/usr/src/gnu/usr.bin/binutils/gdb/event-loop.c

Bug Summary

File:	src/gnu/usr.bin/binutils/gdb/event-loop.c
Warning:	line 821, column 25 Access to field 'ready_mask' results in a dereference of a null pointer (loaded from variable 'file_ptr')
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name event-loop.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/gnu/usr.bin/binutils/obj/gdb -resource-dir /usr/local/lib/clang/13.0.0 -D PIE_DEFAULT=1 -I . -I /usr/src/gnu/usr.bin/binutils/gdb -I /usr/src/gnu/usr.bin/binutils/gdb/config -D LOCALEDIR="/usr/share/locale" -D HAVE_CONFIG_H -I /usr/src/gnu/usr.bin/binutils/gdb/../include/opcode -I ../bfd -I /usr/src/gnu/usr.bin/binutils/gdb/../bfd -I /usr/src/gnu/usr.bin/binutils/gdb/../include -I ../intl -I /usr/src/gnu/usr.bin/binutils/gdb/../intl -D MI_OUT=1 -D TUI=1 -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/gnu/usr.bin/binutils/obj/gdb -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -fcommon -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/gnu/usr.bin/binutils/gdb/event-loop.c
1/* Event loop machinery for GDB, the GNU debugger.
 Copyright 1999, 2000, 2001, 2002 Free Software Foundation, Inc.
 Written by Elena Zannoni <ezannoni@cygnus.com> of Cygnus Solutions.

 This file is part of GDB.

 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.

 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.

 You should have received a copy of the GNU General Public License
 along with this program; if not, write to the Free Software
 Foundation, Inc., 59 Temple Place - Suite 330,
 Boston, MA 02111-1307, USA. */

22#include "defs.h"
23#include "event-loop.h"
24#include "event-top.h"

26#ifdef HAVE_POLL1
27#if defined (HAVE_POLL_H1)
28#include <poll.h>
29#elif defined (HAVE_SYS_POLL_H1)
30#include <sys/poll.h>
31#endif
32#endif

34#include <sys/types.h>
35#include "gdb_string.h"
36#include <errno(*__errno()).h>
37#include <sys/time.h>

39typedef struct gdb_event gdb_event;
40typedef void (event_handler_func) (int);

42/* Event for the GDB event system.  Events are queued by calling
 async_queue_event and serviced later on by gdb_do_one_event. An
 event can be, for instance, a file descriptor becoming ready to be
 read. Servicing an event simply means that the procedure PROC will
 be called.  We have 2 queues, one for file handlers that we listen
 to in the event loop, and one for the file handlers+events that are
 ready. The procedure PROC associated with each event is always the
 same (handle_file_event).  Its duty is to invoke the handler
 associated with the file descriptor whose state change generated
 the event, plus doing other cleanups and such. */

53struct gdb_event
{
  event_handler_func *proc;	/* Procedure to call to service this event. */
  int fd;			/* File descriptor that is ready. */
  struct gdb_event *next_event;	/* Next in list of events or NULL. */
};

60/* Information about each file descriptor we register with the event
 loop. */

63typedef struct file_handler
{
  int fd;			/* File descriptor. */
  int mask;			/* Events we want to monitor: POLLIN, etc. */
  int ready_mask;		/* Events that have been seen since
		   the last time. */
  handler_func *proc;		/* Procedure to call when fd is ready. */
  gdb_client_data client_data;	/* Argument to pass to proc. */
  int error;			/* Was an error detected on this fd? */
  struct file_handler *next_file;	/* Next registered file descriptor. */
}
74file_handler;

76/* PROC is a function to be invoked when the READY flag is set. This
 happens when there has been a signal and the corresponding signal
 handler has 'triggered' this async_signal_handler for
 execution. The actual work to be done in response to a signal will
 be carried out by PROC at a later time, within process_event. This
 provides a deferred execution of signal handlers.
 Async_init_signals takes care of setting up such an
 asyn_signal_handler for each interesting signal. */
84typedef struct async_signal_handler
{
  int ready;			/* If ready, call this handler from the main event loop, 
		   using invoke_async_handler. */
  struct async_signal_handler *next_handler;	/* Ptr to next handler */
  sig_handler_func *proc;	/* Function to call to do the work */
  gdb_client_data client_data;	/* Argument to async_handler_func */
}
92async_signal_handler;


95/* Event queue:  
 - the first event in the queue is the head of the queue. 
 It will be the next to be serviced.
 - the last event in the queue 

 Events can be inserted at the front of the queue or at the end of
 the queue.  Events will be extracted from the queue for processing
 starting from the head.  Therefore, events inserted at the head of
 the queue will be processed in a last in first out fashion, while
 those inserted at the tail of the queue will be processed in a first
 in first out manner.  All the fields are NULL if the queue is
 empty. */

108static struct
{
  gdb_event *first_event;	/* First pending event */
  gdb_event *last_event;	/* Last pending event */
}
113event_queue;

115/* Gdb_notifier is just a list of file descriptors gdb is interested in.
 These are the input file descriptor, and the target file
 descriptor. We have two flavors of the notifier, one for platforms
 that have the POLL function, the other for those that don't, and
 only support SELECT. Each of the elements in the gdb_notifier list is
 basically a description of what kind of events gdb is interested
 in, for each fd. */

123/* As of 1999-04-30 only the input file descriptor is registered with the
 event loop. */

126/* Do we use poll or select ? */
127#ifdef HAVE_POLL1
128#define USE_POLL1 1
129#else
130#define USE_POLL1 0
131#endif /* HAVE_POLL */

133static unsigned char use_poll = USE_POLL1;

135static struct
{
  /* Ptr to head of file handler list. */
  file_handler *first_file_handler;

140#ifdef HAVE_POLL1
  /* Ptr to array of pollfd structures. */
  struct pollfd *poll_fds;

  /* Timeout in milliseconds for calls to poll(). */
  int poll_timeout;
146#endif

  /* Masks to be used in the next call to select.
     Bits are set in response to calls to create_file_handler. */
  fd_set check_masks[3];

  /* What file descriptors were found ready by select. */
  fd_set ready_masks[3];

  /* Number of file descriptors to monitor. (for poll) */
  /* Number of valid bits (highest fd value + 1). (for select) */
  int num_fds;

  /* Time structure for calls to select(). */
  struct timeval select_timeout;

  /* Flag to tell whether the timeout should be used. */
  int timeout_valid;
}
165gdb_notifier;

167/* Structure associated with a timer. PROC will be executed at the
 first occasion after WHEN. */
169struct gdb_timer
{
  struct timeval when;
  int timer_id;
  struct gdb_timer *next;
  timer_handler_func *proc;	/* Function to call to do the work */
  gdb_client_data client_data;	/* Argument to async_handler_func */
}
177gdb_timer;

179/* List of currently active timers. It is sorted in order of
 increasing timers. */
181static struct
{
  /* Pointer to first in timer list. */
  struct gdb_timer *first_timer;

  /* Id of the last timer created. */
  int num_timers;
}
189timer_list;

191/* All the async_signal_handlers gdb is interested in are kept onto
 this list. */
193static struct
{
  /* Pointer to first in handler list. */
  async_signal_handler *first_handler;

  /* Pointer to last in handler list. */
  async_signal_handler *last_handler;
}
201sighandler_list;

203/* Are any of the handlers ready?  Check this variable using
 check_async_ready. This is used by process_event, to determine
 whether or not to invoke the invoke_async_signal_handler
 function. */
207static int async_handler_ready = 0;

209static void create_file_handler (int fd, int mask, handler_func * proc, gdb_client_data client_data);
210static void invoke_async_signal_handler (void);
211static void handle_file_event (int event_file_desc);
212static int gdb_wait_for_event (void);
213static int check_async_ready (void);
214static void async_queue_event (gdb_event * event_ptr, queue_position position);
215static gdb_event *create_file_event (int fd);
216static int process_event (void);
217static void handle_timer_event (int dummy);
218static void poll_timers (void);
219

221/* Insert an event object into the gdb event queue at 
 the specified position.
 POSITION can be head or tail, with values TAIL, HEAD.
 EVENT_PTR points to the event to be inserted into the queue.
 The caller must allocate memory for the event. It is freed
 after the event has ben handled.
 Events in the queue will be processed head to tail, therefore,
 events inserted at the head of the queue will be processed
 as last in first out. Event appended at the tail of the queue
 will be processed first in first out. */
231static void
232async_queue_event (gdb_event * event_ptr, queue_position position)
233{
if (position == TAIL)
  {
    /* The event will become the new last_event. */

    event_ptr->next_event = NULL((void*)0);
    if (event_queue.first_event == NULL((void*)0))
event_queue.first_event = event_ptr;
    else
event_queue.last_event->next_event = event_ptr;
    event_queue.last_event = event_ptr;
  }
else if (position == HEAD)
  {
    /* The event becomes the new first_event. */

    event_ptr->next_event = event_queue.first_event;
    if (event_queue.first_event == NULL((void*)0))
event_queue.last_event = event_ptr;
    event_queue.first_event = event_ptr;
  }
254}

256/* Create a file event, to be enqueued in the event queue for
 processing. The procedure associated to this event is always
 handle_file_event, which will in turn invoke the one that was
 associated to FD when it was registered with the event loop. */
260static gdb_event *
261create_file_event (int fd)
262{
gdb_event *file_event_ptr;

file_event_ptr = (gdb_event *) xmalloc (sizeof (gdb_event));
file_event_ptr->proc = handle_file_event;
file_event_ptr->fd = fd;
return (file_event_ptr);
269}

271/* Process one event.
 The event can be the next one to be serviced in the event queue,
 or an asynchronous event handler can be invoked in response to
 the reception of a signal.
 If an event was processed (either way), 1 is returned otherwise
 0 is returned.   
 Scan the queue from head to tail, processing therefore the high
 priority events first, by invoking the associated event handler
 procedure. */
280static int
281process_event (void)
282{
gdb_event *event_ptr, *prev_ptr;
event_handler_func *proc;
int fd;

/* First let's see if there are any asynchronous event handlers that
   are ready. These would be the result of invoking any of the
   signal handlers. */

if (check_async_ready ())
  {
    invoke_async_signal_handler ();
    return 1;
  }

/* Look in the event queue to find an event that is ready
   to be processed. */

for (event_ptr = event_queue.first_event; event_ptr != NULL((void*)0);
     event_ptr = event_ptr->next_event)
  {
    /* Call the handler for the event. */

    proc = event_ptr->proc;
    fd = event_ptr->fd;

    /* Let's get rid of the event from the event queue.  We need to
       do this now because while processing the event, the proc
       function could end up calling 'error' and therefore jump out
       to the caller of this function, gdb_do_one_event. In that
       case, we would have on the event queue an event wich has been
       processed, but not deleted. */

    if (event_queue.first_event == event_ptr)
{
 event_queue.first_event = event_ptr->next_event;
 if (event_ptr->next_event == NULL((void*)0))
   event_queue.last_event = NULL((void*)0);
}
    else
{
 prev_ptr = event_queue.first_event;
 while (prev_ptr->next_event != event_ptr)
   prev_ptr = prev_ptr->next_event;

 prev_ptr->next_event = event_ptr->next_event;
 if (event_ptr->next_event == NULL((void*)0))
   event_queue.last_event = prev_ptr;
}
    xfree (event_ptr);

    /* Now call the procedure associated with the event. */
    (*proc) (fd);
    return 1;
  }

/* this is the case if there are no event on the event queue. */
return 0;
340}

342/* Process one high level event.  If nothing is ready at this time,
 wait for something to happen (via gdb_wait_for_event), then process
 it.  Returns >0 if something was done otherwise returns <0 (this
 can happen if there are no event sources to wait for).  If an error
 occurs catch_errors() which calls this function returns zero. */

348int
349gdb_do_one_event (void *data)
350{
/* Any events already waiting in the queue? */
if (process_event ())
1
Taking false branch→
  {
    return 1;
  }

/* Are any timers that are ready? If so, put an event on the queue. */
poll_timers ();

/* Wait for a new event.  If gdb_wait_for_event returns -1,
   we should get out because this means that there are no
   event sources left. This will make the event loop stop,
   and the application exit. */

if (gdb_wait_for_event () < 0)
2
←
Calling 'gdb_wait_for_event'→
  {
    return -1;
  }

/* Handle any new events occurred while waiting. */
if (process_event ())
  {
    return 1;
  }

/* If gdb_wait_for_event has returned 1, it means that one
   event has been handled. We break out of the loop. */
return 1;
379}

381/* Start up the event loop. This is the entry point to the event loop
 from the command loop. */

384void
385start_event_loop (void)
386{
/* Loop until there is nothing to do. This is the entry point to the
   event loop engine. gdb_do_one_event, called via catch_errors()
   will process one event for each invocation.  It blocks waits for
   an event and then processes it.  >0 when an event is processed, 0
   when catch_errors() caught an error and <0 when there are no
   longer any event sources registered. */
while (1)
  {
    int gdb_result;

    gdb_result = catch_errors (gdb_do_one_event, 0, "", RETURN_MASK_ALL((1 << (int)(-RETURN_QUIT)) | (1 << (int)(-RETURN_ERROR
))));
    if (gdb_result < 0)
break;

    /* If we long-jumped out of do_one_event, we probably
       didn't get around to resetting the prompt, which leaves
       readline in a messed-up state.  Reset it here. */

    if (gdb_result == 0)
{
 /* FIXME: this should really be a call to a hook that is
    interface specific, because interfaces can display the
    prompt in their own way. */
 display_gdb_prompt (0);
 /* This call looks bizarre, but it is required.  If the user
    entered a command that caused an error,
    after_char_processing_hook won't be called from
    rl_callback_read_char_wrapper.  Using a cleanup there
    won't work, since we want this function to be called
    after a new prompt is printed.  */
 if (after_char_processing_hook)
   (*after_char_processing_hook) ();
 /* Maybe better to set a flag to be checked somewhere as to
    whether display the prompt or not. */
}
  }

/* We are done with the event loop. There are no more event sources
   to listen to.  So we exit GDB. */
return;
427}
428

430/* Wrapper function for create_file_handler, so that the caller
 doesn't have to know implementation details about the use of poll
 vs. select. */
433void
434add_file_handler (int fd, handler_func * proc, gdb_client_data client_data)
435{
436#ifdef HAVE_POLL1
struct pollfd fds;
438#endif

if (use_poll)
  {
442#ifdef HAVE_POLL1
    /* Check to see if poll () is usable. If not, we'll switch to
       use select. This can happen on systems like
       m68k-motorola-sys, `poll' cannot be used to wait for `stdin'.
       On m68k-motorola-sysv, tty's are not stream-based and not
       `poll'able. */
    fds.fd = fd;
    fds.events = POLLIN0x0001;
    if (poll (&fds, 1, 0) == 1 && (fds.revents & POLLNVAL0x0020))
use_poll = 0;
452#else
    internal_error (__FILE__"/usr/src/gnu/usr.bin/binutils/gdb/event-loop.c", __LINE__453,
      "use_poll without HAVE_POLL");
455#endif /* HAVE_POLL */
  }
if (use_poll)
  {
459#ifdef HAVE_POLL1
    create_file_handler (fd, POLLIN0x0001, proc, client_data);
461#else
    internal_error (__FILE__"/usr/src/gnu/usr.bin/binutils/gdb/event-loop.c", __LINE__462,
      "use_poll without HAVE_POLL");
464#endif
  }
else
  create_file_handler (fd, GDB_READABLE(1<<1) | GDB_EXCEPTION(1<<3), proc, client_data);
468}

470/* Add a file handler/descriptor to the list of descriptors we are
 interested in.  
 FD is the file descriptor for the file/stream to be listened to.  
 For the poll case, MASK is a combination (OR) of
 POLLIN, POLLRDNORM, POLLRDBAND, POLLPRI, POLLOUT, POLLWRNORM,
 POLLWRBAND: these are the events we are interested in. If any of them 
 occurs, proc should be called.
 For the select case, MASK is a combination of READABLE, WRITABLE, EXCEPTION.
 PROC is the procedure that will be called when an event occurs for
 FD.  CLIENT_DATA is the argument to pass to PROC. */
480static void
481create_file_handler (int fd, int mask, handler_func * proc, gdb_client_data client_data)
482{
file_handler *file_ptr;

/* Do we already have a file handler for this file? (We may be
   changing its associated procedure). */
for (file_ptr = gdb_notifier.first_file_handler; file_ptr != NULL((void*)0);
     file_ptr = file_ptr->next_file)
  {
    if (file_ptr->fd == fd)
break;
  }

/* It is a new file descriptor. Add it to the list. Otherwise, just
   change the data associated with it. */
if (file_ptr == NULL((void*)0))
  {
    file_ptr = (file_handler *) xmalloc (sizeof (file_handler));
    file_ptr->fd = fd;
    file_ptr->ready_mask = 0;
    file_ptr->next_file = gdb_notifier.first_file_handler;
    gdb_notifier.first_file_handler = file_ptr;

    if (use_poll)
{
506#ifdef HAVE_POLL1
 gdb_notifier.num_fds++;
 if (gdb_notifier.poll_fds)
   gdb_notifier.poll_fds =
     (struct pollfd *) xrealloc (gdb_notifier.poll_fds,
			  (gdb_notifier.num_fds
			   * sizeof (struct pollfd)));
 else
   gdb_notifier.poll_fds =
     (struct pollfd *) xmalloc (sizeof (struct pollfd));
 (gdb_notifier.poll_fds + gdb_notifier.num_fds - 1)->fd = fd;
 (gdb_notifier.poll_fds + gdb_notifier.num_fds - 1)->events = mask;
 (gdb_notifier.poll_fds + gdb_notifier.num_fds - 1)->revents = 0;
519#else
 internal_error (__FILE__"/usr/src/gnu/usr.bin/binutils/gdb/event-loop.c", __LINE__520,
	  "use_poll without HAVE_POLL");
522#endif /* HAVE_POLL */
}
    else
{
 if (mask & GDB_READABLE(1<<1))
   FD_SET (fd, &gdb_notifier.check_masks[0])__fd_set((fd), (&gdb_notifier.check_masks[0]));
 else
   FD_CLR (fd, &gdb_notifier.check_masks[0])__fd_clr((fd), (&gdb_notifier.check_masks[0]));

 if (mask & GDB_WRITABLE(1<<2))
   FD_SET (fd, &gdb_notifier.check_masks[1])__fd_set((fd), (&gdb_notifier.check_masks[1]));
 else
   FD_CLR (fd, &gdb_notifier.check_masks[1])__fd_clr((fd), (&gdb_notifier.check_masks[1]));

 if (mask & GDB_EXCEPTION(1<<3))
   FD_SET (fd, &gdb_notifier.check_masks[2])__fd_set((fd), (&gdb_notifier.check_masks[2]));
 else
   FD_CLR (fd, &gdb_notifier.check_masks[2])__fd_clr((fd), (&gdb_notifier.check_masks[2]));

 if (gdb_notifier.num_fds <= fd)
   gdb_notifier.num_fds = fd + 1;
}
  }

file_ptr->proc = proc;
file_ptr->client_data = client_data;
file_ptr->mask = mask;
549}

551/* Remove the file descriptor FD from the list of monitored fd's: 
 i.e. we don't care anymore about events on the FD. */
553void
554delete_file_handler (int fd)
555{
file_handler *file_ptr, *prev_ptr = NULL((void*)0);
int i;
558#ifdef HAVE_POLL1
int j;
struct pollfd *new_poll_fds;
561#endif

/* Find the entry for the given file. */

for (file_ptr = gdb_notifier.first_file_handler; file_ptr != NULL((void*)0);
     file_ptr = file_ptr->next_file)
  {
    if (file_ptr->fd == fd)
break;
  }

if (file_ptr == NULL((void*)0))
  return;

if (use_poll)
  {
577#ifdef HAVE_POLL1
    /* Create a new poll_fds array by copying every fd's information but the
       one we want to get rid of. */

    new_poll_fds =
(struct pollfd *) xmalloc ((gdb_notifier.num_fds - 1) * sizeof (struct pollfd));

    for (i = 0, j = 0; i < gdb_notifier.num_fds; i++)
{
 if ((gdb_notifier.poll_fds + i)->fd != fd)
   {
     (new_poll_fds + j)->fd = (gdb_notifier.poll_fds + i)->fd;
     (new_poll_fds + j)->events = (gdb_notifier.poll_fds + i)->events;
     (new_poll_fds + j)->revents = (gdb_notifier.poll_fds + i)->revents;
     j++;
   }
}
    xfree (gdb_notifier.poll_fds);
    gdb_notifier.poll_fds = new_poll_fds;
    gdb_notifier.num_fds--;
597#else
    internal_error (__FILE__"/usr/src/gnu/usr.bin/binutils/gdb/event-loop.c", __LINE__598,
      "use_poll without HAVE_POLL");
600#endif /* HAVE_POLL */
  }
else
  {
    if (file_ptr->mask & GDB_READABLE(1<<1))
FD_CLR (fd, &gdb_notifier.check_masks[0])__fd_clr((fd), (&gdb_notifier.check_masks[0]));
    if (file_ptr->mask & GDB_WRITABLE(1<<2))
FD_CLR (fd, &gdb_notifier.check_masks[1])__fd_clr((fd), (&gdb_notifier.check_masks[1]));
    if (file_ptr->mask & GDB_EXCEPTION(1<<3))
FD_CLR (fd, &gdb_notifier.check_masks[2])__fd_clr((fd), (&gdb_notifier.check_masks[2]));

    /* Find current max fd. */

    if ((fd + 1) == gdb_notifier.num_fds)
{
 gdb_notifier.num_fds--;
 for (i = gdb_notifier.num_fds; i; i--)
   {
     if (FD_ISSET (i - 1, &gdb_notifier.check_masks[0])__fd_isset((i - 1), (&gdb_notifier.check_masks[0]))
  || FD_ISSET (i - 1, &gdb_notifier.check_masks[1])__fd_isset((i - 1), (&gdb_notifier.check_masks[1]))
  || FD_ISSET (i - 1, &gdb_notifier.check_masks[2])__fd_isset((i - 1), (&gdb_notifier.check_masks[2])))
break;
   }
 gdb_notifier.num_fds = i;
}
  }

/* Deactivate the file descriptor, by clearing its mask, 
   so that it will not fire again. */

file_ptr->mask = 0;

/* Get rid of the file handler in the file handler list. */
if (file_ptr == gdb_notifier.first_file_handler)
  gdb_notifier.first_file_handler = file_ptr->next_file;
else
  {
    for (prev_ptr = gdb_notifier.first_file_handler;
  prev_ptr->next_file != file_ptr;
  prev_ptr = prev_ptr->next_file)
;
    prev_ptr->next_file = file_ptr->next_file;
  }
xfree (file_ptr);
644}

646/* Handle the given event by calling the procedure associated to the
 corresponding file handler.  Called by process_event indirectly,
 through event_ptr->proc.  EVENT_FILE_DESC is file descriptor of the
 event in the front of the event queue. */
650static void
651handle_file_event (int event_file_desc)
652{
file_handler *file_ptr;
int mask;
655#ifdef HAVE_POLL1
int error_mask;
int error_mask_returned;
658#endif

/* Search the file handler list to find one that matches the fd in
   the event. */
for (file_ptr = gdb_notifier.first_file_handler; file_ptr != NULL((void*)0);
     file_ptr = file_ptr->next_file)
  {
    if (file_ptr->fd == event_file_desc)
{
 /* With poll, the ready_mask could have any of three events
    set to 1: POLLHUP, POLLERR, POLLNVAL. These events cannot
    be used in the requested event mask (events), but they
    can be returned in the return mask (revents). We need to
    check for those event too, and add them to the mask which
    will be passed to the handler. */

 /* See if the desired events (mask) match the received
    events (ready_mask). */

 if (use_poll)
   {
679#ifdef HAVE_POLL1
     error_mask = POLLHUP0x0010 | POLLERR0x0008 | POLLNVAL0x0020;
     mask = (file_ptr->ready_mask & file_ptr->mask) |
(file_ptr->ready_mask & error_mask);
     error_mask_returned = mask & error_mask;

     if (error_mask_returned != 0)
{
  /* Work in progress. We may need to tell somebody what
     kind of error we had. */
  if (error_mask_returned & POLLHUP0x0010)
    printf_unfiltered ("Hangup detected on fd %d\n", file_ptr->fd);
  if (error_mask_returned & POLLERR0x0008)
    printf_unfiltered ("Error detected on fd %d\n", file_ptr->fd);
  if (error_mask_returned & POLLNVAL0x0020)
    printf_unfiltered ("Invalid or non-`poll'able fd %d\n", file_ptr->fd);
  file_ptr->error = 1;
}
     else
file_ptr->error = 0;
699#else
     internal_error (__FILE__"/usr/src/gnu/usr.bin/binutils/gdb/event-loop.c", __LINE__700,
	      "use_poll without HAVE_POLL");
702#endif /* HAVE_POLL */
   }
 else
   {
     if (file_ptr->ready_mask & GDB_EXCEPTION(1<<3))
{
  printf_unfiltered ("Exception condition detected on fd %d\n", file_ptr->fd);
  file_ptr->error = 1;
}
     else
file_ptr->error = 0;
     mask = file_ptr->ready_mask & file_ptr->mask;
   }

 /* Clear the received events for next time around. */
 file_ptr->ready_mask = 0;

 /* If there was a match, then call the handler. */
 if (mask != 0)
   (*file_ptr->proc) (file_ptr->error, file_ptr->client_data);
 break;
}
  }
725}

727/* Called by gdb_do_one_event to wait for new events on the 
 monitored file descriptors. Queue file events as they are 
 detected by the poll. 
 If there are no events, this function will block in the 
 call to poll.
 Return -1 if there are no files descriptors to monitor, 
 otherwise return 0. */
734static int
735gdb_wait_for_event (void)
736{
file_handler *file_ptr;
gdb_event *file_event_ptr;
int num_found = 0;
int i;

/* Make sure all output is done before getting another event. */
gdb_flush (gdb_stdout);
gdb_flush (gdb_stderr);
3
←
Value assigned to 'gdb_notifier.first_file_handler'→

if (gdb_notifier.num_fds == 0)
4
←
Assuming field 'num_fds' is not equal to 0→
5
←
Taking false branch→
  return -1;

if (use_poll)
6
←
Assuming 'use_poll' is not equal to 0→
7
←
Taking true branch→
  {
751#ifdef HAVE_POLL1
    num_found =
poll (gdb_notifier.poll_fds,
     (unsigned long) gdb_notifier.num_fds,
     gdb_notifier.timeout_valid ? gdb_notifier.poll_timeout : -1);
8
←
Assuming field 'timeout_valid' is 0→
9
←
'?' condition is false→

    /* Don't print anything if we get out of poll because of a
       signal. */
    if (num_found == -1 && errno(*__errno()) != EINTR4)
10
←
Assuming the condition is false→
perror_with_name ("Poll");
761#else
    internal_error (__FILE__"/usr/src/gnu/usr.bin/binutils/gdb/event-loop.c", __LINE__762,
      "use_poll without HAVE_POLL");
764#endif /* HAVE_POLL */
  }
else
  {
    gdb_notifier.ready_masks[0] = gdb_notifier.check_masks[0];
    gdb_notifier.ready_masks[1] = gdb_notifier.check_masks[1];
    gdb_notifier.ready_masks[2] = gdb_notifier.check_masks[2];
    num_found = select (gdb_notifier.num_fds,
	  &gdb_notifier.ready_masks[0],
	  &gdb_notifier.ready_masks[1],
	  &gdb_notifier.ready_masks[2],
	  gdb_notifier.timeout_valid
	  ? &gdb_notifier.select_timeout : NULL((void*)0));

    /* Clear the masks after an error from select. */
    if (num_found == -1)
{
 FD_ZERO (&gdb_notifier.ready_masks[0])do { fd_set *_p = (&gdb_notifier.ready_masks[0]); __size_t
 _n = (((1024) + ((((unsigned)(sizeof(__fd_mask) * 8))) - 1))
 / (((unsigned)(sizeof(__fd_mask) * 8)))); while (_n > 0) _p
->fds_bits[--_n] = 0; } while (0);
 FD_ZERO (&gdb_notifier.ready_masks[1])do { fd_set *_p = (&gdb_notifier.ready_masks[1]); __size_t
 _n = (((1024) + ((((unsigned)(sizeof(__fd_mask) * 8))) - 1))
 / (((unsigned)(sizeof(__fd_mask) * 8)))); while (_n > 0) _p
->fds_bits[--_n] = 0; } while (0);
 FD_ZERO (&gdb_notifier.ready_masks[2])do { fd_set *_p = (&gdb_notifier.ready_masks[2]); __size_t
 _n = (((1024) + ((((unsigned)(sizeof(__fd_mask) * 8))) - 1))
 / (((unsigned)(sizeof(__fd_mask) * 8)))); while (_n > 0) _p
->fds_bits[--_n] = 0; } while (0);
 /* Dont print anything is we got a signal, let gdb handle it. */
 if (errno(*__errno()) != EINTR4)
   perror_with_name ("Select");
}
  }

/* Enqueue all detected file events. */

if (use_poll10.1
'use_poll' is not equal to 0
)
11
←
Taking true branch→
  {
794#ifdef HAVE_POLL1
    for (i = 0; (i < gdb_notifier.num_fds) && (num_found > 0); i++)
12
←
Assuming 'i' is < field 'num_fds'→
13
←
Assuming 'num_found' is > 0→
14
←
Loop condition is true.  Entering loop body→
{
 if ((gdb_notifier.poll_fds + i)->revents)
15
←
Assuming field 'revents' is not equal to 0→
16
←
Taking true branch→
   num_found--;
 else
   continue;

 for (file_ptr = gdb_notifier.first_file_handler;
17
←
Value assigned to 'file_ptr'→
19
←
Loop condition is false. Execution continues on line 810→
      file_ptr != NULL((void*)0);
18
←
Assuming 'file_ptr' is equal to NULL→
      file_ptr = file_ptr->next_file)
   {
     if (file_ptr->fd == (gdb_notifier.poll_fds + i)->fd)
break;
   }

 if (file_ptr19.1
'file_ptr' is null
)
20
←
Taking false branch→
   {
     /* Enqueue an event only if this is still a new event for
        this fd. */
     if (file_ptr->ready_mask == 0)
{
  file_event_ptr = create_file_event (file_ptr->fd);
  async_queue_event (file_event_ptr, TAIL);
}
   }

 file_ptr->ready_mask = (gdb_notifier.poll_fds + i)->revents;
21
←
Access to field 'ready_mask' results in a dereference of a null pointer (loaded from variable 'file_ptr')
}
823#else
    internal_error (__FILE__"/usr/src/gnu/usr.bin/binutils/gdb/event-loop.c", __LINE__824,
      "use_poll without HAVE_POLL");
826#endif /* HAVE_POLL */
  }
else
  {
    for (file_ptr = gdb_notifier.first_file_handler;
  (file_ptr != NULL((void*)0)) && (num_found > 0);
  file_ptr = file_ptr->next_file)
{
 int mask = 0;

 if (FD_ISSET (file_ptr->fd, &gdb_notifier.ready_masks[0])__fd_isset((file_ptr->fd), (&gdb_notifier.ready_masks[
0])))
   mask |= GDB_READABLE(1<<1);
 if (FD_ISSET (file_ptr->fd, &gdb_notifier.ready_masks[1])__fd_isset((file_ptr->fd), (&gdb_notifier.ready_masks[
1])))
   mask |= GDB_WRITABLE(1<<2);
 if (FD_ISSET (file_ptr->fd, &gdb_notifier.ready_masks[2])__fd_isset((file_ptr->fd), (&gdb_notifier.ready_masks[
2])))
   mask |= GDB_EXCEPTION(1<<3);

 if (!mask)
   continue;
 else
   num_found--;

 /* Enqueue an event only if this is still a new event for
    this fd. */

 if (file_ptr->ready_mask == 0)
   {
     file_event_ptr = create_file_event (file_ptr->fd);
     async_queue_event (file_event_ptr, TAIL);
   }
 file_ptr->ready_mask = mask;
}
  }
return 0;
860}
861

863/* Create an asynchronous handler, allocating memory for it. 
 Return a pointer to the newly created handler.
 This pointer will be used to invoke the handler by 
 invoke_async_signal_handler.
 PROC is the function to call with CLIENT_DATA argument 
 whenever the handler is invoked. */
869async_signal_handler *
870create_async_signal_handler (sig_handler_func * proc, gdb_client_data client_data)
871{
async_signal_handler *async_handler_ptr;

async_handler_ptr =
  (async_signal_handler *) xmalloc (sizeof (async_signal_handler));
async_handler_ptr->ready = 0;
async_handler_ptr->next_handler = NULL((void*)0);
async_handler_ptr->proc = proc;
async_handler_ptr->client_data = client_data;
if (sighandler_list.first_handler == NULL((void*)0))
  sighandler_list.first_handler = async_handler_ptr;
else
  sighandler_list.last_handler->next_handler = async_handler_ptr;
sighandler_list.last_handler = async_handler_ptr;
return async_handler_ptr;
886}

888/* Mark the handler (ASYNC_HANDLER_PTR) as ready. This information will
 be used when the handlers are invoked, after we have waited for
 some event.  The caller of this function is the interrupt handler
 associated with a signal. */
892void
893mark_async_signal_handler (async_signal_handler * async_handler_ptr)
894{
((async_signal_handler *) async_handler_ptr)->ready = 1;
async_handler_ready = 1;
897}

899/* Call all the handlers that are ready. */
900static void
901invoke_async_signal_handler (void)
902{
async_signal_handler *async_handler_ptr;

if (async_handler_ready == 0)
  return;
async_handler_ready = 0;

/* Invoke ready handlers. */

while (1)
  {
    for (async_handler_ptr = sighandler_list.first_handler;
  async_handler_ptr != NULL((void*)0);
  async_handler_ptr = async_handler_ptr->next_handler)
{
 if (async_handler_ptr->ready)
   break;
}
    if (async_handler_ptr == NULL((void*)0))
break;
    async_handler_ptr->ready = 0;
    (*async_handler_ptr->proc) (async_handler_ptr->client_data);
  }

return;
927}

929/* Delete an asynchronous handler (ASYNC_HANDLER_PTR). 
 Free the space allocated for it.  */
931void
932delete_async_signal_handler (async_signal_handler ** async_handler_ptr)
933{
async_signal_handler *prev_ptr;

if (sighandler_list.first_handler == (*async_handler_ptr))
  {
    sighandler_list.first_handler = (*async_handler_ptr)->next_handler;
    if (sighandler_list.first_handler == NULL((void*)0))
sighandler_list.last_handler = NULL((void*)0);
  }
else
  {
    prev_ptr = sighandler_list.first_handler;
    while (prev_ptr->next_handler != (*async_handler_ptr) && prev_ptr)
prev_ptr = prev_ptr->next_handler;
    prev_ptr->next_handler = (*async_handler_ptr)->next_handler;
    if (sighandler_list.last_handler == (*async_handler_ptr))
sighandler_list.last_handler = prev_ptr;
  }
xfree ((*async_handler_ptr));
(*async_handler_ptr) = NULL((void*)0);
953}

955/* Is it necessary to call invoke_async_signal_handler? */
956static int
957check_async_ready (void)
958{
return async_handler_ready;
960}

962/* Create a timer that will expire in MILLISECONDS from now. When the
 timer is ready, PROC will be executed. At creation, the timer is
 aded to the timers queue.  This queue is kept sorted in order of
 increasing timers. Return a handle to the timer struct. */
966int
967create_timer (int milliseconds, timer_handler_func * proc, gdb_client_data client_data)
968{
struct gdb_timer *timer_ptr, *timer_index, *prev_timer;
struct timeval time_now, delta;

/* compute seconds */
delta.tv_sec = milliseconds / 1000;
/* compute microseconds */
delta.tv_usec = (milliseconds % 1000) * 1000;

gettimeofday (&time_now, NULL((void*)0));

timer_ptr = (struct gdb_timer *) xmalloc (sizeof (gdb_timer));
timer_ptr->when.tv_sec = time_now.tv_sec + delta.tv_sec;
timer_ptr->when.tv_usec = time_now.tv_usec + delta.tv_usec;
/* carry? */
if (timer_ptr->when.tv_usec >= 1000000)
  {
    timer_ptr->when.tv_sec += 1;
    timer_ptr->when.tv_usec -= 1000000;
  }
timer_ptr->proc = proc;
timer_ptr->client_data = client_data;
timer_list.num_timers++;
timer_ptr->timer_id = timer_list.num_timers;

/* Now add the timer to the timer queue, making sure it is sorted in
   increasing order of expiration. */

for (timer_index = timer_list.first_timer;
     timer_index != NULL((void*)0);
     timer_index = timer_index->next)
  {
    /* If the seconds field is greater or if it is the same, but the
       microsecond field is greater. */
    if ((timer_index->when.tv_sec > timer_ptr->when.tv_sec) ||
 ((timer_index->when.tv_sec == timer_ptr->when.tv_sec)
  && (timer_index->when.tv_usec > timer_ptr->when.tv_usec)))
break;
  }

if (timer_index == timer_list.first_timer)
  {
    timer_ptr->next = timer_list.first_timer;
    timer_list.first_timer = timer_ptr;

  }
else
  {
    for (prev_timer = timer_list.first_timer;
  prev_timer->next != timer_index;
  prev_timer = prev_timer->next)
;

    prev_timer->next = timer_ptr;
    timer_ptr->next = timer_index;
  }

gdb_notifier.timeout_valid = 0;
return timer_ptr->timer_id;
1027}

1029/* There is a chance that the creator of the timer wants to get rid of
 it before it expires. */
1031void
1032delete_timer (int id)
1033{
struct gdb_timer *timer_ptr, *prev_timer = NULL((void*)0);

/* Find the entry for the given timer. */

for (timer_ptr = timer_list.first_timer; timer_ptr != NULL((void*)0);
     timer_ptr = timer_ptr->next)
  {
    if (timer_ptr->timer_id == id)
break;
  }

if (timer_ptr == NULL((void*)0))
  return;
/* Get rid of the timer in the timer list. */
if (timer_ptr == timer_list.first_timer)
  timer_list.first_timer = timer_ptr->next;
else
  {
    for (prev_timer = timer_list.first_timer;
  prev_timer->next != timer_ptr;
  prev_timer = prev_timer->next)
;
    prev_timer->next = timer_ptr->next;
  }
xfree (timer_ptr);

gdb_notifier.timeout_valid = 0;
1061}

1063/* When a timer event is put on the event queue, it will be handled by
 this function.  Just call the assiciated procedure and delete the
 timer event from the event queue. Repeat this for each timer that
 has expired. */
1067static void
1068handle_timer_event (int dummy)
1069{
struct timeval time_now;
struct gdb_timer *timer_ptr, *saved_timer;

gettimeofday (&time_now, NULL((void*)0));
timer_ptr = timer_list.first_timer;

while (timer_ptr != NULL((void*)0))
  {
    if ((timer_ptr->when.tv_sec > time_now.tv_sec) ||
 ((timer_ptr->when.tv_sec == time_now.tv_sec) &&
  (timer_ptr->when.tv_usec > time_now.tv_usec)))
break;

    /* Get rid of the timer from the beginning of the list. */
    timer_list.first_timer = timer_ptr->next;
    saved_timer = timer_ptr;
    timer_ptr = timer_ptr->next;
    /* Call the procedure associated with that timer. */
    (*saved_timer->proc) (saved_timer->client_data);
    xfree (saved_timer);
  }

gdb_notifier.timeout_valid = 0;
1093}

1095/* Check whether any timers in the timers queue are ready. If at least
 one timer is ready, stick an event onto the event queue.  Even in
 case more than one timer is ready, one event is enough, because the
 handle_timer_event() will go through the timers list and call the
 procedures associated with all that have expired. Update the
 timeout for the select() or poll() as well. */
1101static void
1102poll_timers (void)
1103{
struct timeval time_now, delta;
gdb_event *event_ptr;

if (timer_list.first_timer != NULL((void*)0))
  {
    gettimeofday (&time_now, NULL((void*)0));
    delta.tv_sec = timer_list.first_timer->when.tv_sec - time_now.tv_sec;
    delta.tv_usec = timer_list.first_timer->when.tv_usec - time_now.tv_usec;
    /* borrow? */
    if (delta.tv_usec < 0)
{
 delta.tv_sec -= 1;
 delta.tv_usec += 1000000;
}

    /* Oops it expired already. Tell select / poll to return
       immediately. (Cannot simply test if delta.tv_sec is negative
       because time_t might be unsigned.)  */
    if (timer_list.first_timer->when.tv_sec < time_now.tv_sec
 || (timer_list.first_timer->when.tv_sec == time_now.tv_sec
     && timer_list.first_timer->when.tv_usec < time_now.tv_usec))
{
 delta.tv_sec = 0;
 delta.tv_usec = 0;
}

    if (delta.tv_sec == 0 && delta.tv_usec == 0)
{
 event_ptr = (gdb_event *) xmalloc (sizeof (gdb_event));
 event_ptr->proc = handle_timer_event;
 event_ptr->fd = timer_list.first_timer->timer_id;
 async_queue_event (event_ptr, TAIL);
}

    /* Now we need to update the timeout for select/ poll, because we
       don't want to sit there while this timer is expiring. */
    if (use_poll)
{
1142#ifdef HAVE_POLL1
 gdb_notifier.poll_timeout = delta.tv_sec * 1000;
1144#else
 internal_error (__FILE__"/usr/src/gnu/usr.bin/binutils/gdb/event-loop.c", __LINE__1145,
	  "use_poll without HAVE_POLL");
1147#endif /* HAVE_POLL */
}
    else
{
 gdb_notifier.select_timeout.tv_sec = delta.tv_sec;
 gdb_notifier.select_timeout.tv_usec = delta.tv_usec;
}
    gdb_notifier.timeout_valid = 1;
  }
else
  gdb_notifier.timeout_valid = 0;
1158}