/usr/src/lib/libc/gen/getcap.c

Bug Summary

File:	src/lib/libc/gen/getcap.c
Warning:	line 798, column 6 Potential leak of memory pointed to by 'rp'

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name getcap.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/lib/libc/obj -resource-dir /usr/local/lib/clang/13.0.0 -include namespace.h -I /usr/src/lib/libc/include -I /usr/src/lib/libc/hidden -D __LIBC__ -D APIWARN -D YP -I /usr/src/lib/libc/yp -I /usr/src/lib/libc -I /usr/src/lib/libc/gdtoa -I /usr/src/lib/libc/arch/amd64/gdtoa -D INFNAN_CHECK -D MULTIPLE_THREADS -D NO_FENV_H -D USE_LOCALE -I /usr/src/lib/libc -I /usr/src/lib/libc/citrus -D RESOLVSORT -D FLOATING_POINT -D PRINTF_WIDE_CHAR -D SCANF_WIDE_CHAR -D FUTEX -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/lib/libc/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/lib/libc/gen/getcap.c

1/*	$OpenBSD: getcap.c,v 1.35 2019/07/03 03:24:04 deraadt Exp $	*/
2/*-
* Copyright (c) 1992, 1993
*	The Regents of the University of California.  All rights reserved.
*
* This code is derived from software contributed to Berkeley by
* Casey Leedom of Lawrence Livermore National Laboratory.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of the University nor the names of its contributors
*    may be used to endorse or promote products derived from this software
*    without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

34#include <sys/types.h>

36#include <ctype.h>
37#include <db.h>
38#include <errno(*__errno()).h>
39#include <fcntl.h>
40#include <limits.h>
41#include <stdio.h>
42#include <stdlib.h>
43#include <string.h>
44#include <unistd.h>

46#define	BFRAG1024		1024
47#define	BSIZE1024		1024
48#define	ESC('[' & 037)		('[' & 037)	/* ASCII ESC */
49#define	MAX_RECURSION32	32		/* maximum getent recursion */
50#define	SFRAG100		100		/* cgetstr mallocs in SFRAG chunks */

52#define RECOK(char)0	(char)0
53#define TCERR(char)1	(char)1
54#define	SHADOW(char)2	(char)2

56static size_t	 topreclen;	/* toprec length */
57static char	*toprec;	/* Additional record specified by cgetset() */
58static int	 gottoprec;	/* Flag indicating retrieval of toprecord */

60static int	cdbget(DB *, char **, const char *);
61static int 	getent(char **, u_int *, char **, FILE *, const char *, int, char *);
62static int	nfcmp(const char *, char *);

64static int	usedb = 1;

66/*
* Cgetusedb() allows the user to specify whether or not to use a .db
* version of the database file (if it exists) in preference to the
* text version.  By default, the getcap(3) routines will use a .db file.
*/
71int
72cgetusedb(int new_usedb)
73{
int old_usedb = usedb;

usedb = new_usedb;
return(old_usedb);
78}
79DEF_WEAK(cgetusedb)__asm__(".weak " "cgetusedb" " ; " "cgetusedb" " = " "_libc_cgetusedb"
);

81/*
* Cgetset() allows the addition of a user specified buffer to be added
* to the database array, in effect "pushing" the buffer on top of the
* virtual database. 0 is returned on success, -1 on failure.
*/
86int
87cgetset(const char *ent)
88{
if (ent == NULL((void *)0)) {
free(toprec);
toprec = NULL((void *)0);
topreclen = 0;
return (0);
}
topreclen = strlen(ent);
if ((toprec = malloc(topreclen + 1)) == NULL((void *)0))
return (-1);
gottoprec = 0;
memcpy(toprec, ent, topreclen + 1);
return (0);
101}
102DEF_WEAK(cgetset)__asm__(".weak " "cgetset" " ; " "cgetset" " = " "_libc_cgetset"
);

104/*
* Cgetcap searches the capability record buf for the capability cap with
* type `type'.  A pointer to the value of cap is returned on success, NULL
* if the requested capability couldn't be found.
*
* Specifying a type of ':' means that nothing should follow cap (:cap:).
* In this case a pointer to the terminating ':' or NUL will be returned if
* cap is found.
*
* If (cap, '@') or (cap, terminator, '@') is found before (cap, terminator)
* return NULL.
*/
116char *
117cgetcap(char *buf, const char *cap, int type)
118{
char *bp;
const char *cp;

bp = buf;
for (;;) {
/*
 * Skip past the current capability field - it's either the
 * name field if this is the first time through the loop, or
 * the remainder of a field whose name failed to match cap.
 */
for (;;)
	if (*bp == '\0')
		return (NULL((void *)0));
	else
		if (*bp++ == ':')
			break;

/*
 * Try to match (cap, type) in buf.
 */
for (cp = cap; *cp == *bp && *bp != '\0'; cp++, bp++)
	continue;
if (*cp != '\0')
	continue;
if (*bp == '@')
	return (NULL((void *)0));
if (type == ':') {
	if (*bp != '\0' && *bp != ':')
		continue;
	return(bp);
}
if (*bp != type)
	continue;
bp++;
return (*bp == '@' ? NULL((void *)0) : bp);
}
/* NOTREACHED */
156}
157DEF_WEAK(cgetcap)__asm__(".weak " "cgetcap" " ; " "cgetcap" " = " "_libc_cgetcap"
);

159/*
* Cgetent extracts the capability record name from the NULL terminated file
* array db_array and returns a pointer to a malloc'd copy of it in buf.
* Buf must be retained through all subsequent calls to cgetcap, cgetnum,
* cgetflag, and cgetstr, but may then be free'd.  0 is returned on success,
* -1 if the requested record couldn't be found, -2 if a system error was
* encountered (couldn't open/read a file, etc.), and -3 if a potential
* reference loop is detected.
*/
168int
169cgetent(char **buf, char **db_array, const char *name)
170{
u_int dummy;

return (getent(buf, &dummy, db_array, NULL((void *)0), name, 0, NULL((void *)0)));
174}
175DEF_WEAK(cgetent)__asm__(".weak " "cgetent" " ; " "cgetent" " = " "_libc_cgetent"
);

177/*
* Getent implements the functions of cgetent.  If fp is non-NULL,
* *db_array has already been opened and fp is the open file descriptor.  We
* do this to save time and avoid using up file descriptors for tc=
* recursions.
*
* Getent returns the same success/failure codes as cgetent.  On success, a
* pointer to a malloc'ed capability record with all tc= capabilities fully
* expanded and its length (not including trailing ASCII NUL) are left in
* *cap and *len.
*
* Basic algorithm:
*	+ Allocate memory incrementally as needed in chunks of size BFRAG
*	  for capability buffer.
*	+ Recurse for each tc=name and interpolate result.  Stop when all
*	  names interpolated, a name can't be found, or depth exceeds
*	  MAX_RECURSION.
*/
195static int
196getent(char **cap, u_int *len, char **db_array, FILE *fp,
const char *name, int depth, char *nfield)
198{
DB *capdbp;
char *r_end, *rp, **db_p;
int myfd, eof, foundit, opened, retval, clen;
char *record, *cbuf;
int tc_not_resolved;
char pbuf[PATH_MAX1024];

/*
* Return with ``loop detected'' error if we've recursed more than
* MAX_RECURSION times.
*/
if (depth > MAX_RECURSION32)
return (-3);

opened = 0;

/*
* Check if we have a top record from cgetset().
*/
if (depth == 0 && toprec != NULL((void *)0) && cgetmatch(toprec, name) == 0) {
opened++;
if ((record = malloc(topreclen + 1 + BFRAG1024)) == NULL((void *)0))
	return (-2);
memcpy(record, toprec, topreclen + 1);
myfd = 0;
db_p = db_array;
rp = record + topreclen + 1;
r_end = rp + BFRAG1024;
goto tc_exp;
}
/*
* Allocate first chunk of memory.
*/
if ((record = malloc(BFRAG1024)) == NULL((void *)0))
return (-2);
r_end = record + BFRAG1024;
foundit = 0;
/*
* Loop through database array until finding the record.
*/

for (db_p = db_array; *db_p != NULL((void *)0); db_p++) {
eof = 0;

/*
 * Open database if not already open.
 */
if (fp != NULL((void *)0)) {
	(void)fseek(fp, 0L, SEEK_SET0);
	myfd = 0;
	opened++;
} else {
	char *dbrecord;

	clen = snprintf(pbuf, sizeof(pbuf), "%s.db", *db_p);
	if (clen >= 0 && clen < sizeof(pbuf) && usedb &&
	    (capdbp = dbopen(pbuf, O_RDONLY0x0000, 0, DB_HASH, 0))) {
		opened++;
		retval = cdbget(capdbp, &dbrecord, name);
		if (retval < 0) {
			/* no record available */
			(void)capdbp->close(capdbp);
			continue;
		}
		free(record);
		/* save the data; close frees it */
		clen = strlen(dbrecord);
		if ((cbuf = malloc(clen + 1)) == NULL((void *)0))
			return (-2);
		memcpy(cbuf, dbrecord, clen + 1);
		if (capdbp->close(capdbp) < 0) {
			free(cbuf);
			return (-2);
		}
		/* assume tc='s have been expanded??? */
		*len = clen;
		*cap = cbuf;
		return (retval);
	} else {
		fp = fopen(*db_p, "re");
		if (fp == NULL((void *)0)) {
			/* No error on unfound file. */
			continue;
		}
		myfd = 1;
		opened++;
	}
}
/*
 * Find the requested capability record ...
 */
{
    char buf[BUFSIZ1024];
    char *b_end, *bp;
    int c;

    /*
     * Loop invariants:
     *	There is always room for one more character in record.
     *	R_end always points just past end of record.
     *	Rp always points just past last character in record.
     *	B_end always points just past last character in buf.
     *	Bp always points at next character in buf.
     */
    b_end = buf;
    bp = buf;
    for (;;) {

	/*
	 * Read in a line implementing (\, newline)
	 * line continuation.
	 */
	rp = record;
	for (;;) {
		if (bp >= b_end) {
			size_t n;

			n = fread(buf, 1, sizeof(buf), fp);
			if (n == 0) {
				eof = feof(fp)(!__isthreaded ? (((fp)->_flags & 0x0020) != 0) : (feof
)(fp));
				if (myfd)
					(void)fclose(fp);
				if (eof) {
					fp = NULL((void *)0);
					break;
				}
				free(record);
				return (-2);
			}
			b_end = buf+n;
			bp = buf;
		}

		c = *bp++;
		if (c == '\n') {
			if (rp > record && *(rp-1) == '\\') {
				rp--;
				continue;
			} else
				break;
		}
		*rp++ = c;

		/*
		 * Enforce loop invariant: if no room
		 * left in record buffer, try to get
		 * some more.
		 */
		if (rp >= r_end) {
			size_t pos;
			size_t newsize;
			char *nrecord;

			pos = rp - record;
			newsize = r_end - record + BFRAG1024;
			nrecord = realloc(record, newsize);
			if (nrecord == NULL((void *)0)) {
				free(record);
				if (myfd)
					(void)fclose(fp);
				errno(*__errno()) = ENOMEM12;
				return (-2);
			}
			record = nrecord;
			r_end = record + newsize;
			rp = record + pos;
		}
	}
		/* loop invariant lets us do this */
	*rp++ = '\0';

	/*
	 * If encountered EOF check next file.
	 */
	if (eof)
		break;

	/*
	 * Toss blank lines and comments.
	 */
	if (*record == '\0' || *record == '#')
		continue;

	/*
	 * See if this is the record we want ...
	 */
	if (cgetmatch(record, name) == 0) {
		if (nfield == NULL((void *)0) || !nfcmp(nfield, record)) {
			foundit = 1;
			break;	/* found it! */
		}
	}
    }
}
if (foundit)
	break;
}

if (!foundit) {
free(record);
return (opened ? -1 : -2);
}

/*
* Got the capability record, but now we have to expand all tc=name
* references in it ...
*/
406tc_exp:	{
char *s;
u_int ilen;
int diff, iret, tclen;
char *ibuf, *icap, *scan, *tc, *tcstart, *tcend;

/*
 * Loop invariants:
 *	There is room for one more character in record.
 *	R_end points just past end of record.
 *	Rp points just past last character in record.
 *	Scan points at remainder of record that needs to be
 *	scanned for tc=name constructs.
 */
scan = record;
tc_not_resolved = 0;
for (;;) {
	if ((tc = cgetcap(scan, "tc", '=')) == NULL((void *)0))
		break;

	/*
	 * Find end of tc=name and stomp on the trailing `:'
	 * (if present) so we can use it to call ourselves.
	 */
	s = tc;
	for (;;) {
		if (*s == '\0')
			break;
		else
			if (*s++ == ':') {
				*(s - 1) = '\0';
				break;
			}
	}
	tcstart = tc - 3;
	tclen = s - tcstart;
	tcend = s;

	iret = getent(&icap, &ilen, db_p, fp, tc, depth+1,
		      NULL((void *)0));
	if (iret != 0) {
		/* an error */
		if (iret < -1) {
			if (myfd)
				(void)fclose(fp);
			free(record);
			return (iret);
		}
		if (iret == 1)
			tc_not_resolved = 1;
		/* couldn't resolve tc */
		if (iret == -1) {
			*(s - 1) = ':';
			scan = s - 1;
			tc_not_resolved = 1;
			continue;

		}
	}
	/* not interested in name field of tc'ed record */
	s = ibuf = icap;
	for (;;)
		if (*s == '\0')
			break;
		else
			if (*s++ == ':')
				break;
	ilen -= s - icap;
	icap = s;

	/* make sure interpolated record is `:'-terminated */
	s += ilen;
	if (*(s-1) != ':') {
		*s = ':';	/* overwrite NUL with : */
		ilen++;
	}

	/*
	 * Make sure there's enough room to insert the
	 * new record.
	 */
	diff = ilen - tclen;
	if (diff >= r_end - rp) {
		u_int pos, tcpos, tcposend;
		size_t newsize;
		char *nrecord;

		pos = rp - record;
		newsize = r_end - record + diff + BFRAG1024;
		tcpos = tcstart - record;
		tcposend = tcend - record;
		nrecord = realloc(record, newsize);
		if (nrecord == NULL((void *)0)) {
			free(record);
			if (myfd)
				(void)fclose(fp);
			free(ibuf);
			errno(*__errno()) = ENOMEM12;
			return (-2);
		}
		record = nrecord;
		r_end = record + newsize;
		rp = record + pos;
		tcstart = record + tcpos;
		tcend = record + tcposend;
	}

	/*
	 * Insert tc'ed record into our record.
	 */
	s = tcstart + ilen;
	memmove(s, tcend, rp - tcend);
	memmove(tcstart, icap, ilen);
	rp += diff;
	free(ibuf);

	/*
	 * Start scan on `:' so next cgetcap works properly
	 * (cgetcap always skips first field).
	 */
	scan = s-1;
}

}
/*
* Close file (if we opened it), give back any extra memory, and
* return capability, length and success.
*/
if (myfd)
(void)fclose(fp);
*len = rp - record - 1;	/* don't count NUL */
if (r_end > rp) {
char *nrecord;

if ((nrecord = realloc(record, rp - record)) == NULL((void *)0)) {
	free(record);
	errno(*__errno()) = ENOMEM12;
	return (-2);
}
record = nrecord;
}
*cap = record;
if (tc_not_resolved)
return (1);
return (0);
551}

553static int
554cdbget(DB *capdbp, char **bp, const char *name)
555{
DBT key, data;

key.data = (void *)name;
key.size = strlen(name);

for (;;) {
/* Get the reference. */
switch(capdbp->get(capdbp, &key, &data, 0)) {
case -1:
	return (-2);
case 1:
	return (-1);
}

/* If not an index to another record, leave. */
if (((char *)data.data)[0] != SHADOW(char)2)
	break;

key.data = (char *)data.data + 1;
key.size = data.size - 1;
}

*bp = (char *)data.data + 1;
return (((char *)(data.data))[0] == TCERR(char)1 ? 1 : 0);
580}

582/*
* Cgetmatch will return 0 if name is one of the names of the capability
* record buf, -1 if not.
*/
586int
587cgetmatch(char *buf, const char *name)
588{
char *bp;
const char *np;

if (*name == '\0')
return (-1);
/*
* Start search at beginning of record.
*/
bp = buf;
for (;;) {
/*
 * Try to match a record name.
 */
np = name;
for (;;)
	if (*np == '\0') {
		if (*bp == '|' || *bp == ':' || *bp == '\0')
			return (0);
		else
			break;
	} else
		if (*bp++ != *np++)
			break;

/*
 * Match failed, skip to next name in record.
 */
bp--;	/* a '|' or ':' may have stopped the match */
for (;;)
	if (*bp == '\0' || *bp == ':')
		return (-1);	/* match failed totally */
	else
		if (*bp++ == '|')
			break;	/* found next name */
}
624}
625DEF_WEAK(cgetmatch)__asm__(".weak " "cgetmatch" " ; " "cgetmatch" " = " "_libc_cgetmatch"
);

627int
628cgetfirst(char **buf, char **db_array)
629{

(void)cgetclose();
return (cgetnext(buf, db_array));
1
Calling 'cgetnext'→
633}
634DEF_WEAK(cgetfirst)__asm__(".weak " "cgetfirst" " ; " "cgetfirst" " = " "_libc_cgetfirst"
);

636static FILE *pfp;
637static int slash;
638static char **dbp;

640int
641cgetclose(void)
642{

if (pfp != NULL((void *)0)) {
(void)fclose(pfp);
pfp = NULL((void *)0);
}
dbp = NULL((void *)0);
gottoprec = 0;
slash = 0;
return(0);
652}
653DEF_WEAK(cgetclose)__asm__(".weak " "cgetclose" " ; " "cgetclose" " = " "_libc_cgetclose"
);

655/*
* Cgetnext() gets either the first or next entry in the logical database
* specified by db_array.  It returns 0 upon completion of the database, 1
* upon returning an entry with more remaining, and -1 if an error occurs.
*/
660int
661cgetnext(char **cap, char **db_array)
662{
size_t len, otopreclen = topreclen;
int c, serrno, status = -1;
char buf[BUFSIZ1024], nbuf[BSIZE1024];
char *b_end, *bp, *r_end, *rp;
char *record = NULL((void *)0);
char *otoprec = toprec;
u_int dummy;
off_t pos;

if (dbp1.1
'dbp' is equal to NULL
 == NULL((void *)0))
2
←
Taking true branch→
dbp = db_array;

if (pfp2.1
'pfp' is equal to NULL
 == NULL((void *)0) && (pfp = fopen(*dbp, "re")) == NULL((void *)0))
3
←
Assuming the condition is false→
4
←
Taking false branch→
goto done;

/*
* Check if we have an unused top record from cgetset().
*/
if (toprec && !gottoprec) {
5
←
Assuming 'toprec' is null→
gottoprec = 1;
record = toprec;
goto lookup;
}

/*
* Allocate first chunk of memory.
*/
if ((record = malloc(BFRAG1024)) == NULL((void *)0))
6
←
Memory is allocated→
7
←
Assuming the condition is false→
8
←
Taking false branch→
goto done;
r_end = record + BFRAG1024;

/*
* Find the next capability record
*/
/*
* Loop invariants:
*	There is always room for one more character in record.
*	R_end always points just past end of record.
*	Rp always points just past last character in record.
*	B_end always points just past last character in buf.
*	Bp always points at next character in buf.
*/
b_end = buf;
bp = buf;
for (;;) {
9
←
Loop condition is true.  Entering loop body→
/*
 * Read in a line implementing (\, newline)
 * line continuation.
 */
rp = record;
for (;;) {
10
←
Loop condition is true.  Entering loop body→
	if (bp10.1
'bp' is >= 'b_end'
 >= b_end) {
11
←
Taking true branch→
		size_t n;

		n = fread(buf, 1, sizeof(buf), pfp);
		if (n == 0) {
12
←
Assuming 'n' is equal to 0→
13
←
Taking true branch→
			if (ferror(pfp)(!__isthreaded ? (((pfp)->_flags & 0x0040) != 0) : (ferror
)(pfp)))
14
←
Assuming '__isthreaded' is not equal to 0→
15
←
'?' condition is false→
16
←
Assuming the condition is true→
17
←
Taking true branch→
				goto done;
18
←
Control jumps to line 792→
			(void)fclose(pfp);
			pfp = NULL((void *)0);
			if (*++dbp == NULL((void *)0)) {
				status = 0;
				goto done;
			} else if ((pfp =
			    fopen(*dbp, "re")) == NULL((void *)0)) {
				goto done;
			} else
				continue;
		}
		b_end = buf + n;
		bp = buf;
	}

	c = *bp++;
	if (c == '\n') {
		if (rp > record && *(rp-1) == '\\') {
			rp--;
			continue;
		} else
			break;
	}
	*rp++ = c;

	/*
	 * Enforce loop invariant: if no room
	 * left in record buffer, try to get
	 * some more.
	 */
	if (rp >= r_end) {
		size_t newsize, off;
		char *nrecord;

		off = rp - record;
		newsize = r_end - record + BFRAG1024;
		nrecord = realloc(record, newsize);
		if (nrecord == NULL((void *)0))
			goto done;
		record = nrecord;
		r_end = record + newsize;
		rp = record + off;
	}
}
/* loop invariant lets us do this */
*rp++ = '\0';

/*
 * If not blank or comment, set toprec and topreclen so
 * getent() doesn't have to re-parse the file to find it.
 */
if (*record != '\0' && *record != '#') {
	/* Rewind to end of record */
	fseeko(pfp, bp - b_end, SEEK_CUR1);
	toprec = record;
	topreclen = rp - record;
	break;
}
}
780lookup:
/* extract name from record */
len = strcspn(record, "|:");
memcpy(nbuf, record, len);
nbuf[len] = '\0';

/* return value of getent() is one less than cgetnext() */
pos = ftello(pfp);
status = getent(cap, &dummy, dbp, pfp, nbuf, 0, NULL((void *)0)) + 1;
if (status > 0)
fseeko(pfp, pos, SEEK_SET0);
791done:
serrno = errno(*__errno());
if (toprec != otoprec) {
19
←
Assuming 'toprec' is equal to 'otoprec'→
20
←
Taking false branch→
toprec = otoprec;
topreclen = otopreclen;
free(record);
}
if (status <= 0)
21
←
Potential leak of memory pointed to by 'rp'
(void)cgetclose();
errno(*__errno()) = serrno;

return (status);
803}
804DEF_WEAK(cgetnext)__asm__(".weak " "cgetnext" " ; " "cgetnext" " = " "_libc_cgetnext"
);

806/*
* Cgetstr retrieves the value of the string capability cap from the
* capability record pointed to by buf.  A pointer to a decoded, NUL
* terminated, malloc'd copy of the string is returned in the char *
* pointed to by str.  The length of the string not including the trailing
* NUL is returned on success, -1 if the requested string capability
* couldn't be found, -2 if a system error was encountered (storage
* allocation failure).
*/
815int
816cgetstr(char *buf, const char *cap, char **str)
817{
u_int m_room;
char *bp, *mp;
int len;
char *mem;

/*
* Find string capability cap
*/
bp = cgetcap(buf, cap, '=');
if (bp == NULL((void *)0))
return (-1);

/*
* Conversion / storage allocation loop ...  Allocate memory in
* chunks SFRAG in size.
*/
if ((mem = malloc(SFRAG100)) == NULL((void *)0))
return (-2);	/* couldn't even allocate the first fragment */
m_room = SFRAG100;
mp = mem;

while (*bp != ':' && *bp != '\0') {
/*
 * Loop invariants:
 *	There is always room for one more character in mem.
 *	Mp always points just past last character in mem.
 *	Bp always points at next character in buf.
 */
if (*bp == '^') {
	bp++;
	if (*bp == ':' || *bp == '\0')
		break;	/* drop unfinished escape */
	*mp++ = *bp++ & 037;
} else if (*bp == '\\') {
	bp++;
	if (*bp == ':' || *bp == '\0')
		break;	/* drop unfinished escape */
	if ('0' <= *bp && *bp <= '7') {
		int n, i;

		n = 0;
		i = 3;	/* maximum of three octal digits */
		do {
			n = n * 8 + (*bp++ - '0');
		} while (--i && '0' <= *bp && *bp <= '7');
		*mp++ = n;
	}
	else switch (*bp++) {
		case 'b': case 'B':
			*mp++ = '\b';
			break;
		case 't': case 'T':
			*mp++ = '\t';
			break;
		case 'n': case 'N':
			*mp++ = '\n';
			break;
		case 'f': case 'F':
			*mp++ = '\f';
			break;
		case 'r': case 'R':
			*mp++ = '\r';
			break;
		case 'e': case 'E':
			*mp++ = ESC('[' & 037);
			break;
		case 'c': case 'C':
			*mp++ = ':';
			break;
		default:
			/*
			 * Catches '\', '^', and
			 *  everything else.
			 */
			*mp++ = *(bp-1);
			break;
	}
} else
	*mp++ = *bp++;
m_room--;

/*
 * Enforce loop invariant: if no room left in current
 * buffer, try to get some more.
 */
if (m_room == 0) {
	size_t size = mp - mem;
	char *nmem;

	if ((nmem = realloc(mem, size + SFRAG100)) == NULL((void *)0)) {
		free(mem);
		return (-2);
	}
	mem = nmem;
	m_room = SFRAG100;
	mp = mem + size;
}
}
*mp++ = '\0';	/* loop invariant let's us do this */
m_room--;
len = mp - mem - 1;

/*
* Give back any extra memory and return value and success.
*/
if (m_room != 0) {
char *nmem;

if ((nmem = realloc(mem, mp - mem)) == NULL((void *)0)) {
	free(mem);
	return (-2);
}
mem = nmem;
}
*str = mem;
return (len);
934}
935DEF_WEAK(cgetstr)__asm__(".weak " "cgetstr" " ; " "cgetstr" " = " "_libc_cgetstr"
);

937/*
* Cgetustr retrieves the value of the string capability cap from the
* capability record pointed to by buf.  The difference between cgetustr()
* and cgetstr() is that cgetustr does not decode escapes but rather treats
* all characters literally.  A pointer to a  NUL terminated malloc'd
* copy of the string is returned in the char pointed to by str.  The
* length of the string not including the trailing NUL is returned on success,
* -1 if the requested string capability couldn't be found, -2 if a system
* error was encountered (storage allocation failure).
*/
947int
948cgetustr(char *buf, const char *cap, char **str)
949{
u_int m_room;
char *bp, *mp;
int len;
char *mem;

/*
* Find string capability cap
*/
if ((bp = cgetcap(buf, cap, '=')) == NULL((void *)0))
return (-1);

/*
* Conversion / storage allocation loop ...  Allocate memory in
* chunks SFRAG in size.
*/
if ((mem = malloc(SFRAG100)) == NULL((void *)0))
return (-2);	/* couldn't even allocate the first fragment */
m_room = SFRAG100;
mp = mem;

while (*bp != ':' && *bp != '\0') {
/*
 * Loop invariants:
 *	There is always room for one more character in mem.
 *	Mp always points just past last character in mem.
 *	Bp always points at next character in buf.
 */
*mp++ = *bp++;
m_room--;

/*
 * Enforce loop invariant: if no room left in current
 * buffer, try to get some more.
 */
if (m_room == 0) {
	size_t size = mp - mem;
	char *nmem;

	if ((nmem = realloc(mem, size + SFRAG100)) == NULL((void *)0)) {
		free(mem);
		return (-2);
	}
	mem = nmem;
	m_room = SFRAG100;
	mp = mem + size;
}
}
*mp++ = '\0';	/* loop invariant let's us do this */
m_room--;
len = mp - mem - 1;

/*
* Give back any extra memory and return value and success.
*/
if (m_room != 0) {
char *nmem;

if ((nmem = realloc(mem, mp - mem)) == NULL((void *)0)) {
	free(mem);
	return (-2);
}
mem = nmem;
}
*str = mem;
return (len);
1015}
1016DEF_WEAK(cgetustr)__asm__(".weak " "cgetustr" " ; " "cgetustr" " = " "_libc_cgetustr"
);

1018/*
* Cgetnum retrieves the value of the numeric capability cap from the
* capability record pointed to by buf.  The numeric value is returned in
* the long pointed to by num.  0 is returned on success, -1 if the requested
* numeric capability couldn't be found.
*/
1024int
1025cgetnum(char *buf, const char *cap, long *num)
1026{
long n;
int base, digit;
char *bp;

/*
* Find numeric capability cap
*/
bp = cgetcap(buf, cap, '#');
if (bp == NULL((void *)0))
return (-1);

/*
* Look at value and determine numeric base:
*	0x... or 0X...	hexadecimal,
* else	0...		octal,
* else			decimal.
*/
if (*bp == '0') {
bp++;
if (*bp == 'x' || *bp == 'X') {
	bp++;
	base = 16;
} else
	base = 8;
} else
base = 10;

/*
* Conversion loop ...
*/
n = 0;
for (;;) {
if ('0' <= *bp && *bp <= '9')
	digit = *bp - '0';
else if ('a' <= *bp && *bp <= 'f')
	digit = 10 + *bp - 'a';
else if ('A' <= *bp && *bp <= 'F')
	digit = 10 + *bp - 'A';
else
	break;

if (digit >= base)
	break;

n = n * base + digit;
bp++;
}

/*
* Return value and success.
*/
*num = n;
return (0);
1080}
1081DEF_WEAK(cgetnum)__asm__(".weak " "cgetnum" " ; " "cgetnum" " = " "_libc_cgetnum"
);

1083/*
* Compare name field of record.
*/
1086static int
1087nfcmp(const char *nf, char *rec)
1088{
char *cp, tmp;
int ret;

for (cp = rec; *cp != ':'; cp++)
;

tmp = *(cp + 1);
*(cp + 1) = '\0';
ret = strcmp(nf, rec);
*(cp + 1) = tmp;

return (ret);
1101}