/usr/src/bin/ksh/misc.c

Bug Summary

File:	src/bin/ksh/misc.c
Warning:	line 437, column 20 Dereference of null pointer (loaded from variable 'array')
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name misc.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/bin/ksh/obj -resource-dir /usr/local/lib/clang/13.0.0 -D EMACS -D VI -I . -I /usr/src/bin/ksh -I /usr/src/bin/ksh/../../lib/libc/gen -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/bin/ksh/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/bin/ksh/misc.c
1/*	$OpenBSD: misc.c,v 1.78 2021/12/24 22:08:37 deraadt Exp $	*/

3/*
* Miscellaneous functions
*/

7#include <ctype.h>
8#include <errno(*__errno()).h>
9#include <fcntl.h>
10#include <limits.h>
11#include <stdlib.h>
12#include <string.h>
13#include <unistd.h>

15#include "sh.h"
16#include "charclass.h"

18short ctypes [UCHAR_MAX(127*2 +1)+1];	/* type bits for unsigned char */
19static int dropped_privileges;

21static int	do_gmatch(const unsigned char *, const unsigned char *,
    const unsigned char *, const unsigned char *);
23static const unsigned char *cclass(const unsigned char *, int);

25/*
* Fast character classes
*/
28void
29setctypes(const char *s, int t)
30{
int i;

if (t & C_IFS(1<<(7))) {
for (i = 0; i < UCHAR_MAX(127*2 +1)+1; i++)
	ctypes[i] &= ~C_IFS(1<<(7));
ctypes[0] |= C_IFS(1<<(7)); /* include \0 in C_IFS */
}
while (*s != 0)
ctypes[(unsigned char) *s++] |= t;
40}

42void
43initctypes(void)
44{
int c;

for (c = 'a'; c <= 'z'; c++)
ctypes[c] |= C_ALPHA(1<<(0));
for (c = 'A'; c <= 'Z'; c++)
ctypes[c] |= C_ALPHA(1<<(0));
ctypes['_'] |= C_ALPHA(1<<(0));
setctypes(" \t\n|&;<>()", C_LEX1(1<<(2))); /* \0 added automatically */
setctypes("*@#!$-?", C_VAR1(1<<(3)));
setctypes(" \t\n", C_IFSWS(1<<(4)));
setctypes("=-+?", C_SUBOP1(1<<(5)));
setctypes("#%", C_SUBOP2(1<<(6)));
setctypes(" \n\t\"#$&'()*;<>?[\\`|", C_QUOTE(1<<(8)));
58}

60/* convert uint64_t to base N string */

62char *
63u64ton(uint64_t n, int base)
64{
char *p;
static char buf [20];

p = &buf[sizeof(buf)];
*--p = '\0';
do {
*--p = "0123456789ABCDEF"[n%base];
n /= base;
} while (n != 0);
return p;
75}

77char *
78str_save(const char *s, Area *ap)
79{
size_t len;
char *p;

if (!s)
return NULL((void*)0);
len = strlen(s)+1;
p = alloc(len, ap);
strlcpy(p, s, len);
return (p);
89}

91/* Allocate a string of size n+1 and copy upto n characters from the possibly
* null terminated string s into it.  Always returns a null terminated string
* (unless n < 0).
*/
95char *
96str_nsave(const char *s, int n, Area *ap)
97{
char *ns;

if (n < 0)
return 0;
ns = alloc(n + 1, ap);
ns[0] = '\0';
return strncat(ns, s, n);
105}

107/* called from expand.h:XcheckN() to grow buffer */
108char *
109Xcheck_grow_(XString *xsp, char *xp, size_t more)
110{
char *old_beg = xsp->beg;

xsp->len += more > xsp->len ? more : xsp->len;
xsp->beg = aresize(xsp->beg, xsp->len + 8, xsp->areap);
xsp->end = xsp->beg + xsp->len;
return xsp->beg + (xp - old_beg);
117}

119const struct option sh_options[] = {
/* Special cases (see parse_args()): -A, -o, -s.
* Options are sorted by their longnames - the order of these
* entries MUST match the order of sh_flag F* enumerations in sh.h.
*/
{ "allexport",	'a',		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) },
{ "braceexpand",  0,		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) }, /* non-standard */
{ "bgnice",	  0,		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) },
{ NULL((void*)0),	'c',	    OF_CMDLINE0x01 },
{ "csh-history",  0,		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) }, /* non-standard */
129#ifdef EMACS1
{ "emacs",	  0,		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) },
131#endif
{ "errexit",	'e',		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) },
133#ifdef EMACS1
{ "gmacs",	  0,		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) },
135#endif
{ "ignoreeof",	  0,		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) },
{ "interactive",'i',	    OF_CMDLINE0x01 },
{ "keyword",	'k',		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) },
{ "login",	'l',	    OF_CMDLINE0x01 },
{ "markdirs",	'X',		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) },
{ "monitor",	'm',		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) },
{ "noclobber",	'C',		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) },
{ "noexec",	'n',		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) },
{ "noglob",	'f',		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) },
{ "nohup",	  0,		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) },
{ "nolog",	  0,		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) }, /* no effect */
{ "notify",	'b',		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) },
{ "nounset",	'u',		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) },
{ "physical",	  0,		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) }, /* non-standard */
{ "pipefail",	  0,		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) }, /* non-standard */
{ "posix",	  0,		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) }, /* non-standard */
{ "privileged",	'p',		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) },
{ "restricted",	'r',	    OF_CMDLINE0x01 },
{ "sh",		  0,		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) }, /* non-standard */
{ "stdin",	's',	    OF_CMDLINE0x01 }, /* pseudo non-standard */
{ "trackall",	'h',		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) },
{ "verbose",	'v',		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) },
158#ifdef VI1
{ "vi",		  0,		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) },
{ "viraw",	  0,		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) }, /* no effect */
{ "vi-show8",	  0,		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) }, /* non-standard */
{ "vi-tabcomplete",  0,		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) }, /* non-standard */
{ "vi-esccomplete",  0,		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) }, /* non-standard */
164#endif
{ "xtrace",	'x',		OF_ANY(0x01 | 0x02 | 0x04 | 0x08) },
/* Anonymous flags: used internally by shell only
* (not visible to user)
*/
{ NULL((void*)0),	0,		OF_INTERNAL0x08 }, /* FTALKING_I */
170};

172/*
* translate -o option into F* constant (also used for test -o option)
*/
175int
176option(const char *n)
177{
unsigned int ele;

for (ele = 0; ele < NELEM(sh_options)(sizeof(sh_options) / sizeof((sh_options)[0])); ele++)
if (sh_options[ele].name && strcmp(sh_options[ele].name, n) == 0)
	return ele;

return -1;
185}

187struct options_info {
int opt_width;
struct {
const char *name;
int	flag;
} opts[NELEM(sh_options)(sizeof(sh_options) / sizeof((sh_options)[0]))];
193};

195static char *options_fmt_entry(void *arg, int i, char *buf, int buflen);
196static void printoptions(int verbose);

198/* format a single select menu item */
199static char *
200options_fmt_entry(void *arg, int i, char *buf, int buflen)
201{
struct options_info *oi = (struct options_info *) arg;

shf_snprintf(buf, buflen, "%-*s %s",
   oi->opt_width, oi->opts[i].name,
   Flag(oi->opts[i].flag)(shell_flags[(int) (oi->opts[i].flag)]) ? "on" : "off");
return buf;
208}

210static void
211printoptions(int verbose)
212{
unsigned int ele;

if (verbose) {
struct options_info oi;
unsigned int n;
int len;

/* verbose version */
shprintf("Current option settings\n");

for (ele = n = oi.opt_width = 0; ele < NELEM(sh_options)(sizeof(sh_options) / sizeof((sh_options)[0])); ele++) {
	if (sh_options[ele].name) {
		len = strlen(sh_options[ele].name);
		oi.opts[n].name = sh_options[ele].name;
		oi.opts[n++].flag = ele;
		if (len > oi.opt_width)
			oi.opt_width = len;
	}
}
print_columns(shl_stdout(&shf_iob[1]), n, options_fmt_entry, &oi,
    oi.opt_width + 5, 1);
} else {
/* short version ala ksh93 */
shprintf("set");
for (ele = 0; ele < NELEM(sh_options)(sizeof(sh_options) / sizeof((sh_options)[0])); ele++) {
	if (sh_options[ele].name)
		shprintf(" %co %s",
			 Flag(ele)(shell_flags[(int) (ele)]) ? '-' : '+',
			 sh_options[ele].name);
}
shprintf("\n");
}
245}

247char *
248getoptions(void)
249{
unsigned int ele;
char m[(int) FNFLAGS + 1];
char *cp = m;

for (ele = 0; ele < NELEM(sh_options)(sizeof(sh_options) / sizeof((sh_options)[0])); ele++)
if (sh_options[ele].c && Flag(ele)(shell_flags[(int) (ele)]))
	*cp++ = sh_options[ele].c;
*cp = 0;
return str_save(m, ATEMP&genv->area);
259}

261/* change a Flag(*) value; takes care of special actions */
262void
263change_flag(enum sh_flag f,
  int what,		/* flag to change */
  int newval)		/* what is changing the flag (command line vs set) */
266{
int oldval;

oldval = Flag(f)(shell_flags[(int) (f)]);
Flag(f)(shell_flags[(int) (f)]) = newval;
if (f == FMONITOR) {
if (what != OF_CMDLINE0x01 && newval != oldval)
	j_change();
} else
if (0
276#ifdef VI1
   || f == FVI
278#endif /* VI */
279#ifdef EMACS1
   || f == FEMACS || f == FGMACS
281#endif /* EMACS */
  )
{
if (newval) {
285#ifdef VI1
	Flag(FVI)(shell_flags[(int) (FVI)]) = 0;
287#endif /* VI */
288#ifdef EMACS1
	Flag(FEMACS)(shell_flags[(int) (FEMACS)]) = Flag(FGMACS)(shell_flags[(int) (FGMACS)]) = 0;
290#endif /* EMACS */
	Flag(f)(shell_flags[(int) (f)]) = newval;
}
} else
/* Turning off -p? */
if (f == FPRIVILEGED && oldval && !newval && issetugid() &&
   !dropped_privileges) {
gid_t gid = getgid();

setresgid(gid, gid, gid);
setgroups(1, &gid);
setresuid(ksheuid, ksheuid, ksheuid);

if (pledge("stdio rpath wpath cpath fattr flock getpw proc "
    "exec tty", NULL((void*)0)) == -1)
	bi_errorf("pledge fail");
dropped_privileges = 1;
} else if (f == FPOSIX && newval) {
Flag(FBRACEEXPAND)(shell_flags[(int) (FBRACEEXPAND)]) = 0;
}
/* Changing interactive flag? */
if (f == FTALKING) {
if ((what == OF_CMDLINE0x01 || what == OF_SET0x02) && procpid == kshpid)
	Flag(FTALKING_I)(shell_flags[(int) (FTALKING_I)]) = newval;
}
315}

317/* parse command line & set command arguments.  returns the index of
* non-option arguments, -1 if there is an error.
*/
320int
321parse_args(char **argv,
  int what,			/* OF_CMDLINE or OF_SET */
  int *setargsp)
324{
static char cmd_opts[NELEM(sh_options)(sizeof(sh_options) / sizeof((sh_options)[0])) + 3]; /* o:\0 */
static char set_opts[NELEM(sh_options)(sizeof(sh_options) / sizeof((sh_options)[0])) + 5]; /* Ao;s\0 */
char *opts;
char *array = NULL((void*)0);
Getopt go;
int i, optc, sortargs = 0, arrayset = 0;
unsigned int ele;

/* First call?  Build option strings... */
if (cmd_opts[0] == '\0') {
1
Assuming the condition is false→
2
←
Taking false branch→
char *p, *q;

/* see cmd_opts[] declaration */
strlcpy(cmd_opts, "o:", sizeof cmd_opts);
p = cmd_opts + strlen(cmd_opts);
/* see set_opts[] declaration */
strlcpy(set_opts, "A:o;s", sizeof set_opts);
q = set_opts + strlen(set_opts);
for (ele = 0; ele < NELEM(sh_options)(sizeof(sh_options) / sizeof((sh_options)[0])); ele++) {
	if (sh_options[ele].c) {
		if (sh_options[ele].flags & OF_CMDLINE0x01)
			*p++ = sh_options[ele].c;
		if (sh_options[ele].flags & OF_SET0x02)
			*q++ = sh_options[ele].c;
	}
}
*p = '\0';
*q = '\0';
}

if (what == OF_CMDLINE0x01) {
3
←
Assuming 'what' is not equal to OF_CMDLINE→
4
←
Taking false branch→
char *p;
/* Set FLOGIN before parsing options so user can clear
 * flag using +l.
 */
Flag(FLOGIN)(shell_flags[(int) (FLOGIN)]) = (argv[0][0] == '-' ||
    ((p = strrchr(argv[0], '/')) && *++p == '-'));
opts = cmd_opts;
} else
opts = set_opts;
ksh_getopt_reset(&go, GF_ERROR(1<<(0))|GF_PLUSOPT(1<<(1)));
5
←
Calling 'ksh_getopt_reset'→
7
←
Returning from 'ksh_getopt_reset'→
while ((optc = ksh_getopt(argv, &go, opts)) != -1) {
8
←
Calling 'ksh_getopt'→
32
←
Returning from 'ksh_getopt'→
33
←
Assuming the condition is true→
34
←
Loop condition is true.  Entering loop body→
40
←
Loop condition is false. Execution continues on line 423→
int set = (go.info & GI_PLUS(1<<(1))) ? 0 : 1;
35
←
'?' condition is true→
switch (optc) {
36
←
Control jumps to 'case 65:'  at line 369→
case 'A':
	arrayset = set36.1
'set' is 0
 ? 1 : -1;
37
←
'?' condition is false→
	array = go.optarg;
38
←
Null pointer value stored to 'array'→
	break;
39
←
 Execution continues on line 366→

case 'o':
	if (go.optarg == NULL((void*)0)) {
		/* lone -o: print options
		 *
		 * Note that on the command line, -o requires
		 * an option (ie, can't get here if what is
		 * OF_CMDLINE).
		 */
		printoptions(set);
		break;
	}
	i = option(go.optarg);
	if (i != -1 && set == Flag(i)(shell_flags[(int) (i)]))
		/* Don't check the context if the flag
		 * isn't changing - makes "set -o interactive"
		 * work if you're already interactive.  Needed
		 * if the output of "set +o" is to be used.
		 */
		;
	else if (i != -1 && (sh_options[i].flags & what))
		change_flag((enum sh_flag) i, what, set);
	else {
		bi_errorf("%s: bad option", go.optarg);
		return -1;
	}
	break;

case '?':
	return -1;

default:
	/* -s: sort positional params (at&t ksh stupidity) */
	if (what == OF_SET0x02 && optc == 's') {
		sortargs = 1;
		break;
	}
	for (ele = 0; ele < NELEM(sh_options)(sizeof(sh_options) / sizeof((sh_options)[0])); ele++)
		if (optc == sh_options[ele].c &&
		    (what & sh_options[ele].flags)) {
			change_flag((enum sh_flag) ele, what,
			    set);
			break;
		}
	if (ele == NELEM(sh_options)(sizeof(sh_options) / sizeof((sh_options)[0]))) {
		internal_errorf("%s: `%c'", __func__, optc);
		return -1; /* not reached */
	}
}
}
if (!(go.info & GI_MINUSMINUS(1<<(2))) && argv[go.optind] &&
   (argv[go.optind][0] == '-' || argv[go.optind][0] == '+') &&
   argv[go.optind][1] == '\0') {
/* lone - clears -v and -x flags */
if (argv[go.optind][0] == '-' && !Flag(FPOSIX)(shell_flags[(int) (FPOSIX)]))
	Flag(FVERBOSE)(shell_flags[(int) (FVERBOSE)]) = Flag(FXTRACE)(shell_flags[(int) (FXTRACE)]) = 0;
/* set skips lone - or + option */
go.optind++;
}
if (setargsp)
41
←
Assuming 'setargsp' is null→
42
←
Taking false branch→
/* -- means set $#/$* even if there are no arguments */
*setargsp = !arrayset && ((go.info & GI_MINUSMINUS(1<<(2))) ||
    argv[go.optind]);

if (arrayset42.1
'arrayset' is -1
 && (!*array || *skip_varname(array, false0))) {
43
←
Dereference of null pointer (loaded from variable 'array')
bi_errorf("%s: is not an identifier", array);
return -1;
}
if (sortargs) {
for (i = go.optind; argv[i]; i++)
	;
qsortp((void **) &argv[go.optind], (size_t) (i - go.optind),
    xstrcmp);
}
if (arrayset) {
set_array(array, arrayset, argv + go.optind);
for (; argv[go.optind]; go.optind++)
	;
}

return go.optind;
454}

456/* parse a decimal number: returns 0 if string isn't a number, 1 otherwise */
457int
458getn(const char *as, int *ai)
459{
char *p;
long n;

n = strtol(as, &p, 10);

if (!*as || *p || INT_MIN(-2147483647 -1) >= n || n >= INT_MAX2147483647)
return 0;

*ai = (int)n;
return 1;
470}

472/* getn() that prints error */
473int
474bi_getn(const char *as, int *ai)
475{
int rv = getn(as, ai);

if (!rv)
bi_errorf("%s: bad number", as);
return rv;
481}

483/* -------- gmatch.c -------- */

485/*
* int gmatch(string, pattern)
* char *string, *pattern;
*
* Match a pattern as in sh(1).
* pattern character are prefixed with MAGIC by expand.
*/

493int
494gmatch(const char *s, const char *p, int isfile)
495{
const char *se, *pe;

if (s == NULL((void*)0) || p == NULL((void*)0))
return 0;
se = s + strlen(s);
pe = p + strlen(p);
/* isfile is false iff no syntax check has been done on
* the pattern.  If check fails, just to a strcmp().
*/
if (!isfile && !has_globbing(p, pe)) {
size_t len = pe - p + 1;
char tbuf[64];
char *t = len <= sizeof(tbuf) ? tbuf :
    alloc(len, ATEMP&genv->area);
debunk(t, p, len);
return !strcmp(t, s);
}
return do_gmatch((const unsigned char *) s, (const unsigned char *) se,
   (const unsigned char *) p, (const unsigned char *) pe);
515}

517/* Returns if p is a syntacticly correct globbing pattern, false
* if it contains no pattern characters or if there is a syntax error.
* Syntax errors are:
*	- [ with no closing ]
*	- imbalanced $(...) expression
*	- [...] and *(...) not nested (eg, [a$(b|]c), *(a[b|c]d))
*/
524/*XXX
525- if no magic,
if dest given, copy to dst
return ?
528- if magic && (no globbing || syntax error)
debunk to dst
return ?
531- return ?
532*/
533int
534has_globbing(const char *xp, const char *xpe)
535{
const unsigned char *p = (const unsigned char *) xp;
const unsigned char *pe = (const unsigned char *) xpe;
int c;
int nest = 0, bnest = 0;
int saw_glob = 0;
int in_bracket = 0; /* inside [...] */

for (; p < pe; p++) {
if (!ISMAGIC(*p)((unsigned char)(*p) == (7)))
	continue;
if ((c = *++p) == '*' || c == '?')
	saw_glob = 1;
else if (c == '[') {
	if (!in_bracket) {
		saw_glob = 1;
		in_bracket = 1;
		if (ISMAGIC(p[1])((unsigned char)(p[1]) == (7)) && p[2] == '!')
			p += 2;
		if (ISMAGIC(p[1])((unsigned char)(p[1]) == (7)) && p[2] == ']')
			p += 2;
	}
	/* XXX Do we need to check ranges here? POSIX Q */
} else if (c == ']') {
	if (in_bracket) {
		if (bnest)		/* [a*(b]) */
			return 0;
		in_bracket = 0;
	}
} else if ((c & 0x80) && strchr("*+?@! ", c & 0x7f)) {
	saw_glob = 1;
	if (in_bracket)
		bnest++;
	else
		nest++;
} else if (c == '|') {
	if (in_bracket && !bnest)	/* *(a[foo|bar]) */
		return 0;
} else if (c == /*(*/ ')') {
	if (in_bracket) {
		if (!bnest--)		/* *(a[b)c] */
			return 0;
	} else if (nest)
		nest--;
}
/* else must be a MAGIC-MAGIC, or MAGIC-!, MAGIC--, MAGIC-]
	 MAGIC-{, MAGIC-,, MAGIC-} */
}
return saw_glob && !in_bracket && !nest;
584}

586/* Function must return either 0 or 1 (assumed by code for 0x80|'!') */
587static int
588do_gmatch(const unsigned char *s, const unsigned char *se,
  const unsigned char *p, const unsigned char *pe)
590{
int sc, pc;
const unsigned char *prest, *psub, *pnext;
const unsigned char *srest;

if (s == NULL((void*)0) || p == NULL((void*)0))
return 0;
while (p < pe) {
pc = *p++;
sc = s < se ? *s : '\0';
s++;
if (!ISMAGIC(pc)((unsigned char)(pc) == (7))) {
	if (sc != pc)
		return 0;
	continue;
}
switch (*p++) {
case '[':
	if (sc == 0 || (p = cclass(p, sc)) == NULL((void*)0))
		return 0;
	break;

case '?':
	if (sc == 0)
		return 0;
	break;

case '*':
	/* collapse consecutive stars */
	while (ISMAGIC(p[0])((unsigned char)(p[0]) == (7)) && p[1] == '*')
		p += 2;
	if (p == pe)
		return 1;
	s--;
	do {
		if (do_gmatch(s, se, p, pe))
			return 1;
	} while (s++ < se);
	return 0;

  /*
   * [*+?@!](pattern|pattern|..)
   *
   * Not ifdef'd KSH as this is needed for ${..%..}, etc.
   */
case 0x80|'+': /* matches one or more times */
case 0x80|'*': /* matches zero or more times */
	if (!(prest = pat_scan(p, pe, 0)))
		return 0;
	s--;
	/* take care of zero matches */
	if (p[-1] == (0x80 | '*') &&
	    do_gmatch(s, se, prest, pe))
		return 1;
	for (psub = p; ; psub = pnext) {
		pnext = pat_scan(psub, pe, 1);
		for (srest = s; srest <= se; srest++) {
			if (do_gmatch(s, srest, psub, pnext - 2) &&
			    (do_gmatch(srest, se, prest, pe) ||
			    (s != srest && do_gmatch(srest,
			    se, p - 2, pe))))
				return 1;
		}
		if (pnext == prest)
			break;
	}
	return 0;

case 0x80|'?': /* matches zero or once */
case 0x80|'@': /* matches one of the patterns */
case 0x80|' ': /* simile for @ */
	if (!(prest = pat_scan(p, pe, 0)))
		return 0;
	s--;
	/* Take care of zero matches */
	if (p[-1] == (0x80 | '?') &&
	    do_gmatch(s, se, prest, pe))
		return 1;
	for (psub = p; ; psub = pnext) {
		pnext = pat_scan(psub, pe, 1);
		srest = prest == pe ? se : s;
		for (; srest <= se; srest++) {
			if (do_gmatch(s, srest, psub, pnext - 2) &&
			    do_gmatch(srest, se, prest, pe))
				return 1;
		}
		if (pnext == prest)
			break;
	}
	return 0;

case 0x80|'!': /* matches none of the patterns */
	if (!(prest = pat_scan(p, pe, 0)))
		return 0;
	s--;
	for (srest = s; srest <= se; srest++) {
		int matched = 0;

		for (psub = p; ; psub = pnext) {
			pnext = pat_scan(psub, pe, 1);
			if (do_gmatch(s, srest, psub,
			    pnext - 2)) {
				matched = 1;
				break;
			}
			if (pnext == prest)
				break;
		}
		if (!matched &&
		    do_gmatch(srest, se, prest, pe))
			return 1;
	}
	return 0;

default:
	if (sc != p[-1])
		return 0;
	break;
}
}
return s == se;
711}

713static int
714posix_cclass(const unsigned char *pattern, int test, const unsigned char **ep)
715{
const struct cclass *cc;
const unsigned char *colon;
size_t len;
int rval = 0;

if ((colon = strchr(pattern, ':')) == NULL((void*)0) || colon[1] != MAGIC(7)) {
*ep = pattern - 2;
return -1;
}
*ep = colon + 3; /* skip MAGIC */
len = (size_t)(colon - pattern);

for (cc = cclasses; cc->name != NULL((void*)0); cc++) {
if (!strncmp(pattern, cc->name, len) && cc->name[len] == '\0') {
	if (cc->isctype(test))
		rval = 1;
	break;
}
}
if (cc->name == NULL((void*)0)) {
rval = -2;	/* invalid character class */
}
return rval;
739}

741static const unsigned char *
742cclass(const unsigned char *p, int sub)
743{
int c, d, rv, not, found = 0;
const unsigned char *orig_p = p;

if ((not = (ISMAGIC(*p)((unsigned char)(*p) == (7)) && *++p == '!')))
p++;
do {
/* check for POSIX character class (e.g. [[:alpha:]]) */
if ((p[0] == MAGIC(7) && p[1] == '[' && p[2] == ':') ||
    (p[0] == '[' && p[1] == ':')) {
	do {
		const char *pp = p + (*p == MAGIC(7)) + 2;
		rv = posix_cclass(pp, sub, &p);
		switch (rv) {
		case 1:
			found = 1;
			break;
		case -2:
			return NULL((void*)0);
		}
	} while (rv != -1 && p[0] == MAGIC(7) && p[1] == '[' && p[2] == ':');
	if (p[0] == MAGIC(7) && p[1] == ']')
		break;
}

c = *p++;
if (ISMAGIC(c)((unsigned char)(c) == (7))) {
	c = *p++;
	if ((c & 0x80) && !ISMAGIC(c)((unsigned char)(c) == (7))) {
		c &= 0x7f;/* extended pattern matching: *+?@! */
		/* XXX the ( char isn't handled as part of [] */
		if (c == ' ') /* simile for @: plain (..) */
			c = '(' /*)*/;
	}
}
if (c == '\0')
	/* No closing ] - act as if the opening [ was quoted */
	return sub == '[' ? orig_p : NULL((void*)0);
if (ISMAGIC(p[0])((unsigned char)(p[0]) == (7)) && p[1] == '-' &&
    (!ISMAGIC(p[2])((unsigned char)(p[2]) == (7)) || p[3] != ']')) {
	p += 2; /* MAGIC- */
	d = *p++;
	if (ISMAGIC(d)((unsigned char)(d) == (7))) {
		d = *p++;
		if ((d & 0x80) && !ISMAGIC(d)((unsigned char)(d) == (7)))
			d &= 0x7f;
	}
	/* POSIX says this is an invalid expression */
	if (c > d)
		return NULL((void*)0);
} else
	d = c;
if (c == sub || (c <= sub && sub <= d))
	found = 1;
} while (!(ISMAGIC(p[0])((unsigned char)(p[0]) == (7)) && p[1] == ']'));

return (found != not) ? p+2 : NULL((void*)0);
800}

802/* Look for next ) or | (if match_sep) in *(foo|bar) pattern */
803const unsigned char *
804pat_scan(const unsigned char *p, const unsigned char *pe, int match_sep)
805{
int nest = 0;

for (; p < pe; p++) {
if (!ISMAGIC(*p)((unsigned char)(*p) == (7)))
	continue;
if ((*++p == /*(*/ ')' && nest-- == 0) ||
    (*p == '|' && match_sep && nest == 0))
	return ++p;
if ((*p & 0x80) && strchr("*+?@! ", *p & 0x7f))
	nest++;
}
return NULL((void*)0);
818}

820/*
* quick sort of array of generic pointers to objects.
*/
823void
824qsortp(void **base,			/* base address */
  size_t n,				/* elements */
  int (*f) (const void *, const void *)) /* compare function */
827{
qsort(base, n, sizeof(char *), f);
829}

831int
832xstrcmp(const void *p1, const void *p2)
833{
return (strcmp(*(char **)p1, *(char **)p2));
835}

837/* Initialize a Getopt structure */
838void
839ksh_getopt_reset(Getopt *go, int flags)
840{
go->optind = 1;
go->optarg = NULL((void*)0);
6
←
Null pointer value stored to 'go.optarg'→
go->p = 0;
go->flags = flags;
go->info = 0;
go->buf[1] = '\0';
847}


850/* getopt() used for shell built-in commands, the getopts command, and
* command line options.
* A leading ':' in options means don't print errors, instead return '?'
* or ':' and set go->optarg to the offending option character.
* If GF_ERROR is set (and option doesn't start with :), errors result in
* a call to bi_errorf().
*
* Non-standard features:
*	- ';' is like ':' in options, except the argument is optional
*	  (if it isn't present, optarg is set to 0).
*	  Used for 'set -o'.
*	- ',' is like ':' in options, except the argument always immediately
*	  follows the option character (optarg is set to the null string if
*	  the option is missing).
*	  Used for 'read -u2', 'print -u2' and fc -40.
*	- '#' is like ':' in options, expect that the argument is optional
*	  and must start with a digit or be the string "unlimited".  If the
*	  argument doesn't match, it is assumed to be missing and normal option
*	  processing continues (optarg is set to 0 if the option is missing).
*	  Used for 'typeset -LZ4' and 'ulimit -adunlimited'.
*	- accepts +c as well as -c IF the GF_PLUSOPT flag is present.  If an
*	  option starting with + is accepted, the GI_PLUS flag will be set
*	  in go->info.
*/
874int
875ksh_getopt(char **argv, Getopt *go, const char *options)
876{
char c;
char *o;

if (go->p8.1
Field 'p' is equal to 0
 == 0 || (c = argv[go->optind - 1][go->p]) == '\0') {
char *arg = argv[go->optind], flag = arg ? *arg : '\0';
9
←
Assuming 'arg' is non-null→
10
←
'?' condition is true→

go->p = 1;
if (flag == '-' && arg[1] == '-' && arg[2] == '\0') {
11
←
Assuming the condition is false→
	go->optind++;
	go->p = 0;
	go->info |= GI_MINUSMINUS(1<<(2));
	return -1;
}
if (arg11.1
'arg' is not equal to NULL
 == NULL((void*)0) ||
14
←
Taking false branch→
    ((flag != '-' ) && /* neither a - nor a + (if + allowed) */
    (!(go->flags & GF_PLUSOPT(1<<(1))) || flag != '+')) ||
12
←
Assuming the condition is false→
    (c = arg[1]) == '\0') {
13
←
Assuming the condition is false→
	go->p = 0;
	return -1;
}
go->optind++;
go->info &= ~(GI_MINUS(1<<(0))|GI_PLUS(1<<(1)));
go->info |= flag == '-' ? GI_MINUS(1<<(0)) : GI_PLUS(1<<(1));
15
←
'?' condition is false→
}
go->p++;
if (c == '?' || c == ':' || c == ';' || c == ',' || c == '#' ||
16
←
Assuming the condition is false→
17
←
Assuming the condition is false→
18
←
Assuming the condition is false→
19
←
Assuming the condition is false→
20
←
Assuming the condition is false→
22
←
Taking false branch→
   !(o = strchr(options, c))) {
21
←
Assuming 'o' is non-null→
if (options[0] == ':') {
	go->buf[0] = c;
	go->optarg = go->buf;
} else {
	warningf(false0, "%s%s-%c: unknown option",
	    (go->flags & GF_NONAME(1<<(2))) ? "" : argv[0],
	    (go->flags & GF_NONAME(1<<(2))) ? "" : ": ", c);
	if (go->flags & GF_ERROR(1<<(0)))
		bi_errorf(NULL((void*)0));
}
return '?';
}
/* : means argument must be present, may be part of option argument
*   or the next argument
* ; same as : but argument may be missing
* , means argument is part of option argument, and may be null.
*/
if (*++o == ':' || *o == ';') {
23
←
Assuming the condition is false→
24
←
Assuming the condition is false→
25
←
Taking false branch→
if (argv[go->optind - 1][go->p])
	go->optarg = argv[go->optind - 1] + go->p;
else if (argv[go->optind])
	go->optarg = argv[go->optind++];
else if (*o == ';')
	go->optarg = NULL((void*)0);
else {
	if (options[0] == ':') {
		go->buf[0] = c;
		go->optarg = go->buf;
		return ':';
	}
	warningf(false0, "%s%s-`%c' requires argument",
	    (go->flags & GF_NONAME(1<<(2))) ? "" : argv[0],
	    (go->flags & GF_NONAME(1<<(2))) ? "" : ": ", c);
	if (go->flags & GF_ERROR(1<<(0)))
		bi_errorf(NULL((void*)0));
	return '?';
}
go->p = 0;
} else if (*o == ',') {
26
←
Assuming the condition is false→
27
←
Taking false branch→
/* argument is attached to option character, even if null */
go->optarg = argv[go->optind - 1] + go->p;
go->p = 0;
} else if (*o == '#') {
28
←
Assuming the condition is false→
29
←
Taking false branch→
/* argument is optional and may be attached or unattached
 * but must start with a digit.  optarg is set to 0 if the
 * argument is missing.
 */
if (argv[go->optind - 1][go->p]) {
	if (digit(argv[go->optind - 1][go->p])isdigit((unsigned char)(argv[go->optind - 1][go->p])) ||
	    !strcmp(&argv[go->optind - 1][go->p], "unlimited")) {
		go->optarg = argv[go->optind - 1] + go->p;
		go->p = 0;
	} else
		go->optarg = NULL((void*)0);
} else {
	if (argv[go->optind] && (digit(argv[go->optind][0])isdigit((unsigned char)(argv[go->optind][0])) ||
	    !strcmp(argv[go->optind], "unlimited"))) {
		go->optarg = argv[go->optind++];
		go->p = 0;
	} else
		go->optarg = NULL((void*)0);
}
}
return c;
30
←
Returning without writing to 'go->optarg'→
31
←
Returning value (loaded from 'c'), which participates in a condition later→
968}

970/* print variable/alias value using necessary quotes
* (POSIX says they should be suitable for re-entry...)
* No trailing newline is printed.
*/
974void
975print_value_quoted(const char *s)
976{
const char *p;
int inquote = 0;

/* Test if any quotes are needed */
for (p = s; *p; p++)
if (ctype(*p, C_QUOTE)!!(ctypes[(unsigned char)(*p)]&((1<<(8)))))
	break;
if (!*p) {
shprintf("%s", s);
return;
}
for (p = s; *p; p++) {
if (*p == '\'') {
	shprintf(inquote ? "'\\'" : "\\'");
	inquote = 0;
} else {
	if (!inquote) {
		shprintf("'");
		inquote = 1;
	}
	shf_putc(*p, shl_stdout)(((&shf_iob[1]))->wnleft == 0 ? shf_putchar((*p), ((&
shf_iob[1]))) : (((&shf_iob[1]))->wnleft--, *((&shf_iob
[1]))->wp++ = (*p)));
}
}
if (inquote)
shprintf("'");
1002}

1004/* Print things in columns and rows - func() is called to format the ith
* element
*/
1007void
1008print_columns(struct shf *shf, int n, char *(*func) (void *, int, char *, int),
  void *arg, int max_width, int prefcol)
1010{
char *str = alloc(max_width + 1, ATEMP&genv->area);
int i;
int r, c;
int rows, cols;
int nspace;
int col_width;

/* max_width + 1 for the space.  Note that no space
* is printed after the last column to avoid problems
* with terminals that have auto-wrap.
*/
cols = x_cols / (max_width + 1);
if (!cols)
cols = 1;
rows = (n + cols - 1) / cols;
if (prefcol && n && cols > rows) {
int tmp = rows;

rows = cols;
cols = tmp;
if (rows > n)
	rows = n;
}

col_width = max_width;
if (cols == 1)
col_width = 0; /* Don't pad entries in single column output. */
nspace = (x_cols - max_width * cols) / cols;
if (nspace <= 0)
nspace = 1;
for (r = 0; r < rows; r++) {
for (c = 0; c < cols; c++) {
	i = c * rows + r;
	if (i < n) {
		shf_fprintf(shf, "%-*s",
		    col_width,
		    (*func)(arg, i, str, max_width + 1));
		if (c + 1 < cols)
			shf_fprintf(shf, "%*s", nspace, "");
	}
}
shf_putchar('\n', shf);
}
afree(str, ATEMP&genv->area);
1055}

1057/* Strip any nul bytes from buf - returns new length (nbytes - # of nuls) */
1058int
1059strip_nuls(char *buf, int nbytes)
1060{
char *dst;

if ((dst = memchr(buf, '\0', nbytes))) {
char *end = buf + nbytes;
char *p, *q;

for (p = dst; p < end; p = q) {
	/* skip a block of nulls */
	while (++p < end && *p == '\0')
		;
	/* find end of non-null block */
	if (!(q = memchr(p, '\0', end - p)))
		q = end;
	memmove(dst, p, q - p);
	dst += q - p;
}
*dst = '\0';
return dst - buf;
}
return nbytes;
1081}

1083/* Like read(2), but if read fails due to non-blocking flag, resets flag
* and restarts read.
*/
1086int
1087blocking_read(int fd, char *buf, int nbytes)
1088{
int ret;
int tried_reset = 0;

while ((ret = read(fd, buf, nbytes)) == -1) {
if (!tried_reset && errno(*__errno()) == EAGAIN35) {
	int oerrno = errno(*__errno());
	if (reset_nonblock(fd) > 0) {
		tried_reset = 1;
		continue;
	}
	errno(*__errno()) = oerrno;
}
break;
}
return ret;
1104}

1106/* Reset the non-blocking flag on the specified file descriptor.
* Returns -1 if there was an error, 0 if non-blocking wasn't set,
* 1 if it was.
*/
1110int
1111reset_nonblock(int fd)
1112{
int flags;

if ((flags = fcntl(fd, F_GETFL3)) == -1)
return -1;
if (!(flags & O_NONBLOCK0x0004))
return 0;
flags &= ~O_NONBLOCK0x0004;
if (fcntl(fd, F_SETFL4, flags) == -1)
return -1;
return 1;
1123}


1126/* Like getcwd(), except bsize is ignored if buf is 0 (PATH_MAX is used) */
1127char *
1128ksh_get_wd(char *buf, int bsize)
1129{
char *b;
char *ret;

/* Note: we could just use plain getcwd(), but then we'd had to
* inject possibly allocated space into the ATEMP area. */
/* Assume getcwd() available */
if (!buf) {
bsize = PATH_MAX1024;
b = alloc(bsize, ATEMP&genv->area);
} else
b = buf;

ret = getcwd(b, bsize);

if (!buf) {
if (ret)
	ret = aresize(b, strlen(b) + 1, ATEMP&genv->area);
else
	afree(b, ATEMP&genv->area);
}

return ret;
1152}