/usr/src/usr.sbin/lpr/lpd/printjob.c

Bug Summary

File:	src/usr.sbin/lpr/lpd/printjob.c
Warning:	line 1565, column 9 Potential leak of memory pointed to by 'val'
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name printjob.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/lpr/lpd/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/usr.sbin/lpr/lpd/../common_source -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/lpr/lpd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.sbin/lpr/lpd/printjob.c
1/*	$OpenBSD: printjob.c,v 1.62 2021/10/24 21:24:18 deraadt Exp $	*/
2/*	$NetBSD: printjob.c,v 1.31 2002/01/21 14:42:30 wiz Exp $	*/

4/*
* Copyright (c) 1983, 1993
*	The Regents of the University of California.  All rights reserved.
*
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of the University nor the names of its contributors
*    may be used to endorse or promote products derived from this software
*    without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

34/*
* printjob -- print jobs in the queue.
*
*	NOTE: the lock file is used to pass information to lpq and lprm.
*	it does not need to be removed because file locks are dynamic.
*/

41#include <sys/types.h>
42#include <sys/wait.h>
43#include <sys/stat.h>

45#include <pwd.h>
46#include <unistd.h>
47#include <signal.h>
48#include <termios.h>
49#include <syslog.h>
50#include <fcntl.h>
51#include <dirent.h>
52#include <errno(*__errno()).h>
53#include <stdio.h>
54#include <string.h>
55#include <limits.h>
56#include <stdlib.h>
57#include <stdarg.h>
58#include <ctype.h>

60#include "lp.h"
61#include "lp.local.h"
62#include "pathnames.h"
63#include "extern.h"

65#define DORETURN0	0	/* absorb fork error */
66#define DOABORT1		1	/* abort if dofork fails */

68/*
* Error tokens
*/
71#define REPRINT-2		-2
72#define ERROR-1		-1
73#define	OK0		0
74#define	FATALERR1	1
75#define	NOACCT2		2
76#define	FILTERERR3	3
77#define	ACCESS4		4

79static dev_t	 fdev;		/* device of file pointed to by symlink */
80static ino_t	 fino;		/* inode of file pointed to by symlink */
81static FILE	*cfp;		/* control file */
82static pid_t	 child;		/* pid of any filters */
83static int	 lfd;		/* lock file descriptor */
84static int	 ofd;		/* output filter file descriptor */
85static pid_t	 ofilter;	/* pid of output filter, if any */
86static int	 pfd;		/* prstatic inter file descriptor */
87static pid_t	 pid;		/* pid of lpd process */
88static pid_t	 prchild;	/* pid of pr process */
89static char	 title[80];	/* ``pr'' title */
90static int	 tof;		/* true if at top of form */

92static char	class[32];		/* classification field */
93static char	fromhost[HOST_NAME_MAX255+1]; /* user's host machine */
		/* indentation size in static characters */
95static char	indent[10] = "-i0";
96static char	jobname[NAME_MAX255];	/* job or file name */
97static char	length[10] = "-l";	/* page length in lines */
98static char	logname[LOGIN_NAME_MAX32];/* user's login name */
99static char	pxlength[10] = "-y";	/* page length in pixels */
100static char	pxwidth[10] = "-x";	/* page width in pixels */
101static char	tempfile[] = "errsXXXXXXXXXX"; /* file name for filter output */
102static char	width[10] = "-w";	/* page width in static characters */

104static void       abortpr(int);
105static void       banner(char *, char *);
106static void       delay(int);
107static pid_t      dofork(int);
108static int        dropit(int);
109static void       init(void);
110static void       openpr(void);
111static void       opennet(char *);
112static void       opentty(void);
113static void       openrem(void);
114static int        print(int, char *);
115static int        printit(char *);
116static void       pstatus(const char *, ...)
__attribute__((__format__(__printf__, 1, 2)));
118static char       response(void);
119static void       scan_out(int, char *, int);
120static char      *scnline(int, char *, int);
121static int        sendfile(int, char *);
122static int        sendit(char *);
123static void       sendmail(char *, int);
124static void       setty(void);
125static void       alarmer(int);

127void
128printjob(void)
129{
struct stat stb;
struct queue *q, **qp;
struct queue **queue;
struct sigaction sa;
int i, fd, nitems;
off_t pidoff;
int errcnt, count = 0;

init();					/* set up capabilities */
(void)write(STDOUT_FILENO1, "", 1);	/* ack that daemon is started */
PRIV_STARTdo { int save_errno = (*__errno()); (void)seteuid(effective_uid
); (void)setegid(effective_gid); (*__errno()) = save_errno; }
 while (0);
1
Loop condition is false.  Exiting loop→
fd = open(LF, O_WRONLY0x0001|O_APPEND0x0008);	/* set up log file */
PRIV_ENDdo { int save_errno = (*__errno()); (void)setegid(real_gid); (
void)seteuid(real_uid); (*__errno()) = save_errno; } while (0
);
2
←
Loop condition is false.  Exiting loop→
if (fd < 0) {
3
←
Assuming 'fd' is >= 0→
4
←
Taking false branch→
syslog(LOG_ERR3, "%s: %m", LF);
if ((fd = open(_PATH_DEVNULL"/dev/null", O_WRONLY0x0001)) < 0)
	exit(1);
}
if (fd != STDERR_FILENO2) {
5
←
Assuming 'fd' is equal to STDERR_FILENO→
6
←
Taking false branch→
if (dup2(fd, STDERR_FILENO2) < 0) {
	syslog(LOG_ERR3, "dup2: %m");
	exit(1);
}
(void)close(fd);
}
setpgid(0, 0);

/* we add SIGINT to the mask so abortpr() doesn't kill itself */
memset(&sa, 0, sizeof(sa));
sa.sa_handler__sigaction_u.__sa_handler = abortpr;
sa.sa_flags = SA_RESTART0x0002;
sigemptyset(&sa.sa_mask);
sigaddset(&sa.sa_mask, SIGINT2);
sigaction(SIGHUP1, &sa, NULL((void *)0));
sigaction(SIGINT2, &sa, NULL((void *)0));
sigaction(SIGQUIT3, &sa, NULL((void *)0));
sigaction(SIGTERM15, &sa, NULL((void *)0));

/* so we can use short form file names */
if (chdir(SD) < 0) {
7
←
Assuming the condition is false→
8
←
Taking false branch→
syslog(LOG_ERR3, "%s: %m", SD);
exit(1);
}

(void)mktemp(tempfile);			/* safe */

lfd = safe_open(LO, O_WRONLY0x0001|O_CREAT0x0200|O_NOFOLLOW0x0100|O_EXLOCK0x0020, 0640);
if (lfd < 0) {
9
←
Assuming 'lfd' is >= 0→
10
←
Taking false branch→
if (errno(*__errno()) == EWOULDBLOCK35)	/* active daemon present */
	exit(0);
syslog(LOG_ERR3, "%s: %s: %m", printer, LO);
exit(1);
}
if (fstat(lfd, &stb) == 0 && (stb.st_mode & S_IXUSR0000100))
11
←
Assuming the condition is false→
exit(0);		/* printing disabled */
ftruncate(lfd, 0);
/*
* write process id for others to know
*/
pid = getpid();
if ((pidoff = i = snprintf(line, sizeof(line), "%d\n", pid)) < 0 ||
12
←
Assuming the condition is false→
14
←
Taking false branch→
   i >= sizeof(line)) {
13
←
Assuming the condition is false→
syslog(LOG_ERR3, "impossibly large pid: %u", pid);
exit(1);
}
if (write(lfd, line, i) != i) {
15
←
Assuming the condition is false→
16
←
Taking false branch→
syslog(LOG_ERR3, "%s: %s: %m", printer, LO);
exit(1);
}
/*
* search the spool directory for work and sort by queue order.
*/
if ((nitems = getq(&queue)) < 0) {
17
←
Assuming the condition is false→
18
←
Taking false branch→
syslog(LOG_ERR3, "%s: can't scan %s", printer, SD);
exit(1);
}
if (nitems == 0)		/* no work to do */
19
←
Assuming 'nitems' is not equal to 0→
20
←
Taking false branch→
exit(0);
if (stb.st_mode & S_IXOTH0000001) {		/* reset queue flag */
21
←
Assuming the condition is false→
22
←
Taking false branch→
stb.st_mode &= ~S_IXOTH0000001;
if (fchmod(lfd, stb.st_mode & 0777) < 0)
	syslog(LOG_ERR3, "%s: %s: %m", printer, LO);
}
PRIV_STARTdo { int save_errno = (*__errno()); (void)seteuid(effective_uid
); (void)setegid(effective_gid); (*__errno()) = save_errno; }
 while (0);
23
←
Loop condition is false.  Exiting loop→
openpr();			/* open printer or remote */
24
←
Calling 'openpr'→
PRIV_ENDdo { int save_errno = (*__errno()); (void)setegid(real_gid); (
void)seteuid(real_uid); (*__errno()) = save_errno; } while (0
);

217again:
/*
* we found something to do now do it --
*    write the name of the current control file into the lock file
*    so the spool queue program can tell what we're working on
*/
for (qp = queue; nitems--; free(q)) {
q = *qp++;
if (stat(q->q_name, &stb) < 0)
	continue;
errcnt = 0;
restart:
fdev = (dev_t)-1;
fino = (ino_t)-1;

(void)lseek(lfd, pidoff, SEEK_SET0);
if ((i = snprintf(line, sizeof(line), "%s\n", q->q_name)) < 0 ||
    i >= sizeof(line))
	i = sizeof(line) - 1;	/* can't happen */
if (write(lfd, line, i) != i)
	syslog(LOG_ERR3, "%s: %s: %m", printer, LO);
if (!remote)
	i = printit(q->q_name);
else
	i = sendit(q->q_name);
/*
 * Check to see if we are supposed to stop printing or
 * if we are to rebuild the queue.
 */
if (fstat(lfd, &stb) == 0) {
	/* stop printing before starting next job? */
	if (stb.st_mode & S_IXUSR0000100)
		goto done;
	/* rebuild queue (after lpc topq) */
	if (stb.st_mode & S_IXOTH0000001) {
		for (free(q); nitems--; free(q))
			q = *qp++;
		stb.st_mode &= ~S_IXOTH0000001;
		if (fchmod(lfd, stb.st_mode & 0777) < 0)
			syslog(LOG_WARNING4, "%s: %s: %m",
				printer, LO);
		break;
	}
}
if (i == OK0)		/* file ok and printed */
	count++;
else if (i == REPRINT-2 && ++errcnt < 5) {
	/* try reprinting the job */
	syslog(LOG_INFO6, "restarting %s", printer);
	if (ofilter > 0) {
		kill(ofilter, SIGCONT19);	/* to be sure */
		(void)close(ofd);
		while ((i = wait(NULL((void *)0))) > 0 && i != ofilter)
			;
		ofilter = 0;
	}
	(void)close(pfd);	/* close printer */
	if (ftruncate(lfd, pidoff) < 0)
		syslog(LOG_WARNING4, "%s: %s: %m", printer, LO);
	PRIV_STARTdo { int save_errno = (*__errno()); (void)seteuid(effective_uid
); (void)setegid(effective_gid); (*__errno()) = save_errno; }
 while (0);
	openpr();		/* try to reopen printer */
	PRIV_ENDdo { int save_errno = (*__errno()); (void)setegid(real_gid); (
void)seteuid(real_uid); (*__errno()) = save_errno; } while (0
);
	goto restart;
} else {
	syslog(LOG_WARNING4, "%s: job could not be %s (%s)", printer,
		remote ? "sent to remote host" : "printed", q->q_name);
	if (i == REPRINT-2) {
		/* ensure we don't attempt this job again */
		PRIV_STARTdo { int save_errno = (*__errno()); (void)seteuid(effective_uid
); (void)setegid(effective_gid); (*__errno()) = save_errno; }
 while (0);
		(void)unlink(q->q_name);
		q->q_name[0] = 'd';
		(void)unlink(q->q_name);
		PRIV_ENDdo { int save_errno = (*__errno()); (void)setegid(real_gid); (
void)seteuid(real_uid); (*__errno()) = save_errno; } while (0
);
		if (logname[0])
			sendmail(logname, FATALERR1);
	}
}
}
free(queue);
/*
* search the spool directory for more work.
*/
if ((nitems = getq(&queue)) < 0) {
syslog(LOG_ERR3, "%s: can't scan %s", printer, SD);
exit(1);
}
if (nitems == 0) {		/* no more work to do */
done:
if (count > 0) {	/* Files actually printed */
	if (!SF && !tof)
		(void)write(ofd, FF, strlen(FF));
	if (TR != NULL((void *)0))		/* output trailer */
		(void)write(ofd, TR, strlen(TR));
}
(void)close(ofd);
(void)wait(NULL((void *)0));
(void)unlink(tempfile);
exit(0);
}
goto again;
317}

319#define	FONTLEN50	50
320char	fonts[4][FONTLEN50];	/* fonts for troff */

322char ifonts[4][40] = {
_PATH_VFONTR"/usr/libdata/vfont/R",
_PATH_VFONTI"/usr/libdata/vfont/I",
_PATH_VFONTB"/usr/libdata/vfont/B",
_PATH_VFONTS"/usr/libdata/vfont/S",
327};

329/*
* The remaining part is the reading of the control file (cf)
* and performing the various actions.
*/
333static int
334printit(char *file)
335{
int i, fd;
char *cp;
int bombed = OK0;

/*
* open control file; ignore if no longer there.
*/
fd = safe_open(file, O_RDONLY0x0000|O_NOFOLLOW0x0100, 0);
if (fd < 0 || (cfp = fdopen(fd, "r")) == NULL((void *)0)) {
syslog(LOG_INFO6, "%s: %s: %m", printer, file);
if (fd >= 0)
	(void)close(fd);
return(OK0);
}
/*
* Reset troff fonts.
*/
for (i = 0; i < 4; i++)
strlcpy(fonts[i], ifonts[i], FONTLEN50);
(void)snprintf(&width[2], sizeof(width) - 2, "%ld", PW);
indent[2] = '0';
indent[3] = '\0';

/*
*      read the control file for work to do
*
*      file format -- first character in the line is a command
*      rest of the line is the argument.
*      valid commands are:
*
*		S -- "stat info" for symbolic link protection
*		J -- "job name" on banner page
*		C -- "class name" on banner page
*              L -- "literal" user's name to print on banner
*		T -- "title" for pr
*		H -- "host name" of machine where lpr was done
*              P -- "person" user's login name
*              I -- "indent" amount to indent output
*		R -- laser dpi "resolution"
*              f -- "file name" name of text file to print
*		l -- "file name" text file with control chars
*		p -- "file name" text file to print with pr(1)
*		t -- "file name" troff(1) file to print
*		n -- "file name" ditroff(1) file to print
*		d -- "file name" dvi file to print
*		g -- "file name" plot(1G) file to print
*		v -- "file name" plain raster file to print
*		c -- "file name" cifplot file to print
*		1 -- "R font file" for troff
*		2 -- "I font file" for troff
*		3 -- "B font file" for troff
*		4 -- "S font file" for troff
*		N -- "name" of file (used by lpq)
*              U -- "unlink" name of file to remove
*                    (after we print it. (Pass 2 only)).
*		M -- "mail" to user when done printing
*
*      get_line reads a line and expands tabs to blanks
*/

/* pass 1 */

while (get_line(cfp))
switch (line[0]) {
case 'H':
	strlcpy(fromhost, line+1, sizeof(fromhost));
	if (class[0] == '\0')
		strlcpy(class, line+1, sizeof(class));
	continue;

case 'P':
	strlcpy(logname, line+1, sizeof(logname));
	if (RS) {			/* restricted */
		if (getpwnam(logname) == NULL((void *)0)) {
			bombed = NOACCT2;
			sendmail(line+1, bombed);
			goto pass2;
		}
	}
	continue;

case 'S':
	cp = line+1;
	fdev = 0;
	while (*cp >= '0' && *cp <= '9')
		fdev = fdev * 10 + (*cp++ - '0');
	cp++;
	fino = 0;
	while (*cp >= '0' && *cp <= '9')
		fino = fino * 10 + (*cp++ - '0');
	continue;

case 'J':
	if (line[1] != '\0')
		strlcpy(jobname, line+1, sizeof(jobname));
	else {
		jobname[0] = ' ';
		jobname[1] = '\0';
	}
	continue;

case 'C':
	if (line[1] != '\0')
		strlcpy(class, line+1, sizeof(class));
	else if (class[0] == '\0')
		gethostname(class, sizeof(class));
	continue;

case 'T':	/* header title for pr */
	strlcpy(title, line+1, sizeof(title));
	continue;

case 'L':	/* identification line */
	if (!SH && !HL)
		banner(line+1, jobname);
	continue;

case '1':	/* troff fonts */
case '2':
case '3':
case '4':
	if (line[1] != '\0')
		strlcpy(fonts[line[0]-'1'], line+1, FONTLEN50);
	continue;

case 'W':	/* page width */
	strlcpy(width+2, line+1, sizeof(width) - 2);
	continue;

case 'I':	/* indent amount */
	strlcpy(indent+2, line+1, sizeof(indent) - 2);
	continue;

default:	/* some file to print */
	switch (i = print(line[0], line+1)) {
	case ERROR-1:
		if (bombed == OK0)
			bombed = FATALERR1;
		break;
	case REPRINT-2:
		(void)fclose(cfp);
		return(REPRINT-2);
	case FILTERERR3:
	case ACCESS4:
		bombed = i;
		sendmail(logname, bombed);
	}
	title[0] = '\0';
	continue;

case 'N':
case 'U':
case 'M':
case 'R':
	continue;
}

/* pass 2 */

495pass2:
fseek(cfp, 0L, SEEK_SET0);
while (get_line(cfp))
switch (line[0]) {
case 'L':	/* identification line */
	if (!SH && HL)
		banner(line+1, jobname);
	continue;

case 'M':
	if (bombed < NOACCT2)	/* already sent if >= NOACCT */
		sendmail(line+1, bombed);
	continue;

case 'U':
	if (strchr(line+1, '/'))
		continue;
	(void)unlink(line+1);
}
/*
* clean-up in case another control file exists
*/
(void)fclose(cfp);
(void)unlink(file);
return(bombed == OK0 ? OK0 : ERROR-1);
520}

522/*
* Print a file.
* Set up the chain [ PR [ | {IF, OF} ] ] or {IF, RF, TF, NF, DF, CF, VF}.
* Return -1 if a non-recoverable error occurred,
* 2 if the filter detected some errors (but printed the job anyway),
* 1 if we should try to reprint this job and
* 0 if all is well.
* Note: all filters take stdin as the file, stdout as the printer,
* stderr as the log file, and must not ignore SIGINT.
*/
532static int
533print(int format, char *file)
534{
ssize_t nread;
struct stat stb;
pid_t pid;
char *prog, *av[17], buf[BUFSIZ1024];
int fd, status, serrno;
int n, fi, fo, p[2], stopped = 0, nofile;

if (fdev != (dev_t)-1 && fino != (ino_t)-1) {
/* symbolic link */
PRIV_STARTdo { int save_errno = (*__errno()); (void)seteuid(effective_uid
); (void)setegid(effective_gid); (*__errno()) = save_errno; }
 while (0);
fi = safe_open(file, O_RDONLY0x0000, 0);
PRIV_ENDdo { int save_errno = (*__errno()); (void)setegid(real_gid); (
void)seteuid(real_uid); (*__errno()) = save_errno; } while (0
);
if (fi != -1) {
	/*
	 * The symbolic link should still point to the same file
	 * or someone is trying to print something he shouldn't.
	 */
	if (fstat(fi, &stb) == -1 ||
	    stb.st_dev != fdev || stb.st_ino != fino) {
		close(fi);
		return(ACCESS4);
	}
}
} else {
/* regular file */
PRIV_STARTdo { int save_errno = (*__errno()); (void)seteuid(effective_uid
); (void)setegid(effective_gid); (*__errno()) = save_errno; }
 while (0);
fi = safe_open(file, O_RDONLY0x0000|O_NOFOLLOW0x0100, 0);
PRIV_ENDdo { int save_errno = (*__errno()); (void)setegid(real_gid); (
void)seteuid(real_uid); (*__errno()) = save_errno; } while (0
);
}
if (fi == -1)
return(ERROR-1);
if (!SF && !tof) {		/* start on a fresh page */
(void)write(ofd, FF, strlen(FF));
tof = 1;
}
if (IF == NULL((void *)0) && (format == 'f' || format == 'l' || format == 'o')) {
tof = 0;
while ((n = read(fi, buf, BUFSIZ1024)) > 0)
	if (write(ofd, buf, n) != n) {
		(void)close(fi);
		return(REPRINT-2);
	}
(void)close(fi);
return(OK0);
}
switch (format) {
case 'p':	/* print file using 'pr' */
if (IF == NULL((void *)0)) {	/* use output filter */
	prog = _PATH_PR"/usr/bin/pr";
	av[0] = "pr";
	av[1] = width;
	av[2] = length;
	av[3] = "-h";
	av[4] = *title ? title : " ";
	av[5] = NULL((void *)0);
	fo = ofd;
	goto start;
}
pipe(p);
if ((prchild = dofork(DORETURN0)) == 0) {	/* child */
	dup2(fi, 0);		/* file is stdin */
	dup2(p[1], 1);		/* pipe is stdout */
	closelog();
	nofile = sysconf(_SC_OPEN_MAX5);
	for (n = 3; n < nofile; n++)
		(void)close(n);
	execl(_PATH_PR"/usr/bin/pr", "pr", width, length,
	    "-h", *title ? title : " ", (char *)NULL((void *)0));
	syslog(LOG_ERR3, "cannot execl %s", _PATH_PR"/usr/bin/pr");
	exit(2);
}
(void)close(p[1]);		/* close output side */
(void)close(fi);
if (prchild < 0) {
	prchild = 0;
	(void)close(p[0]);
	return(ERROR-1);
}
fi = p[0];			/* use pipe for input */
case 'f':	/* print plain text file */
prog = IF;
av[1] = width;
av[2] = length;
av[3] = indent;
n = 4;
break;
case 'o':       /* print postscript file */
/*
 * Treat this as a "plain file with control characters", and
 * assume the standard LPF_INPUT filter will recognize that
 * the data is postscript and know what to do with it.  These
 * 'o'-file requests could come from MacOS 10.1 systems.
 * (later versions of MacOS 10 will explicitly use 'l')
 * A postscript file can contain binary data, which is why 'l'
 * is somewhat more appropriate than 'f'.
 */
/* FALLTHROUGH */
case 'l':	/* like 'f' but pass control characters */
prog = IF;
av[1] = "-c";
av[2] = width;
av[3] = length;
av[4] = indent;
n = 5;
break;
case 'r':	/* print a fortran text file */
prog = RF;
av[1] = width;
av[2] = length;
n = 3;
break;
case 't':	/* print troff output */
case 'n':	/* print ditroff output */
case 'd':	/* print tex output */
(void)unlink(".railmag");
if ((fo = open(".railmag", O_CREAT0x0200|O_WRONLY0x0001|O_EXCL0x0800, FILMOD0660)) < 0) {
	syslog(LOG_ERR3, "%s: cannot create .railmag", printer);
	(void)unlink(".railmag");
} else {
	for (n = 0; n < 4; n++) {
		if (fonts[n][0] != '/')
			(void)write(fo, _PATH_VFONT"/usr/libdata/vfont/",
			    sizeof(_PATH_VFONT"/usr/libdata/vfont/") - 1);
		(void)write(fo, fonts[n], strlen(fonts[n]));
		(void)write(fo, "\n", 1);
	}
	(void)close(fo);
}
prog = (format == 't') ? TF : (format == 'n') ? NF : DF;
av[1] = pxwidth;
av[2] = pxlength;
n = 3;
break;
case 'c':	/* print cifplot output */
prog = CF;
av[1] = pxwidth;
av[2] = pxlength;
n = 3;
break;
case 'g':	/* print plot(1G) output */
prog = GF;
av[1] = pxwidth;
av[2] = pxlength;
n = 3;
break;
case 'v':	/* print raster output */
prog = VF;
av[1] = pxwidth;
av[2] = pxlength;
n = 3;
break;
default:
(void)close(fi);
syslog(LOG_ERR3, "%s: illegal format character '%c'",
	printer, format);
return(ERROR-1);
}
if (prog == NULL((void *)0)) {
(void)close(fi);
syslog(LOG_ERR3,
    "%s: no filter found in printcap for format character '%c'",
    printer, format);
return(ERROR-1);
}
if ((av[0] = strrchr(prog, '/')) != NULL((void *)0))
av[0]++;
else
av[0] = prog;
av[n++] = "-n";
av[n++] = logname;
if (*jobname != '\0' && strcmp(jobname, " ") != 0) {
av[n++] = "-j";
av[n++] = jobname;
}
av[n++] = "-h";
av[n++] = fromhost;
av[n++] = AF;
av[n] = 0;
fo = pfd;
if (ofilter > 0) {		/* stop output filter */
write(ofd, "\031\1", 2);
while ((pid = waitpid((pid_t)-1, &status, WUNTRACED2)) > 0
    && pid != ofilter)
	;
if (WIFSTOPPED(status)(((status) & 0xff) == 0177) == 0) {
	(void)close(fi);
	syslog(LOG_WARNING4,
	    "%s: output filter died (retcode=%d termsig=%d)",
	    printer, WEXITSTATUS(status)(int)(((unsigned)(status) >> 8) & 0xff), WTERMSIG(status)(((status) & 0177)));
	return(REPRINT-2);
}
stopped++;
}
728start:
if ((child = dofork(DORETURN0)) == 0) {	/* child */
dup2(fi, 0);
dup2(fo, 1);
unlink(tempfile);
n = open(tempfile, O_WRONLY0x0001|O_CREAT0x0200|O_EXCL0x0800, 0664);
if (n >= 0)
	dup2(n, 2);
closelog();
nofile = sysconf(_SC_OPEN_MAX5);
for (n = 3; n < nofile; n++)
	(void)close(n);
execv(prog, av);
syslog(LOG_ERR3, "cannot execv %s", prog);
_exit(2);
}
serrno = errno(*__errno());
(void)close(fi);
errno(*__errno()) = serrno;
if (child < 0) {
child = prchild = tof = 0;
syslog(LOG_ERR3, "cannot start child process: %m");
return (ERROR-1);
}
while ((pid = wait(&status)) > 0 && pid != child)
;
child = 0;
prchild = 0;
if (stopped) {		/* restart output filter */
if (kill(ofilter, SIGCONT19) < 0) {
	syslog(LOG_ERR3, "cannot restart output filter");
	exit(1);
}
}
tof = 0;

/* Copy filter output to "lf" logfile */
fd = safe_open(tempfile, O_RDONLY0x0000|O_NOFOLLOW0x0100, 0);
if (fd >= 0) {
while ((nread = read(fd, buf, sizeof(buf))) > 0)
	(void)write(STDERR_FILENO2, buf, nread);
(void)close(fd);
}

if (!WIFEXITED(status)(((status) & 0177) == 0)) {
syslog(LOG_WARNING4, "%s: filter '%c' terminated (termsig=%d)",
    printer, format, WTERMSIG(status)(((status) & 0177)));
return(ERROR-1);
}
switch (WEXITSTATUS(status)(int)(((unsigned)(status) >> 8) & 0xff)) {
case 0:
tof = 1;
return(OK0);
case 1:
return(REPRINT-2);
case 2:
return(ERROR-1);
default:
syslog(LOG_WARNING4, "%s: filter '%c' exited (retcode=%d)",
    printer, format, WEXITSTATUS(status)(int)(((unsigned)(status) >> 8) & 0xff));
return(FILTERERR3);
}
790}

792/*
* Send the daemon control file (cf) and any data files.
* Return -1 if a non-recoverable error occurred, 1 if a recoverable error and
* 0 if all is well.
*/
797static int
798sendit(char *file)
799{
int fd, i, err = OK0;
char *cp, last[BUFSIZ1024];

/* open control file */
fd = safe_open(file, O_RDONLY0x0000|O_NOFOLLOW0x0100, 0);
if (fd < 0 || (cfp = fdopen(fd, "r")) == NULL((void *)0))
return(OK0);
/*
*      read the control file for work to do
*
*      file format -- first character in the line is a command
*      rest of the line is the argument.
*      commands of interest are:
*
*            a-z -- "file name" name of file to print
*              U -- "unlink" name of file to remove
*                    (after we print it. (Pass 2 only)).
*/

/*
* pass 1
*/
while (get_line(cfp)) {
again:
if (line[0] == 'S') {
	cp = line+1;
	fdev = 0;
	while (*cp >= '0' && *cp <= '9')
		fdev = fdev * 10 + (*cp++ - '0');
	cp++;
	fino = 0;
	while (*cp >= '0' && *cp <= '9')
		fino = fino * 10 + (*cp++ - '0');
	continue;
}
if (line[0] >= 'a' && line[0] <= 'z') {
	strlcpy(last, line, sizeof(last));
	while ((i = get_line(cfp)) != 0)
		if (strcmp(last, line))
			break;
	switch (sendfile('\3', last+1)) {
	case OK0:
		if (i)
			goto again;
		break;
	case REPRINT-2:
		(void)fclose(cfp);
		return(REPRINT-2);
	case ACCESS4:
		sendmail(logname, ACCESS4);
	case ERROR-1:
		err = ERROR-1;
	}
	break;
}
}
if (err == OK0 && sendfile('\2', file) > 0) {
(void)fclose(cfp);
return(REPRINT-2);
}
/*
* pass 2
*/
fseek(cfp, 0L, SEEK_SET0);
while (get_line(cfp))
if (line[0] == 'U' && strchr(line+1, '/') == 0)
	(void)unlink(line+1);
/*
* clean-up in case another control file exists
*/
(void)fclose(cfp);
(void)unlink(file);
return(err);
873}

875/*
* Send a data file to the remote machine and spool it.
* Return positive if we should try resending.
*/
879static int
880sendfile(int type, char *file)
881{
int f, i, amt;
struct stat stb;
char buf[BUFSIZ1024];
int sizerr, resp;

if (fdev != (dev_t)-1 && fino != (ino_t)-1) {
/* symbolic link */
PRIV_STARTdo { int save_errno = (*__errno()); (void)seteuid(effective_uid
); (void)setegid(effective_gid); (*__errno()) = save_errno; }
 while (0);
f = safe_open(file, O_RDONLY0x0000, 0);
PRIV_ENDdo { int save_errno = (*__errno()); (void)setegid(real_gid); (
void)seteuid(real_uid); (*__errno()) = save_errno; } while (0
);
if (f != -1) {
	/*
	 * The symbolic link should still point to the same file
	 * or someone is trying to print something he shouldn't.
	 */
	if (fstat(f, &stb) == -1 ||
	    stb.st_dev != fdev || stb.st_ino != fino) {
		close(f);
		return(ACCESS4);
	}
}
} else {
/* regular file */
PRIV_STARTdo { int save_errno = (*__errno()); (void)seteuid(effective_uid
); (void)setegid(effective_gid); (*__errno()) = save_errno; }
 while (0);
f = safe_open(file, O_RDONLY0x0000|O_NOFOLLOW0x0100, 0);
PRIV_ENDdo { int save_errno = (*__errno()); (void)setegid(real_gid); (
void)seteuid(real_uid); (*__errno()) = save_errno; } while (0
);
if (fstat(f, &stb) == -1) {
	close(f);
	f = -1;
}
}
if (f == -1)
return(ERROR-1);
if ((amt = snprintf(buf, sizeof(buf), "%c%lld %s\n", type,
   (long long)stb.st_size, file)) < 0 || amt >= sizeof(buf))
return (ACCESS4);		/* XXX hack */
for (i = 0;  ; i++) {
if (write(pfd, buf, amt) != amt ||
    (resp = response()) < 0 || resp == '\1') {
	(void)close(f);
	return(REPRINT-2);
} else if (resp == '\0')
	break;
if (i == 0)
	pstatus("no space on remote; waiting for queue to drain");
if (i == 10)
	syslog(LOG_ALERT1, "%s: can't send to %s; queue full",
		printer, RM);
sleep(5 * 60);
}
if (i)
pstatus("sending to %s", RM);
sizerr = 0;
for (i = 0; i < stb.st_size; i += BUFSIZ1024) {
struct sigaction osa, nsa;

amt = BUFSIZ1024;
if (i + amt > stb.st_size)
	amt = stb.st_size - i;
if (sizerr == 0 && read(f, buf, amt) != amt)
	sizerr = 1;
memset(&nsa, 0, sizeof(nsa));
nsa.sa_handler__sigaction_u.__sa_handler = alarmer;
sigemptyset(&nsa.sa_mask);
nsa.sa_flags = 0;
(void)sigaction(SIGALRM14, &nsa, &osa);
alarm(wait_time);
if (write(pfd, buf, amt) != amt) {
	alarm(0);
	(void)sigaction(SIGALRM14, &osa, NULL((void *)0));
	(void)close(f);
	return(REPRINT-2);
}
alarm(0);
(void)sigaction(SIGALRM14, &osa, NULL((void *)0));
}

(void)close(f);
if (sizerr) {
syslog(LOG_INFO6, "%s: %s: changed size", printer, file);
/* tell recvjob to ignore this file */
(void)write(pfd, "\1", 1);
return(ERROR-1);
}
if (write(pfd, "", 1) != 1 || response())
return(REPRINT-2);
return(OK0);
969}

971/*
* Check to make sure there have been no errors and that both programs
* are in sync with eachother.
* Return non-zero if the connection was lost.
*/
976static char
977response(void)
978{
struct sigaction osa, nsa;
char resp;

memset(&nsa, 0, sizeof(nsa));
nsa.sa_handler__sigaction_u.__sa_handler = alarmer;
sigemptyset(&nsa.sa_mask);
nsa.sa_flags = 0;
(void)sigaction(SIGALRM14, &nsa, &osa);
alarm(wait_time);
if (read(pfd, &resp, 1) != 1) {
syslog(LOG_INFO6, "%s: lost connection", printer);
resp = -1;
}
alarm(0);
(void)sigaction(SIGALRM14, &osa, NULL((void *)0));
return (resp);
995}

997/*
* Banner printing stuff
*/
1000static void
1001banner(char *name1, char *name2)
1002{
time_t tvec;

time(&tvec);
if (!SF && !tof)
(void)write(ofd, FF, strlen(FF));
if (SB) {	/* short banner only */
if (class[0]) {
	(void)write(ofd, class, strlen(class));
	(void)write(ofd, ":", 1);
}
(void)write(ofd, name1, strlen(name1));
(void)write(ofd, "  Job: ", 7);
(void)write(ofd, name2, strlen(name2));
(void)write(ofd, "  Date: ", 8);
(void)write(ofd, ctime(&tvec), 24);
(void)write(ofd, "\n", 1);
} else {	/* normal banner */
(void)write(ofd, "\n\n\n", 3);
scan_out(ofd, name1, '\0');
(void)write(ofd, "\n\n", 2);
scan_out(ofd, name2, '\0');
if (class[0]) {
	(void)write(ofd, "\n\n\n", 3);
	scan_out(ofd, class, '\0');
}
(void)write(ofd, "\n\n\n\n\t\t\t\t\tJob:  ", 15);
(void)write(ofd, name2, strlen(name2));
(void)write(ofd, "\n\t\t\t\t\tDate: ", 12);
(void)write(ofd, ctime(&tvec), 24);
(void)write(ofd, "\n", 1);
}
if (!SF)
(void)write(ofd, FF, strlen(FF));
tof = 1;
1037}

1039static char *
1040scnline(int key, char *p, int c)
1041{
int scnwidth;

for (scnwidth = WIDTH8; --scnwidth;) {
key <<= 1;
*p++ = key & 0200 ? c : BACKGND' ';
}
return (p);
1049}

1051#define TRC(q)(((q)-' ')&0177)	(((q)-' ')&0177)

1053static void
1054scan_out(int scfd, char *scsp, int dlm)
1055{
char *strp;
int nchrs, j;
char outbuf[LINELEN132+1], *sp, c, cc;
int d, scnhgt;
extern char scnkey[][HEIGHT9];	/* in lpdchar.c */

for (scnhgt = 0; scnhgt++ < HEIGHT9+DROP3; ) {
strp = &outbuf[0];
sp = scsp;
for (nchrs = 0; ; ) {
	d = dropit(c = TRC(cc = *sp++)(((cc = *sp++)-' ')&0177));
	if ((!d && scnhgt > HEIGHT9) || (scnhgt <= DROP3 && d))
		for (j = WIDTH8; --j;)
			*strp++ = BACKGND' ';
	else
		strp = scnline(scnkey[(int)c][scnhgt-1-d],
		    strp, cc);
	if (*sp == dlm || *sp == '\0' ||
	    nchrs++ >= PW/(WIDTH8+1)-1)
		break;
	*strp++ = BACKGND' ';
	*strp++ = BACKGND' ';
}
while (*--strp == BACKGND' ' && strp >= outbuf)
	;
strp++;
*strp++ = '\n';	
(void)write(scfd, outbuf, strp-outbuf);
}
1085}

1087static int
1088dropit(int c)
1089{
switch(c) {

case TRC('_')((('_')-' ')&0177):
case TRC(';')(((';')-' ')&0177):
case TRC(',')(((',')-' ')&0177):
case TRC('g')((('g')-' ')&0177):
case TRC('j')((('j')-' ')&0177):
case TRC('p')((('p')-' ')&0177):
case TRC('q')((('q')-' ')&0177):
case TRC('y')((('y')-' ')&0177):
return (DROP3);

default:
return (0);
}
1105}

1107/*
* sendmail ---
*   tell people about job completion
*/
1111static void
1112sendmail(char *user, int bombed)
1113{
int i, p[2], s, nofile;
char *cp = NULL((void *)0);
struct stat stb;
FILE *fp;

if (user[0] == '-' || user[0] == '/' || !isprint((unsigned char)user[0]))
return;
pipe(p);
if ((s = dofork(DORETURN0)) == 0) {		/* child */
dup2(p[0], 0);
closelog();
nofile = sysconf(_SC_OPEN_MAX5);
for (i = 3; i < nofile; i++)
	(void)close(i);
if ((cp = strrchr(_PATH_SENDMAIL"/usr/sbin/sendmail", '/')) != NULL((void *)0))
	cp++;
else
	cp = _PATH_SENDMAIL"/usr/sbin/sendmail";
execl(_PATH_SENDMAIL"/usr/sbin/sendmail", cp, "-t", (char *)NULL((void *)0));
_exit(0);
} else if (s > 0) {				/* parent */
dup2(p[1], 1);
printf("Auto-Submitted: auto-generated\n");
printf("To: %s@%s\n", user, fromhost);
printf("Subject: %s printer job \"%s\"\n", printer,
	*jobname ? jobname : "<unknown>");
printf("Reply-To: root@%s\n\n", host);
printf("Your printer job ");
if (*jobname)
	printf("(%s) ", jobname);
switch (bombed) {
case OK0:
	printf("\ncompleted successfully\n");
	cp = "OK";
	break;
default:
case FATALERR1:
	printf("\ncould not be printed\n");
	cp = "FATALERR";
	break;
case NOACCT2:
	printf("\ncould not be printed without an account on %s\n", host);
	cp = "NOACCT";
	break;
case FILTERERR3:
	cp = "FILTERERR";
	if (stat(tempfile, &stb) < 0 || stb.st_size == 0 ||
	    (fp = fopen(tempfile, "r")) == NULL((void *)0)) {
		printf("\nhad some errors and may not have printed\n");
		break;
	}
	printf("\nhad the following errors and may not have printed:\n");
	while ((i = getc(fp)(!__isthreaded ? (--(fp)->_r < 0 ? __srget(fp) : (int)(
*(fp)->_p++)) : (getc)(fp))) != EOF(-1))
		putchar(i)(!__isthreaded ? __sputc(i, (&__sF[1])) : (putc)(i, (&
__sF[1])));
	(void)fclose(fp);
	break;
case ACCESS4:
	printf("\nwas not printed because it was not linked to the original file\n");
	cp = "ACCESS";
}
fflush(stdout(&__sF[1]));
(void)close(1);
} else {
syslog(LOG_ERR3, "fork for sendmail failed: %m");
}
(void)close(p[0]);
(void)close(p[1]);
if (s != -1) {
wait(NULL((void *)0));
syslog(LOG_INFO6,
    "mail sent to user %s about job %s on printer %s (%s)",
    user, *jobname ? jobname : "<unknown>", printer, cp);
}
1187}

1189/* sleep n milliseconds */
1190static void
1191delay(int n)
1192{
struct timespec tdelay;

if (n <= 0 || n > 10000)
fatal("unreasonable delay period (%d)", n);
tdelay.tv_sec = n / 1000;
tdelay.tv_nsec = n * 1000000 % 1000000000;
nanosleep(&tdelay, NULL((void *)0));
1200}

1202/*
* dofork - fork with retries on failure
*/
1205static pid_t
1206dofork(int action)
1207{
struct passwd *pw;
pid_t pid;
int i;

for (i = 0; i < 20; i++) {
if ((pid = fork()) < 0) {
	sleep((unsigned)(i*i));
	continue;
}
/*
 * Child should run as daemon instead of root
 */
if (pid == 0) {
	(void)close(lfd);
	PRIV_STARTdo { int save_errno = (*__errno()); (void)seteuid(effective_uid
); (void)setegid(effective_gid); (*__errno()) = save_errno; }
 while (0);
	pw = getpwuid(DU);
	if (pw == 0) {
		syslog(LOG_ERR3, "uid %ld not in password file",
		    DU);
		break;
	}
	initgroups(pw->pw_name, pw->pw_gid);
	setgid(pw->pw_gid);
	setlogin("");
	setuid(DU);
}
return (pid);
}
syslog(LOG_ERR3, "can't fork");

switch (action) {
case DORETURN0:
return (-1);
default:
syslog(LOG_ERR3, "bad action (%d) to dofork", action);
/*FALL THRU*/
case DOABORT1:
exit(1);
}
/*NOTREACHED*/
1248}

1250/*
* Kill child processes to abort current job.
*/
1253static void
1254abortpr(int signo)
1255{
(void)close(lfd);
(void)unlink(tempfile);
(void)kill(0, SIGINT2);
if (ofilter > 0)
kill(ofilter, SIGCONT19);
while (wait(NULL((void *)0)) > 0)
;
_exit(0);
1264}

1266static void
1267init(void)
1268{
int status;
char *s;

PRIV_STARTdo { int save_errno = (*__errno()); (void)seteuid(effective_uid
); (void)setegid(effective_gid); (*__errno()) = save_errno; }
 while (0);
status = cgetent(&bp, printcapdb, printer);
PRIV_ENDdo { int save_errno = (*__errno()); (void)setegid(real_gid); (
void)seteuid(real_uid); (*__errno()) = save_errno; } while (0
);

switch (status) {
case -1:
syslog(LOG_ERR3, "unknown printer: %s", printer);
exit(1);
case -2:
syslog(LOG_ERR3, "can't open printer description file");
exit(1);
case -3:
fatal("potential reference loop detected in printcap file");
default:
break;
}

if (cgetstr(bp, DEFLP"lp", &LP) == -1)
LP = _PATH_DEFDEVLP"/dev/lp";
if (cgetstr(bp, "rp", &RP) == -1)
RP = DEFLP"lp";
if (cgetstr(bp, "lo", &LO) == -1)
LO = DEFLOCK"lock";
if (cgetstr(bp, "st", &ST) == -1)
ST = DEFSTAT"status";
if (cgetstr(bp, "lf", &LF) == -1)
LF = _PATH_CONSOLE"/dev/console";
if (cgetstr(bp, "sd", &SD) == -1)
SD = _PATH_DEFSPOOL"/var/spool/output/lpd";
if (cgetnum(bp, "du", &DU) < 0)
DU = DEFUID1;
if (cgetstr(bp, "ff", &FF) == -1)
FF = DEFFF"\f";
if (cgetnum(bp, "pw", &PW) < 0)
PW = DEFWIDTH132;
(void)snprintf(&width[2], sizeof(width) - 2, "%ld", PW);
if (cgetnum(bp, "pl", &PL) < 0)
PL = DEFLENGTH66;
(void)snprintf(&length[2], sizeof(length) - 2, "%ld", PL);
if (cgetnum(bp, "px", &PX) < 0)
PX = 0;
(void)snprintf(&pxwidth[2], sizeof(pxwidth) - 2, "%ld", PX);
if (cgetnum(bp, "py", &PY) < 0)
PY = 0;
(void)snprintf(&pxlength[2], sizeof(pxlength) - 2, "%ld", PY);
cgetstr(bp, "rm", &RM);
if ((s = checkremote()) != NULL((void *)0))
syslog(LOG_WARNING4, "%s", s);

cgetstr(bp, "af", &AF);
cgetstr(bp, "of", &OF);
cgetstr(bp, "if", &IF);
cgetstr(bp, "rf", &RF);
cgetstr(bp, "tf", &TF);
cgetstr(bp, "nf", &NF);
cgetstr(bp, "df", &DF);
cgetstr(bp, "gf", &GF);
cgetstr(bp, "vf", &VF);
cgetstr(bp, "cf", &CF);
cgetstr(bp, "tr", &TR);

RS = (cgetcap(bp, "rs", ':') != NULL((void *)0));
SF = (cgetcap(bp, "sf", ':') != NULL((void *)0));
SH = (cgetcap(bp, "sh", ':') != NULL((void *)0));
SB = (cgetcap(bp, "sb", ':') != NULL((void *)0));
HL = (cgetcap(bp, "hl", ':') != NULL((void *)0));
RW = (cgetcap(bp, "rw", ':') != NULL((void *)0));

cgetnum(bp, "br", &BR);
cgetstr(bp, "ms", &MS);

tof = (cgetcap(bp, "fo", ':') == NULL((void *)0));
1344}

1346/*
* Acquire line printer or remote connection.
* XXX - should push down privs in here
*/
1350static void
1351openpr(void)
1352{
int i, nofile;
char *cp;
extern int rflag;

if (!remote && *LP) {
25
←
Assuming 'remote' is 0→
26
←
Assuming the condition is true→
27
←
Taking true branch→
if ((cp = strchr(LP, '@')))
28
←
Assuming 'cp' is null→
29
←
Taking false branch→
	opennet(cp);
else
	opentty();
30
←
Calling 'opentty'→
} else if (remote) {
openrem();
} else {
syslog(LOG_ERR3, "%s: no line printer device or host name",
	printer);
exit(1);
}

/*
* Start up an output filter, if needed.
*/
if ((!remote || rflag) && OF) {
int p[2];

pipe(p);
if ((ofilter = dofork(DOABORT1)) == 0) {	/* child */
	dup2(p[0], 0);		/* pipe is std in */
	dup2(pfd, 1);		/* printer is std out */
	closelog();
	nofile = sysconf(_SC_OPEN_MAX5);
	for (i = 3; i < nofile; i++)
		(void)close(i);
	if ((cp = strrchr(OF, '/')) == NULL((void *)0))
		cp = OF;
	else
		cp++;
	execl(OF, cp, width, length, (char *)NULL((void *)0));
	syslog(LOG_ERR3, "%s: %s: %m", printer, OF);
	exit(1);
}
(void)close(p[0]);		/* close input side */
ofd = p[1];			/* use pipe for output */
} else {
ofd = pfd;
ofilter = 0;
}
1398}

1400/*
* Printer connected directly to the network
* or to a terminal server on the net
*/
1404static void
1405opennet(char *cp)
1406{
int i;
int resp, port;
char save_ch;

save_ch = *cp;
*cp = '\0';
port = atoi(LP);
if (port <= 0) {
syslog(LOG_ERR3, "%s: bad port number: %s", printer, LP);
exit(1);
}
*cp++ = save_ch;

for (i = 1; ; i = i < 256 ? i << 1 : i) {
resp = -1;
pfd = getport(cp, port);
if (pfd < 0 && errno(*__errno()) == ECONNREFUSED61)
	resp = 1;
else if (pfd >= 0) {
	/*
	 * need to delay a bit for rs232 lines
	 * to stabilize in case printer is
	 * connected via a terminal server
	 */
	delay(500);
	break;
}
if (i == 1) {
   if (resp < 0)
	pstatus("waiting for %s to come up", LP);
   else
	pstatus("waiting for access to printer on %s", LP);
}
sleep(i);
}
pstatus("sending to %s port %d", cp, port);
1443}

1445/*
* Printer is connected to an RS232 port on this host
*/
1448static void
1449opentty(void)
1450{
int i;

for (i = 1; ; i = i < 32 ? i << 1 : i) {
31
←
Loop condition is true.  Entering loop body→
pfd = open(LP, RW ? O_RDWR0x0002 : O_WRONLY0x0001);
32
←
Assuming 'RW' is 0→
33
←
'?' condition is false→
if (pfd >= 0) {
34
←
Assuming 'pfd' is >= 0→
35
←
Taking true branch→
	delay(500);
	break;
36
←
 Execution continues on line 1468→
}
if (errno(*__errno()) == ENOENT2) {
	syslog(LOG_ERR3, "%s: %m", LP);
	exit(1);
}
if (i == 1)
	pstatus("waiting for %s to become ready (offline ?)",
		printer);
sleep(i);
}
if (isatty(pfd))
37
←
Assuming the condition is true→
38
←
Taking true branch→
setty();
39
←
Calling 'setty'→
pstatus("%s is ready and printing", printer);
1471}

1473/*
* Printer is on a remote host
*/
1476static void
1477openrem(void)
1478{
int i, n;
int resp;

for (i = 1; ; i = i < 256 ? i << 1 : i) {
resp = -1;
pfd = getport(RM, 0);
if (pfd >= 0) {
	if ((n = snprintf(line, sizeof(line), "\2%s\n", RP)) < 0 ||
	    n >= sizeof(line))
		n = sizeof(line) - 1;
	if (write(pfd, line, n) == n &&
	    (resp = response()) == '\0')
		break;
	(void)close(pfd);
}
if (i == 1) {
	if (resp < 0)
		pstatus("waiting for %s to come up", RM);
	else {
		pstatus("waiting for queue to be enabled on %s",
			RM);
		i = 256;
	}
}
sleep(i);
}
pstatus("sending to %s", RM);
1506}

1508static void
1509alarmer(int s)
1510{
/* nothing */
1512}

1514/*
* setup tty lines.
*/
1517static void
1518setty(void)
1519{
struct info i;
char **argv, **ap, **ep, *p, *val;

i.fd = pfd;
i.set = i.wset = 0;
if (ioctl(i.fd, TIOCEXCL((unsigned long)0x20000000 | ((0 & 0x1fff) << 16) |
 ((('t')) << 8) | ((13))), (char *)0) < 0) {
40
←
Assuming the condition is false→
41
←
Taking false branch→
syslog(LOG_ERR3, "%s: ioctl(TIOCEXCL): %m", printer);
exit(1);
}
if (tcgetattr(i.fd, &i.t) < 0) {
42
←
Assuming the condition is false→
43
←
Taking false branch→
syslog(LOG_ERR3, "%s: tcgetattr: %m", printer);
exit(1);
}
if (BR > 0) {
44
←
Assuming 'BR' is <= 0→
45
←
Taking false branch→
cfsetspeed(&i.t, BR);
i.set = 1;
}
if (MS) {
46
←
Assuming 'MS' is non-null→
47
←
Taking true branch→
if (ioctl(i.fd, TIOCGETD((unsigned long)0x40000000 | ((sizeof(int) & 0x1fff) <<
 16) | ((('t')) << 8) | ((26))), &i.ldisc) < 0) {
48
←
Assuming the condition is false→
49
←
Taking false branch→
	syslog(LOG_ERR3, "%s: ioctl(TIOCGETD): %m", printer);
	exit(1);
}
if (ioctl(i.fd, TIOCGWINSZ((unsigned long)0x40000000 | ((sizeof(struct winsize) & 0x1fff
) << 16) | ((('t')) << 8) | ((104))), &i.win) < 0)
50
←
Assuming the condition is false→
51
←
Taking false branch→
	syslog(LOG_INFO6, "%s: ioctl(TIOCGWINSZ): %m",
	       printer);

argv = calloc(256, sizeof(char *));
if (argv == NULL((void *)0)) {
52
←
Assuming 'argv' is not equal to NULL→
53
←
Taking false branch→
	syslog(LOG_ERR3, "%s: malloc: %m", printer);
	exit(1);
}
p = strdup(MS);
54
←
Memory is allocated→
ap = argv;
ep = argv + 255;
while ((val = strsep(&p, " \t,")) != NULL((void *)0)) {
55
←
Assuming the condition is true→
56
←
Loop condition is true.  Entering loop body→
60
←
Assuming the condition is false→
61
←
Loop condition is false. Execution continues on line 1565→
	if ((*ap++ = strdup(val)) == NULL((void *)0)) {
57
←
Assuming the condition is false→
58
←
Taking false branch→
		syslog(LOG_ERR3, "%s: strdup: %m", printer);
		exit(1);
	}
	if (ap58.1
'ap' is not equal to 'ep'
 == ep) {
59
←
Taking false branch→
		syslog(LOG_ERR3, "%s: too many \"ms\" entries",
		    printer);
		exit(1);
	}
}
*ap = NULL((void *)0);
62
←
Potential leak of memory pointed to by 'val'

for (; *argv; ++argv) {
	if (ksearch(&argv, &i))
		continue;
	if (msearch(&argv, &i))
		continue;
	syslog(LOG_INFO6, "%s: unknown stty flag: %s",
	       printer, *argv);
}
}

if (i.set && tcsetattr(i.fd, TCSANOW0, &i.t) < 0) {
syslog(LOG_ERR3, "%s: tcsetattr: %m", printer);
exit(1);
}
if (i.wset && ioctl(i.fd, TIOCSWINSZ((unsigned long)0x80000000 | ((sizeof(struct winsize) & 0x1fff
) << 16) | ((('t')) << 8) | ((103))), &i.win) < 0)
syslog(LOG_INFO6, "%s: ioctl(TIOCSWINSZ): %m", printer);
return;
1584}

1586static void
1587pstatus(const char *msg, ...)
1588{
int fd, len;
char buf[BUFSIZ1024];
va_list ap;

va_start(ap, msg)__builtin_va_start(ap, msg);
umask(0);
fd = open(ST, O_WRONLY0x0001|O_CREAT0x0200|O_NOFOLLOW0x0100|O_EXLOCK0x0020, 0660);
if (fd < 0) {
syslog(LOG_ERR3, "%s: %s: %m", printer, ST);
exit(1);
}
ftruncate(fd, 0);
len = vsnprintf(buf, sizeof(buf), msg, ap);
va_end(ap)__builtin_va_end(ap);
if (len < 0) {
(void)close(fd);
return;
}
if (len >= sizeof(buf))
len = sizeof(buf) - 1;
buf[len++] = '\n';		/* replace NUL with newline */
(void)write(fd, buf, len);
(void)close(fd);
1612}