/usr/src/usr.sbin/pppd/chat/chat.c

Bug Summary

File:	src/usr.sbin/pppd/chat/chat.c
Warning:	line 794, column 11 Dereference of null pointer
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name chat.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/pppd/chat/obj -resource-dir /usr/local/llvm16/lib/clang/16 -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/pppd/chat/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/usr.sbin/pppd/chat/chat.c
1/*	$OpenBSD: chat.c,v 1.35 2016/04/05 21:24:02 krw Exp $	*/

3/*
*	Chat -- a program for automatic session establishment (i.e. dial
*		the phone and log in).
*
* Standard termination codes:
*  0 - successful completion of the script
*  1 - invalid argument, expect string too large, etc.
*  2 - error on an I/O operation or fatal error condition.
*  3 - timeout waiting for a simple string.
*  4 - the first string declared as "ABORT"
*  5 - the second string declared as "ABORT"
*  6 - ... and so on for successive ABORT strings.
*
*	This software is in the public domain.
*
* -----------------
*	added -T and -U option and \T and \U substitution to pass a phone
*	number into chat script. Two are needed for some ISDN TA applications.
*	Keith Dart <kdart@cisco.com>
*	
*
*	Added SAY keyword to send output to stderr.
*      This allows to turn ECHO OFF and to output specific, user selected,
*      text to give progress messages. This best works when stderr
*      exists (i.e.: pppd in nodetach mode).
*
* 	Added HANGUP directives to allow for us to be called
*      back. When HANGUP is set to NO, chat will not hangup at HUP signal.
*      We rely on timeouts in that case.
*
*      Added CLR_ABORT to clear previously set ABORT string. This has been
*      dictated by the HANGUP above as "NO CARRIER" (for example) must be
*      an ABORT condition until we know the other host is going to close
*      the connection for call back. As soon as we have completed the
*      first stage of the call back sequence, "NO CARRIER" is a valid, non
*      fatal string. As soon as we got called back (probably get "CONNECT"),
*      we should re-arm the ABORT "NO CARRIER". Hence the CLR_ABORT command.
*      Note that CLR_ABORT packs the abort_strings[] array so that we do not
*      have unused entries not being reclaimed.
*
*      In the same vein as above, added CLR_REPORT keyword.
*
*      Allow for comments. Line starting with '#' are comments and are
*      ignored. If a '#' is to be expected as the first character, the 
*      expect string must be quoted.
*
*
*		Francis Demierre <Francis@SwissMail.Com>
* 		Thu May 15 17:15:40 MET DST 1997
*
*
*      Added -r "report file" switch & REPORT keyword.
*              Robert Geer <bgeer@xmission.com>
*
*      Added -s "use stderr" and -S "don't use syslog" switches.
*              June 18, 1997
*              Karl O. Pinc <kop@meme.com>
*
*
*	Added -e "echo" switch & ECHO keyword
*		Dick Streefland <dicks@tasking.nl>
*
*
*	Considerable updates and modifications by
*		Al Longyear <longyear@pobox.com>
*		Paul Mackerras <paulus@cs.anu.edu.au>
*
*
*	The original author is:
*
*		Karl Fox <karl@MorningStar.Com>
*		Morning Star Technologies, Inc.
*		1760 Zollinger Road
*		Columbus, OH  43221
*		(614)451-1883
*
*
*/

82#include <stdio.h>
83#include <ctype.h>
84#include <time.h>
85#include <fcntl.h>
86#include <signal.h>
87#include <errno(*__errno()).h>
88#include <string.h>
89#include <stdlib.h>
90#include <unistd.h>
91#include <sys/types.h>
92#include <sys/stat.h>
93#include <syslog.h>
94#include <stdarg.h>

96#ifndef TERMIO
97#undef	TERMIOS
98#define TERMIOS
99#endif

101#ifdef TERMIO
102#include <termio.h>
103#endif
104#ifdef TERMIOS
105#include <termios.h>
106#endif

108#define	STR_LEN1024	1024

110#ifndef SIGTYPEvoid
111#define SIGTYPEvoid void
112#endif

114#ifndef O_NONBLOCK0x0004
115#define O_NONBLOCK0x0004	O_NDELAY0x0004
116#endif

118#ifdef SUNOS
119extern int sys_nerr;
120extern char *sys_errlist[];
121#define memmove(to, from, n)	bcopy(from, to, n)
122#define strerror(n)		((unsigned)(n) < sys_nerr? sys_errlist[(n)] :\
		 "unknown error")
124#endif

126#define	MAX_ABORTS50		50
127#define	MAX_REPORTS50		50
128#define	DEFAULT_CHAT_TIMEOUT45	45

130int echo          = 0;
131int verbose       = 0;
132int to_log        = 1;
133int to_stderr     = 0;
134int Verbose       = 0;
135int quiet         = 0;
136int report        = 0;
137int exit_code     = 0;
138FILE* report_fp   = (FILE *) 0;
139char *report_file = (char *) 0;
140char *chat_file   = (char *) 0;
141char *phone_num   = (char *) 0;
142char *phone_num2  = (char *) 0;
143int timeout       = DEFAULT_CHAT_TIMEOUT45;

145int have_tty_parameters = 0;

147extern char *__progname;

149#ifdef TERMIO
150#define term_parmsstruct termios struct termio
151#define get_term_param(param)tcgetattr(0, param) ioctl(0, TCGETA, param)
152#define set_term_param(param)tcsetattr(0, 0, param) ioctl(0, TCSETA, param)
153struct termio saved_tty_parameters;
154#endif

156#ifdef TERMIOS
157#define term_parmsstruct termios struct termios
158#define get_term_param(param)tcgetattr(0, param) tcgetattr(0, param)
159#define set_term_param(param)tcsetattr(0, 0, param) tcsetattr(0, TCSANOW0, param)
160struct termios saved_tty_parameters;
161#endif

163char *abort_string[MAX_ABORTS50], *fail_reason = NULL((void *)0),
fail_buffer[50];
165int n_aborts = 0, abort_next = 0, timeout_next = 0, echo_next = 0;
166int clear_abort_next = 0;

168char *report_string[MAX_REPORTS50] ;
169char  report_buffer[50] ;
170int n_reports = 0, report_next = 0, report_gathering = 0 ; 
171int clear_report_next = 0;

173int say_next = 0, hup_next = 0;

175void *dup_mem(void *b, size_t c);
176void *copy_of(char *s);
177void usage(void);
178void logmsg(const char *fmt, ...);
179void fatal(int code, const char *fmt, ...);
180SIGTYPEvoid sigalrm(int signo);
181SIGTYPEvoid sigint(int signo);
182SIGTYPEvoid sigterm(int signo);
183SIGTYPEvoid sighup(int signo);
184void unalarm(void);
185void init(void);
186void set_tty_parameters(void);
187void echo_stderr(int);
188void break_sequence(void);
189void terminate(int status);
190void do_file(char *chat_file);
191int  get_string(register char *string);
192int  put_string(register char *s);
193int  write_char(int c);
194int  put_char(int c);
195int  get_char(void);
196void chat_send(register char *s);
197char *character(int c);
198void chat_expect(register char *s);
199char *clean(register char *s, int sending);
200void break_sequence(void);
201void terminate(int status);
202void pack_array(char **array, int end);
203char *expect_strtok(char *, char *);
204int vfmtmsg(char *, int, const char *, va_list);	/* vsnprintf++ */

206int main(int, char *[]);

208void *dup_mem(b, c)
209void *b;
210size_t c;
211{
  void *ans = malloc (c);
  if (!ans)
fatal(2, "memory error!");

  memcpy (ans, b, c);
  return ans;
218}

220void *copy_of (s)
221char *s;
222{
  return dup_mem (s, strlen (s) + 1);
224}

226/*
* chat [ -v ] [-T number] [-U number] [ -t timeout ] [ -f chat-file ] \
* [ -r report-file ] \
*		[...[[expect[-say[-expect...]] say expect[-say[-expect]] ...]]]
*
*	Perform a UUCP-dialer-like chat script on stdin and stdout.
*/
233int
234main(argc, argv)
   int argc;
   char **argv;
237{
  int option;

  tzset();

  while ((option = getopt(argc, argv, "esSvVt:r:f:T:U:")) != -1) {
switch (option) {
case 'e':
   echo = 1;
   break;

case 'v':
   verbose = 1;
   break;

case 'V':
   Verbose = 1;
   break;

case 's':
   to_stderr = 1;
   break;

case 'S':
   to_log = 0;
   break;

case 'f':
   chat_file = copy_of(optarg);
   break;

case 't':
   timeout = atoi(optarg);
   break;

case 'r':
   if (report_fp != NULL((void *)0))
fclose (report_fp);
   report_file = copy_of (optarg);
   report_fp   = fopen (report_file, "a");
   if (report_fp != NULL((void *)0)) {
if (verbose)
    fprintf (report_fp, "Opening \"%s\"...\n",
	     report_file);
report = 1;
   }
   break;

case 'T':
   phone_num = copy_of(optarg);
   break;

case 'U':
   phone_num2 = copy_of(optarg);
   break;

case ':':
   fprintf(stderr(&__sF[2]), "Option -%c requires an argument\n",
optopt);

default:
   usage();
   break;
}
  }
  argc -= optind;
  argv += optind;
304/*
* Default the report file to the stderr location
*/
  if (report_fp == NULL((void *)0))
report_fp = stderr(&__sF[2]);

  if (to_log) {
311#ifdef ultrix
openlog("chat", LOG_PID0x01);
313#else
openlog("chat", LOG_PID0x01 | LOG_NDELAY0x08, LOG_LOCAL2(18<<3));

if (verbose)
   setlogmask(LOG_UPTO(LOG_INFO)((1 << ((6)+1)) - 1));
else
   setlogmask(LOG_UPTO(LOG_WARNING)((1 << ((4)+1)) - 1));
320#endif
  }

  init();
  
  if (chat_file != NULL((void *)0)) {
if (argc > 0)
   usage();
else
   do_file (chat_file);
  } else {
while (argc-- > 0) {
   chat_expect(*argv++);

   if (argc-- > 0) {
chat_send(*argv++);
   }
}
  }

  terminate(0);
  return 0;
342}

344/*
*  Process a chat script when read from a file.
*/

348void do_file (chat_file)
349char *chat_file;
350{
  int linect, sendflg;
  char *sp, *arg, quote;
  char buf [STR_LEN1024];
  FILE *cfp;

  cfp = fopen (chat_file, "r");
  if (cfp == NULL((void *)0))
fatal(1, "%s -- open failed: %m", chat_file);

  linect = 0;
  sendflg = 0;

  while (fgets(buf, STR_LEN1024, cfp) != NULL((void *)0)) {
buf[strcspn(buf, "\n")] = '\0';

linect++;
sp = buf;

      /* lines starting with '#' are comments. If a real '#'
         is to be expected, it should be quoted .... */
      if ( *sp == '#' )
   continue;

while (*sp != '\0') {
   if (*sp == ' ' || *sp == '\t') {
++sp;
continue;
   }

   if (*sp == '"' || *sp == '\'') {
quote = *sp++;
arg = sp;
while (*sp != quote) {
    if (*sp == '\0')
	fatal(1, "unterminated quote (line %d)", linect);

    if (*sp++ == '\\') {
	if (*sp != '\0')
	    ++sp;
    }
}
   }
   else {
arg = sp;
while (*sp != '\0' && *sp != ' ' && *sp != '\t')
    ++sp;
   }

   if (*sp != '\0')
*sp++ = '\0';

   if (sendflg)
chat_send (arg);
   else
chat_expect (arg);
   sendflg = !sendflg;
}
  }
  fclose (cfp);
410}

412/*
*	We got an error parsing the command line.
*/
415void usage()
416{
  fprintf(stderr(&__sF[2]), "\
418usage: %s [-eSsVv] [-f chat_file] [-r report_file] [-T phone_number]\n\
          [-t timeout] [-U phone_number_2] script\n",
   __progname);
  exit(1);
422}

424char line[1024];

426/*
* Send a message to syslog and/or stderr.
*/
429void logmsg(const char *fmt, ...)
430{
  va_list args;

  va_start(args, fmt)__builtin_va_start((args), fmt);
  vfmtmsg(line, sizeof(line), fmt, args);
  va_end(args)__builtin_va_end((args));
  if (to_log)
syslog(LOG_INFO6, "%s", line);
  if (to_stderr)
fprintf(stderr(&__sF[2]), "%s\n", line);
440}

442/*
*	Print an error message and terminate.
*/

446void fatal(int code, const char *fmt, ...)
447{
  va_list args;

  va_start(args, fmt)__builtin_va_start((args), fmt);
  vfmtmsg(line, sizeof(line), fmt, args);
  va_end(args)__builtin_va_end((args));
  if (to_log)
syslog(LOG_ERR3, "%s", line);
  if (to_stderr)
fprintf(stderr(&__sF[2]), "%s\n", line);
  terminate(code);
458}

460int alarmed = 0;

462SIGTYPEvoid sigalrm(signo)
463int signo;
464{
  int flags;

  alarm(1);
  alarmed = 1;		/* Reset alarm to avoid race window */
  signal(SIGALRM14, sigalrm);	/* that can cause hanging in read() */

  if ((flags = fcntl(0, F_GETFL3)) == -1)
fatal(2, "Can't get file mode flags on stdin: %m");

  if (fcntl(0, F_SETFL4, flags | O_NONBLOCK0x0004) == -1)
fatal(2, "Can't set file mode flags on stdin: %m");

  if (verbose)
logmsg("alarm");
479}

481void unalarm()
482{
  int flags;

  if ((flags = fcntl(0, F_GETFL3)) == -1)
fatal(2, "Can't get file mode flags on stdin: %m");

  if (fcntl(0, F_SETFL4, flags & ~O_NONBLOCK0x0004) == -1)
fatal(2, "Can't set file mode flags on stdin: %m");
490}

492SIGTYPEvoid sigint(signo)
493int signo;
494{
  fatal(2, "SIGINT");
496}

498SIGTYPEvoid sigterm(signo)
499int signo;
500{
  fatal(2, "SIGTERM");
502}

504SIGTYPEvoid sighup(signo)
505int signo;
506{
  fatal(2, "SIGHUP");
508}

510void init()
511{
  signal(SIGINT2, sigint);
  signal(SIGTERM15, sigterm);
  signal(SIGHUP1, sighup);

  set_tty_parameters();
  signal(SIGALRM14, sigalrm);
  alarm(0);
  alarmed = 0;
520}

522void set_tty_parameters()
523{
524#if defined(get_term_param)
  term_parmsstruct termios t;

  if (get_term_param (&t)tcgetattr(0, &t) < 0)
fatal(2, "Can't get terminal parameters: %m");

  saved_tty_parameters = t;
  have_tty_parameters  = 1;

  t.c_iflag     |= IGNBRK0x00000001 | ISTRIP0x00000020 | IGNPAR0x00000004;
  t.c_oflag      = 0;
  t.c_lflag      = 0;
  t.c_cc[VERASE3] =
  t.c_cc[VKILL5]  = 0;
  t.c_cc[VMIN16]   = 1;
  t.c_cc[VTIME17]  = 0;

  if (set_term_param (&t)tcsetattr(0, 0, &t) < 0)
fatal(2, "Can't set terminal parameters: %m");
543#endif
544}

546void break_sequence()
547{
548#ifdef TERMIOS
  tcsendbreak (0, 0);
550#endif
551}

553void terminate(status)
554int status;
555{
  echo_stderr(-1);
  if (report_file != (char *) 0 && report_fp != (FILE *) NULL((void *)0)) {
558/*
* Allow the last of the report string to be gathered before we terminate.
*/
if (report_gathering) {
   int c, rep_len;

   rep_len = strlen(report_buffer);
   while (rep_len + 1 <= sizeof(report_buffer)) {
alarm(1);
c = get_char();
alarm(0);
if (c < 0 || iscntrl(c))
    break;
report_buffer[rep_len] = c;
++rep_len;
   }
   report_buffer[rep_len] = 0;
   fprintf (report_fp, "chat:  %s\n", report_buffer);
}
if (verbose)
   fprintf (report_fp, "Closing \"%s\".\n", report_file);
fclose (report_fp);
report_fp = (FILE *) NULL((void *)0);
  }

583#if defined(get_term_param)
  if (have_tty_parameters) {
if (set_term_param (&saved_tty_parameters)tcsetattr(0, 0, &saved_tty_parameters) < 0)
   fatal(2, "Can't restore terminal parameters: %m");
  }
588#endif

  exit(status);
591}

593/*
*	'Clean up' this string.
*/
596char *clean(s, sending)
597register char *s;
598int sending;  /* set to 1 when sending (putting) this string. */
599{
  char *ret, *t, cur_chr;
  int new_length;
  register char *s1, *phchar;
  int add_return = sending;
604#define isoctal(chr)(((chr) >= '0') && ((chr) <= '7')) (((chr) >= '0') && ((chr) <= '7'))

  /* Overestimate new length: */
  new_length = 0;
  for (t = s; *t; t++)
1
Loop condition is false. Execution continues on line 655→
if (*t == '^' && *(t+1) != '\0') {
   t++;
   new_length++;
} else if (*t != '\\') {
   new_length++;
} else {
   t++;
   switch (*t) {
   case 'c':
   case 'b':
   case 'r':
   case 'n':
   case 's':
   case 't':
new_length++;
break;
   case 'K':
   case 'p':
   case 'd':
   case '\0':
   case '\\':
   case 'N':
new_length += 2;
break;
   case 'T':
new_length += sending && phone_num ? strlen(phone_num) : 2;
break;
   case 'U':
new_length += sending && phone_num2 ? strlen(phone_num2) : 2;
break;
   default:
if (isoctal(*t)(((*t) >= '0') && ((*t) <= '7'))) {
    t++;
    if (isoctal(*t)(((*t) >= '0') && ((*t) <= '7'))) {
	t++;
	if (isoctal(*t)(((*t) >= '0') && ((*t) <= '7'))) 
	    t++;
    }
}
t--;
new_length += 2;	/* Could become \\ */
   }
   if (*t == '\0')
break;
}

  new_length += 3;	/* \r and two nuls */

  ret = malloc(new_length);
  if (ret == NULL((void *)0))
2
←
Assuming 'ret' is equal to NULL→
3
←
Taking true branch→
   fatal(2, "cannot allocate memory");

  s1 = ret;
  while (*s) {
4
←
Loop condition is false. Execution continues on line 791→
cur_chr = *s++;
if (cur_chr == '^') {
   cur_chr = *s++;
   if (cur_chr == '\0') {
*s1++ = '^';
break;
   }
   cur_chr &= 0x1F;
   if (cur_chr != 0) {
*s1++ = cur_chr;
   }
   continue;
}

if (cur_chr != '\\') {
   *s1++ = cur_chr;
   continue;
}

cur_chr = *s++;
if (cur_chr == '\0') {
   if (sending) {
*s1++ = '\\';
*s1++ = '\\';
   }
   break;
}

switch (cur_chr) {
case 'b':
   *s1++ = '\b';
   break;

case 'c':
   if (sending && *s == '\0')
add_return = 0;
   else
*s1++ = cur_chr;
   break;

case '\\':
case 'K':
case 'p':
case 'd':
   if (sending)
*s1++ = '\\';

   *s1++ = cur_chr;
   break;

case 'T':
   if (sending && phone_num) {
for ( phchar = phone_num; *phchar != '\0'; phchar++) 
    *s1++ = *phchar;
   }
   else {
*s1++ = '\\';
*s1++ = 'T';
   }
   break;

case 'U':
   if (sending && phone_num2) {
for ( phchar = phone_num2; *phchar != '\0'; phchar++) 
    *s1++ = *phchar;
   }
   else {
*s1++ = '\\';
*s1++ = 'U';
   }
   break;

case 'q':
   quiet = 1;
   break;

case 'r':
   *s1++ = '\r';
   break;

case 'n':
   *s1++ = '\n';
   break;

case 's':
   *s1++ = ' ';
   break;

case 't':
   *s1++ = '\t';
   break;

case 'N':
   if (sending) {
*s1++ = '\\';
*s1++ = '\0';
   }
   else
*s1++ = 'N';
   break;
   
default:
   if (isoctal (cur_chr)(((cur_chr) >= '0') && ((cur_chr) <= '7'))) {
cur_chr &= 0x07;
if (isoctal (*s)(((*s) >= '0') && ((*s) <= '7'))) {
    cur_chr <<= 3;
    cur_chr |= *s++ - '0';
    if (isoctal (*s)(((*s) >= '0') && ((*s) <= '7'))) {
	cur_chr <<= 3;
	cur_chr |= *s++ - '0';
    }
}

if (cur_chr != 0 || sending) {
    if (sending && (cur_chr == '\\' || cur_chr == 0))
	*s1++ = '\\';
    *s1++ = cur_chr;
}
break;
   }

   if (sending)
*s1++ = '\\';
   *s1++ = cur_chr;
   break;
}
  }

  if (add_return)
5
←
Assuming 'add_return' is 0→
6
←
Taking false branch→
*s1++ = '\r';

  *s1++ = '\0'; /* guarantee closure */
7
←
Null pointer value stored to 's1'→
8
←
Dereference of null pointer
  *s1++ = '\0'; /* terminate the string */

797#ifdef DEBUG
  fprintf(stderr(&__sF[2]), "clean(): guessed %d and used %d\n", new_length, s1-ret);
799#endif
  if (new_length < s1 - ret)
logmsg("clean(): new_length too short! %d < %d: \"%s\" -> \"%s\"", 
      new_length, s1 - ret, s, ret);

  return ret;
805}

807/*
* A modified version of 'strtok'. This version skips \ sequences.
*/

811char *expect_strtok (s, term)
   char *s, *term;
813{
  static  char *str   = "";
  int	    escape_flag = 0;
  char   *result;

818/*
* If a string was specified then do initial processing.
*/
  if (s)
str = s;

824/*
* If this is the escape flag then reset it and ignore the character.
*/
  if (*str)
result = str;
  else
result = (char *) 0;

  while (*str) {
if (escape_flag) {
   escape_flag = 0;
   ++str;
   continue;
}

if (*str == '\\') {
   ++str;
   escape_flag = 1;
   continue;
}

845/*
* If this is not in the termination string, continue.
*/
if (strchr (term, *str) == (char *) 0) {
   ++str;
   continue;
}

853/*
* This is the terminator. Mark the end of the string and stop.
*/
*str++ = '\0';
break;
  }
  return (result);
860}

862/*
* Process the expect string
*/

866void chat_expect (s)
867char *s;
868{
  char *expect;
  char *reply;

  if (strcmp(s, "HANGUP") == 0) {
++hup_next;
      return;
  }

  if (strcmp(s, "ABORT") == 0) {
++abort_next;
return;
  }

  if (strcmp(s, "CLR_ABORT") == 0) {
++clear_abort_next;
return;
  }

  if (strcmp(s, "REPORT") == 0) {
++report_next;
return;
  }

  if (strcmp(s, "CLR_REPORT") == 0) {
++clear_report_next;
return;
  }

  if (strcmp(s, "TIMEOUT") == 0) {
++timeout_next;
return;
  }

  if (strcmp(s, "ECHO") == 0) {
++echo_next;
return;
  }

  if (strcmp(s, "SAY") == 0) {
++say_next;
return;
  }

912/*
* Fetch the expect and reply string.
*/
  for (;;) {
expect = expect_strtok (s, "-");
s      = (char *) 0;

if (expect == (char *) 0)
   return;

reply = expect_strtok (s, "-");

924/*
* Handle the expect string. If successful then exit.
*/
if (get_string (expect))
   return;

930/*
* If there is a sub-reply string then send it. Otherwise any condition
* is terminal.
*/
if (reply == (char *) 0 || exit_code != 3)
   break;

chat_send (reply);
  }

940/*
* The expectation did not occur. This is terminal.
*/
  if (fail_reason)
logmsg("Failed (%s)", fail_reason);
  else
logmsg("Failed");
  terminate(exit_code);
948}

950/*
* Translate the input character to the appropriate string for printing
* the data.
*/

955char *character(c)
956int c;
957{
  static char string[10];
  char *meta;

  meta = (c & 0x80) ? "M-" : "";
  c &= 0x7F;

  if (c < 32)
snprintf(string, sizeof string, "%s^%c", meta, (int)c + '@');
  else if (c == 127)
snprintf(string, sizeof string, "%s^?", meta);
  else
snprintf(string, sizeof string, "%s%c", meta, c);

  return (string);
972}

974/*
*  process the reply string
*/
977void chat_send (s)
978register char *s;
979{
  if (say_next) {
say_next = 0;
s = clean(s,0);
write(STDERR_FILENO2, s, strlen(s));
      free(s);
return;
  }

  if (hup_next) {
      hup_next = 0;
if (strcmp(s, "OFF") == 0)
         signal(SIGHUP1, SIG_IGN(void (*)(int))1);
      else
         signal(SIGHUP1, sighup);
      return;
  }

  if (echo_next) {
echo_next = 0;
echo = (strcmp(s, "ON") == 0);
return;
  }

  if (abort_next) {
char *s1;

abort_next = 0;

if (n_aborts >= MAX_ABORTS50)
   fatal(2, "Too many ABORT strings");

s1 = clean(s, 0);

if (strlen(s1) > strlen(s)
   || strlen(s1) + 1 > sizeof(fail_buffer))
   fatal(1, "Illegal or too-long ABORT string ('%v')", s);

abort_string[n_aborts++] = s1;

if (verbose)
   logmsg("abort on (%v)", s);
return;
  }

  if (clear_abort_next) {
char *s1;
int   i;
      int   old_max;
int   pack = 0;

clear_abort_next = 0;

s1 = clean(s, 0);

if (strlen(s1) > strlen(s)
   || strlen(s1) + 1 > sizeof(fail_buffer))
   fatal(1, "Illegal or too-long CLR_ABORT string ('%v')", s);

      old_max = n_aborts;
for (i=0; i < n_aborts; i++) {
   if ( strcmp(s1,abort_string[i]) == 0 ) {
free(abort_string[i]);
abort_string[i] = NULL((void *)0);
pack++;
n_aborts--;
if (verbose)
    logmsg("clear abort on (%v)", s);
   }
}
      free(s1);
if (pack)
   pack_array(abort_string,old_max);
return;
  }

  if (report_next) {
char *s1;

report_next = 0;
if (n_reports >= MAX_REPORTS50)
   fatal(2, "Too many REPORT strings");

s1 = clean(s, 0);

if (strlen(s1) > strlen(s) || strlen(s1) > sizeof fail_buffer - 1)
   fatal(1, "Illegal or too-long REPORT string ('%v')", s);

report_string[n_reports++] = s1;

if (verbose)
   logmsg("report (%v)", s);
return;
  }

  if (clear_report_next) {
char *s1;
int   i;
int   old_max;
int   pack = 0;

clear_report_next = 0;

s1 = clean(s, 0);

if (strlen(s1) > strlen(s) || strlen(s1) > sizeof fail_buffer - 1)
   fatal(1, "Illegal or too-long REPORT string ('%v')", s);

old_max = n_reports;
for (i=0; i < n_reports; i++) {
   if ( strcmp(s1,report_string[i]) == 0 ) {
free(report_string[i]);
report_string[i] = NULL((void *)0);
pack++;
n_reports--;
if (verbose)
    logmsg("clear report (%v)", s);
   }
}
      free(s1);
      if (pack)
   pack_array(report_string,old_max);

return;
  }

  if (timeout_next) {
timeout_next = 0;
timeout = atoi(s);

if (timeout <= 0)
   timeout = DEFAULT_CHAT_TIMEOUT45;

if (verbose)
   logmsg("timeout set to %d seconds", timeout);

return;
  }

  if (strcmp(s, "EOT") == 0)
s = "^D\\c";
  else if (strcmp(s, "BREAK") == 0)
s = "\\K\\c";

  if (!put_string(s))
fatal(1, "Failed");
1125}

1127int get_char()
1128{
  int status;
  char c;

  status = read(0, &c, 1);

  switch (status) {
  case 1:
return ((int)c & 0x7F);

  default:
logmsg("warning: read() on stdin returned %d", status);

  case -1:
if ((status = fcntl(0, F_GETFL3)) == -1)
   fatal(2, "Can't get file mode flags on stdin: %m");

if (fcntl(0, F_SETFL4, status & ~O_NONBLOCK0x0004) == -1)
   fatal(2, "Can't set file mode flags on stdin: %m");

return (-1);
  }
1150}

1152int put_char(c)
1153int c;
1154{
  int status;
  char ch = c;

  usleep(10000);		/* inter-character typing delay (?) */

  status = write(STDOUT_FILENO1, &ch, 1);

  switch (status) {
  case 1:
return (0);

  default:
logmsg("warning: write() on stdout returned %d", status);

  case -1:
if ((status = fcntl(0, F_GETFL3)) == -1)
   fatal(2, "Can't get file mode flags on stdin, %m");

if (fcntl(0, F_SETFL4, status & ~O_NONBLOCK0x0004) == -1)
   fatal(2, "Can't set file mode flags on stdin: %m");

return (-1);
  }
1178}

1180int write_char (c)
1181int c;
1182{
  if (alarmed || put_char(c) < 0) {
alarm(0);
alarmed = 0;

if (verbose) {
   if (errno(*__errno()) == EINTR4 || errno(*__errno()) == EWOULDBLOCK35)
logmsg(" -- write timed out");
   else
logmsg(" -- write failed: %m");
}
return (0);
  }
  return (1);
1196}

1198int put_string (s)
1199register char *s;
1200{
  quiet = 0;
  s = clean(s, 1);

  if (verbose) {
if (quiet)
   logmsg("send (hidden)");
else
   logmsg("send (%v)", s);
  }

  alarm(timeout); alarmed = 0;

  while (*s) {
register char c = *s++;

if (c != '\\') {
   if (!write_char (c))
return 0;
   continue;
}

c = *s++;
switch (c) {
case 'd':
   sleep(1);
   break;

case 'K':
   break_sequence();
   break;

case 'p':
   usleep(10000); 	/* 1/100th of a second (arg is microseconds) */
   break;

default:
   if (!write_char (c))
return 0;
   break;
}
  }

  alarm(0);
  alarmed = 0;
  return (1);
1246}

1248/*
*	Echo a character to stderr.
*	When called with -1, a '\n' character is generated when
*	the cursor is not at the beginning of a line.
*/
1253void echo_stderr(n)
1254int n;
1255{
  static int need_lf;
  char *s;

  switch (n) {
  case '\r':		/* ignore '\r' */
break;
  case -1:
if (need_lf == 0)
   break;
/* fall through */
  case '\n':
write(STDERR_FILENO2, "\n", 1);
need_lf = 0;
break;
  default:
s = character(n);
write(STDERR_FILENO2, s, strlen(s));
need_lf = 1;
break;
  }
1276}

1278/*
*	'Wait for' this string to appear on this file descriptor.
*/
1281int get_string(string)
1282register char *string;
1283{
  char temp[STR_LEN1024];
  int c, printed = 0, len, minlen;
  register char *s = temp, *end = s + STR_LEN1024;
  char *logged = temp;

  fail_reason = NULL((void *)0);
  string = clean(string, 0);
  len = strlen(string);
  minlen = (len > sizeof(fail_buffer)? len: sizeof(fail_buffer)) - 1;

  if (verbose)
logmsg("expect (%v)", string);

  if (len > STR_LEN1024) {
logmsg("expect string is too long");
exit_code = 1;
return 0;
  }

  if (len == 0) {
if (verbose)
   logmsg("got it");
return (1);
  }

  alarm(timeout);
  alarmed = 0;

  while ( ! alarmed && (c = get_char()) >= 0) {
int n, abort_len, report_len;

if (echo)
   echo_stderr(c);
if (verbose && c == '\n') {
   if (s == logged)
logmsg("");	/* blank line */
   else
logmsg("%0.*v", s - logged, logged);
   logged = s + 1;
}

*s++ = c;

if (verbose && s >= logged + 80) {
   logmsg("%0.*v", s - logged, logged);
   logged = s;
}

if (Verbose) {
  if (c == '\n')
      fputc( '\n', stderr(&__sF[2]) );
  else if (c != '\r')
      fprintf( stderr(&__sF[2]), "%s", character(c) );
}

if (!report_gathering) {
   for (n = 0; n < n_reports; ++n) {
if ((report_string[n] != (char*) NULL((void *)0)) &&
    s - temp >= (report_len = strlen(report_string[n])) &&
    strncmp(s - report_len, report_string[n], report_len) == 0) {
    time_t time_now   = time (NULL((void *)0));
    struct tm* tm_now = localtime (&time_now);

    strftime (report_buffer, 20, "%b %d %H:%M:%S ", tm_now);
    strlcat (report_buffer, report_string[n], sizeof(report_buffer));

    report_string[n] = (char *) NULL((void *)0);
    report_gathering = 1;
    break;
}
   }
}
else {
   if (!iscntrl (c)) {
int rep_len = strlen (report_buffer);
report_buffer[rep_len]     = c;
report_buffer[rep_len + 1] = '\0';
   }
   else {
report_gathering = 0;
fprintf (report_fp, "chat:  %s\n", report_buffer);
   }
}

if (s - temp >= len &&
   c == string[len - 1] &&
   strncmp(s - len, string, len) == 0) {
   if (verbose) {
if (s > logged)
    logmsg("%0.*v", s - logged, logged);
logmsg(" -- got it\n");
   }

   alarm(0);
   alarmed = 0;
   return (1);
}

for (n = 0; n < n_aborts; ++n) {
   if (s - temp >= (abort_len = strlen(abort_string[n])) &&
strncmp(s - abort_len, abort_string[n], abort_len) == 0) {
if (verbose) {
    if (s > logged)
	logmsg("%0.*v", s - logged, logged);
    logmsg(" -- failed");
}

alarm(0);
alarmed = 0;
exit_code = n + 4;
strlcpy(fail_buffer, abort_string[n], sizeof fail_buffer);
fail_reason = fail_buffer;
return (0);
   }
}

if (s >= end) {
   if (logged < s - minlen) {
logmsg("%0.*v", s - logged, logged);
logged = s;
   }
   s -= minlen;
   memmove(temp, s, minlen);
   logged = temp + (logged - s);
   s = temp + minlen;
}

if (alarmed && verbose)
   logmsg("warning: alarm synchronization problem");
  }

  alarm(0);
  
  if (verbose && printed) {
if (alarmed)
   logmsg(" -- read timed out");
else
   logmsg(" -- read failed: %m");
  }

  exit_code = 3;
  alarmed   = 0;
  return (0);
1427}

1429void
1430pack_array (array, end)
  char **array; /* The address of the array of string pointers */
  int    end;   /* The index of the next free entry before CLR_ */
1433{
  int i, j;

  for (i = 0; i < end; i++) {
if (array[i] == NULL((void *)0)) {
   for (j = i+1; j < end; ++j)
if (array[j] != NULL((void *)0))
    array[i++] = array[j];
   for (; i < end; ++i)
array[i] = NULL((void *)0);
   break;
}
  }
1446}

1448/*
* vfmtmsg - format a message into a buffer.  Like vsnprintf except we
* also specify the length of the output buffer, and we handle the
* %m (error message) format.
* Doesn't do floating-point formats.
* Returns the number of chars put into buf.
*/
1455#define OUTCHAR(c)(buflen > 0? (--buflen, *buf++ = (c)): 0)	(buflen > 0? (--buflen, *buf++ = (c)): 0)

1457int
1458vfmtmsg(buf, buflen, fmt, args)
  char *buf;
  int buflen;
  const char *fmt;
  va_list args;
1463{
  int c, i, n;
  int width, prec, fillch;
  int base, len, neg, quoted;
  unsigned long val = 0;
  char *str, *buf0;
  const char *f;
  unsigned char *p;
  char num[32];
  static char hexchars[] = "0123456789abcdef";

  buf0 = buf;
  --buflen;
  while (buflen > 0) {
for (f = fmt; *f != '%' && *f != 0; ++f)
   ;
if (f > fmt) {
   len = f - fmt;
   if (len > buflen)
len = buflen;
   memcpy(buf, fmt, len);
   buf += len;
   buflen -= len;
   fmt = f;
}
if (*fmt == 0)
   break;
c = *++fmt;
width = prec = 0;
fillch = ' ';
if (c == '0') {
   fillch = '0';
   c = *++fmt;
}
if (c == '*') {
   width = va_arg(args, int)__builtin_va_arg((args), int);
   c = *++fmt;
} else {
   while (isdigit(c)) {
width = width * 10 + c - '0';
c = *++fmt;
   }
}
if (c == '.') {
   c = *++fmt;
   if (c == '*') {
prec = va_arg(args, int)__builtin_va_arg((args), int);
c = *++fmt;
   } else {
while (isdigit(c)) {
    prec = prec * 10 + c - '0';
    c = *++fmt;
}
   }
}
str = 0;
base = 0;
neg = 0;
++fmt;
switch (c) {
case 'd':
   i = va_arg(args, int)__builtin_va_arg((args), int);
   if (i < 0) {
neg = 1;
val = -i;
   } else
val = i;
   base = 10;
   break;
case 'o':
   val = va_arg(args, unsigned int)__builtin_va_arg((args), unsigned int);
   base = 8;
   break;
case 'x':
   val = va_arg(args, unsigned int)__builtin_va_arg((args), unsigned int);
   base = 16;
   break;
case 'p':
   val = (unsigned long) va_arg(args, void *)__builtin_va_arg((args), void *);
   base = 16;
   neg = 2;
   break;
case 's':
   str = va_arg(args, char *)__builtin_va_arg((args), char *);
   break;
case 'c':
   num[0] = va_arg(args, int)__builtin_va_arg((args), int);
   num[1] = 0;
   str = num;
   break;
case 'm':
   str = strerror(errno(*__errno()));
   break;
case 'v':		/* "visible" string */
case 'q':		/* quoted string */
   quoted = c == 'q';
   p = va_arg(args, unsigned char *)__builtin_va_arg((args), unsigned char *);
   if (fillch == '0' && prec > 0) {
n = prec;
   } else {
n = strlen((char *)p);
if (prec > 0 && prec < n)
    n = prec;
   }
   while (n > 0 && buflen > 0) {
c = *p++;
--n;
if (!quoted && c >= 0x80) {
    OUTCHAR('M')(buflen > 0? (--buflen, *buf++ = ('M')): 0);
    OUTCHAR('-')(buflen > 0? (--buflen, *buf++ = ('-')): 0);
    c -= 0x80;
}
if (quoted && (c == '"' || c == '\\'))
    OUTCHAR('\\')(buflen > 0? (--buflen, *buf++ = ('\\')): 0);
if (c < 0x20 || (0x7f <= c && c < 0xa0)) {
    if (quoted) {
	OUTCHAR('\\')(buflen > 0? (--buflen, *buf++ = ('\\')): 0);
	switch (c) {
	case '\t':	OUTCHAR('t')(buflen > 0? (--buflen, *buf++ = ('t')): 0);	break;
	case '\n':	OUTCHAR('n')(buflen > 0? (--buflen, *buf++ = ('n')): 0);	break;
	case '\b':	OUTCHAR('b')(buflen > 0? (--buflen, *buf++ = ('b')): 0);	break;
	case '\f':	OUTCHAR('f')(buflen > 0? (--buflen, *buf++ = ('f')): 0);	break;
	default:
	    OUTCHAR('x')(buflen > 0? (--buflen, *buf++ = ('x')): 0);
	    OUTCHAR(hexchars[c >> 4])(buflen > 0? (--buflen, *buf++ = (hexchars[c >> 4]))
: 0);
	    OUTCHAR(hexchars[c & 0xf])(buflen > 0? (--buflen, *buf++ = (hexchars[c & 0xf])):
 0);
	}
    } else {
	if (c == '\t')
	    OUTCHAR(c)(buflen > 0? (--buflen, *buf++ = (c)): 0);
	else {
	    OUTCHAR('^')(buflen > 0? (--buflen, *buf++ = ('^')): 0);
	    OUTCHAR(c ^ 0x40)(buflen > 0? (--buflen, *buf++ = (c ^ 0x40)): 0);
	}
    }
} else
    OUTCHAR(c)(buflen > 0? (--buflen, *buf++ = (c)): 0);
   }
   continue;
default:
   *buf++ = '%';
   if (c != '%')
--fmt;		/* so %z outputs %z etc. */
   --buflen;
   continue;
}
if (base != 0) {
   str = num + sizeof(num);
   *--str = 0;
   while (str > num + neg) {
*--str = hexchars[val % base];
val = val / base;
if (--prec <= 0 && val == 0)
    break;
   }
   switch (neg) {
   case 1:
*--str = '-';
break;
   case 2:
*--str = 'x';
*--str = '0';
break;
   }
   len = num + sizeof(num) - 1 - str;
} else {
   len = strlen(str);
   if (prec > 0 && len > prec)
len = prec;
}
if (width > 0) {
   if (width > buflen)
width = buflen;
   if ((n = width - len) > 0) {
buflen -= n;
for (; n > 0; --n)
    *buf++ = fillch;
   }
}
if (len > buflen)
   len = buflen;
memcpy(buf, str, len);
buf += len;
buflen -= len;
  }
  *buf = 0;
  return buf - buf0;
1650}