Bug Summary

File:network/res_msend.c
Location:line 186, column 9
Description:Branch condition evaluates to a garbage value

Annotated Source Code

1#include <sys/socket.h>
2#include <netinet/in.h>
3#include <netdb.h>
4#include <arpa/inet.h>
5#include <stdint.h>
6#include <string.h>
7#include <poll.h>
8#include <time.h>
9#include <ctype.h>
10#include <unistd.h>
11#include <errno(*__errno_location()).h>
12#include <pthread.h>
13#include "stdio_impl.h"
14#include "syscall.h"
15#include "lookup.h"
16
17static void cleanup(void *p)
18{
19 __syscall(SYS_close, (intptr_t)p)__syscall1(3,((long) ((intptr_t)p)));
20}
21
22static unsigned long mtime()
23{
24 struct timespec ts;
25 clock_gettime(CLOCK_REALTIME0, &ts);
26 return (unsigned long)ts.tv_sec * 1000
27 + ts.tv_nsec / 1000000;
28}
29
30int __res_msend(int nqueries, const unsigned char *const *queries,
31 const int *qlens, unsigned char *const *answers, int *alens, int asize)
32{
33 int fd;
34 FILE *f, _f;
35 unsigned char _buf[256];
36 char line[64], *s, *z;
37 int timeout = 5000, attempts = 2, retry_interval, servfail_retry;
1
'servfail_retry' declared without an initial value
→
38 union {
39 struct sockaddr_in sin;
40 struct sockaddr_in6 sin6;
41 } sa = {0}, ns[3] = {{0}};
42 socklen_t sl = sizeof sa.sin;
43 int nns = 0;
44 int family = AF_INET2;
45 int rlen;
46 int next;
47 int i, j;
48 int cs;
49 struct pollfd pfd;
50 unsigned long t0, t1, t2;
51 struct address iplit;
52
53 pthread_setcancelstate(PTHREAD_CANCEL_DISABLE1, &cs);
54
55 /* Get nameservers from resolv.conf, fallback to localhost */
56 f = __fopen_rb_ca("/etc/resolv.conf", &_f, _buf, sizeof _buf);
57 if (f) for (nns=0; nns<3 && fgets(line, sizeof line, f); ) {
2
←
Assuming 'f' is null
→
3
←
Taking false branch
→
58 if (!strncmp(line, "options", 7) && isspace(line[7])__isspace(line[7])) {
59 unsigned long x;
60 char *p, *z;
61 p = strstr(line, "timeout:");
62 if (p && isdigit(p[8])(0 ? isdigit(p[8]) : ((unsigned)(p[8])-'0') < 10)) {
63 p += 8;
64 x = strtoul(p, &z, 10);
65 if (z != p) timeout = x < 30 ? x*1000 : 30000;
66 }
67 p = strstr(line, "attempts:");
68 if (p && isdigit(p[9])(0 ? isdigit(p[9]) : ((unsigned)(p[9])-'0') < 10)) {
69 p += 9;
70 x = strtoul(p, &z, 10);
71 if (z != p) attempts = x < 10 ? x : 10;
72 if (!attempts) attempts = 1;
73 }
74 }
75 if (strncmp(line, "nameserver", 10) || !isspace(line[10])__isspace(line[10]))
76 continue;
77 for (s=line+11; isspace(*s)__isspace(*s); s++);
78 for (z=s; *z && !isspace(*z)__isspace(*z); z++);
79 *z=0;
80
81 if (__lookup_ipliteral(&iplit, s, AF_UNSPEC0)>0) {
82 if (iplit.family == AF_INET2) {
83 memcpy(&ns[nns].sin.sin_addr, iplit.addr, 4);
84 ns[nns].sin.sin_port = htons(53);
85 ns[nns++].sin.sin_family = AF_INET2;
86 } else {
87 sl = sizeof sa.sin6;
88 memcpy(&ns[nns].sin6.sin6_addr, iplit.addr, 16);
89 ns[nns].sin6.sin6_port = htons(53);
90 ns[nns].sin6.sin6_scope_id = iplit.scopeid;
91 ns[nns++].sin6.sin6_family = family = AF_INET610;
92 }
93 }
94 }
95 if (f) __fclose_ca(f);
4
←
Taking false branch
→
96 if (!nns) {
5
←
Taking true branch
→
97 ns[0].sin.sin_family = AF_INET2;
98 ns[0].sin.sin_port = htons(53);
99 ns[0].sin.sin_addr.s_addr = htonl(0x7f000001);
100 nns=1;
101 }
102
103 /* Get local address and open/bind a socket */
104 sa.sin.sin_family = family;
105 fd = socket(family, SOCK_DGRAM2|SOCK_CLOEXEC02000000|SOCK_NONBLOCK04000, 0);
106
107 /* Handle case where system lacks IPv6 support */
108 if (fd < 0 && family == AF_INET610 && errno(*__errno_location()) == EAFNOSUPPORT97) {
6
←
Assuming 'fd' is >= 0
→
109 fd = socket(AF_INET2, SOCK_DGRAM2|SOCK_CLOEXEC02000000|SOCK_NONBLOCK04000, 0);
110 family = AF_INET2;
111 }
112 if (fd < 0 || bind(fd, (void *)&sa, sl) < 0) return -1;
7
←
Taking false branch
→
113
114 /* Past this point, there are no errors. Each individual query will
115 * yield either no reply (indicated by zero length) or an answer
116 * packet which is up to the caller to interpret. */
117
118 pthread_cleanup_push(cleanup, (void *)(intptr_t)fd)do { struct __ptcb __cb; _pthread_cleanup_push(&__cb, cleanup
, (void *)(intptr_t)fd);;
119 pthread_setcancelstate(cs, 0);
120
121 /* Convert any IPv4 addresses in a mixed environment to v4-mapped */
122 if (family == AF_INET610) {
8
←
Taking false branch
→
123 setsockopt(fd, IPPROTO_IPV641, IPV6_V6ONLY26, &(int){0}, sizeof 0);
124 for (i=0; i<nns; i++) {
125 if (ns[i].sin.sin_family != AF_INET2) continue;
126 memcpy(ns[i].sin6.sin6_addr.s6_addr__in6_union.__s6_addr+12,
127 &ns[i].sin.sin_addr, 4);
128 memcpy(ns[i].sin6.sin6_addr.s6_addr__in6_union.__s6_addr,
129 "\0\0\0\0\0\0\0\0\0\0\xff\xff", 12);
130 ns[i].sin6.sin6_family = AF_INET610;
131 ns[i].sin6.sin6_flowinfo = 0;
132 ns[i].sin6.sin6_scope_id = 0;
133 }
134 }
135
136 memset(alens, 0, sizeof *alens * nqueries);
137
138 pfd.fd = fd;
139 pfd.events = POLLIN0x001;
140 retry_interval = timeout / attempts;
141 next = 0;
142 t0 = t2 = mtime();
143 t1 = t2 - retry_interval;
144
145 for (; t2-t0 < timeout; t2=mtime()) {
9
←
Loop condition is true. Entering loop body
→
13
←
Loop condition is true. Entering loop body
→
17
←
Loop condition is true. Entering loop body
→
146 if (t2-t1 >= retry_interval) {
10
←
Taking false branch
→
14
←
Taking false branch
→
18
←
Taking false branch
→
147 /* Query all configured namservers in parallel */
148 for (i=0; i<nqueries; i++)
149 if (!alens[i])
150 for (j=0; j<nns; j++)
151 sendto(fd, queries[i],
152 qlens[i], MSG_NOSIGNAL0x4000,
153 (void *)&ns[j], sl);
154 t1 = t2;
155 servfail_retry = 2 * nqueries;
156 }
157
158 /* Wait for a response, or until time to retry */
159 if (poll(&pfd, 1, t1+retry_interval-t2) <= 0) continue;
11
←
Taking false branch
→
15
←
Taking false branch
→
19
←
Taking false branch
→
160
161 while ((rlen = recvfrom(fd, answers[next], asize, 0,
12
←
Loop condition is false. Execution continues on line 145
→
16
←
Loop condition is false. Execution continues on line 145
→
20
←
Loop condition is true. Entering loop body
→
162 (void *)&sa, (socklen_t[1]){sl})) >= 0) {
163
164 /* Ignore non-identifiable packets */
165 if (rlen < 4) continue;
21
←
Assuming 'rlen' is >= 4
→
22
←
Taking false branch
→
166
167 /* Ignore replies from addresses we didn't send to */
168 for (j=0; j<nns && memcmp(ns+j, &sa, sl); j++);
23
←
Loop condition is false. Execution continues on line 169
→
169 if (j==nns) continue;
24
←
Taking false branch
→
170
171 /* Find which query this answer goes with, if any */
172 for (i=next; i<nqueries && (
25
←
Assuming 'i' is >= 'nqueries'
→
173 answers[next][0] != queries[i][0] ||
174 answers[next][1] != queries[i][1] ); i++);
175 if (i==nqueries) continue;
26
←
Assuming 'i' is not equal to 'nqueries'
→
27
←
Taking false branch
→
176 if (alens[i]) continue;
28
←
Taking false branch
→
177
178 /* Only accept positive or negative responses;
179 * retry immediately on server failure, and ignore
180 * all other codes such as refusal. */
181 switch (answers[next][3] & 15) {
29
←
Control jumps to 'case 2:' at line 185
→
182 case 0:
183 case 3:
184 break;
185 case 2:
186 if (servfail_retry && servfail_retry--)
30
←
Branch condition evaluates to a garbage value
187 sendto(fd, queries[i],
188 qlens[i], MSG_NOSIGNAL0x4000,
189 (void *)&ns[j], sl);
190 default:
191 continue;
192 }
193
194 /* Store answer in the right slot, or update next
195 * available temp slot if it's already in place. */
196 alens[i] = rlen;
197 if (i == next)
198 for (; next<nqueries && alens[next]; next++);
199 else
200 memcpy(answers[i], answers[next], rlen);
201
202 if (next == nqueries) goto out;
203 }
204 }
205out:
206 pthread_cleanup_pop(1)_pthread_cleanup_pop(&__cb, (1)); } while(0);
207
208 return 0;
209}