/usr/src/bin/csh/func.c

Bug Summary

File:	src/bin/csh/func.c
Warning:	line 854, column 18 Dereference of null pointer
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name func.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/bin/csh/obj -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/bin/csh -I . -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/bin/csh/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/bin/csh/func.c
1/*    $OpenBSD: func.c,v 1.41 2023/03/08 04:43:04 guenther Exp $       */
2/*    $NetBSD: func.c,v 1.11 1996/02/09 02:28:29 christos Exp $       */

4/*-
* Copyright (c) 1980, 1991, 1993
*	The Regents of the University of California.  All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of the University nor the names of its contributors
*    may be used to endorse or promote products derived from this software
*    without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

33#include <sys/types.h>
34#include <sys/stat.h>
35#include <signal.h>
36#include <locale.h>
37#include <stdlib.h>
38#include <string.h>
39#include <unistd.h>
40#include <stdarg.h>

42#include "csh.h"
43#include "extern.h"
44#include "pathnames.h"

46extern char **environ;

48static int zlast = -1;
49static void	islogin(void);
50static void	reexecute(struct command *);
51static void	preread(void);
52static void	doagain(void);
53static void	search(int, int, Char *);
54static int	getword(Char *);
55static int	keyword(Char *);
56static void	toend(void);
57static void	xecho(int, Char **);
58static void	Unsetenv(Char *);

60struct biltins *
61isbfunc(struct command *t)
62{
  Char *cp = t->t_dcom[0];
  struct biltins *bp, *bp1, *bp2;
  static struct biltins label = {"", dozip, 0, 0};
  static struct biltins foregnd = {"%job", dofg1, 0, 0};
  static struct biltins backgnd = {"%job &", dobg1, 0, 0};

  if (lastchr(cp) == ':') {
label.bname = short2str(cp);
return (&label);
  }
  if (*cp == '%') {
if (t->t_dflg & F_AMPERSAND(1<<0)) {
   t->t_dflg &= ~F_AMPERSAND(1<<0);
   backgnd.bname = short2str(cp);
   return (&backgnd);
}
foregnd.bname = short2str(cp);
return (&foregnd);
  }
  /*
   * Binary search Bp1 is the beginning of the current search range. Bp2 is
   * one past the end.
   */
  for (bp1 = bfunc, bp2 = bfunc + nbfunc; bp1 < bp2;) {
int i;

bp = bp1 + ((bp2 - bp1) >> 1);
if ((i = *cp - *bp->bname) == 0 &&
   (i = Strcmp(cp, str2short(bp->bname))) == 0)
   return bp;
if (i < 0)
   bp2 = bp;
else
   bp1 = bp + 1;
  }
  return (0);
99}

101void
102func(struct command *t, struct biltins *bp)
103{
  int     i;

  xechoit(t->t_dcom);
  setname(bp->bname)(bname = (bp->bname));
  i = blklen(t->t_dcom) - 1;
  if (i < bp->minargs)
stderror(ERR_NAME0x10000000 | ERR_TOOFEW15);
  if (i > bp->maxargs)
stderror(ERR_NAME0x10000000 | ERR_TOOMANY16);
  (*bp->bfunct) (t->t_dcom, t);
114}

116void
117doonintr(Char **v, struct command *t)
118{
  Char *cp;
  Char *vv = v[1];
  sigset_t sigset;

  if (parintr == SIG_IGN(void (*)(int))1)
return;
  if (setintr && intty)
stderror(ERR_NAME0x10000000 | ERR_TERMINAL47);
  cp = gointr;
  gointr = 0;
  free(cp);
  if (vv == 0) {
if (setintr) {
   sigemptyset(&sigset);
   sigaddset(&sigset, SIGINT2);
   sigprocmask(SIG_BLOCK1, &sigset, NULL((void *)0));
} else
   (void) signal(SIGINT2, SIG_DFL(void (*)(int))0);
gointr = 0;
  }
  else if (eq((vv = strip(vv)), STRminus)(Strcmp((vv = strip(vv)), STRminus) == 0)) {
(void) signal(SIGINT2, SIG_IGN(void (*)(int))1);
gointr = Strsave(STRminus);
  }
  else {
gointr = Strsave(vv);
(void) signal(SIGINT2, pintr);
  }
147}

149void
150donohup(Char **v, struct command *t)
151{
  if (intty)
stderror(ERR_NAME0x10000000 | ERR_TERMINAL47);
  if (setintr == 0) {
(void) signal(SIGHUP1, SIG_IGN(void (*)(int))1);
  }
157}

159void
160dozip(Char **v, struct command *t)
161{
  ;
163}

165void
166prvars(void)
167{
  plist(&shvhed);
169}

171void
172doalias(Char **v, struct command *t)
173{
  struct varent *vp;
  Char *p;

  v++;
  p = *v++;
  if (p == 0)
plist(&aliases);
  else if (*v == 0) {
vp = adrof1(strip(p), &aliases);
if (vp) {
   blkpr(cshout, vp->vec);
   fputc('\n', cshout);
}
  }
  else {
if (eq(p, STRalias)(Strcmp(p, STRalias) == 0) || eq(p, STRunalias)(Strcmp(p, STRunalias) == 0)) {
   setname(vis_str(p))(bname = (vis_str(p)));
   stderror(ERR_NAME0x10000000 | ERR_DANGER17);
}
set1(strip(p), saveblk(v), &aliases);
  }
195}

197void
198unalias(Char **v, struct command *t)
199{
  unset1(v, &aliases);
201}

203void
204dologout(Char **v, struct command *t)
205{
  islogin();
  goodbye();
208}

210void
211dologin(Char **v, struct command *t)
212{
  islogin();
  rechist();
  (void) signal(SIGTERM15, parterm);
  (void) execl(_PATH_LOGIN"/usr/bin/login", "login", short2str(v[1]), (char *)NULL((void *)0));
  untty();
  xexit(1);
219}

221static void
222islogin(void)
223{
  if (chkstop == 0 && setintr)
panystop(0);
  if (loginsh)
return;
  stderror(ERR_NOTLOGIN71);
229}

231void
232doif(Char **v, struct command *kp)
233{
  int i;
  Char **vv;

  v++;
  i = expr(&v);
  vv = v;
  if (*vv == NULL((void *)0))
stderror(ERR_NAME0x10000000 | ERR_EMPTYIF18);
  if (eq(*vv, STRthen)(Strcmp(*vv, STRthen) == 0)) {
if (*++vv)
   stderror(ERR_NAME0x10000000 | ERR_IMPRTHEN19);
setname(vis_str(STRthen))(bname = (vis_str(STRthen)));
/*
* If expression was zero, then scan to else, otherwise just fall into
* following code.
*/
if (!i)
   search(T_IF11, 0, NULL((void *)0));
return;
  }
  /*
   * Simple command attached to this if. Left shift the node in this tree,
   * munging it so we can reexecute it.
   */
  if (i) {
lshift(kp->t_dcom, vv - kp->t_dcom);
reexecute(kp);
donefds();
  }
263}

265/*
* Reexecute a command, being careful not
* to redo i/o redirection, which is already set up.
*/
269static void
270reexecute(struct command *kp)
271{
  kp->t_dflg &= F_SAVE((1<<11)|(1<<13)|(1<<12));
  kp->t_dflg |= F_REPEAT(1<<10);
  /*
   * If tty is still ours to arbitrate, arbitrate it; otherwise dont even set
   * pgrp's as the jobs would then have no way to get the tty (we can't give
   * it to them, and our parent wouldn't know their pgrp, etc.
   */
  execute(kp, (tpgrp > 0 ? tpgrp : -1), NULL((void *)0), NULL((void *)0));
280}

282void
283doelse(Char **v, struct command *t)
284{
  search(T_ELSE4, 0, NULL((void *)0));
286}

288void
289dogoto(Char **v, struct command *t)
290{
  Char   *lp;

  gotolab(lp = globone(v[1], G_ERROR0));
  free(lp);
295}

297void
298gotolab(Char *lab)
299{
  struct whyle *wp;
  /*
   * While we still can, locate any unknown ends of existing loops. This
   * obscure code is the WORST result of the fact that we don't really parse.
   */
  zlast = T_GOTO10;
  for (wp = whyles; wp; wp = wp->w_next)
if (wp->w_end.type == F_SEEK1 && wp->w_end.f_seekfc._f_seek == 0) {
   search(T_BREAK0, 0, NULL((void *)0));
   btell(&wp->w_end);
}
else
   bseek(&wp->w_end);
  search(T_GOTO10, 0, lab);
  /*
   * Eliminate loops which were exited.
   */
  wfree();
318}

320void
321doswitch(Char **v, struct command *t)
322{
  Char *cp, *lp;

  v++;
  if (!*v || *(*v++) != '(')
stderror(ERR_SYNTAX0);
  cp = **v == ')' ? STRNULL : *v++;
  if (*(*v++) != ')')
v--;
  if (*v)
stderror(ERR_SYNTAX0);
  search(T_SWITCH15, 0, lp = globone(cp, G_ERROR0));
  free(lp);
335}

337void
338dobreak(Char **v, struct command *t)
339{
  if (whyles)
toend();
  else
stderror(ERR_NAME0x10000000 | ERR_NOTWHILE48);
344}

346void
347doexit(Char **v, struct command *t)
348{
  if (chkstop == 0 && (intty || intact) && evalvec == 0)
panystop(0);
  /*
   * Don't DEMAND parentheses here either.
   */
  v++;
  if (*v) {
set(STRstatus, putn(expr(&v)));
if (*v)
   stderror(ERR_NAME0x10000000 | ERR_EXPRESSION34);
  }
  btoeof();
  if (intty)
(void) close(SHIN);
363}

365void
366doforeach(Char **v, struct command *t)
367{
  Char *cp, *sp;
  struct whyle *nwp;

  v++;
  sp = cp = strip(*v);
  if (!letter(*sp)(((*sp) & 0100000U) ? 0 : (isalpha((unsigned char) (*sp))
 || (*sp) == '_')))
stderror(ERR_NAME0x10000000 | ERR_VARBEGIN30);
  while (*cp && alnum(*cp)(((*cp) & 0100000U) ? 0 : (isalnum((unsigned char) (*cp))
 || (*cp) == '_')))
cp++;
  if (*cp)
stderror(ERR_NAME0x10000000 | ERR_VARALNUM32);
  if ((cp - sp) > MAXVARLEN30)
stderror(ERR_NAME0x10000000 | ERR_VARTOOLONG31);
  cp = *v++;
  if (v[0][0] != '(' || v[blklen(v) - 1][0] != ')')
stderror(ERR_NAME0x10000000 | ERR_NOPAREN20);
  v++;
  gflag = 0, tglob(v);
  v = globall(v);
  if (v == 0)
stderror(ERR_NAME0x10000000 | ERR_NOMATCH50);
  nwp = xcalloc(1, sizeof *nwp);
  nwp->w_fe = nwp->w_fe0 = v;
  gargv = 0;
  btell(&nwp->w_start);
  nwp->w_fename = Strsave(cp);
  nwp->w_next = whyles;
  nwp->w_end.type = F_SEEK1;
  whyles = nwp;
  /*
   * Pre-read the loop so as to be more comprehensible to a terminal user.
   */
  zlast = T_FOREACH9;
  if (intty)
preread();
  doagain();
404}

406void
407dowhile(Char **v, struct command *t)
408{
  int status;
  bool again = whyles != 0 && SEEKEQ(&whyles->w_start, &lineloc)((&whyles->w_start)->type == (&lineloc)->type
 && (&whyles->w_start)->fc._f_seek == (&
lineloc)->fc._f_seek && (&whyles->w_start)->
a_seek == (&lineloc)->a_seek) &&
  whyles->w_fename == 0;

  v++;
  /*
   * Implement prereading here also, taking care not to evaluate the
   * expression before the loop has been read up from a terminal.
   */
  if (intty && !again)
status = !exp0(&v, 1);
  else
status = !expr(&v);
  if (*v)
stderror(ERR_NAME0x10000000 | ERR_EXPRESSION34);
  if (!again) {
struct whyle *nwp = xcalloc(1, sizeof(*nwp));

nwp->w_start = lineloc;
nwp->w_end.type = F_SEEK1;
nwp->w_end.f_seekfc._f_seek = 0;
nwp->w_next = whyles;
whyles = nwp;
zlast = T_WHILE18;
if (intty) {
   /*
    * The tty preread
    */
   preread();
   doagain();
   return;
}
  }
  if (status)
/* We ain't gonna loop no more, no more! */
toend();
445}

447static void
448preread(void)
449{
  sigset_t sigset;

  whyles->w_end.type = I_SEEK-1;
  if (setintr) {
sigemptyset(&sigset);
sigaddset(&sigset, SIGINT2);
sigprocmask(SIG_UNBLOCK2, &sigset, NULL((void *)0));
  }

  search(T_BREAK0, 0, NULL((void *)0));		/* read the expression in */
  if (setintr)
sigprocmask(SIG_BLOCK1, &sigset, NULL((void *)0));
  btell(&whyles->w_end);
463}

465void
466doend(Char **v, struct command *t)
467{
  if (!whyles)
stderror(ERR_NAME0x10000000 | ERR_NOTWHILE48);
  btell(&whyles->w_end);
  doagain();
472}

474void
475docontin(Char **v, struct command *t)
476{
  if (!whyles)
stderror(ERR_NAME0x10000000 | ERR_NOTWHILE48);
  doagain();
480}

482static void
483doagain(void)
484{
  /* Repeating a while is simple */
  if (whyles->w_fename == 0) {
bseek(&whyles->w_start);
return;
  }
  /*
   * The foreach variable list actually has a spurious word ")" at the end of
   * the w_fe list.  Thus we are at the of the list if one word beyond this
   * is 0.
   */
  if (!whyles->w_fe[1]) {
dobreak(NULL((void *)0), NULL((void *)0));
return;
  }
  set(whyles->w_fename, Strsave(*whyles->w_fe++));
  bseek(&whyles->w_start);
501}

503void
504dorepeat(Char **v, struct command *kp)
505{
  int i;
  sigset_t sigset;

  i = getn(v[1]);
  if (setintr) {
sigemptyset(&sigset);
sigaddset(&sigset, SIGINT2);
sigprocmask(SIG_BLOCK1, &sigset, NULL((void *)0));
  }
  lshift(v, 2);
  while (i > 0) {
if (setintr)
   sigprocmask(SIG_UNBLOCK2, &sigset, NULL((void *)0));
reexecute(kp);
--i;
  }
  donefds();
  if (setintr)
sigprocmask(SIG_UNBLOCK2, &sigset, NULL((void *)0));
525}

527void
528doswbrk(Char **v, struct command *t)
529{
  search(T_BRKSW1, 0, NULL((void *)0));
531}

533int
534srchx(Char *cp)
535{
  struct srch *sp, *sp1, *sp2;
  int i;

  /*
   * Binary search Sp1 is the beginning of the current search range. Sp2 is
   * one past the end.
   */
  for (sp1 = srchn, sp2 = srchn + nsrchn; sp1 < sp2;) {
sp = sp1 + ((sp2 - sp1) >> 1);
if ((i = *cp - *sp->s_name) == 0 &&
   (i = Strcmp(cp, str2short(sp->s_name))) == 0)
   return sp->s_value;
if (i < 0)
   sp2 = sp;
else
   sp1 = sp + 1;
  }
  return (-1);
554}

556static Char Stype;
557static Char *Sgoal;

559static void
560search(int type, int level, Char *goal)
561{
  Char    wordbuf[BUFSIZ1024];
  Char *aword = wordbuf;
  Char *cp;

  Stype = type;
  Sgoal = goal;
  if (type == T_GOTO10) {
struct Ain a;
a.type = F_SEEK1;
a.f_seekfc._f_seek = 0;
bseek(&a);
  }
  do {
needprompt = intty && fseekpB.Bfseekp == feobpB.Bfeobp && aret == F_SEEK1;
if (!filec && needprompt)
   (void) fprintf(cshout, "? "), (void) fflush(cshout);
aword[0] = 0;
(void) getword(aword);
switch (srchx(aword)) {

case T_ELSE4:
   if (level == 0 && type == T_IF11)
return;
   break;

case T_IF11:
   while (getword(aword))
continue;
   if ((type == T_IF11 || type == T_ELSE4) &&
eq(aword, STRthen)(Strcmp(aword, STRthen) == 0))
level++;
   break;

case T_ENDIF6:
   if (type == T_IF11 || type == T_ELSE4)
level--;
   break;

case T_FOREACH9:
case T_WHILE18:
   if (type == T_BREAK0)
level++;
   break;

case T_END5:
   if (type == T_BREAK0)
level--;
   break;

case T_SWITCH15:
   if (type == T_SWITCH15 || type == T_BRKSW1)
level++;
   break;

case T_ENDSW7:
   if (type == T_SWITCH15 || type == T_BRKSW1)
level--;
   break;

case T_LABEL12:
   if (type == T_GOTO10 && getword(aword) && eq(aword, goal)(Strcmp(aword, goal) == 0))
level = -1;
   break;

default:
   if (type != T_GOTO10 && (type != T_SWITCH15 || level != 0))
break;
   if (lastchr(aword) != ':')
break;
   aword[Strlen(aword) - 1] = 0;
   if ((type == T_GOTO10 && eq(aword, goal)(Strcmp(aword, goal) == 0)) ||
(type == T_SWITCH15 && eq(aword, STRdefault)(Strcmp(aword, STRdefault) == 0)))
level = -1;
   break;

case T_CASE2:
   if (type != T_SWITCH15 || level != 0)
break;
   (void) getword(aword);
   if (lastchr(aword) == ':')
aword[Strlen(aword) - 1] = 0;
   cp = strip(Dfix1(aword));
   if (Gmatch(goal, cp))
level = -1;
   free(cp);
   break;

case T_DEFAULT3:
   if (type == T_SWITCH15 && level == 0)
level = -1;
   break;
}
(void) getword(NULL((void *)0));
  } while (level >= 0);
656}

658static int
659getword(Char *wp)
660{
  int found = 0;
  int c, d;
  int     kwd = 0;
  Char   *owp = wp;

  c = readc(1);
  d = 0;
  do {
while (c == ' ' || c == '\t')
   c = readc(1);
if (c == '#')
   do
c = readc(1);
   while (c >= 0 && c != '\n');
if (c < 0)
   goto past;
if (c == '\n') {
   if (wp)
break;
   return (0);
}
unreadc(c);
found = 1;
do {
   c = readc(1);
   if (c == '\\' && (c = readc(1)) == '\n')
c = ' ';
   if (c == '\'' || c == '"') {
if (d == 0)
    d = c;
else if (d == c)
    d = 0;
   }
   if (c < 0)
goto past;
   if (wp) {
*wp++ = c;
*wp = 0;	/* end the string b4 test */
   }
} while ((d || (!(kwd = keyword(owp)) && c != ' '
  && c != '\t')) && c != '\n');
  } while (wp == 0);

  /*
   * if we have read a keyword ( "if", "switch" or "while" ) then we do not
   * need to unreadc the look-ahead char
   */
  if (!kwd) {
unreadc(c);
if (found)
   *--wp = 0;
  }

  return (found);

716past:
  switch (Stype) {

  case T_IF11:
stderror(ERR_NAME0x10000000 | ERR_NOTFOUND21, "then/endif");

  case T_ELSE4:
stderror(ERR_NAME0x10000000 | ERR_NOTFOUND21, "endif");

  case T_BRKSW1:
  case T_SWITCH15:
stderror(ERR_NAME0x10000000 | ERR_NOTFOUND21, "endsw");

  case T_BREAK0:
stderror(ERR_NAME0x10000000 | ERR_NOTFOUND21, "end");

  case T_GOTO10:
setname(vis_str(Sgoal))(bname = (vis_str(Sgoal)));
stderror(ERR_NAME0x10000000 | ERR_NOTFOUND21, "label");
  }
  /* NOTREACHED */
  return (0);
738}

740/*
* keyword(wp) determines if wp is one of the built-n functions if,
* switch or while. It seems that when an if statement looks like
* "if(" then getword above sucks in the '(' and so the search routine
* never finds what it is scanning for. Rather than rewrite doword, I hack
* in a test to see if the string forms a keyword. Then doword stops
* and returns the word "if" -strike
*/

749static int
750keyword(Char *wp)
751{
  static Char STRif[] = {'i', 'f', '\0'};
  static Char STRwhile[] = {'w', 'h', 'i', 'l', 'e', '\0'};
  static Char STRswitch[] = {'s', 'w', 'i', 't', 'c', 'h', '\0'};

  if (!wp)
return (0);

  if ((Strcmp(wp, STRif) == 0) || (Strcmp(wp, STRwhile) == 0)
|| (Strcmp(wp, STRswitch) == 0))
return (1);

  return (0);
764}

766static void
767toend(void)
768{
  if (whyles->w_end.type == F_SEEK1 && whyles->w_end.f_seekfc._f_seek == 0) {
search(T_BREAK0, 0, NULL((void *)0));
btell(&whyles->w_end);
whyles->w_end.f_seekfc._f_seek--;
  }
  else
bseek(&whyles->w_end);
  wfree();
777}

779void
780wfree(void)
781{
  struct Ain    o;
  struct whyle *nwp;

  btell(&o);

  for (; whyles; whyles = nwp) {
struct whyle *wp = whyles;
nwp = wp->w_next;

/*
* We free loops that have different seek types.
*/
if (wp->w_end.type != I_SEEK-1 && wp->w_start.type == wp->w_end.type &&
   wp->w_start.type == o.type) {
   if (wp->w_end.type == F_SEEK1) {
if (o.f_seekfc._f_seek >= wp->w_start.f_seekfc._f_seek &&
    (wp->w_end.f_seekfc._f_seek == 0 || o.f_seekfc._f_seek < wp->w_end.f_seekfc._f_seek))
    break;
   }
   else {
if (o.a_seek >= wp->w_start.a_seek &&
    (wp->w_end.a_seek == 0 || o.a_seek < wp->w_end.a_seek))
    break;
   }
}

blkfree(wp->w_fe0);
free(wp->w_fename);
free(wp);
  }
812}

814void
815doecho(Char **v, struct command *t)
816{
  xecho(' ', v);
818}

820void
821doglob(Char **v, struct command *t)
822{
  xecho(0, v);
1
Calling 'xecho'→
  (void) fflush(cshout);
825}

827static void
828xecho(int sep, Char **v)
829{
  Char *cp;
  int     nonl = 0;
  sigset_t sigset;

  if (setintr) {
2
←
Assuming 'setintr' is 0→
3
←
Taking false branch→
sigemptyset(&sigset);
sigaddset(&sigset, SIGINT2);
sigprocmask(SIG_UNBLOCK2, &sigset, NULL((void *)0));
  }
  v++;
  if (*v == 0)
4
←
Assuming the condition is false→
5
←
Taking false branch→
return;
  gflag = 0, tglob(v);
  if (gflag) {
6
←
Assuming 'gflag' is not equal to 0→
7
←
Taking true branch→
v = globall(v);
8
←
Value assigned to 'v'→
if (v == 0)
9
←
Assuming 'v' is equal to null→
10
←
Assuming pointer value is null→
11
←
Taking true branch→
   stderror(ERR_NAME0x10000000 | ERR_NOMATCH50);
  }
  else {
v = gargv = saveblk(v);
trim(v);
  }
  if (sep == ' ' && *v && eq(*v, STRmn)(Strcmp(*v, STRmn) == 0))
nonl++, v++;
  while ((cp = *v++) != NULL((void *)0)) {
12
←
Dereference of null pointer
int c;

while ((c = *cp++) != '\0')
   (void) vis_fputc(c | QUOTE0100000U, cshout);

if (*v)
   (void) vis_fputc(sep | QUOTE0100000U, cshout);
  }
  if (sep && nonl == 0)
(void) fputc('\n', cshout);
  else
(void) fflush(cshout);
  if (setintr)
sigprocmask(SIG_BLOCK1, &sigset, NULL((void *)0));
blkfree(gargv);
gargv = NULL((void *)0);
871}

873void
874dosetenv(Char **v, struct command *t)
875{
  Char   *vp, *lp;
  sigset_t sigset;

  v++;
  if ((vp = *v++) == 0) {
Char **ep;

if (setintr) {
   sigemptyset(&sigset);
   sigaddset(&sigset, SIGINT2);
   sigprocmask(SIG_UNBLOCK2, &sigset, NULL((void *)0));
}
for (ep = STR_environ; *ep; ep++)
   (void) fprintf(cshout, "%s\n", vis_str(*ep));
return;
  }
  if ((lp = *v++) == 0)
lp = STRNULL;
  Setenv(vp, lp = globone(lp, G_APPEND2));
  if (eq(vp, STRPATH)(Strcmp(vp, STRPATH) == 0)) {
importpath(lp);
dohash(NULL((void *)0), NULL((void *)0));
  }
  free(lp);
900}

902void
903dounsetenv(Char **v, struct command *t)
904{
  Char  **ep, *p, *n, *name;
  int     i, maxi;

  /*
   * Find the longest environment variable
   */
  for (maxi = 0, ep = STR_environ; *ep; ep++) {
for (i = 0, p = *ep; *p && *p != '='; p++, i++)
   continue;
if (i > maxi)
   maxi = i;
  }

  name = xreallocarray(NULL((void *)0), maxi + 1, sizeof(Char));

  while (++v && *v)
for (maxi = 1; maxi;)
   for (maxi = 0, ep = STR_environ; *ep; ep++) {
for (n = name, p = *ep; *p && *p != '='; *n++ = *p++)
    continue;
*n = '\0';
if (!Gmatch(name, *v))
    continue;
maxi = 1;
/*
 * Delete name, and start again cause the environment changes
 */
Unsetenv(name);
break;
   }
  free(name);
936}

938void
939Setenv(Char *name, Char *val)
940{
  Char **ep = STR_environ;
  Char *cp, *dp;
  Char   *blk[2];
  Char  **oep = ep;

  for (; *ep; ep++) {
for (cp = name, dp = *ep; *cp && *cp == *dp; cp++, dp++)
   continue;
if (*cp != 0 || *dp != '=')
   continue;
cp = Strspl(STRequal, val);
free(* ep);
*ep = strip(Strspl(name, cp));
free(cp);
blkfree((Char **) environ);
environ = short2blk(STR_environ);
return;
  }
  cp = Strspl(name, STRequal);
  blk[0] = strip(Strspl(cp, val));
  free(cp);
  blk[1] = 0;
  STR_environ = blkspl(STR_environ, blk);
  blkfree((Char **) environ);
  environ = short2blk(STR_environ);
  free(oep);
967}

969static void
970Unsetenv(Char *name)
971{
  Char **ep = STR_environ;
  Char *cp, *dp;
  Char  **oep = ep;

  for (; *ep; ep++) {
for (cp = name, dp = *ep; *cp && *cp == *dp; cp++, dp++)
   continue;
if (*cp != 0 || *dp != '=')
   continue;
cp = *ep;
*ep = 0;
STR_environ = blkspl(STR_environ, ep + 1);
environ = short2blk(STR_environ);
*ep = cp;
free(cp);
free(oep);
return;
  }
990}

992void
993doumask(Char **v, struct command *t)
994{
  Char *cp = v[1];
  int i;

  if (cp == 0) {
i = umask(0);
(void) umask(i);
(void) fprintf(cshout, "%o\n", i);
return;
  }
  i = 0;
  while (Isdigit(*cp)(((*cp) & 0100000U) ? 0 : isdigit((unsigned char) (*cp))) && *cp != '8' && *cp != '9')
i = i * 8 + *cp++ - '0';
  if (*cp || i < 0 || i > 0777)
stderror(ERR_NAME0x10000000 | ERR_MASK22);
  (void) umask(i);
1010}

1012static struct limits {
  int     limconst;
  char   *limname;
  int     limdiv;
  char   *limscale;
1017}       limits[] = {
  { RLIMIT_CPU0,	"cputime",	1,	"seconds" },
  { RLIMIT_FSIZE1,	"filesize",	1024,	"kbytes" },
  { RLIMIT_DATA2,	"datasize",	1024,	"kbytes" },
  { RLIMIT_STACK3,	"stacksize",	1024,	"kbytes" },
  { RLIMIT_CORE4,	"coredumpsize", 1024,	"kbytes" },
  { RLIMIT_RSS5,	"memoryuse",	1024,	"kbytes" },
1024#ifdef RLIMIT_VMEM
  { RLIMIT_VMEM,	"vmemoryuse",	1024,	"kbytes" },
1026#endif
  { RLIMIT_MEMLOCK6,	"memorylocked",	1024,	"kbytes" },
  { RLIMIT_NPROC7,	"maxproc",	1,	"" },
  { RLIMIT_NOFILE8,	"openfiles",	1,	"" },
  { -1,		NULL((void *)0),		0,	NULL((void *)0) }
1031};

1033static struct limits *findlim(Char *);
1034static rlim_t getval(struct limits *, Char **);
1035static void limtail(Char *, char *);
1036static void plim(struct limits *, Char);
1037static int setlim(struct limits *, Char, rlim_t);

1039static struct limits *
1040findlim(Char *cp)
1041{
  struct limits *lp, *res;

  res = NULL((void *)0);
  for (lp = limits; lp->limconst >= 0; lp++)
if (prefix(cp, str2short(lp->limname))) {
   if (res)
stderror(ERR_NAME0x10000000 | ERR_AMBIG40);
   res = lp;
}
  if (res)
return (res);
  stderror(ERR_NAME0x10000000 | ERR_LIMIT23);
  /* NOTREACHED */
  return (0);
1056}

1058void
1059dolimit(Char **v, struct command *t)
1060{
  struct limits *lp;
  rlim_t limit;
  char    hard = 0;

  v++;
  if (*v && eq(*v, STRmh)(Strcmp(*v, STRmh) == 0)) {
hard = 1;
v++;
  }
  if (*v == 0) {
for (lp = limits; lp->limconst >= 0; lp++)
   plim(lp, hard);
return;
  }
  lp = findlim(v[0]);
  if (v[1] == 0) {
plim(lp, hard);
return;
  }
  limit = getval(lp, v + 1);
  if (setlim(lp, hard, limit) == -1)
stderror(ERR_SILENT0x20000000);
1083}

1085static  rlim_t
1086getval(struct limits *lp, Char **v)
1087{
  float f;
  Char   *cp = *v++;

  f = atof(short2str(cp));

  while (Isdigit(*cp)(((*cp) & 0100000U) ? 0 : isdigit((unsigned char) (*cp))) || *cp == '.' || *cp == 'e' || *cp == 'E')
cp++;
  if (*cp == 0) {
if (*v == 0)
   return ((rlim_t) ((f + 0.5) * lp->limdiv));
cp = *v;
  }
  switch (*cp) {
  case ':':
if (lp->limconst != RLIMIT_CPU0)
   goto badscal;
return ((rlim_t) (f * 60.0 + atof(short2str(cp + 1))));
  case 'h':
if (lp->limconst != RLIMIT_CPU0)
   goto badscal;
limtail(cp, "hours");
f *= 3600.0;
break;
  case 'm':
if (lp->limconst == RLIMIT_CPU0) {
   limtail(cp, "minutes");
   f *= 60.0;
   break;
}
*cp = 'm';
limtail(cp, "megabytes");
f *= 1024.0 * 1024.0;
break;
  case 's':
if (lp->limconst != RLIMIT_CPU0)
   goto badscal;
limtail(cp, "seconds");
break;
  case 'M':
if (lp->limconst == RLIMIT_CPU0)
   goto badscal;
*cp = 'm';
limtail(cp, "megabytes");
f *= 1024.0 * 1024.0;
break;
  case 'k':
if (lp->limconst == RLIMIT_CPU0)
   goto badscal;
limtail(cp, "kbytes");
f *= 1024.0;
break;
  case 'u':
limtail(cp, "unlimited");
return (RLIM_INFINITY(((rlim_t)1 << 63) - 1));
  default:
1143badscal:
stderror(ERR_NAME0x10000000 | ERR_SCALEF25);
  }
  f += 0.5;
  if (f > (float) RLIM_INFINITY(((rlim_t)1 << 63) - 1))
return RLIM_INFINITY(((rlim_t)1 << 63) - 1);
  else
return ((rlim_t) f);
1151}

1153static void
1154limtail(Char *cp, char *str)
1155{
  char *origstr = str;

  while (*cp && *cp == *str)
cp++, str++;
  if (*cp)
stderror(ERR_BADSCALE74, origstr);
1162}

1164static void
1165plim(struct limits *lp, Char hard)
1166{
  struct rlimit rlim;
  rlim_t limit;

  (void) fprintf(cshout, "%s \t", lp->limname);

  (void) getrlimit(lp->limconst, &rlim);
  limit = hard ? rlim.rlim_max : rlim.rlim_cur;

  if (limit == RLIM_INFINITY(((rlim_t)1 << 63) - 1))
(void) fprintf(cshout, "unlimited");
  else if (lp->limconst == RLIMIT_CPU0)
psecs((long) limit);
  else
(void) fprintf(cshout, "%llu %s",
   (unsigned long long) (limit / lp->limdiv), lp->limscale);
  (void) fputc('\n', cshout);
1183}

1185void
1186dounlimit(Char **v, struct command *t)
1187{
  struct limits *lp;
  int     lerr = 0;
  Char    hard = 0;

  v++;
  if (*v && eq(*v, STRmh)(Strcmp(*v, STRmh) == 0)) {
hard = 1;
v++;
  }
  if (*v == 0) {
for (lp = limits; lp->limconst >= 0; lp++)
   if (setlim(lp, hard, RLIM_INFINITY(((rlim_t)1 << 63) - 1)) == -1)
lerr++;
if (lerr)
   stderror(ERR_SILENT0x20000000);
return;
  }
  while (*v) {
lp = findlim(*v++);
if (setlim(lp, hard, RLIM_INFINITY(((rlim_t)1 << 63) - 1)) == -1)
   stderror(ERR_SILENT0x20000000);
  }
1210}

1212static int
1213setlim(struct limits *lp, Char hard, rlim_t limit)
1214{
  struct rlimit rlim;

  (void) getrlimit(lp->limconst, &rlim);

  if (hard)
rlim.rlim_max = limit;
  else if (limit == RLIM_INFINITY(((rlim_t)1 << 63) - 1) && geteuid() != 0)
rlim.rlim_cur = rlim.rlim_max;
  else
rlim.rlim_cur = limit;

  if (rlim.rlim_max < rlim.rlim_cur)
rlim.rlim_max = rlim.rlim_cur;

  if (setrlimit(lp->limconst, &rlim) == -1) {
(void) fprintf(csherr, "%s: %s: Can't %s%s limit\n", bname, lp->limname,
       limit == RLIM_INFINITY(((rlim_t)1 << 63) - 1) ? "remove" : "set",
       hard ? " hard" : "");
return (-1);
  }
  return (0);
1236}

1238void
1239dosuspend(Char **v, struct command *t)
1240{
  int     ctpgrp;

  void    (*old) (int);

  if (loginsh)
stderror(ERR_SUSPLOG75);
  untty();

  old = signal(SIGTSTP18, SIG_DFL(void (*)(int))0);
  (void) kill(0, SIGTSTP18);
  /* the shell stops here */
  (void) signal(SIGTSTP18, old);

  if (tpgrp != -1) {
1255retry:
ctpgrp = tcgetpgrp(FSHTTY15);
    if  (ctpgrp != opgrp) {
   old = signal(SIGTTIN21, SIG_DFL(void (*)(int))0);
   (void) kill(0, SIGTTIN21);
   (void) signal(SIGTTIN21, old);
 goto retry;
}
(void) setpgid(0, shpgrp);
(void) tcsetpgrp(FSHTTY15, shpgrp);
  }
1266}

1268/* This is the dreaded EVAL built-in.
*   If you don't fiddle with file descriptors, and reset didfds,
*   this command will either ignore redirection inside or outside
*   its arguments, e.g. eval "date >x"  vs.  eval "date" >x
*   The stuff here seems to work, but I did it by trial and error rather
*   than really knowing what was going on.  If tpgrp is zero, we are
*   probably a background eval, e.g. "eval date &", and we want to
*   make sure that any processes we start stay in our pgrp.
*   This is also the case for "time eval date" -- stay in same pgrp.
*   Otherwise, under stty tostop, processes will stop in the wrong
*   pgrp, with no way for the shell to get them going again.  -IAN!
*/

1281static Char **gv = NULL((void *)0);

1283void
1284doeval(Char **v, struct command *t)
1285{
  Char  **oevalvec;
  Char   *oevalp;
  int     odidfds;
  jmp_buf osetexit;
  int     my_reenter;
  Char  **savegv = gv;
  int     saveIN;
  int     saveOUT;
  int     saveERR;
  int     oSHIN;
  int     oSHOUT;
  int     oSHERR;

  UNREGISTER(v)(void) &v;

  oevalvec = evalvec;
  oevalp = evalp;
  odidfds = didfds;
  oSHIN = SHIN;
  oSHOUT = SHOUT;
  oSHERR = SHERR;

  v++;
  if (*v == 0)
return;
  gflag = 0, tglob(v);
  if (gflag) {
gv = v = globall(v);
gargv = 0;
if (v == 0)
   stderror(ERR_NOMATCH50);
v = copyblk(v);
  }
  else {
gv = NULL((void *)0);
v = copyblk(v);
trim(v);
  }

  saveIN = dcopy(SHIN, -1);
  saveOUT = dcopy(SHOUT, -1);
  saveERR = dcopy(SHERR, -1);

  getexit(osetexit)memcpy((osetexit), reslab, sizeof reslab);

  if ((my_reenter = setexit()(setjmp(reslab))) == 0) {
evalvec = v;
evalp = 0;
SHIN = dcopy(0, -1);
SHOUT = dcopy(1, -1);
SHERR = dcopy(2, -1);
didfds = 0;
process(0);
  }

  evalvec = oevalvec;
  evalp = oevalp;
  doneinp = 0;
  didfds = odidfds;
  (void) close(SHIN);
  (void) close(SHOUT);
  (void) close(SHERR);
  SHIN = dmove(saveIN, oSHIN);
  SHOUT = dmove(saveOUT, oSHOUT);
  SHERR = dmove(saveERR, oSHERR);
  blkfree(gv);
  gv = NULL((void *)0);
  resexit(osetexit)memcpy(reslab, (osetexit), sizeof reslab);
  gv = savegv;
  if (my_reenter)
stderror(ERR_SILENT0x20000000);
1357}