/usr/src/lib/libmenu/m_driver.c

Bug Summary

File:	src/lib/libmenu/m_driver.c
Warning:	line 545, column 11 Access to field 'y' results in a dereference of a null pointer (loaded from variable 'item')

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name m_driver.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/lib/libmenu/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/lib/libmenu -I /usr/src/lib/libmenu/../libcurses -D HAVE_CONFIG_H -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/lib/libmenu/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/lib/libmenu/m_driver.c

1/* $OpenBSD: m_driver.c,v 1.8 2010/01/12 23:22:07 nicm Exp $ */

3/****************************************************************************
* Copyright (c) 1998-2005,2008 Free Software Foundation, Inc.              *
*                                                                          *
* Permission is hereby granted, free of charge, to any person obtaining a  *
* copy of this software and associated documentation files (the            *
* "Software"), to deal in the Software without restriction, including      *
* without limitation the rights to use, copy, modify, merge, publish,      *
* distribute, distribute with modifications, sublicense, and/or sell       *
* copies of the Software, and to permit persons to whom the Software is    *
* furnished to do so, subject to the following conditions:                 *
*                                                                          *
* The above copyright notice and this permission notice shall be included  *
* in all copies or substantial portions of the Software.                   *
*                                                                          *
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS  *
* OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF               *
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.   *
* IN NO EVENT SHALL THE ABOVE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,   *
* DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR    *
* OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR    *
* THE USE OR OTHER DEALINGS IN THE SOFTWARE.                               *
*                                                                          *
* Except as contained in this notice, the name(s) of the above copyright   *
* holders shall not be used in advertising or otherwise to promote the     *
* sale, use or other dealings in this Software without prior written       *
* authorization.                                                           *
****************************************************************************/

31/****************************************************************************
*   Author:  Juergen Pfeifer, 1995,1997                                    *
****************************************************************************/

35/***************************************************************************
36* Module m_driver                                                          *
37* Central dispatching routine                                              *
38***************************************************************************/

40#include "menu.priv.h"

42MODULE_ID("$Id: m_driver.c,v 1.8 2010/01/12 23:22:07 nicm Exp $")

44/* Macros */

46/* Remove the last character from the match pattern buffer */
47#define Remove_Character_From_Pattern(menu)(menu)->pattern[--((menu)->pindex)] = '\0' \
(menu)->pattern[--((menu)->pindex)] = '\0'

50/* Add a new character to the match pattern buffer */
51#define Add_Character_To_Pattern(menu,ch){ (menu)->pattern[((menu)->pindex)++] = (ch); (menu)->
pattern[(menu)->pindex] = '\0'; } \
{ (menu)->pattern[((menu)->pindex)++] = (ch);\
  (menu)->pattern[(menu)->pindex] = '\0'; }

55/*---------------------------------------------------------------------------
  Facility      :  libnmenu
  Function      :  static bool Is_Sub_String(
                          bool IgnoreCaseFlag,
                          const char *part,
                          const char *string)

  Description   :  Checks whether or not part is a substring of string.

  Return Values :  TRUE   - if it is a substring
                   FALSE  - if it is not a substring
66+--------------------------------------------------------------------------*/
67static bool_Bool
68Is_Sub_String(
      bool_Bool IgnoreCaseFlag,
      const char *part,
      const char *string
72)
73{
assert(part && string)((void)0);
if (IgnoreCaseFlag)
  {
    while (*string && *part)
{
 if (toupper(UChar(*string++)((unsigned char)(*string++))) != toupper(UChar(*part)((unsigned char)(*part))))
   break;
 part++;
}
  }
else
  {
    while (*string && *part)
if (*part != *string++)
 break;
    part++;
  }
return ((*part) ? FALSE0 : TRUE1);
92}

94/*---------------------------------------------------------------------------
  Facility      :  libnmenu
  Function      :  int _nc_Match_Next_Character_In_Item_Name(
                          MENU *menu,
                          int  ch,
                          ITEM **item)

  Description   :  This internal routine is called for a menu positioned
                   at an item with three different classes of characters:
                      - a printable character; the character is added to
                        the current pattern and the next item matching
                        this pattern is searched.
                      - NUL; the pattern stays as it is and the next item
                        matching the pattern is searched
                      - BS; the pattern stays as it is and the previous
                        item matching the pattern is searched

                      The item parameter contains on call a pointer to
                      the item where the search starts. On return - if
                      a match was found - it contains a pointer to the
                      matching item.

  Return Values :  E_OK        - an item matching the pattern was found
                   E_NO_MATCH  - nothing found
118+--------------------------------------------------------------------------*/
119NCURSES_EXPORT(int)int
120_nc_Match_Next_Character_In_Item_Name
121(MENU * menu, int ch, ITEM ** item)
122{
bool_Bool found = FALSE0, passed = FALSE0;
int idx, last;

T((T_CALLED("_nc_Match_Next_Character(%p,%d,%p)"), menu, ch, item));

assert(menu && item && *item)((void)0);
idx = (*item)->index;

if (ch && ch != BS(8))
  {
    /* if we become to long, we need no further checking : there can't be
       a match ! */
    if ((menu->pindex + 1) > menu->namelen)
RETURN(E_NO_MATCH)return( ((*__errno())=((-9))) );

    Add_Character_To_Pattern(menu, ch){ (menu)->pattern[((menu)->pindex)++] = (ch); (menu)->
pattern[(menu)->pindex] = '\0'; };
    /* we artificially position one item back, because in the do...while
       loop we start with the next item. This means, that with a new
       pattern search we always start the scan with the actual item. If
       we do a NEXT_PATTERN oder PREV_PATTERN search, we start with the
       one after or before the actual item. */
    if (--idx < 0)
idx = menu->nitems - 1;
  }

last = idx;			/* this closes the cycle */

do
  {
    if (ch == BS(8))
{			/* we have to go backward */
 if (--idx < 0)
   idx = menu->nitems - 1;
}
    else
{			/* otherwise we always go forward */
 if (++idx >= menu->nitems)
   idx = 0;
}
    if (Is_Sub_String((bool_Bool)((menu->opt & O_IGNORECASE(0x08)) != 0),
	menu->pattern,
	menu->items[idx]->name.str)
)
found = TRUE1;
    else
passed = TRUE1;
  }
while (!found && (idx != last));

if (found)
  {
    if (!((idx == (*item)->index) && passed))
{
 *item = menu->items[idx];
 RETURN(E_OK)return( ((*__errno())=((0))) );
}
    /* This point is reached, if we fully cycled through the item list
       and the only match we found is the starting item. With a NEXT_PATTERN
       or PREV_PATTERN scan this means, that there was no additional match.
       If we searched with an expanded new pattern, we should never reach
       this point, because if the expanded pattern matches also the actual
       item we will find it in the first attempt (passed==FALSE) and we
       will never cycle through the whole item array.
     */
    assert(ch == 0 || ch == BS)((void)0);
  }
else
  {
    if (ch && ch != BS(8) && menu->pindex > 0)
{
 /* if we had no match with a new pattern, we have to restore it */
 Remove_Character_From_Pattern(menu)(menu)->pattern[--((menu)->pindex)] = '\0';
}
  }
RETURN(E_NO_MATCH)return( ((*__errno())=((-9))) );
198}

200/*---------------------------------------------------------------------------
  Facility      :  libnmenu
  Function      :  int menu_driver(MENU *menu, int c)

  Description   :  Central dispatcher for the menu. Translates the logical
                   request 'c' into a menu action.

  Return Values :  E_OK            - success
                   E_BAD_ARGUMENT  - invalid menu pointer
                   E_BAD_STATE     - menu is in user hook routine
                   E_NOT_POSTED    - menu is not posted
211+--------------------------------------------------------------------------*/
212NCURSES_EXPORT(int)int
213menu_driver(MENU * menu, int c)
214{
215#define NAVIGATE(dir)if (!item->dir) result = (-12); else item = item->dir \
if (!item->dir)\
   result = E_REQUEST_DENIED(-12);\
else\
   item = item->dir

int result = E_OK(0);
ITEM *item;
int my_top_row, rdiff;

T((T_CALLED("menu_driver(%p,%d)"), menu, c));

if (!menu)
1
Assuming 'menu' is non-null→
2
←
Taking false branch→
  RETURN(E_BAD_ARGUMENT)return( ((*__errno())=((-2))) );

if (menu->status & _IN_DRIVER(0x02U))
3
←
Assuming the condition is false→
4
←
Taking false branch→
  RETURN(E_BAD_STATE)return( ((*__errno())=((-5))) );
if (!(menu->status & _POSTED(0x01U)))
5
←
Assuming the condition is false→
6
←
Taking false branch→
  RETURN(E_NOT_POSTED)return( ((*__errno())=((-7))) );

item = menu->curitem;
7
←
Value assigned to 'item'→

my_top_row = menu->toprow;
assert(item)((void)0);

if ((c > KEY_MAX0777) && (c <= MAX_MENU_COMMAND(0777 + 17)))
8
←
Assuming 'c' is > KEY_MAX→
9
←
Assuming the condition is true→
10
←
Taking true branch→
  {
    if (!((c == REQ_BACK_PATTERN(0777 + 15))
11
←
Assuming the condition is false→
14
←
Taking true branch→
   || (c == REQ_NEXT_MATCH(0777 + 16)) || (c == REQ_PREV_MATCH(0777 + 17))))
12
←
Assuming the condition is false→
13
←
Assuming the condition is false→
{
 assert(menu->pattern)((void)0);
 Reset_Pattern(menu){ (menu)->pindex = 0; (menu)->pattern[0] = '\0'; };
}

    switch (c)
15
←
Control jumps to 'case 519:'  at line 313→
{
case REQ_LEFT_ITEM(0777 + 1):
   /*=================*/
 NAVIGATE(left)if (!item->left) result = (-12); else item = item->left;
 break;

case REQ_RIGHT_ITEM(0777 + 2):
   /*==================*/
 NAVIGATE(right)if (!item->right) result = (-12); else item = item->right;
 break;

case REQ_UP_ITEM(0777 + 3):
   /*===============*/
 NAVIGATE(up)if (!item->up) result = (-12); else item = item->up;
 break;

case REQ_DOWN_ITEM(0777 + 4):
   /*=================*/
 NAVIGATE(down)if (!item->down) result = (-12); else item = item->down;
 break;

case REQ_SCR_ULINE(0777 + 5):
   /*=================*/
 if (my_top_row == 0 || !(item->up))
   result = E_REQUEST_DENIED(-12);
 else
   {
     --my_top_row;
     item = item->up;
   }
 break;

case REQ_SCR_DLINE(0777 + 6):
   /*=================*/
 if ((my_top_row + menu->arows >= menu->rows) || !(item->down))
   {
     /* only if the menu has less items than rows, we can deny the
        request. Otherwise the epilogue of this routine adjusts the
        top row if necessary */
     result = E_REQUEST_DENIED(-12);
   }
 else
   {
     my_top_row++;
     item = item->down;
   }
 break;

case REQ_SCR_DPAGE(0777 + 7):
   /*=================*/
 rdiff = menu->rows - (menu->arows + my_top_row);
 if (rdiff > menu->arows)
   rdiff = menu->arows;
 if (rdiff <= 0)
   result = E_REQUEST_DENIED(-12);
 else
   {
     my_top_row += rdiff;
     while (rdiff-- > 0 && item != 0 && item->down != 0)
item = item->down;
   }
 break;

case REQ_SCR_UPAGE(0777 + 8):
   /*=================*/
 rdiff = (menu->arows < my_top_row) ? menu->arows : my_top_row;
16
←
Assuming 'my_top_row' is <= field 'arows'→
17
←
'?' condition is false→
 if (rdiff <= 0)
18
←
Assuming 'rdiff' is > 0→
19
←
Taking false branch→
   result = E_REQUEST_DENIED(-12);
 else
   {
     my_top_row -= rdiff;
     while (rdiff-- > 0 && item != 0 && item->up != 0)
20
←
Assuming 'item' is equal to null→
item = item->up;
   }
 break;
21
←
 Execution continues on line 541→

case REQ_FIRST_ITEM(0777 + 9):
   /*==================*/
 item = menu->items[0];
 break;

case REQ_LAST_ITEM(0777 + 10):
   /*=================*/
 item = menu->items[menu->nitems - 1];
 break;

case REQ_NEXT_ITEM(0777 + 11):
   /*=================*/
 if ((item->index + 1) >= menu->nitems)
   {
     if (menu->opt & O_NONCYCLIC(0x20))
result = E_REQUEST_DENIED(-12);
     else
item = menu->items[0];
   }
 else
   item = menu->items[item->index + 1];
 break;

case REQ_PREV_ITEM(0777 + 12):
   /*=================*/
 if (item->index <= 0)
   {
     if (menu->opt & O_NONCYCLIC(0x20))
result = E_REQUEST_DENIED(-12);
     else
item = menu->items[menu->nitems - 1];
   }
 else
   item = menu->items[item->index - 1];
 break;

case REQ_TOGGLE_ITEM(0777 + 13):
   /*===================*/
 if (menu->opt & O_ONEVALUE(0x01))
   {
     result = E_REQUEST_DENIED(-12);
   }
 else
   {
     if (menu->curitem->opt & O_SELECTABLE(0x01))
{
  menu->curitem->value = !menu->curitem->value;
  Move_And_Post_Item(menu, menu->curitem){wmove((menu)->win,(menu)->spc_rows*(menu->curitem)->
y,((menu)->itemlen+(menu)->spc_cols)*(menu->curitem)
->x); _nc_Post_Item((menu),(menu->curitem));};
  _nc_Show_Menu(menu);
}
     else
result = E_NOT_SELECTABLE(-10);
   }
 break;

case REQ_CLEAR_PATTERN(0777 + 14):
   /*=====================*/
 /* already cleared in prologue */
 break;

case REQ_BACK_PATTERN(0777 + 15):
   /*====================*/
 if (menu->pindex > 0)
   {
     assert(menu->pattern)((void)0);
     Remove_Character_From_Pattern(menu)(menu)->pattern[--((menu)->pindex)] = '\0';
     pos_menu_cursor(menu);
   }
 else
   result = E_REQUEST_DENIED(-12);
 break;

case REQ_NEXT_MATCH(0777 + 16):
   /*==================*/
 assert(menu->pattern)((void)0);
 if (menu->pattern[0])
   result = _nc_Match_Next_Character_In_Item_Name(menu, 0, &item);
 else
   {
     if ((item->index + 1) < menu->nitems)
item = menu->items[item->index + 1];
     else
{
  if (menu->opt & O_NONCYCLIC(0x20))
    result = E_REQUEST_DENIED(-12);
  else
    item = menu->items[0];
}
   }
 break;

case REQ_PREV_MATCH(0777 + 17):
   /*==================*/
 assert(menu->pattern)((void)0);
 if (menu->pattern[0])
   result = _nc_Match_Next_Character_In_Item_Name(menu, BS(8), &item);
 else
   {
     if (item->index)
item = menu->items[item->index - 1];
     else
{
  if (menu->opt & O_NONCYCLIC(0x20))
    result = E_REQUEST_DENIED(-12);
  else
    item = menu->items[menu->nitems - 1];
}
   }
 break;

default:
   /*======*/
 result = E_UNKNOWN_COMMAND(-8);
 break;
}
  }
else
  {				/* not a command */
    if (!(c & ~((int)MAX_REGULAR_CHARACTER(0xff))) && isprint(UChar(c)((unsigned char)(c))))
result = _nc_Match_Next_Character_In_Item_Name(menu, c, &item);
446#ifdef NCURSES_MOUSE_VERSION1
    else if (KEY_MOUSE0631 == c)
{
 MEVENT event;
 WINDOW *uwin = Get_Menu_UserWin(menu)((menu)->userwin ? (menu)->userwin : stdscr);

 getmouse(&event);
 if ((event.bstate & (BUTTON1_CLICKED((004L) << (((1) - 1) * 6)) |
	       BUTTON1_DOUBLE_CLICKED((010L) << (((1) - 1) * 6)) |
	       BUTTON1_TRIPLE_CLICKED((020L) << (((1) - 1) * 6))))
     && wenclose(uwin, event.y, event.x))
   {			/* we react only if the click was in the userwin, that means
		 * inside the menu display area or at the decoration window.
		 */
     WINDOW *sub = Get_Menu_Window(menu)((menu)->usersub ? (menu)->usersub : ((menu)->userwin
 ? (menu)->userwin : stdscr));
     int ry = event.y, rx = event.x;	/* screen coordinates */

     result = E_REQUEST_DENIED(-12);
     if (mouse_trafo(&ry, &rx, FALSE)wmouse_trafo(stdscr,&ry,&rx,0))
{		/* rx, ry are now "curses" coordinates */
  if (ry < sub->_begy)
    {		/* we clicked above the display region; this is
		 * interpreted as "scroll up" request
		 */
      if (event.bstate & BUTTON1_CLICKED((004L) << (((1) - 1) * 6)))
	result = menu_driver(menu, REQ_SCR_ULINE(0777 + 5));
      else if (event.bstate & BUTTON1_DOUBLE_CLICKED((010L) << (((1) - 1) * 6)))
	result = menu_driver(menu, REQ_SCR_UPAGE(0777 + 8));
      else if (event.bstate & BUTTON1_TRIPLE_CLICKED((020L) << (((1) - 1) * 6)))
	result = menu_driver(menu, REQ_FIRST_ITEM(0777 + 9));
      RETURN(result)return( ((*__errno())=(result)) );
    }
  else if (ry > sub->_begy + sub->_maxy)
    {		/* we clicked below the display region; this is
		 * interpreted as "scroll down" request
		 */
      if (event.bstate & BUTTON1_CLICKED((004L) << (((1) - 1) * 6)))
	result = menu_driver(menu, REQ_SCR_DLINE(0777 + 6));
      else if (event.bstate & BUTTON1_DOUBLE_CLICKED((010L) << (((1) - 1) * 6)))
	result = menu_driver(menu, REQ_SCR_DPAGE(0777 + 7));
      else if (event.bstate & BUTTON1_TRIPLE_CLICKED((020L) << (((1) - 1) * 6)))
	result = menu_driver(menu, REQ_LAST_ITEM(0777 + 10));
      RETURN(result)return( ((*__errno())=(result)) );
    }
  else if (wenclose(sub, event.y, event.x))
    {		/* Inside the area we try to find the hit item */
      int i, x, y, err;

      ry = event.y;
      rx = event.x;
      if (wmouse_trafo(sub, &ry, &rx, FALSE0))
	{
	  for (i = 0; i < menu->nitems; i++)
	    {
	      err = _nc_menu_cursor_pos(menu, menu->items[i],
					&y, &x);
	      if (E_OK(0) == err)
		{
		  if ((ry == y) &&
		      (rx >= x) &&
		      (rx < x + menu->itemlen))
		    {
		      item = menu->items[i];
		      result = E_OK(0);
		      break;
		    }
		}
	    }
	  if (E_OK(0) == result)
	    {	/* We found an item, now we can handle the click.
		 * A single click just positions the menu cursor
		 * to the clicked item. A double click toggles
		 * the item.
		 */
	      if (event.bstate & BUTTON1_DOUBLE_CLICKED((010L) << (((1) - 1) * 6)))
		{
		  _nc_New_TopRow_and_CurrentItem(menu,
						 my_top_row,
						 item);
		  menu_driver(menu, REQ_TOGGLE_ITEM(0777 + 13));
		  result = E_UNKNOWN_COMMAND(-8);
		}
	    }
	}
    }
}
   }
 else
   result = E_REQUEST_DENIED(-12);
}
536#endif /* NCURSES_MOUSE_VERSION */
    else
result = E_UNKNOWN_COMMAND(-8);
  }

if (E_OK(0) == result21.1
'result' is equal to E_OK
)
22
←
Taking true branch→
  {
    /* Adjust the top row if it turns out that the current item unfortunately
       doesn't appear in the menu window */
    if (item->y < my_top_row)
23
←
Access to field 'y' results in a dereference of a null pointer (loaded from variable 'item')
my_top_row = item->y;
    else if (item->y >= (my_top_row + menu->arows))
my_top_row = item->y - menu->arows + 1;

    _nc_New_TopRow_and_CurrentItem(menu, my_top_row, item);

  }

RETURN(result)return( ((*__errno())=(result)) );
555}

557/* m_driver.c ends here */