Bug Summary

File:src/unistd/faccessat.c
Location:line 55, column 13
Description:The left operand of '&' is a garbage value

Annotated Source Code

1#include <unistd.h>
2#include <fcntl.h>
3#include <errno(*__errno_location()).h>
4#include <sys/wait.h>
5#include "syscall.h"
6#include "pthread_impl.h"
7
8struct ctx {
9 int fd;
10 const char *filename;
11 int amode;
12};
13
14static const int errors[] = {
15 0, -EACCES13, -ELOOP40, -ENAMETOOLONG36, -ENOENT2, -ENOTDIR20,
16 -EROFS30, -EBADF9, -EINVAL22, -ETXTBSY26,
17 -EFAULT14, -EIO5, -ENOMEM12,
18 -EBUSY16
19};
20
21static int checker(void *p)
22{
23 struct ctx *c = p;
24 int ret;
25 int i;
26 if (__syscall(SYS_setregid, __syscall(SYS_getegid), -1)__syscall2(204,((long) (__syscall0(202))),((long) (-1)))
27 || __syscall(SYS_setreuid, __syscall(SYS_geteuid), -1)__syscall2(203,((long) (__syscall0(201))),((long) (-1))))
28 __syscall(SYS_exit, 1)__syscall1(1,((long) (1)));
29 ret = __syscall(SYS_faccessat, c->fd, c->filename, c->amode, 0)__syscall4(334,((long) (c->fd)),((long) (c->filename)),
((long) (c->amode)),((long) (0)))
;
30 for (i=0; i < sizeof errors/sizeof *errors - 1 && ret!=errors[i]; i++);
31 return i;
32}
33
34int faccessat(int fd, const char *filename, int amode, int flag)
35{
36 if (!flag || (flag==AT_EACCESS0x200 && getuid()==geteuid() && getgid()==getegid()))
1
Assuming 'flag' is not equal to 0
2
Assuming 'flag' is equal to 512
37 return syscall(SYS_faccessat, fd, filename, amode, flag)__syscall_ret(__syscall4(334,((long) (fd)),((long) (filename)
),((long) (amode)),((long) (flag))))
;
38
39 if (flag != AT_EACCESS0x200)
3
Taking false branch
40 return __syscall_ret(-EINVAL22);
41
42 char stack[1024];
43 sigset_t set;
44 pid_t pid;
45 int ret = -EBUSY16;
46 struct ctx c = { .fd = fd, .filename = filename, .amode = amode };
47
48 __block_all_sigs(&set);
49
50 pid = __clone(checker, stack+sizeof stack, 0, &c);
51 if (pid > 0) {
4
Assuming 'pid' is > 0
5
Taking true branch
52 int status;
6
'status' declared without an initial value
53 do {
54 __syscall(SYS_wait4, pid, &status, __WCLONE, 0)__syscall4(114,((long) (pid)),((long) (&status)),((long) (
0x80000000)),((long) (0)))
;
55 } while (!WIFEXITED(status)(!((status) & 0x7f)) && !WIFSIGNALED(status)(((status)&0xffff)-1U < 0xffu));
7
Within the expansion of the macro 'WIFEXITED':
a
The left operand of '&' is a garbage value
56 if (WIFEXITED(status)(!((status) & 0x7f)))
57 ret = errors[WEXITSTATUS(status)(((status) & 0xff00) >> 8)];
58 }
59
60 __restore_sigs(&set);
61
62 return __syscall_ret(ret);
63}