n', outfile);
	count = 0;
} else {
	escapes = "\\\a\b\f\r\t\v";
	(void)fputc('\\', outfile);
	if ((p = strchr(escapes, *s))) {
		(void)fputc("\\abfrtv"[p - escapes], outfile);
		count += 2;
	} else {
		(void)fprintf(outfile, "%03o", *(u_char *)s);
		count += 4;
	}
}
}
(void)fputc('$', outfile);
(void)fputc('\n', outfile);
if (ferror(outfile)(!__isthreaded ? (((outfile)->_flags & 0x0040) != 0) :
 (ferror)(outfile)))
error(FATAL1, "%s: %s", outfname, strerror(errno(*__errno()) ? errno(*__errno()) : EIO5));
517}

519static inline int
520regexec_e(regex_t *preg, const char *string, int eflags,
  int nomatch, size_t start, size_t stop)
522{
int eval;

if (preg == NULL((void *)0)) {
if (defpreg == NULL((void *)0))
	error(FATAL1, "first RE may not be empty");
} else
defpreg = preg;

/* Set anchors */
match[0].rm_so = start;
match[0].rm_eo = stop;

eval = regexec(defpreg, string,
   nomatch ? 0 : maxnsub + 1, match, eflags | REG_STARTEND00004);
switch (eval) {
case 0:
return (1);
case REG_NOMATCH1:
return (0);
}
error(FATAL1, "RE error: %s", strregerror(eval, defpreg));
544}

546/*
* regsub - perform substitutions after a regexp match
* Based on a routine by Henry Spencer
*/
550static void
551regsub(SPACE *sp, char *string, char *src)
552{
int len, no;
char c, *dst;

556#define	NEEDSP(reqlen)if (sp->len + (reqlen) + 1 >= sp->blen) { size_t newlen
 = sp->blen + (reqlen) + 1024; sp->space = sp->back =
 xrealloc(sp->back, newlen); sp->blen = newlen; dst = sp
->space + sp->len; }							\
if (sp->len + (reqlen) + 1 >= sp->blen) {			\
size_t newlen = sp->blen + (reqlen) + 1024;		\
sp->space = sp->back = xrealloc(sp->back, newlen);	\
sp->blen = newlen;					\
dst = sp->space + sp->len;				\
}

dst = sp->space + sp->len;
while ((c = *src++) != '\0') {
if (c == '&')
	no = 0;
else if (c == '\\' && isdigit((unsigned char)*src))
	no = *src++ - '0';
else
	no = -1;
if (no < 0) {		/* Ordinary character. */
	if (c == '\\' && (*src == '\\' || *src == '&'))
		c = *src++;
	NEEDSP(1)if (sp->len + (1) + 1 >= sp->blen) { size_t newlen =
 sp->blen + (1) + 1024; sp->space = sp->back = xrealloc
(sp->back, newlen); sp->blen = newlen; dst = sp->space
 + sp->len; };
	*dst++ = c;
	++sp->len;
} else if (match[no].rm_so != -1 && match[no].rm_eo != -1) {
	len = match[no].rm_eo - match[no].rm_so;
	NEEDSP(len)if (sp->len + (len) + 1 >= sp->blen) { size_t newlen
 = sp->blen + (len) + 1024; sp->space = sp->back = xrealloc
(sp->back, newlen); sp->blen = newlen; dst = sp->space
 + sp->len; };
	memmove(dst, string + match[no].rm_so, len);
	dst += len;
	sp->len += len;
}
}
NEEDSP(1)if (sp->len + (1) + 1 >= sp->blen) { size_t newlen =
 sp->blen + (1) + 1024; sp->space = sp->back = xrealloc
(sp->back, newlen); sp->blen = newlen; dst = sp->space
 + sp->len; };
*dst = '\0';
588}

590/*
* aspace --
*	Append the source space to the destination space, allocating new
*	space as necessary.
*/
595void
596cspace(SPACE *sp, const char *p, size_t len, enum e_spflag spflag)
597{
size_t tlen;

/* Make sure SPACE has enough memory and ramp up quickly. */
tlen = sp->len + len + 1;
if (tlen > sp->blen) {
10
←
Assuming 'tlen' is <= field 'blen'→
11
←
Taking false branch→
size_t newlen = tlen + 1024;
sp->space = sp->back = xrealloc(sp->back, newlen);
sp->blen = newlen;
}

if (spflag11.1
'spflag' is equal to REPLACE
 == REPLACE)
12
←
Taking true branch→
sp->len = 0;

memmove(sp->space + sp->len, p, len);

sp->space[sp->len += len] = '\0';
13
←
Array access (via field 'space') results in a null pointer dereference
614}

616/*
* Close all cached opened files and report any errors
*/
619void
620cfclose(struct s_command *cp, struct s_command *end)
621{

for (; cp != end; cp = cp->next)
switch (cp->code) {
case 's':
	if (cp->u.s->wfd != -1 && close(cp->u.s->wfd))
		error(FATAL1,
		    "%s: %s", cp->u.s->wfile, strerror(errno(*__errno())));
	cp->u.s->wfd = -1;
	break;
case 'w':
	if (cp->u.fd != -1 && close(cp->u.fd))
		error(FATAL1, "%s: %s", cp->t, strerror(errno(*__errno())));
	cp->u.fd = -1;
	break;
case '{':
	cfclose(cp->u.c, cp->next);
	break;
}
640}