Bug Summary

File:src/gnu/lib/libreadline/kill.c
Warning:line 138, column 17
Null pointer passed as 1st argument to string length function

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name kill.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/gnu/lib/libreadline/obj -resource-dir /usr/local/lib/clang/13.0.0 -D HAVE_CONFIG_H -I /usr/src/gnu/lib/libreadline -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/gnu/lib/libreadline/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/gnu/lib/libreadline/kill.c
1/* kill.c -- kill ring management. */
2
3/* Copyright (C) 1994 Free Software Foundation, Inc.
4
5 This file is part of the GNU Readline Library, a library for
6 reading lines of text with interactive input and history editing.
7
8 The GNU Readline Library is free software; you can redistribute it
9 and/or modify it under the terms of the GNU General Public License
10 as published by the Free Software Foundation; either version 2, or
11 (at your option) any later version.
12
13 The GNU Readline Library is distributed in the hope that it will be
14 useful, but WITHOUT ANY WARRANTY; without even the implied warranty
15 of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 The GNU General Public License is often shipped with GNU software, and
19 is generally kept in a file called COPYING or LICENSE. If you do not
20 have a copy of the license, write to the Free Software Foundation,
21 59 Temple Place, Suite 330, Boston, MA 02111 USA. */
22#define READLINE_LIBRARY
23
24#if defined (HAVE_CONFIG_H1)
25# include <config.h>
26#endif
27
28#include <sys/types.h>
29
30#if defined (HAVE_UNISTD_H1)
31# include <unistd.h> /* for _POSIX_VERSION */
32#endif /* HAVE_UNISTD_H */
33
34#if defined (HAVE_STDLIB_H1)
35# include <stdlib.h>
36#else
37# include "ansi_stdlib.h"
38#endif /* HAVE_STDLIB_H */
39
40#include <stdio.h>
41
42/* System-specific feature definitions and include files. */
43#include "rldefs.h"
44
45/* Some standard library routines. */
46#include "readline.h"
47#include "history.h"
48
49#include "rlprivate.h"
50#include "xmalloc.h"
51
52/* **************************************************************** */
53/* */
54/* Killing Mechanism */
55/* */
56/* **************************************************************** */
57
58/* What we assume for a max number of kills. */
59#define DEFAULT_MAX_KILLS10 10
60
61/* The real variable to look at to find out when to flush kills. */
62static int rl_max_kills = DEFAULT_MAX_KILLS10;
63
64/* Where to store killed text. */
65static char **rl_kill_ring = (char **)NULL((void *)0);
66
67/* Where we are in the kill ring. */
68static int rl_kill_index;
69
70/* How many slots we have in the kill ring. */
71static int rl_kill_ring_length;
72
73static int _rl_copy_to_kill_ring PARAMS((char *, int))(char *, int);
74static int region_kill_internal PARAMS((int))(int);
75static int _rl_copy_word_as_kill PARAMS((int, int))(int, int);
76static int rl_yank_nth_arg_internal PARAMS((int, int, int))(int, int, int);
77
78/* How to say that you only want to save a certain amount
79 of kill material. */
80int
81rl_set_retained_kills (num)
82 int num;
83{
84 return 0;
85}
86
87/* Add TEXT to the kill ring, allocating a new kill ring slot as necessary.
88 This uses TEXT directly, so the caller must not free it. If APPEND is
89 non-zero, and the last command was a kill, the text is appended to the
90 current kill ring slot, otherwise prepended. */
91static int
92_rl_copy_to_kill_ring (text, append)
93 char *text;
94 int append;
95{
96 char *old, *new;
97 int slot;
98
99 /* First, find the slot to work with. */
100 if (_rl_last_command_was_kill == 0)
12
←
Assuming '_rl_last_command_was_kill' is equal to 0
→
13
←
Taking true branch
→
101 {
102 /* Get a new slot. */
103 if (rl_kill_ring == 0)
14
←
Assuming 'rl_kill_ring' is equal to null
→
15
←
Taking true branch
→
104 {
105 /* If we don't have any defined, then make one. */
106 rl_kill_ring = (char **)
107 xmalloc (((rl_kill_ring_length = 1) + 1) * sizeof (char *));
108 rl_kill_ring[slot = 0] = (char *)NULL((void *)0);
16
←
The value 0 is assigned to 'slot'
→
17
←
Storing null pointer value
→
109 }
110 else
111 {
112 /* We have to add a new slot on the end, unless we have
113 exceeded the max limit for remembering kills. */
114 slot = rl_kill_ring_length;
115 if (slot == rl_max_kills)
116 {
117 register int i;
118 free (rl_kill_ring[0]);
119 for (i = 0; i < slot; i++)
120 rl_kill_ring[i] = rl_kill_ring[i + 1];
121 }
122 else
123 {
124 slot = rl_kill_ring_length += 1;
125 rl_kill_ring = (char **)xrealloc (rl_kill_ring, slot * sizeof (char *));
126 }
127 rl_kill_ring[--slot] = (char *)NULL((void *)0);
128 }
129 }
130 else
131 slot = rl_kill_ring_length - 1;
132
133 /* If the last command was a kill, prepend or append. */
134 if (_rl_last_command_was_kill && rl_editing_mode != vi_mode0)
18
←
Assuming '_rl_last_command_was_kill' is not equal to 0
→
19
←
Assuming 'rl_editing_mode' is not equal to vi_mode
→
20
←
Taking true branch
→
135 {
136 int len;
137 old = rl_kill_ring[slot];
21
←
Null pointer value stored to 'old'
→
138 len = 1 + strlen (old) + strlen (text);
22
←
Null pointer passed as 1st argument to string length function
139 new = (char *)xmalloc (len);
140
141 if (append)
142 {
143 strlcpy (new, old, len);
144 strlcat (new, text, len);
145 }
146 else
147 {
148 strlcpy (new, text, len);
149 strlcat (new, old, len);
150 }
151 free (old);
152 free (text);
153 rl_kill_ring[slot] = new;
154 }
155 else
156 rl_kill_ring[slot] = text;
157
158 rl_kill_index = slot;
159 return 0;
160}
161
162/* The way to kill something. This appends or prepends to the last
163 kill, if the last command was a kill command. if FROM is less
164 than TO, then the text is appended, otherwise prepended. If the
165 last command was not a kill command, then a new slot is made for
166 this kill. */
167int
168rl_kill_text (from, to)
169 int from, to;
170{
171 char *text;
172
173 /* Is there anything to kill? */
174 if (from == to)
175 {
176 _rl_last_command_was_kill++;
177 return 0;
178 }
179
180 text = rl_copy_text (from, to);
181
182 /* Delete the copied text from the line. */
183 rl_delete_text (from, to);
184
185 _rl_copy_to_kill_ring (text, from < to);
186
187 _rl_last_command_was_kill++;
188 return 0;
189}
190
191/* Now REMEMBER! In order to do prepending or appending correctly, kill
192 commands always make rl_point's original position be the FROM argument,
193 and rl_point's extent be the TO argument. */
194
195/* **************************************************************** */
196/* */
197/* Killing Commands */
198/* */
199/* **************************************************************** */
200
201/* Delete the word at point, saving the text in the kill ring. */
202int
203rl_kill_word (count, key)
204 int count, key;
205{
206 int orig_point;
207
208 if (count < 0)
209 return (rl_backward_kill_word (-count, key));
210 else
211 {
212 orig_point = rl_point;
213 rl_forward_word (count, key);
214
215 if (rl_point != orig_point)
216 rl_kill_text (orig_point, rl_point);
217
218 rl_point = orig_point;
219 if (rl_editing_mode == emacs_mode1)
220 rl_mark = rl_point;
221 }
222 return 0;
223}
224
225/* Rubout the word before point, placing it on the kill ring. */
226int
227rl_backward_kill_word (count, ignore)
228 int count, ignore;
229{
230 int orig_point;
231
232 if (count < 0)
233 return (rl_kill_word (-count, ignore));
234 else
235 {
236 orig_point = rl_point;
237 rl_backward_word (count, ignore);
238
239 if (rl_point != orig_point)
240 rl_kill_text (orig_point, rl_point);
241
242 if (rl_editing_mode == emacs_mode1)
243 rl_mark = rl_point;
244 }
245 return 0;
246}
247
248/* Kill from here to the end of the line. If DIRECTION is negative, kill
249 back to the line start instead. */
250int
251rl_kill_line (direction, ignore)
252 int direction, ignore;
253{
254 int orig_point;
255
256 if (direction < 0)
257 return (rl_backward_kill_line (1, ignore));
258 else
259 {
260 orig_point = rl_point;
261 rl_end_of_line (1, ignore);
262 if (orig_point != rl_point)
263 rl_kill_text (orig_point, rl_point);
264 rl_point = orig_point;
265 if (rl_editing_mode == emacs_mode1)
266 rl_mark = rl_point;
267 }
268 return 0;
269}
270
271/* Kill backwards to the start of the line. If DIRECTION is negative, kill
272 forwards to the line end instead. */
273int
274rl_backward_kill_line (direction, ignore)
275 int direction, ignore;
276{
277 int orig_point;
278
279 if (direction < 0)
280 return (rl_kill_line (1, ignore));
281 else
282 {
283 if (!rl_point)
284 rl_ding ();
285 else
286 {
287 orig_point = rl_point;
288 rl_beg_of_line (1, ignore);
289 if (rl_point != orig_point)
290 rl_kill_text (orig_point, rl_point);
291 if (rl_editing_mode == emacs_mode1)
292 rl_mark = rl_point;
293 }
294 }
295 return 0;
296}
297
298/* Kill the whole line, no matter where point is. */
299int
300rl_kill_full_line (count, ignore)
301 int count, ignore;
302{
303 rl_begin_undo_group ();
304 rl_point = 0;
305 rl_kill_text (rl_point, rl_end);
306 rl_mark = 0;
307 rl_end_undo_group ();
308 return 0;
309}
310
311/* The next two functions mimic unix line editing behaviour, except they
312 save the deleted text on the kill ring. This is safer than not saving
313 it, and since we have a ring, nobody should get screwed. */
314
315/* This does what C-w does in Unix. We can't prevent people from
316 using behaviour that they expect. */
317int
318rl_unix_word_rubout (count, key)
319 int count, key;
320{
321 int orig_point;
322
323 if (rl_point == 0)
324 rl_ding ();
325 else
326 {
327 orig_point = rl_point;
328 if (count <= 0)
329 count = 1;
330
331 while (count--)
332 {
333 while (rl_point && whitespace (rl_line_buffer[rl_point - 1])(((rl_line_buffer[rl_point - 1]) == ' ') || ((rl_line_buffer[
rl_point - 1]) == '\t')))
334 rl_point--;
335
336 while (rl_point && (whitespace (rl_line_buffer[rl_point - 1])(((rl_line_buffer[rl_point - 1]) == ' ') || ((rl_line_buffer[
rl_point - 1]) == '\t')) == 0))
337 rl_point--;
338 }
339
340 rl_kill_text (orig_point, rl_point);
341 if (rl_editing_mode == emacs_mode1)
342 rl_mark = rl_point;
343 }
344 return 0;
345}
346
347/* Here is C-u doing what Unix does. You don't *have* to use these
348 key-bindings. We have a choice of killing the entire line, or
349 killing from where we are to the start of the line. We choose the
350 latter, because if you are a Unix weenie, then you haven't backspaced
351 into the line at all, and if you aren't, then you know what you are
352 doing. */
353int
354rl_unix_line_discard (count, key)
355 int count, key;
356{
357 if (rl_point == 0)
358 rl_ding ();
359 else
360 {
361 rl_kill_text (rl_point, 0);
362 rl_point = 0;
363 if (rl_editing_mode == emacs_mode1)
364 rl_mark = rl_point;
365 }
366 return 0;
367}
368
369/* Copy the text in the `region' to the kill ring. If DELETE is non-zero,
370 delete the text from the line as well. */
371static int
372region_kill_internal (delete)
373 int delete;
374{
375 char *text;
376
377 if (rl_mark != rl_point)
7
←
Assuming 'rl_mark' is not equal to 'rl_point'
→
8
←
Taking true branch
→
378 {
379 text = rl_copy_text (rl_point, rl_mark);
380 if (delete
8.1
'delete' is 0
)
9
←
Taking false branch
→
381 rl_delete_text (rl_point, rl_mark);
382 _rl_copy_to_kill_ring (text, rl_point < rl_mark);
10
←
Assuming 'rl_point' is >= 'rl_mark'
→
11
←
Calling '_rl_copy_to_kill_ring'
→
383 }
384
385 _rl_last_command_was_kill++;
386 return 0;
387}
388
389/* Copy the text in the region to the kill ring. */
390int
391rl_copy_region_to_kill (count, ignore)
392 int count, ignore;
393{
394 return (region_kill_internal (0));
395}
396
397/* Kill the text between the point and mark. */
398int
399rl_kill_region (count, ignore)
400 int count, ignore;
401{
402 int r, npoint;
403
404 npoint = (rl_point < rl_mark) ? rl_point : rl_mark;
405 r = region_kill_internal (1);
406 _rl_fix_point (1);
407 rl_point = npoint;
408 return r;
409}
410
411/* Copy COUNT words to the kill ring. DIR says which direction we look
412 to find the words. */
413static int
414_rl_copy_word_as_kill (count, dir)
415 int count, dir;
416{
417 int om, op, r;
418
419 om = rl_mark;
420 op = rl_point;
421
422 if (dir
3.1
'dir' is > 0
 > 0)
4
←
Taking true branch
→
423 rl_forward_word (count, 0);
424 else
425 rl_backward_word (count, 0);
426
427 rl_mark = rl_point;
428
429 if (dir
4.1
'dir' is > 0
 > 0)
5
←
Taking true branch
→
430 rl_backward_word (count, 0);
431 else
432 rl_forward_word (count, 0);
433
434 r = region_kill_internal (0);
6
←
Calling 'region_kill_internal'
→
435
436 rl_mark = om;
437 rl_point = op;
438
439 return r;
440}
441
442int
443rl_copy_forward_word (count, key)
444 int count, key;
445{
446 if (count < 0)
1
Assuming 'count' is >= 0
→
2
←
Taking false branch
→
447 return (rl_copy_backward_word (-count, key));
448
449 return (_rl_copy_word_as_kill (count, 1));
3
←
Calling '_rl_copy_word_as_kill'
→
450}
451
452int
453rl_copy_backward_word (count, key)
454 int count, key;
455{
456 if (count < 0)
457 return (rl_copy_forward_word (-count, key));
458
459 return (_rl_copy_word_as_kill (count, -1));
460}
461
462/* Yank back the last killed text. This ignores arguments. */
463int
464rl_yank (count, ignore)
465 int count, ignore;
466{
467 if (rl_kill_ring == 0)
468 {
469 _rl_abort_internal ();
470 return -1;
471 }
472
473 _rl_set_mark_at_pos (rl_point);
474 rl_insert_text (rl_kill_ring[rl_kill_index]);
475 return 0;
476}
477
478/* If the last command was yank, or yank_pop, and the text just
479 before point is identical to the current kill item, then
480 delete that text from the line, rotate the index down, and
481 yank back some other text. */
482int
483rl_yank_pop (count, key)
484 int count, key;
485{
486 int l, n;
487
488 if (((rl_last_func != rl_yank_pop) && (rl_last_func != rl_yank)) ||
489 !rl_kill_ring)
490 {
491 _rl_abort_internal ();
492 return -1;
493 }
494
495 l = strlen (rl_kill_ring[rl_kill_index]);
496 n = rl_point - l;
497 if (n >= 0 && STREQN (rl_line_buffer + n, rl_kill_ring[rl_kill_index], l)(((l) == 0) ? (1) : ((rl_line_buffer + n)[0] == (rl_kill_ring
[rl_kill_index])[0]) && (strncmp ((rl_line_buffer + n
), (rl_kill_ring[rl_kill_index]), (l)) == 0)))
498 {
499 rl_delete_text (n, rl_point);
500 rl_point = n;
501 rl_kill_index--;
502 if (rl_kill_index < 0)
503 rl_kill_index = rl_kill_ring_length - 1;
504 rl_yank (1, 0);
505 return 0;
506 }
507 else
508 {
509 _rl_abort_internal ();
510 return -1;
511 }
512}
513
514/* Yank the COUNTh argument from the previous history line, skipping
515 HISTORY_SKIP lines before looking for the `previous line'. */
516static int
517rl_yank_nth_arg_internal (count, ignore, history_skip)
518 int count, ignore, history_skip;
519{
520 register HIST_ENTRY *entry;
521 char *arg;
522 int i, pos;
523
524 pos = where_history ();
525
526 if (history_skip)
527 {
528 for (i = 0; i < history_skip; i++)
529 entry = previous_history ();
530 }
531
532 entry = previous_history ();
533
534 history_set_pos (pos);
535
536 if (entry == 0)
537 {
538 rl_ding ();
539 return -1;
540 }
541
542 arg = history_arg_extract (count, count, entry->line);
543 if (!arg || !*arg)
544 {
545 rl_ding ();
546 return -1;
547 }
548
549 rl_begin_undo_group ();
550
551 _rl_set_mark_at_pos (rl_point);
552
553#if defined (VI_MODE)
554 /* Vi mode always inserts a space before yanking the argument, and it
555 inserts it right *after* rl_point. */
556 if (rl_editing_mode == vi_mode0)
557 {
558 rl_vi_append_mode (1, ignore);
559 rl_insert_text (" ");
560 }
561#endif /* VI_MODE */
562
563 rl_insert_text (arg);
564 free (arg);
565
566 rl_end_undo_group ();
567 return 0;
568}
569
570/* Yank the COUNTth argument from the previous history line. */
571int
572rl_yank_nth_arg (count, ignore)
573 int count, ignore;
574{
575 return (rl_yank_nth_arg_internal (count, ignore, 0));
576}
577
578/* Yank the last argument from the previous history line. This `knows'
579 how rl_yank_nth_arg treats a count of `$'. With an argument, this
580 behaves the same as rl_yank_nth_arg. */
581int
582rl_yank_last_arg (count, key)
583 int count, key;
584{
585 static int history_skip = 0;
586 static int explicit_arg_p = 0;
587 static int count_passed = 1;
588 static int direction = 1;
589 static int undo_needed = 0;
590 int retval;
591
592 if (rl_last_func != rl_yank_last_arg)
593 {
594 history_skip = 0;
595 explicit_arg_p = rl_explicit_arg;
596 count_passed = count;
597 direction = 1;
598 }
599 else
600 {
601 if (undo_needed)
602 rl_do_undo ();
603 if (count < 1)
604 direction = -direction;
605 history_skip += direction;
606 if (history_skip < 0)
607 history_skip = 0;
608 }
609
610 if (explicit_arg_p)
611 retval = rl_yank_nth_arg_internal (count_passed, key, history_skip);
612 else
613 retval = rl_yank_nth_arg_internal ('$', key, history_skip);
614
615 undo_needed = retval == 0;
616 return retval;
617}
618
619/* A special paste command for users of Cygnus's cygwin32. */
620#if defined (__CYGWIN__)
621#include <windows.h>
622
623int
624rl_paste_from_clipboard (count, key)
625 int count, key;
626{
627 char *data, *ptr;
628 int len;
629
630 if (OpenClipboard (NULL((void *)0)) == 0)
631 return (0);
632
633 data = (char *)GetClipboardData (CF_TEXT);
634 if (data)
635 {
636 ptr = strchr (data, '\r');
637 if (ptr)
638 {
639 len = ptr - data;
640 ptr = (char *)xmalloc (len + 1);
641 ptr[len] = '\0';
642 strncpy (ptr, data, len);
643 }
644 else
645 ptr = data;
646 _rl_set_mark_at_pos (rl_point);
647 rl_insert_text (ptr);
648 if (ptr != data)
649 free (ptr);
650 CloseClipboard ();
651 }
652 return (0);
653}
654#endif /* __CYGWIN__ */