/usr/src/sbin/dump/traverse.c

Bug Summary

File:	src/sbin/dump/traverse.c
Warning:	line 908, column 3 Null pointer passed as 2nd argument to memory copy function
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name traverse.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sbin/dump/obj -resource-dir /usr/local/lib/clang/13.0.0 -D RDUMP -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/sbin/dump/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/sbin/dump/traverse.c
1/*	$OpenBSD: traverse.c,v 1.39 2018/04/26 17:40:48 guenther Exp $	*/
2/*	$NetBSD: traverse.c,v 1.17 1997/06/05 11:13:27 lukem Exp $	*/

4/*-
* Copyright (c) 1980, 1988, 1991, 1993
*	The Regents of the University of California.  All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of the University nor the names of its contributors
*    may be used to endorse or promote products derived from this software
*    without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

33#include <sys/param.h>	/* MAXBSIZE DEV_BSIZE dbtob */
34#include <sys/time.h>
35#include <sys/stat.h>
36#include <sys/disklabel.h>
37#include <ufs/ffs/fs.h>
38#include <ufs/ufs/dir.h>
39#include <ufs/ufs/dinode.h>

41#include <protocols/dumprestore.h>

43#include <ctype.h>
44#include <errno(*__errno()).h>
45#include <fts.h>
46#include <stdio.h>
47#include <stdlib.h>
48#include <string.h>
49#include <unistd.h>
50#include <limits.h>

52#include "dump.h"

54extern struct disklabel lab;

56union dinode {
struct ufs1_dinode dp1;
struct ufs2_dinode dp2;
59};
60#define	DIP(dp, field)((sblock->fs_magic == 0x011954) ? (dp)->dp1.field : (dp
)->dp2.field) \
((sblock->fs_magic == FS_UFS1_MAGIC0x011954) ? \
(dp)->dp1.field : (dp)->dp2.field)

64#define	HASDUMPEDFILE0x1	0x1
65#define	HASSUBDIRS0x2	0x2

67static	int dirindir(ino_t, daddr_t, int, off_t *, int64_t *, int);
68static	void dmpindir(ino_t, daddr_t, int, off_t *);
69static	int searchdir(ino_t, daddr_t, long, off_t, int64_t *, int);
70void	fs_mapinodes(ino_t maxino, off_t *tapesize, int *anydirskipped);

72/*
* This is an estimation of the number of TP_BSIZE blocks in the file.
* It estimates the number of blocks in files with holes by assuming
* that all of the blocks accounted for by di_blocks are data blocks
* (when some of the blocks are usually used for indirect pointers);
* hence the estimate may be high.
*/
79int64_t
80blockest(union dinode *dp)
81{
int64_t blkest, sizeest;

/*
* dp->di_size is the size of the file in bytes.
* dp->di_blocks stores the number of sectors actually in the file.
* If there are more sectors than the size would indicate, this just
*	means that there are indirect blocks in the file or unused
*	sectors in the last file block; we can safely ignore these
*	(blkest = sizeest below).
* If the file is bigger than the number of sectors would indicate,
*	then the file has holes in it.	In this case we must use the
*	block count to estimate the number of data blocks used, but
*	we use the actual size for estimating the number of indirect
*	dump blocks (sizeest vs. blkest in the indirect block
*	calculation).
*/
blkest = howmany(dbtob((int64_t)DIP(dp, di_blocks)), TP_BSIZE)((((((int64_t)((sblock->fs_magic == 0x011954) ? (dp)->dp1
.di_blocks : (dp)->dp2.di_blocks)) << 9)) + ((1024) -
 1)) / (1024));
sizeest = howmany((int64_t)DIP(dp, di_size), TP_BSIZE)((((int64_t)((sblock->fs_magic == 0x011954) ? (dp)->dp1
.di_size : (dp)->dp2.di_size)) + ((1024) - 1)) / (1024));
if (blkest > sizeest)
blkest = sizeest;
if (DIP(dp, di_size)((sblock->fs_magic == 0x011954) ? (dp)->dp1.di_size : (
dp)->dp2.di_size) > sblock->fs_bsize * NDADDR12) {
/* calculate the number of indirect blocks on the dump tape */
blkest +=
	howmany(sizeest - NDADDR * sblock->fs_bsize / TP_BSIZE,(((sizeest - 12 * sblock->fs_bsize / 1024) + (((1024/2)) -
 1)) / ((1024/2)))
	TP_NINDIR)(((sizeest - 12 * sblock->fs_bsize / 1024) + (((1024/2)) -
 1)) / ((1024/2)));
}
return (blkest + 1);
109}

111/* true if "nodump" flag has no effect here, i.e. dumping allowed */
112#define CHECKNODUMP(dp)(nonodump || (((sblock->fs_magic == 0x011954) ? ((dp))->
dp1.di_flags : ((dp))->dp2.di_flags) & 0x00000001) != 0x00000001
) \
(nonodump || (DIP((dp), di_flags)((sblock->fs_magic == 0x011954) ? ((dp))->dp1.di_flags :
 ((dp))->dp2.di_flags) & UF_NODUMP0x00000001) != UF_NODUMP0x00000001)

115/*
* Determine if given inode should be dumped
*/
118void
119mapfileino(ino_t ino, int64_t *tapesize, int *dirskipped)
120{
int mode;
union dinode *dp;

dp = getino(ino, &mode);
if (mode == 0)
return;
SETINO(ino, usedinomap)usedinomap[(u_int)((ino) - 1) / 8] |= 1 << ((u_int)((ino
) - 1) % 8);
if (mode == IFDIR0040000)
SETINO(ino, dumpdirmap)dumpdirmap[(u_int)((ino) - 1) / 8] |= 1 << ((u_int)((ino
) - 1) % 8);
if (CHECKNODUMP(dp)(nonodump || (((sblock->fs_magic == 0x011954) ? ((dp))->
dp1.di_flags : ((dp))->dp2.di_flags) & 0x00000001) != 0x00000001
) &&
   (DIP(dp, di_mtime)((sblock->fs_magic == 0x011954) ? (dp)->dp1.di_mtime : (
dp)->dp2.di_mtime) >= spclu_spcl.s_spcl.c_ddate ||
    DIP(dp, di_ctime)((sblock->fs_magic == 0x011954) ? (dp)->dp1.di_ctime : (
dp)->dp2.di_ctime) >= spclu_spcl.s_spcl.c_ddate)) {
SETINO(ino, dumpinomap)dumpinomap[(u_int)((ino) - 1) / 8] |= 1 << ((u_int)((ino
) - 1) % 8);
if (mode != IFREG0100000 && mode != IFDIR0040000 && mode != IFLNK0120000)
	*tapesize += 1;
else
	*tapesize += blockest(dp);
return;
}
if (mode == IFDIR0040000) {
if (!CHECKNODUMP(dp)(nonodump || (((sblock->fs_magic == 0x011954) ? ((dp))->
dp1.di_flags : ((dp))->dp2.di_flags) & 0x00000001) != 0x00000001
))
	CLRINO(ino, usedinomap)usedinomap[(u_int)((ino) - 1) / 8] &= ~(1 << ((u_int
)((ino) - 1) % 8));
*dirskipped = 1;
}
145}

147void
148fs_mapinodes(ino_t maxino, int64_t *tapesize, int *anydirskipped)
149{
int i, cg, inosused;
struct cg *cgp;
ino_t ino;
char *cp;

if ((cgp = malloc(sblock->fs_cgsize)) == NULL((void *)0))
quit("fs_mapinodes: cannot allocate memory.\n");

for (cg = 0; cg < sblock->fs_ncg; cg++) {
ino = cg * (ino_t)sblock->fs_ipg;
bread(fsbtodb(sblock, cgtod(sblock, cg))((((((daddr_t)(sblock)->fs_fpg * (cg)) + (sblock)->fs_cgoffset
 * ((cg) & ~((sblock)->fs_cgmask))) + (sblock)->fs_cblkno
)) << (sblock)->fs_fsbtodb), (char *)cgp,
    sblock->fs_cgsize);
if (sblock->fs_magic == FS_UFS2_MAGIC0x19540119)
	inosused = cgp->cg_initediblk;
else
	inosused = sblock->fs_ipg;
/*
 * If we are using soft updates, then we can trust the
 * cylinder group inode allocation maps to tell us which
 * inodes are allocated. We will scan the used inode map
 * to find the inodes that are really in use, and then
 * read only those inodes in from disk.
 */
if (sblock->fs_flags & FS_DOSOFTDEP0x02) {
	if (!cg_chkmagic(cgp)((cgp)->cg_magic == 0x090255 || ((struct ocg *)(cgp))->
cg_magic == 0x090255))
		quit("mapfiles: cg %d: bad magic number\n", cg);
	cp = &cg_inosused(cgp)(((cgp)->cg_magic != 0x090255) ? (((struct ocg *)(cgp))->
cg_iused) : ((u_int8_t *)((u_int8_t *)(cgp) + (cgp)->cg_iusedoff
)))[(inosused - 1) / CHAR_BIT8];
	for ( ; inosused > 0; inosused -= CHAR_BIT8, cp--) {
		if (*cp == 0)
			continue;
		for (i = 1 << (CHAR_BIT8 - 1); i > 0; i >>= 1) {
			if (*cp & i)
				break;
			inosused--;
		}
		break;
	}
	if (inosused <= 0)
		continue;
}
for (i = 0; i < inosused; i++, ino++) {
	if (ino < ROOTINO((ufsino_t)2))
		continue;
	mapfileino(ino, tapesize, anydirskipped);
}
}

free(cgp);
198}

200/*
* Dump pass 1.
*
* Walk the inode list for a filesystem to find all allocated inodes
* that have been modified since the previous dump time. Also, find all
* the directories in the filesystem.
*/
207int
208mapfiles(ino_t maxino, int64_t *tapesize, char *disk, char * const *dirv)
209{
int anydirskipped = 0;

if (dirv != NULL((void *)0)) {
char	 curdir[PATH_MAX1024];
FTS	*dirh;
FTSENT	*entry;
int	 d;

if (getcwd(curdir, sizeof(curdir)) == NULL((void *)0)) {
	msg("Can't determine cwd: %s\n", strerror(errno(*__errno())));
	dumpabort(0);
}
if ((dirh = fts_open(dirv, FTS_PHYSICAL0x0010|FTS_SEEDOT0x0020|FTS_XDEV0x0040,
    NULL((void *)0))) == NULL((void *)0)) {
	msg("fts_open failed: %s\n", strerror(errno(*__errno())));
	dumpabort(0);
}
while ((entry = fts_read(dirh)) != NULL((void *)0)) {
	switch (entry->fts_info) {
	case FTS_DNR4:		/* an error */
	case FTS_ERR7:
	case FTS_NS10:
		msg("Can't fts_read %s: %s\n", entry->fts_path,
		    strerror(errno(*__errno())));
		/* FALLTHROUGH */
	case FTS_DP6:		/* already seen dir */
		continue;
	}
	mapfileino(entry->fts_statp->st_ino, tapesize,
	    &anydirskipped);
}
if (errno(*__errno())) {
	msg("fts_read failed: %s\n", strerror(errno(*__errno())));
	dumpabort(0);
}
(void)fts_close(dirh);

/*
 * Add any parent directories
 */
for (d = 0 ; dirv[d] != NULL((void *)0) ; d++) {
	char path[PATH_MAX1024];

	if (dirv[d][0] != '/')
		(void)snprintf(path, sizeof(path), "%s/%s",
		    curdir, dirv[d]);
	else
		(void)snprintf(path, sizeof(path), "%s",
		    dirv[d]);
	while (strcmp(path, disk) != 0) {
		char *p;
		struct stat sb;

		if (*path == '\0')
			break;
		if ((p = strrchr(path, '/')) == NULL((void *)0))
			break;
		if (p == path)
			break;
		*p = '\0';
		if (stat(path, &sb) == -1) {
			msg("Can't stat %s: %s\n", path,
			    strerror(errno(*__errno())));
			break;
		}
		mapfileino(sb.st_ino, tapesize, &anydirskipped);
	}
}

/*
 * Ensure that the root inode actually appears in the
 * file list for a subdir
 */
mapfileino(ROOTINO((ufsino_t)2), tapesize, &anydirskipped);
} else {
fs_mapinodes(maxino, tapesize, &anydirskipped);
}
/*
* Restore gets very upset if the root is not dumped,
* so ensure that it always is dumped.
*/
SETINO(ROOTINO, dumpinomap)dumpinomap[(u_int)((((ufsino_t)2)) - 1) / 8] |= 1 << ((
u_int)((((ufsino_t)2)) - 1) % 8);
return (anydirskipped);
293}

295/*
* Dump pass 2.
*
* Scan each directory on the filesystem to see if it has any modified
* files in it. If it does, and has not already been added to the dump
* list (because it was itself modified), then add it. If a directory
* has not been modified itself, contains no modified files and has no
* subdirectories, then it can be deleted from the dump list and from
* the list of directories. By deleting it from the list of directories,
* its parent may now qualify for the same treatment on this or a later
* pass using this algorithm.
*/
307int
308mapdirs(ino_t maxino, int64_t *tapesize)
309{
union dinode *dp;
int i, isdir, nodump;
char *map;
ino_t ino;
union dinode di;
off_t filesize;
int ret, change = 0;

isdir = 0;		/* XXX just to get gcc to shut up */
for (map = dumpdirmap, ino = 1; ino < maxino; ino++) {
if (((ino - 1) % NBBY8) == 0)	/* map is offset by 1 */
	isdir = *map++;
else
	isdir >>= 1;
              /*
 * If a directory has been removed from usedinomap, it
 * either has the nodump flag set, or has inherited
 * it.  Although a directory can't be in dumpinomap if
 * it isn't in usedinomap, we have to go through it to
 * propagate the nodump flag.
 */
nodump = !nonodump && !TSTINO(ino, usedinomap)(usedinomap[(u_int)((ino) - 1) / 8] & (1 << ((u_int
)((ino) - 1) % 8)));
if ((isdir & 1) == 0 || (TSTINO(ino, dumpinomap)(dumpinomap[(u_int)((ino) - 1) / 8] & (1 << ((u_int
)((ino) - 1) % 8))) && !nodump))
	continue;
dp = getino(ino, &i);
/*
 * inode buf may change in searchdir().
 */
if (sblock->fs_magic == FS_UFS1_MAGIC0x011954)
	di.dp1 = dp->dp1;
else
	di.dp2 = dp->dp2;
filesize = (off_t)DIP(dp, di_size)((sblock->fs_magic == 0x011954) ? (dp)->dp1.di_size : (
dp)->dp2.di_size);
for (ret = 0, i = 0; filesize > 0 && i < NDADDR12; i++) {
	if (DIP(&di, di_db[i])((sblock->fs_magic == 0x011954) ? (&di)->dp1.di_db[
i] : (&di)->dp2.di_db[i]) != 0)
		ret |= searchdir(ino, DIP(&di, di_db[i])((sblock->fs_magic == 0x011954) ? (&di)->dp1.di_db[
i] : (&di)->dp2.di_db[i]),
		    sblksize(sblock, DIP(dp, di_size), i)(((i) >= 12 || (((sblock->fs_magic == 0x011954) ? (dp)->
dp1.di_size : (dp)->dp2.di_size)) >= ((i) + 1) <<
 (sblock)->fs_bshift) ? (u_int64_t)(sblock)->fs_bsize :
 (((((((((sblock->fs_magic == 0x011954) ? (dp)->dp1.di_size
 : (dp)->dp2.di_size))) & (sblock)->fs_qbmask)) + (
sblock)->fs_qfmask) & (sblock)->fs_fmask))),
		    filesize, tapesize, nodump);
	if (ret & HASDUMPEDFILE0x1)
		filesize = 0;
	else
		filesize -= sblock->fs_bsize;
}
for (i = 0; filesize > 0 && i < NIADDR3; i++) {
	if (DIP(&di, di_ib[i])((sblock->fs_magic == 0x011954) ? (&di)->dp1.di_ib[
i] : (&di)->dp2.di_ib[i]) == 0)
		continue;
	ret |= dirindir(ino, DIP(&di, di_ib[i])((sblock->fs_magic == 0x011954) ? (&di)->dp1.di_ib[
i] : (&di)->dp2.di_ib[i]), i, &filesize,
	    tapesize, nodump);
}
if (ret & HASDUMPEDFILE0x1) {
	SETINO(ino, dumpinomap)dumpinomap[(u_int)((ino) - 1) / 8] |= 1 << ((u_int)((ino
) - 1) % 8);
	*tapesize += blockest(dp);
	change = 1;
	continue;
}
              if (nodump) {
                      if (ret & HASSUBDIRS0x2)
                              change = 1;     /* subdirs inherit nodump */
                      CLRINO(ino, dumpdirmap)dumpdirmap[(u_int)((ino) - 1) / 8] &= ~(1 << ((u_int
)((ino) - 1) % 8));
              } else if ((ret & HASSUBDIRS0x2) == 0) {
	if (!TSTINO(ino, dumpinomap)(dumpinomap[(u_int)((ino) - 1) / 8] & (1 << ((u_int
)((ino) - 1) % 8)))) {
		CLRINO(ino, dumpdirmap)dumpdirmap[(u_int)((ino) - 1) / 8] &= ~(1 << ((u_int
)((ino) - 1) % 8));
		change = 1;
	}
}
}
return (change);
377}

379/*
* Read indirect blocks, and pass the data blocks to be searched
* as directories. Quit as soon as any entry is found that will
* require the directory to be dumped.
*/
384static int
385dirindir(ino_t ino, daddr_t blkno, int ind_level, off_t *filesize,
  int64_t *tapesize, int nodump)
387{
int ret = 0;
int i;
char idblk[MAXBSIZE(64 * 1024)];

bread(fsbtodb(sblock, blkno)((blkno) << (sblock)->fs_fsbtodb), idblk, (int)sblock->fs_bsize);
if (ind_level <= 0) {
for (i = 0; *filesize > 0 && i < NINDIR(sblock)((sblock)->fs_nindir); i++) {
	if (sblock->fs_magic == FS_UFS1_MAGIC0x011954)
		blkno = ((int32_t *)idblk)[i];
	else
		blkno = ((int64_t *)idblk)[i];
	if (blkno != 0)
		ret |= searchdir(ino, blkno, sblock->fs_bsize,
			*filesize, tapesize, nodump);
	if (ret & HASDUMPEDFILE0x1)
		*filesize = 0;
	else
		*filesize -= sblock->fs_bsize;
}
return (ret);
}
ind_level--;
for (i = 0; *filesize > 0 && i < NINDIR(sblock)((sblock)->fs_nindir); i++) {
if (sblock->fs_magic == FS_UFS1_MAGIC0x011954)
	blkno = ((int32_t *)idblk)[i];
else
	blkno = ((int64_t *)idblk)[i];
if (blkno != 0)
	ret |= dirindir(ino, blkno, ind_level, filesize,
	    tapesize, nodump);
}
return (ret);
420}

422/*
* Scan a disk block containing directory information looking to see if
* any of the entries are on the dump list and to see if the directory
* contains any subdirectories.
*/
427static int
428searchdir(ino_t ino, daddr_t blkno, long size, off_t filesize,
  int64_t *tapesize, int nodump)
430{
struct direct *dp;
union dinode *ip;
long loc;
static caddr_t dblk;
int mode, ret = 0;

if (dblk == NULL((void *)0) && (dblk = malloc(sblock->fs_bsize)) == NULL((void *)0))
quit("searchdir: cannot allocate indirect memory.\n");
bread(fsbtodb(sblock, blkno)((blkno) << (sblock)->fs_fsbtodb), dblk, (int)size);
if (filesize < size)
size = filesize;
for (loc = 0; loc < size; ) {
dp = (struct direct *)(dblk + loc);
if (dp->d_reclen == 0) {
	msg("corrupted directory, inumber %llu\n",
	    (unsigned long long)ino);
	break;
}
loc += dp->d_reclen;
if (dp->d_ino == 0)
	continue;
if (dp->d_name[0] == '.') {
	if (dp->d_name[1] == '\0')
		continue;
	if (dp->d_name[1] == '.' && dp->d_name[2] == '\0')
		continue;
}
if (nodump) {
                      ip = getino(dp->d_ino, &mode);
                      if (TSTINO(dp->d_ino, dumpinomap)(dumpinomap[(u_int)((dp->d_ino) - 1) / 8] & (1 <<
 ((u_int)((dp->d_ino) - 1) % 8)))) {
                              CLRINO(dp->d_ino, dumpinomap)dumpinomap[(u_int)((dp->d_ino) - 1) / 8] &= ~(1 <<
 ((u_int)((dp->d_ino) - 1) % 8));
                              *tapesize -= blockest(ip);
                      }
                      /*
                       * Add back to dumpdirmap and remove from usedinomap
                       * to propagate nodump.
                       */
                      if (mode == IFDIR0040000) {
                              SETINO(dp->d_ino, dumpdirmap)dumpdirmap[(u_int)((dp->d_ino) - 1) / 8] |= 1 << ((u_int
)((dp->d_ino) - 1) % 8);
                              CLRINO(dp->d_ino, usedinomap)usedinomap[(u_int)((dp->d_ino) - 1) / 8] &= ~(1 <<
 ((u_int)((dp->d_ino) - 1) % 8));
                              ret |= HASSUBDIRS0x2;
                      }
} else {
	if (TSTINO(dp->d_ino, dumpinomap)(dumpinomap[(u_int)((dp->d_ino) - 1) / 8] & (1 <<
 ((u_int)((dp->d_ino) - 1) % 8)))) {
		ret |= HASDUMPEDFILE0x1;
		if (ret & HASSUBDIRS0x2)
			break;
	}
	if (TSTINO(dp->d_ino, dumpdirmap)(dumpdirmap[(u_int)((dp->d_ino) - 1) / 8] & (1 <<
 ((u_int)((dp->d_ino) - 1) % 8)))) {
		ret |= HASSUBDIRS0x2;
		if (ret & HASDUMPEDFILE0x1)
			break;
	}
}
}
return (ret);
487}

489/*
* Dump passes 3 and 4.
*
* Dump the contents of an inode to tape.
*/
494void
495dumpino(union dinode *dp, ino_t ino)
496{
int ind_level, cnt;
off_t size;
char buf[TP_BSIZE1024];

if (newtape) {
1
Assuming 'newtape' is 0→
2
←
Taking false branch→
newtape = 0;
dumpmap(dumpinomap, TS_BITS3, ino);
}
CLRINO(ino, dumpinomap)dumpinomap[(u_int)((ino) - 1) / 8] &= ~(1 << ((u_int
)((ino) - 1) % 8));
if (sblock->fs_magic == FS_UFS1_MAGIC0x011954) {
3
←
Assuming field 'fs_magic' is not equal to FS_UFS1_MAGIC→
4
←
Taking false branch→
spclu_spcl.s_spcl.c_mode__c_ino.__uc_ino.__uc_mode = dp->dp1.di_mode;
spclu_spcl.s_spcl.c_size__c_ino.__uc_ino.__uc_size = dp->dp1.di_size;
spclu_spcl.s_spcl.c_old_atime__c_ino.__uc_ino.__uc_old_atime = (time_t)dp->dp1.di_atime;
spclu_spcl.s_spcl.c_atime__c_ino.__uc_ino.__uc_atime = dp->dp1.di_atime;
spclu_spcl.s_spcl.c_atimensec__c_ino.__uc_ino.__uc_atimensec = dp->dp1.di_atimensec;
spclu_spcl.s_spcl.c_old_mtime__c_ino.__uc_ino.__uc_old_mtime = (time_t)dp->dp1.di_mtime;
spclu_spcl.s_spcl.c_mtime__c_ino.__uc_ino.__uc_mtime = dp->dp1.di_mtime;
spclu_spcl.s_spcl.c_mtimensec__c_ino.__uc_ino.__uc_mtimensec = dp->dp1.di_mtimensec;
spclu_spcl.s_spcl.c_birthtime__c_ino.__uc_ino.__uc_birthtime = 0;
spclu_spcl.s_spcl.c_birthtimensec__c_ino.__uc_ino.__uc_birthtimensec = 0;
spclu_spcl.s_spcl.c_rdev__c_ino.__uc_ino.__uc_rdev = dp->dp1.di_rdevdi_db[0];
spclu_spcl.s_spcl.c_file_flags__c_ino.__uc_ino.__uc_file_flags = dp->dp1.di_flags;
spclu_spcl.s_spcl.c_uid__c_ino.__uc_ino.__uc_uid = dp->dp1.di_uid;
spclu_spcl.s_spcl.c_gid__c_ino.__uc_ino.__uc_gid = dp->dp1.di_gid;
} else {
spclu_spcl.s_spcl.c_mode__c_ino.__uc_ino.__uc_mode = dp->dp2.di_mode;
spclu_spcl.s_spcl.c_size__c_ino.__uc_ino.__uc_size = dp->dp2.di_size;
spclu_spcl.s_spcl.c_atime__c_ino.__uc_ino.__uc_atime = dp->dp2.di_atime;
spclu_spcl.s_spcl.c_atimensec__c_ino.__uc_ino.__uc_atimensec = dp->dp2.di_atimensec;
spclu_spcl.s_spcl.c_mtime__c_ino.__uc_ino.__uc_mtime = dp->dp2.di_mtime;
spclu_spcl.s_spcl.c_mtimensec__c_ino.__uc_ino.__uc_mtimensec = dp->dp2.di_mtimensec;
spclu_spcl.s_spcl.c_birthtime__c_ino.__uc_ino.__uc_birthtime = dp->dp2.di_birthtime;
spclu_spcl.s_spcl.c_birthtimensec__c_ino.__uc_ino.__uc_birthtimensec = dp->dp2.di_birthnsec;
spclu_spcl.s_spcl.c_rdev__c_ino.__uc_ino.__uc_rdev = dp->dp2.di_rdevdi_db[0];
spclu_spcl.s_spcl.c_file_flags__c_ino.__uc_ino.__uc_file_flags = dp->dp2.di_flags;
spclu_spcl.s_spcl.c_uid__c_ino.__uc_ino.__uc_uid = dp->dp2.di_uid;
spclu_spcl.s_spcl.c_gid__c_ino.__uc_ino.__uc_gid = dp->dp2.di_gid;
}
spclu_spcl.s_spcl.c_type = TS_INODE2;
spclu_spcl.s_spcl.c_count = 0;
switch (DIP(dp, di_mode)((sblock->fs_magic == 0x011954) ? (dp)->dp1.di_mode : (
dp)->dp2.di_mode) & S_IFMT0170000) {
5
←
'?' condition is false→
6
←
Control jumps to 'case 16384:'  at line 573→

case 0:
/*
 * Freed inode.
 */
return;

case IFLNK0120000:
/*
 * Check for short symbolic link.
 */
if (DIP(dp, di_size)((sblock->fs_magic == 0x011954) ? (dp)->dp1.di_size : (
dp)->dp2.di_size) > 0 &&
550#ifdef FS_44INODEFMT2
    (DIP(dp, di_size)((sblock->fs_magic == 0x011954) ? (dp)->dp1.di_size : (
dp)->dp2.di_size) < sblock->fs_maxsymlinklen ||
     (sblock->fs_maxsymlinklen == 0 &&
	 DIP(dp, di_blocks)((sblock->fs_magic == 0x011954) ? (dp)->dp1.di_blocks :
 (dp)->dp2.di_blocks) == 0))) {
554#else
    DIP(dp, di_blocks)((sblock->fs_magic == 0x011954) ? (dp)->dp1.di_blocks :
 (dp)->dp2.di_blocks) == 0) {
556#endif
	void *shortlink;

	spclu_spcl.s_spcl.c_addr[0] = 1;
	spclu_spcl.s_spcl.c_count = 1;
	writeheader(ino);
	if (sblock->fs_magic == FS_UFS1_MAGIC0x011954)
		shortlink = dp->dp1.di_shortlinkdi_db;
	else
		shortlink = dp->dp2.di_shortlinkdi_db;
	memcpy(buf, shortlink, DIP(dp, di_size)((sblock->fs_magic == 0x011954) ? (dp)->dp1.di_size : (
dp)->dp2.di_size));
	buf[DIP(dp, di_size)((sblock->fs_magic == 0x011954) ? (dp)->dp1.di_size : (
dp)->dp2.di_size)] = '\0';
	writerec(buf, 0);
	return;
}
/* FALLTHROUGH */

case IFDIR0040000:
case IFREG0100000:
if (DIP(dp, di_size)((sblock->fs_magic == 0x011954) ? (dp)->dp1.di_size : (
dp)->dp2.di_size) > 0)
7
←
'?' condition is false→
8
←
Assuming the condition is true→
9
←
Taking true branch→
	break;
10
←
 Execution continues on line 591→
/* FALLTHROUGH */

case IFIFO0010000:
case IFSOCK0140000:
case IFCHR0020000:
case IFBLK0060000:
writeheader(ino);
return;

default:
msg("Warning: undefined file type 0%o\n",
    DIP(dp, di_mode)((sblock->fs_magic == 0x011954) ? (dp)->dp1.di_mode : (
dp)->dp2.di_mode) & IFMT0170000);
return;
}
if (DIP(dp, di_size)((sblock->fs_magic == 0x011954) ? (dp)->dp1.di_size : (
dp)->dp2.di_size) > NDADDR12 * sblock->fs_bsize)
11
←
'?' condition is false→
12
←
Assuming the condition is false→
13
←
Taking false branch→
cnt = NDADDR12 * sblock->fs_frag;
else
cnt = howmany(DIP(dp, di_size), sblock->fs_fsize)(((((sblock->fs_magic == 0x011954) ? (dp)->dp1.di_size :
 (dp)->dp2.di_size)) + ((sblock->fs_fsize) - 1)) / (sblock
->fs_fsize));
14
←
'?' condition is false→
if (sblock->fs_magic14.1
Field 'fs_magic' is not equal to FS_UFS1_MAGIC
 == FS_UFS1_MAGIC0x011954)
15
←
Taking false branch→
ufs1_blksout(&dp->dp1.di_db[0], cnt, ino);
else
ufs2_blksout(&dp->dp2.di_db[0], cnt, ino);
if ((size = DIP(dp, di_size)((sblock->fs_magic == 0x011954) ? (dp)->dp1.di_size : (
dp)->dp2.di_size) - NDADDR12 * sblock->fs_bsize) <= 0)
16
←
'?' condition is false→
17
←
Assuming the condition is false→
18
←
Taking false branch→
return;
for (ind_level = 0; ind_level < NIADDR3; ind_level++) {
19
←
Loop condition is true.  Entering loop body→
dmpindir(ino, DIP(dp, di_ib[ind_level])((sblock->fs_magic == 0x011954) ? (dp)->dp1.di_ib[ind_level
] : (dp)->dp2.di_ib[ind_level]), ind_level, &size);
20
←
'?' condition is false→
21
←
Calling 'dmpindir'→
if (size <= 0)
	return;
}
606}

608/*
* Read indirect blocks, and pass the data blocks to be dumped.
*/
611static void
612dmpindir(ino_t ino, daddr_t  blk, int ind_level, off_t *size)
613{
int i, cnt;
char idblk[MAXBSIZE(64 * 1024)];

if (blk != 0)
22
←
Assuming 'blk' is not equal to 0→
23
←
Taking true branch→
bread(fsbtodb(sblock, blk)((blk) << (sblock)->fs_fsbtodb), idblk, (int) sblock->fs_bsize);
24
←
Calling 'bread'→
else
memset(idblk, 0, (int)sblock->fs_bsize);
if (ind_level <= 0) {
if (*size < NINDIR(sblock)((sblock)->fs_nindir) * sblock->fs_bsize)
	cnt = howmany(*size, sblock->fs_fsize)(((*size) + ((sblock->fs_fsize) - 1)) / (sblock->fs_fsize
));
else
	cnt = NINDIR(sblock)((sblock)->fs_nindir) * sblock->fs_frag;
*size -= NINDIR(sblock)((sblock)->fs_nindir) * sblock->fs_bsize;
if (sblock->fs_magic == FS_UFS1_MAGIC0x011954)
	ufs1_blksout((int32_t *)idblk, cnt, ino);
else
	ufs2_blksout((int64_t *)idblk, cnt, ino);
return;
}
ind_level--;
for (i = 0; i < NINDIR(sblock)((sblock)->fs_nindir); i++) {
if (sblock->fs_magic == FS_UFS1_MAGIC0x011954)
	dmpindir(ino, ((int32_t *)idblk)[i], ind_level,
	    size);
else
	dmpindir(ino, ((int64_t *)idblk)[i], ind_level,
	    size);
if (*size <= 0)
	return;
}
644}

646/*
* Collect up the data into tape record sized buffers and output them.
*/
649void
650ufs1_blksout(int32_t *blkp, int frags, ino_t ino)
651{
int32_t *bp;
int i, j, count, blks, tbperdb;

blks = howmany(frags * sblock->fs_fsize, TP_BSIZE)(((frags * sblock->fs_fsize) + ((1024) - 1)) / (1024));
tbperdb = sblock->fs_bsize >> tp_bshift;
for (i = 0; i < blks; i += TP_NINDIR(1024/2)) {
if (i + TP_NINDIR(1024/2) > blks)
	count = blks;
else
	count = i + TP_NINDIR(1024/2);
for (j = i; j < count; j++)
	if (blkp[j / tbperdb] != 0)
		spclu_spcl.s_spcl.c_addr[j - i] = 1;
	else
		spclu_spcl.s_spcl.c_addr[j - i] = 0;
spclu_spcl.s_spcl.c_count = count - i;
writeheader(ino);
bp = &blkp[i / tbperdb];
for (j = i; j < count; j += tbperdb, bp++)
	if (*bp != 0) {
		if (j + tbperdb <= count)
			dumpblock(*bp, (int)sblock->fs_bsize);
		else
			dumpblock(*bp, (count - j) * TP_BSIZE1024);
	}
spclu_spcl.s_spcl.c_type = TS_ADDR4;
}
679}

681/*
* Collect up the data into tape record sized buffers and output them.
*/
684void
685ufs2_blksout(daddr_t *blkp, int frags, ino_t ino)
686{
daddr_t *bp;
int i, j, count, blks, tbperdb;

blks = howmany(frags * sblock->fs_fsize, TP_BSIZE)(((frags * sblock->fs_fsize) + ((1024) - 1)) / (1024));
tbperdb = sblock->fs_bsize >> tp_bshift;
for (i = 0; i < blks; i += TP_NINDIR(1024/2)) {
if (i + TP_NINDIR(1024/2) > blks)
	count = blks;
else
	count = i + TP_NINDIR(1024/2);
for (j = i; j < count; j++)
	if (blkp[j / tbperdb] != 0)
		spclu_spcl.s_spcl.c_addr[j - i] = 1;
	else
		spclu_spcl.s_spcl.c_addr[j - i] = 0;
spclu_spcl.s_spcl.c_count = count - i;
writeheader(ino);
bp = &blkp[i / tbperdb];
for (j = i; j < count; j += tbperdb, bp++)
	if (*bp != 0) {
		if (j + tbperdb <= count)
			dumpblock(*bp, (int)sblock->fs_bsize);
		else
			dumpblock(*bp, (count - j) * TP_BSIZE1024);
	}
spclu_spcl.s_spcl.c_type = TS_ADDR4;
}
714}

716/*
* Dump a map to the tape.
*/
719void
720dumpmap(map, type, ino)
char *map;
int type;
ino_t ino;
724{
int i;
char *cp;

spclu_spcl.s_spcl.c_type = type;
spclu_spcl.s_spcl.c_count = howmany(mapsize * sizeof(char), TP_BSIZE)(((mapsize * sizeof(char)) + ((1024) - 1)) / (1024));
writeheader(ino);
for (i = 0, cp = map; i < spclu_spcl.s_spcl.c_count; i++, cp += TP_BSIZE1024)
writerec(cp, 0);
733}

735/*
* Write a header record to the dump tape.
*/
738void
739writeheader(ino)
ino_t ino;
741{
int32_t sum, cnt, *lp;

spclu_spcl.s_spcl.c_inumber = ino;
if (sblock->fs_magic == FS_UFS2_MAGIC0x19540119) {
spclu_spcl.s_spcl.c_magic = FS_UFS2_MAGIC0x19540119;
} else {
spclu_spcl.s_spcl.c_magic = NFS_MAGIC(int)60012;
spclu_spcl.s_spcl.c_old_date = (int32_t)spclu_spcl.s_spcl.c_date;
spclu_spcl.s_spcl.c_old_ddate = (int32_t)spclu_spcl.s_spcl.c_ddate;
spclu_spcl.s_spcl.c_old_tapea = (int32_t)spclu_spcl.s_spcl.c_tapea;
spclu_spcl.s_spcl.c_old_firstrec = (int32_t)spclu_spcl.s_spcl.c_firstrec;
}
spclu_spcl.s_spcl.c_checksum = 0;
lp = (int32_t *)&spclu_spcl.s_spcl;
sum = 0;
cnt = sizeof(union u_spcl) / (4 * sizeof(int32_t));
while (--cnt >= 0) {
sum += *lp++;
sum += *lp++;
sum += *lp++;
sum += *lp++;
}
spclu_spcl.s_spcl.c_checksum = CHECKSUM(int)84446 - sum;
writerec((char *)&spclu_spcl.s_spcl, 1);
766}

768union dinode *
769getino(ino_t inum, int *modep)
770{
static ino_t minino, maxino;
static void *inoblock;
struct ufs1_dinode *dp1;
struct ufs2_dinode *dp2;

if (inoblock == NULL((void *)0) && (inoblock = malloc(sblock->fs_bsize)) == NULL((void *)0))
quit("cannot allocate inode memory.\n");
curino = inum;
if (inum >= minino && inum < maxino)
goto gotit;
bread(fsbtodb(sblock, ino_to_fsba(sblock, inum))((((daddr_t)(((((daddr_t)(sblock)->fs_fpg * (((inum) / (sblock
)->fs_ipg))) + (sblock)->fs_cgoffset * ((((inum) / (sblock
)->fs_ipg)) & ~((sblock)->fs_cgmask))) + (sblock)->
fs_iblkno) + ((((((inum) % (sblock)->fs_ipg) / ((sblock)->
fs_inopb))) << ((sblock))->fs_fragshift))))) <<
 (sblock)->fs_fsbtodb), inoblock,
   (int)sblock->fs_bsize);
minino = inum - (inum % INOPB(sblock)((sblock)->fs_inopb));
maxino = minino + INOPB(sblock)((sblock)->fs_inopb);
785gotit:
if (sblock->fs_magic == FS_UFS1_MAGIC0x011954) {
dp1 = &((struct ufs1_dinode *)inoblock)[inum - minino];
*modep = (dp1->di_mode & IFMT0170000);
return ((union dinode *)dp1);
}
dp2 = &((struct ufs2_dinode *)inoblock)[inum - minino];
*modep = (dp2->di_mode & IFMT0170000);
return ((union dinode *)dp2);
794}

796/*
* Read a chunk of data from the disk.
* Try to recover from hard errors by reading in sector sized pieces.
* Error recovery is attempted at most BREADEMAX times before seeking
* consent from the operator to continue.
*/
802int	breaderrors = 0;
803#define	BREADEMAX32 32

805void
806bread(daddr_t blkno, char *buf, int size)
807{
static char *mybuf = NULL((void *)0);
25
←
'mybuf' initialized to a null pointer value→
char *mybufp, *bufp, *np;
static size_t mybufsz = 0;
off_t offset;
int cnt, i;
u_int64_t secno, seccount;
u_int32_t secoff, secsize = lab.d_secsize;

/*
* We must read an integral number of sectors large enough to contain
* all the requested data. The read must begin at a sector.
*/
if (DL_BLKOFFSET(&lab, blkno)(((blkno) % ((&lab)->d_secsize / (1 << 9))) * (1
 << 9)) == 0 && size % secsize == 0) {
26
←
Assuming the condition is false→
secno = DL_BLKTOSEC(&lab, blkno)((blkno) / ((&lab)->d_secsize / (1 << 9)));
secoff = 0;
seccount = size / secsize;
bufp = buf;
} else {
secno = DL_BLKTOSEC(&lab, blkno)((blkno) / ((&lab)->d_secsize / (1 << 9)));
secoff = DL_BLKOFFSET(&lab, blkno)(((blkno) % ((&lab)->d_secsize / (1 << 9))) * (1
 << 9));
seccount = DL_BLKTOSEC(&lab, (size + secoff) / DEV_BSIZE)(((size + secoff) / (1 << 9)) / ((&lab)->d_secsize
 / (1 << 9)));
if (seccount * secsize < (size + secoff))
27
←
Assuming the condition is false→
28
←
Taking false branch→
	seccount++;
if (mybufsz < seccount * secsize) {
29
←
Assuming the condition is false→
30
←
Taking false branch→
	np = reallocarray(mybuf, seccount, secsize);
	if (np == NULL((void *)0)) {
		msg("No memory to read %llu %u-byte sectors",
		    seccount, secsize);
		dumpabort(0);
	}
	mybufsz = seccount * secsize;
	mybuf = np;
}
bufp = mybuf;
31
←
Null pointer value stored to 'bufp'→
}

offset = secno * secsize;

846loop:
if ((cnt = pread(diskfd, bufp, seccount * secsize, offset)) ==
32
←
Assuming the condition is true→
33
←
Taking true branch→
   seccount * secsize)
goto done;
34
←
Control jumps to line 907→
if (blkno + (size / DEV_BSIZE(1 << 9)) >
   fsbtodb(sblock, sblock->fs_ffs1_size)((sblock->fs_ffs1_size) << (sblock)->fs_fsbtodb)) {
/*
 * Trying to read the final fragment.
 *
 * NB - dump only works in TP_BSIZE blocks, hence
 * rounds `DEV_BSIZE' fragments up to TP_BSIZE pieces.
 * It should be smarter about not actually trying to
 * read more than it can get, but for the time being
 * we punt and scale back the read only when it gets
 * us into trouble. (mkm 9/25/83)
 */
size -= secsize;
seccount--;
goto loop;
}
if (cnt == -1)
msg("read error from %s: %s: [block %lld]: count=%d\n",
    disk, strerror(errno(*__errno())), (long long)blkno, size);
else
msg("short read error from %s: [block %lld]: count=%d, "
    "got=%d\n", disk, (long long)blkno, size, cnt);
if (++breaderrors > BREADEMAX32) {
msg("More than %d block read errors from %s\n",
	BREADEMAX32, disk);
broadcast("DUMP IS AILING!\n");
msg("This is an unrecoverable error.\n");
if (!query("Do you want to attempt to continue?")){
	dumpabort(0);
	/*NOTREACHED*/
} else
	breaderrors = 0;
}
/*
* Zero buffer, then try to read each sector of buffer separately.
*/
if (bufp == mybuf)
memset(bufp, 0, mybufsz);
else
memset(bufp, 0, size);
for (i = 0, mybufp = bufp; i < size; i += secsize, mybufp += secsize) {
if ((cnt = pread(diskfd, mybufp, secsize, offset + i)) ==
    secsize)
	continue;
if (cnt == -1) {
	msg("read error from %s: %s: [block %lld]: "
	    "count=%u\n", disk, strerror(errno(*__errno())),
	    (long long)(offset + i) / DEV_BSIZE(1 << 9), secsize);
	continue;
}
msg("short read error from %s: [block %lld]: count=%u, "
    "got=%d\n", disk, (long long)(offset + i) / DEV_BSIZE(1 << 9),
    secsize, cnt);
}

905done:
/* If necessary, copy out data that was read. */
if (bufp34.1
'bufp' is equal to 'mybuf'
 == mybuf)
35
←
Taking true branch→
memcpy(buf, bufp + secoff, size);
36
←
Null pointer passed as 2nd argument to memory copy function
909}