/usr/src/usr.bin/sed/compile.c

Bug Summary

File:	src/usr.bin/sed/compile.c
Warning:	line 701, column 7 Dereference of null pointer (loaded from variable 's')

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name compile.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.bin/sed/obj -resource-dir /usr/local/lib/clang/13.0.0 -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.bin/sed/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.bin/sed/compile.c

1/*	$OpenBSD: compile.c,v 1.50 2018/12/07 14:45:40 schwarze Exp $	*/

3/*-
* Copyright (c) 1992 Diomidis Spinellis.
* Copyright (c) 1992, 1993
*	The Regents of the University of California.  All rights reserved.
*
* This code is derived from software contributed to Berkeley by
* Diomidis Spinellis of Imperial College, University of London.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of the University nor the names of its contributors
*    may be used to endorse or promote products derived from this software
*    without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

36#include <sys/types.h>
37#include <sys/stat.h>

39#include <ctype.h>
40#include <errno(*__errno()).h>
41#include <fcntl.h>
42#include <limits.h>
43#include <regex.h>
44#include <stdio.h>
45#include <stdlib.h>
46#include <string.h>

48#include "defs.h"
49#include "extern.h"

51#define LHSZ128	128
52#define	LHMASK(128 - 1)	(LHSZ128 - 1)
53static struct labhash {
struct	labhash *lh_next;
u_int	lh_hash;
struct	s_command *lh_cmd;
int	lh_ref;
58} *labels[LHSZ128];

60static char	 *compile_addr(char *, struct s_addr *);
61static char	 *compile_ccl(char **, char *);
62static char	 *compile_delimited(char *, char *);
63static char	 *compile_flags(char *, struct s_subst *);
64static char	 *compile_re(char *, regex_t **);
65static char	 *compile_subst(char *, struct s_subst *);
66static char	 *compile_text(void);
67static char	 *compile_tr(char *, char **);
68static struct s_command
**compile_stream(struct s_command **);
70static char	 *duptoeol(char *, char *, char **);
71static void	  enterlabel(struct s_command *);
72static struct s_command
 *findlabel(char *);
74static void	  fixuplabel(struct s_command *, struct s_command *);
75static void	  uselabel(void);

77/*
* Command specification.  This is used to drive the command parser.
*/
80struct s_format {
char code;				/* Command code */
int naddr;				/* Number of address args */
enum e_args args;			/* Argument type */
84};

86static struct s_format cmd_fmts[] = {
{'{', 2, GROUP},
{'}', 0, ENDGROUP},
{'a', 1, TEXT},
{'b', 2, BRANCH},
{'c', 2, TEXT},
{'d', 2, EMPTY},
{'D', 2, EMPTY},
{'g', 2, EMPTY},
{'G', 2, EMPTY},
{'h', 2, EMPTY},
{'H', 2, EMPTY},
{'i', 1, TEXT},
{'l', 2, EMPTY},
{'n', 2, EMPTY},
{'N', 2, EMPTY},
{'p', 2, EMPTY},
{'P', 2, EMPTY},
{'q', 1, EMPTY},
{'r', 1, RFILE},
{'s', 2, SUBST},
{'t', 2, BRANCH},
{'w', 2, WFILE},
{'x', 2, EMPTY},
{'y', 2, TR},
{'!', 2, NONSEL},
{':', 0, LABEL},
{'#', 0, COMMENT},
{'=', 1, EMPTY},
{'\0', 0, COMMENT},
116};

118/* The compiled program. */
119struct s_command *prog;

121/*
* Compile the program into prog.
* Initialise appends.
*/
125void
126compile(void)
127{
*compile_stream(&prog) = NULL((void *)0);
fixuplabel(prog, NULL((void *)0));
uselabel();
appends = xreallocarray(NULL((void *)0), appendnum, sizeof(struct s_appends));
match = xreallocarray(NULL((void *)0), maxnsub + 1, sizeof(regmatch_t));
133}

135#define EATSPACE()do { if (p) while (isascii((unsigned char)*p) && isspace
((unsigned char)*p)) p++; } while (0) do {							\
if (p)								\
while (isascii((unsigned char)*p) &&			\
    isspace((unsigned char)*p))				\
	p++;						\
} while (0)

142static struct s_command **
143compile_stream(struct s_command **link)
144{
char *p;
static char *lbuf;	/* To avoid excessive malloc calls */
static size_t bufsize;
struct s_command *cmd, *cmd2, *stack;
struct s_format *fp;
int naddr;				/* Number of addresses */

stack = 0;
for (;;) {
1
Loop condition is true.  Entering loop body→
if ((p = cu_fgets(&lbuf, &bufsize)) == NULL((void *)0)) {
2
←
Assuming the condition is false→
3
←
Taking false branch→
	if (stack != 0)
		error(COMPILE2, "unexpected EOF (pending }'s)");
	return (link);
}

160semicolon:	EATSPACE()do { if (p) while (isascii((unsigned char)*p) && isspace
((unsigned char)*p)) p++; } while (0);
4
←
Taking true branch→
5
←
Loop condition is false.  Exiting loop→
if (*p == '#' || *p == '\0')
6
←
Taking false branch→
	continue;
if (*p == ';') {
7
←
Taking false branch→
	p++;
	goto semicolon;
}
*link = cmd = xmalloc(sizeof(struct s_command));
link = &cmd->next;
cmd->nonsel = cmd->inrange = 0;
/* First parse the addresses */
naddr = 0;

173/* Valid characters to start an address */
174#define	addrchar(c)(strchr("0123456789/\\$", (c)))	(strchr("0123456789/\\$", (c)))
if (addrchar(*p)(strchr("0123456789/\\$", (*p)))) {
8
←
Assuming the condition is false→
9
←
Taking false branch→
	naddr++;
	cmd->a1 = xmalloc(sizeof(struct s_addr));
	p = compile_addr(p, cmd->a1);
	EATSPACE()do { if (p) while (isascii((unsigned char)*p) && isspace
((unsigned char)*p)) p++; } while (0);				/* EXTENSION */
	if (*p == ',') {
		p++;
		EATSPACE()do { if (p) while (isascii((unsigned char)*p) && isspace
((unsigned char)*p)) p++; } while (0);			/* EXTENSION */
		naddr++;
		cmd->a2 = xmalloc(sizeof(struct s_addr));
		p = compile_addr(p, cmd->a2);
		EATSPACE()do { if (p) while (isascii((unsigned char)*p) && isspace
((unsigned char)*p)) p++; } while (0);
	} else {
		cmd->a2 = 0;
	}
} else {
	cmd->a1 = cmd->a2 = 0;
}

194nonsel:		/* Now parse the command */
if (!*p)
10
←
Taking false branch→
	error(COMPILE2, "command expected");
cmd->code = *p;
for (fp = cmd_fmts; fp->code; fp++)
11
←
Loop condition is true.  Entering loop body→
	if (fp->code == *p)
12
←
Assuming the condition is true→
13
←
Taking true branch→
		break;
14
←
 Execution continues on line 201→
if (!fp->code14.1
Field 'code' is not equal to 0
)
15
←
Taking false branch→
	error(COMPILE2, "invalid command code %c", *p);
if (naddr > fp->naddr)
16
←
Assuming 'naddr' is <= field 'naddr'→
17
←
Taking false branch→
	error(COMPILE2,
	    "command %c expects up to %d address(es), found %d",
	    *p, fp->naddr, naddr);
switch (fp->args) {
18
←
Control jumps to 'case TEXT:'  at line 246→
case NONSEL:			/* ! */
	p++;
	EATSPACE()do { if (p) while (isascii((unsigned char)*p) && isspace
((unsigned char)*p)) p++; } while (0);
	cmd->nonsel = 1;
	goto nonsel;
case GROUP:			/* { */
	p++;
	EATSPACE()do { if (p) while (isascii((unsigned char)*p) && isspace
((unsigned char)*p)) p++; } while (0);
	cmd->next = stack;
	stack = cmd;
	link = &cmd->u.c;
	if (*p)
		goto semicolon;
	break;
case ENDGROUP:
	/*
	 * Short-circuit command processing, since end of
	 * group is really just a noop.
	 */
	cmd->nonsel = 1;
	if (stack == 0)
		error(COMPILE2, "unexpected }");
	cmd2 = stack;
	stack = cmd2->next;
	cmd2->next = cmd;
	/*FALLTHROUGH*/
case EMPTY:		/* d D g G h H l n N p P q x = \0 */
	p++;
	EATSPACE()do { if (p) while (isascii((unsigned char)*p) && isspace
((unsigned char)*p)) p++; } while (0);
	if (*p == ';') {
		p++;
		link = &cmd->next;
		goto semicolon;
	}
	if (*p)
		error(COMPILE2,
244"extra characters at the end of %c command", cmd->code);
	break;
case TEXT:			/* a c i */
	p++;
	EATSPACE()do { if (p) while (isascii((unsigned char)*p) && isspace
((unsigned char)*p)) p++; } while (0);
19
←
Taking true branch→
20
←
Loop condition is false. Execution continues on line 248→
21
←
Loop condition is false.  Exiting loop→
	if (*p != '\\')
22
←
Assuming the condition is false→
23
←
Taking false branch→
		error(COMPILE2, "command %c expects \\ followed by"
		    " text", cmd->code);
	p++;
	EATSPACE()do { if (p) while (isascii((unsigned char)*p) && isspace
((unsigned char)*p)) p++; } while (0);
24
←
Taking true branch→
25
←
Loop condition is false. Execution continues on line 253→
26
←
Loop condition is false.  Exiting loop→
	if (*p)
27
←
Assuming the condition is false→
28
←
Taking false branch→
		error(COMPILE2, "extra characters after \\ at the"
		    " end of %c command", cmd->code);
	cmd->t = compile_text();
29
←
Calling 'compile_text'→
	break;
case COMMENT:			/* \0 # */
	break;
case WFILE:			/* w */
	p++;
	EATSPACE()do { if (p) while (isascii((unsigned char)*p) && isspace
((unsigned char)*p)) p++; } while (0);
	if (*p == '\0')
		error(COMPILE2, "filename expected");
	cmd->t = duptoeol(p, "w command", NULL((void *)0));
	if (aflag) {
		cmd->u.fd = -1;
		pledge_wpath = 1;
	}
	else if ((cmd->u.fd = open(p,
	    O_WRONLY0x0001|O_APPEND0x0008|O_CREAT0x0200|O_TRUNC0x0400,
	    DEFFILEMODE(0000400|0000200|0000040|0000020|0000004|0000002))) == -1)
		error(FATAL1, "%s: %s", p, strerror(errno(*__errno())));
	break;
case RFILE:			/* r */
	pledge_rpath = 1;
	p++;
	EATSPACE()do { if (p) while (isascii((unsigned char)*p) && isspace
((unsigned char)*p)) p++; } while (0);
	if (*p == '\0')
		error(COMPILE2, "filename expected");
	cmd->t = duptoeol(p, "read command", NULL((void *)0));
	break;
case BRANCH:			/* b t */
	p++;
	EATSPACE()do { if (p) while (isascii((unsigned char)*p) && isspace
((unsigned char)*p)) p++; } while (0);
	if (*p == '\0' || *p == ';')
		cmd->t = NULL((void *)0);
	else
		cmd->t = duptoeol(p, "branch", &p);
	if (*p == ';') {
		p++;
		goto semicolon;
	}
	break;
case LABEL:			/* : */
	p++;
	EATSPACE()do { if (p) while (isascii((unsigned char)*p) && isspace
((unsigned char)*p)) p++; } while (0);
	cmd->t = duptoeol(p, "label", &p);
	if (strlen(cmd->t) == 0)
		error(COMPILE2, "empty label");
	enterlabel(cmd);
	if (*p == ';') {
		p++;
		goto semicolon;
	}
	break;
case SUBST:			/* s */
	p++;
	if (*p == '\0' || *p == '\\')
		error(COMPILE2, "substitute pattern can not be"
		    " delimited by newline or backslash");
	cmd->u.s = xmalloc(sizeof(struct s_subst));
	p = compile_re(p, &cmd->u.s->re);
	if (p == NULL((void *)0))
		error(COMPILE2, "unterminated substitute pattern");
	--p;
	p = compile_subst(p, cmd->u.s);
	p = compile_flags(p, cmd->u.s);
	EATSPACE()do { if (p) while (isascii((unsigned char)*p) && isspace
((unsigned char)*p)) p++; } while (0);
	if (*p == ';') {
		p++;
		link = &cmd->next;
		goto semicolon;
	}
	break;
case TR:			/* y */
	p++;
	p = compile_tr(p, (char **)&cmd->u.y);
	EATSPACE()do { if (p) while (isascii((unsigned char)*p) && isspace
((unsigned char)*p)) p++; } while (0);
	if (*p == ';') {
		p++;
		link = &cmd->next;
		goto semicolon;
	}
	if (*p)
		error(COMPILE2, "extra text at the end of a"
		    " transform command");
	break;
}
}
342}

344/*
* Get a delimited string.  P points to the delimeter of the string; d points
* to a buffer area.  Newline and delimiter escapes are processed; other
* escapes are ignored.
*
* Returns a pointer to the first character after the final delimiter or NULL
* in the case of a non-terminated string.  The character array d is filled
* with the processed string.
*/
353static char *
354compile_delimited(char *p, char *d)
355{
char c;

c = *p++;
if (c == '\0')
return (NULL((void *)0));
else if (c == '\\')
error(COMPILE2, "\\ can not be used as a string delimiter");
else if (c == '\n')
error(COMPILE2, "newline can not be used as a string delimiter");

while (p[0]) {
/* Unescaped delimiter: We are done. */
if (p[0] == c) {
	*d = '\0';
	return p + 1;
}
if (p[0] == '\\') {
	/* Escaped delimiter: Skip the backslash. */
	if (p[1] == c) {
		p++;
	} else {
		/* Backslash-n: Match linefeed. */
		if (p[1] == 'n') {
			*d++ = '\n';
			p += 2;
		/* Other escapes remain unchanged. */
		} else {
			*d++ = *p++;
			*d++ = *p++;
		}
		continue;
	}
}
if (p[0] != '[')
	*d++ = *p++;
/*
 * Bracket expression:
 * It may contain the delimiter without escaping.
 */
else if ((d = compile_ccl(&p, d)) == NULL((void *)0))
	error(COMPILE2, "unbalanced brackets ([])");
}
return NULL((void *)0);
399}


402/* compile_ccl: expand a POSIX character class */
403static char *
404compile_ccl(char **sp, char *t)
405{
int c, d;
char *s = *sp;

*t++ = *s++;
if (*s == '^')
*t++ = *s++;
if (*s == ']')
*t++ = *s++;
for (; *s && (*t = *s) != ']'; s++, t++)
if (*s == '[' && ((d = *(s+1)) == '.' || d == ':' || d == '=')) {
	*++t = *++s, t++, s++;
	for (c = *s; (*t = *s) != ']' || c != d; s++, t++)
		if ((c = *s) == '\0')
			return NULL((void *)0);
} else if (*s == '\\' && s[1] == 'n') {
	*t = '\n';
	s++;
}
if (*s == ']') {
*sp = ++s;
return (++t);
} else {
return (NULL((void *)0));
}
430}

432/*
* Get a regular expression.  P points to the delimiter of the regular
* expression; repp points to the address of a regexp pointer.  Newline
* and delimiter escapes are processed; other escapes are ignored.
* Returns a pointer to the first character after the final delimiter
* or NULL in the case of a non terminated regular expression.  The regexp
* pointer is set to the compiled regular expression.
* Cflags are passed to regcomp.
*/
441static char *
442compile_re(char *p, regex_t **repp)
443{
int eval;
char *re;

re = xmalloc(strlen(p) + 1); /* strlen(re) <= strlen(p) */
p = compile_delimited(p, re);
if (p && strlen(re) == 0) {
*repp = NULL((void *)0);
free(re);
return (p);
}
*repp = xmalloc(sizeof(regex_t));
if (p && (eval = regcomp(*repp, re, Eflag ? REG_EXTENDED0001 : 0)) != 0)
error(COMPILE2, "RE error: %s", strregerror(eval, *repp));
if (maxnsub < (*repp)->re_nsub)
maxnsub = (*repp)->re_nsub;
free(re);
return (p);
461}

463/*
* Compile the substitution string of a regular expression and set res to
* point to a saved copy of it.  Nsub is the number of parenthesized regular
* expressions.
*/
468static char *
469compile_subst(char *p, struct s_subst *s)
470{
static char *lbuf;
static size_t bufsize;
size_t asize, ref, size;
char c, *text, *op, *sp;
int sawesc = 0;

c = *p++;			/* Terminator character */
if (c == '\0')
return (NULL((void *)0));

s->maxbref = 0;
s->linenum = linenum;
text = NULL((void *)0);
asize = size = 0;
do {
size_t len = ROUNDLEN(strlen(p) + 1)(((strlen(p) + 1) + 2048 - 1) & ~(2048 - 1));
if (asize - size < len) {
	do {
		asize += len;
	} while (asize - size < len);
	text = xrealloc(text, asize);
}
op = sp = text + size;
for (; *p; p++) {
	if (*p == '\\' || sawesc) {
		/*
		 * If this is a continuation from the last
		 * buffer, we won't have a character to
		 * skip over.
		 */
		if (sawesc)
			sawesc = 0;
		else
			p++;

		if (*p == '\0') {
			/*
			 * This escaped character is continued
			 * in the next part of the line.  Note
			 * this fact, then cause the loop to
			 * exit w/ normal EOL case and reenter
			 * above with the new buffer.
			 */
			sawesc = 1;
			p--;
			continue;
		} else if (strchr("123456789", *p) != NULL((void *)0)) {
			*sp++ = '\\';
			ref = *p - '0';
			if (s->re != NULL((void *)0) &&
			    ref > s->re->re_nsub)
				error(COMPILE2,
523"\\%c not defined in the RE", *p);
			if (s->maxbref < ref)
				s->maxbref = ref;
		} else if (*p == '&' || *p == '\\')
			*sp++ = '\\';
	} else if (*p == c) {
		p++;
		*sp++ = '\0';
		size += sp - op;
		s->new = xrealloc(text, size);
		return (p);
	} else if (*p == '\n') {
		error(COMPILE2,
536"unescaped newline inside substitute pattern");
	}
	*sp++ = *p;
}
size += sp - op;
} while ((p = cu_fgets(&lbuf, &bufsize)));
error(COMPILE2, "unterminated substitute in regular expression");
543}

545/*
* Compile the flags of the s command
*/
548static char *
549compile_flags(char *p, struct s_subst *s)
550{
int gn;			/* True if we have seen g or n */
long l;

s->n = 1;				/* Default */
s->p = 0;
s->wfile = NULL((void *)0);
s->wfd = -1;
for (gn = 0;;) {
EATSPACE()do { if (p) while (isascii((unsigned char)*p) && isspace
((unsigned char)*p)) p++; } while (0);			/* EXTENSION */
switch (*p) {
case 'g':
	if (gn)
		error(COMPILE2, "more than one number or 'g' in"
		    " substitute flags");
	gn = 1;
	s->n = 0;
	break;
case '\0':
case '\n':
case ';':
	return (p);
case 'p':
	s->p = 1;
	break;
case '1': case '2': case '3':
case '4': case '5': case '6':
case '7': case '8': case '9':
	if (gn)
		error(COMPILE2, "more than one number or 'g' in"
		    " substitute flags");
	gn = 1;
	l = strtol(p, &p, 10);
	if (l <= 0 || l >= INT_MAX2147483647)
		error(COMPILE2,
		    "number in substitute flags out of range");
	s->n = (int)l;
	continue;
case 'w':
	p++;
	EATSPACE()do { if (p) while (isascii((unsigned char)*p) && isspace
((unsigned char)*p)) p++; } while (0);
	if (*p == '\0')
		error(COMPILE2, "filename expected");
	s->wfile = duptoeol(p, "s command w flag", NULL((void *)0));
	*p = '\0';
	if (aflag)
		pledge_wpath = 1;
	else if ((s->wfd = open(s->wfile,
	    O_WRONLY0x0001|O_APPEND0x0008|O_CREAT0x0200|O_TRUNC0x0400,
	    DEFFILEMODE(0000400|0000200|0000040|0000020|0000004|0000002))) == -1)
		error(FATAL1, "%s: %s", s->wfile, strerror(errno(*__errno())));
	return (p);
default:
	error(COMPILE2,
	    "bad flag in substitute command: '%c'", *p);
	break;
}
p++;
}
609}

611/*
* Compile a translation set of strings into a lookup table.
*/
614static char *
615compile_tr(char *old, char **transtab)
616{
int i;
char delimiter, check[UCHAR_MAX(127*2 +1) + 1];
char *new, *end;

memset(check, 0, sizeof(check));
delimiter = *old;
if (delimiter == '\\')
error(COMPILE2, "\\ can not be used as a string delimiter");
else if (delimiter == '\n' || delimiter == '\0')
error(COMPILE2, "newline can not be used as a string delimiter");

new = old++;
do {
if ((new = strchr(new + 1, delimiter)) == NULL((void *)0))
	error(COMPILE2, "unterminated transform source string");
} while (*(new - 1) == '\\' && *(new -2) != '\\');
*new = '\0';
end = new++;
do {
if ((end = strchr(end + 1, delimiter)) == NULL((void *)0))
	error(COMPILE2, "unterminated transform target string");
} while (*(end -1) == '\\' && *(end -2) != '\\');
*end = '\0';

/* We assume characters are 8 bits */
*transtab = xmalloc(UCHAR_MAX(127*2 +1) + 1);
for (i = 0; i <= UCHAR_MAX(127*2 +1); i++)
(*transtab)[i] = (char)i;

while (*old != '\0' && *new != '\0') {
if (*old == '\\') {
	old++;
	if (*old == 'n')
		*old = '\n';
	else if (*old != delimiter && *old != '\\')
		error(COMPILE2, "Unexpected character after "
		    "backslash");
}
if (*new == '\\') {
	new++;
	if (*new == 'n')
		*new = '\n';
	else if (*new != delimiter && *new != '\\')
		error(COMPILE2, "Unexpected character after "
		    "backslash");
}
if (check[(u_char) *old] == 1)
	error(COMPILE2, "Repeated character in source string");
check[(u_char) *old] = 1;
(*transtab)[(u_char) *old++] = *new++;
}
if (*old != '\0' || *new != '\0')
error(COMPILE2, "transform strings are not the same length");
return end + 1;
671}

673/*
* Compile the text following an a, c, or i command.
*/
676static char *
677compile_text(void)
678{
size_t asize, size, bufsize;
char *lbuf, *text, *p, *op, *s;
int esc_nl;

lbuf = text = NULL((void *)0);
30
←
Null pointer value stored to 'text'→
asize = size = 0;
while ((p = cu_fgets(&lbuf, &bufsize))) {
31
←
Loop condition is true.  Entering loop body→
size_t len = ROUNDLEN(strlen(p) + 1)(((strlen(p) + 1) + 2048 - 1) & ~(2048 - 1));
if (asize - size < len) {
32
←
Assuming the condition is false→
33
←
Taking false branch→
	do {
		asize += len;
	} while (asize - size < len);
	text = xrealloc(text, asize);
}
op = s = text + size;
34
←
Null pointer value stored to 's'→
for (esc_nl = 0; *p != '\0'; p++) {
35
←
Assuming the condition is false→
36
←
Loop condition is false. Execution continues on line 699→
	if (*p == '\\' && p[1] != '\0' && *++p == '\n')
		esc_nl = 1;
	*s++ = *p;
}
size += s - op;
if (!esc_nl36.1
'esc_nl' is 0
) {
37
←
Taking true branch→
	*s = '\0';
38
←
Dereference of null pointer (loaded from variable 's')
	break;
}
}
free(lbuf);
text = xrealloc(text, size + 1);
text[size] = '\0';
return (text);
709}

711/*
* Get an address and return a pointer to the first character after
* it.  Fill the structure pointed to according to the address.
*/
715static char *
716compile_addr(char *p, struct s_addr *a)
717{
char *end;

switch (*p) {
case '\\':				/* Context address */
++p;
/* FALLTHROUGH */
case '/':				/* Context address */
p = compile_re(p, &a->u.r);
if (p == NULL((void *)0))
	error(COMPILE2, "unterminated regular expression");
a->type = AT_RE;
return (p);

case '$':				/* Last line */
a->type = AT_LAST;
return (p + 1);
				/* Line number */
case '0': case '1': case '2': case '3': case '4':
case '5': case '6': case '7': case '8': case '9':
a->type = AT_LINE;
a->u.l = strtoul(p, &end, 10);
return (end);
default:
error(COMPILE2, "expected context address");
return (NULL((void *)0));
}
744}

746/*
* duptoeol --
*	Return a copy of all the characters up to \n or \0.
*/
750static char *
751duptoeol(char *s, char *ctype, char **semi)
752{
size_t len;
int ws;
char *start;

ws = 0;
if (semi) {
for (start = s; *s != '\0' && *s != '\n' && *s != ';'; ++s)
	ws = isspace((unsigned char)*s);
} else {
for (start = s; *s != '\0' && *s != '\n'; ++s)
	ws = isspace((unsigned char)*s);
*s = '\0';
}
if (ws)
warning("whitespace after %s", ctype);
len = s - start + 1;
if (semi)
*semi = s;
s = xmalloc(len);
strlcpy(s, start, len);
return (s);
774}

776/*
* Convert goto label names to addresses, and count a and r commands, in
* the given subset of the script.  Free the memory used by labels in b
* and t commands (but not by :).
*
* TODO: Remove } nodes
*/
783static void
784fixuplabel(struct s_command *cp, struct s_command *end)
785{

for (; cp != end; cp = cp->next)
switch (cp->code) {
case 'a':
case 'r':
	appendnum++;
	break;
case 'b':
case 't':
	/* Resolve branch target. */
	if (cp->t == NULL((void *)0)) {
		cp->u.c = NULL((void *)0);
		break;
	}
	if ((cp->u.c = findlabel(cp->t)) == NULL((void *)0))
		error(COMPILE2, "undefined label '%s'", cp->t);
	free(cp->t);
	break;
case '{':
	/* Do interior commands. */
	fixuplabel(cp->u.c, cp->next);
	break;
}
809}

811/*
* Associate the given command label for later lookup.
*/
814static void
815enterlabel(struct s_command *cp)
816{
struct labhash **lhp, *lh;
u_char *p;
u_int h, c;

for (h = 0, p = (u_char *)cp->t; (c = *p) != 0; p++)
h = (h << 5) + h + c;
lhp = &labels[h & LHMASK(128 - 1)];
for (lh = *lhp; lh != NULL((void *)0); lh = lh->lh_next)
if (lh->lh_hash == h && strcmp(cp->t, lh->lh_cmd->t) == 0)
	error(COMPILE2, "duplicate label '%s'", cp->t);
lh = xmalloc(sizeof *lh);
lh->lh_next = *lhp;
lh->lh_hash = h;
lh->lh_cmd = cp;
lh->lh_ref = 0;
*lhp = lh;
833}

835/*
* Find the label contained in the command l in the command linked
* list cp.  L is excluded from the search.  Return NULL if not found.
*/
839static struct s_command *
840findlabel(char *name)
841{
struct labhash *lh;
u_char *p;
u_int h, c;

for (h = 0, p = (u_char *)name; (c = *p) != 0; p++)
h = (h << 5) + h + c;
for (lh = labels[h & LHMASK(128 - 1)]; lh != NULL((void *)0); lh = lh->lh_next) {
if (lh->lh_hash == h && strcmp(name, lh->lh_cmd->t) == 0) {
	lh->lh_ref = 1;
	return (lh->lh_cmd);
}
}
return (NULL((void *)0));
855}

857/*
* Warn about any unused labels.  As a side effect, release the label hash
* table space.
*/
861static void
862uselabel(void)
863{
struct labhash *lh, *next;
int i;

for (i = 0; i < LHSZ128; i++) {
for (lh = labels[i]; lh != NULL((void *)0); lh = next) {
	next = lh->lh_next;
	if (!lh->lh_ref)
		warning("unused label '%s'",
		    lh->lh_cmd->t);
	free(lh);
}
}
876}