tree_cell* nasl_incr_variable(lex_ctxt* lexic, tree_cell* tc, int pre, int val) { anon_nasl_var *v; int old_val = 0, new_val; tree_cell *retc; if (tc->type != REF_VAR) { nasl_perror(lexic, "nasl_incr_variable: argument (type=%d) is not REF_VAR %s\n", tc->type, get_line_nb(tc)); return NULL; } v = tc->x.ref_val; switch (v->var_type) { case VAR2_INT: old_val = v->v.v_int; break; case VAR2_STRING: case VAR2_DATA: #if NASL_DEBUG > 0 nasl_perror(lexic, "nasl_incr_variable: variable %s is a STRING %s - converting to integer\n", "", get_line_nb(tc)); #endif old_val = v->v.v_str.s_val == NULL ? 0 : atoi(v->v.v_str.s_val); break; case VAR2_UNDEF: #if NASL_DEBUG > 0 nasl_perror(lexic, "nasl_incr_variable: variable %s is undefined %s\n", "", get_line_nb(tc)); #endif old_val = 0; break; default: nasl_perror(lexic, "nasl_incr_variable: variable %s has bad type %d %s\n", /*get_var_name(v)*/ "", get_line_nb(tc)); return NULL; } new_val = old_val + val; clear_anon_var(v); v->var_type = VAR2_INT; v->v.v_int = new_val; retc = alloc_tree_cell(0, NULL); retc->type = CONST_INT; retc->x.i_val = pre ? new_val : old_val; return retc; }
tree_cell* nasl_read_var_ref(lex_ctxt* lexic, tree_cell* tc) { tree_cell *ret; anon_nasl_var *v; if (tc == NULL || tc == FAKE_CELL) { nasl_perror(lexic, "nasl_read_var_ref: cannot read NULL or FAKE cell\n"); return NULL; } if (tc->type != REF_VAR) { nasl_perror(lexic, "nasl_read_var_ref: argument (type=%d) is not REF_VAR %s\n", tc->type, get_line_nb(tc)); return NULL; } v = tc->x.ref_val; if (v == NULL) { nasl_perror(lexic, "nasl_read_var_ref: NULL variable in REF_VAR\n"); return NULL; } ret = alloc_tree_cell(tc->line_nb, NULL); switch (v->var_type) { case VAR2_INT: ret->type = CONST_INT; ret->x.i_val = v->v.v_int; if(nasl_trace_enabled())nasl_trace(lexic, "NASL> %s -> %d\n", get_var_name(v), ret->x.i_val); return ret; case VAR2_STRING: ret->type = CONST_STR; /* Fix bad string length */ if (v->v.v_str.s_siz <= 0 && v->v.v_str.s_val[0] != '\0') { v->v.v_str.s_siz = strlen(v->v.v_str.s_val); nasl_perror(lexic, "nasl_read_var_ref: Bad string length fixed\n"); } /* Go on next case */ case VAR2_DATA: ret->type = v->var_type == VAR2_STRING ? CONST_STR : CONST_DATA; if(v->v.v_str.s_val == NULL) { ret->x.str_val = NULL; ret->size = 0; } else { ret->x.str_val = emalloc(v->v.v_str.s_siz); memcpy(ret->x.str_val, v->v.v_str.s_val, v->v.v_str.s_siz); ret->size = v->v.v_str.s_siz; } if(nasl_trace_enabled())nasl_trace(lexic, "NASL> %s -> \"%s\"\n", get_var_name(v), ret->x.str_val); return ret; case VAR2_ARRAY: ret->type = REF_ARRAY; ret->x.ref_val = &v->v.v_arr; return ret; case VAR2_UNDEF: #if NASL_DEBUG > 0 name = get_var_name(v); if (strcmp(name, "NULL") != 0) /* special case */ nasl_perror(lexic, "nasl_read_var_ref: variable %s is undefined %s\n", name, get_line_nb(tc)); #endif if(nasl_trace_enabled())nasl_trace(lexic, "NASL> %s -> undef\n", get_var_name(v), v->var_type); break; default: nasl_perror(lexic, "nasl_read_var_ref: unhandled variable type %d\n", v->var_type); if(nasl_trace_enabled())nasl_trace(lexic, "NASL> %s -> ???? (Var type %d)\n", get_var_name(v), v->var_type); break; } deref_cell(ret); return NULL; }
tree_cell* get_array_elem(lex_ctxt* ctxt, const char* name, tree_cell* idx) { named_nasl_var *v = get_var_ref_by_name(ctxt, name, 1); named_nasl_var *nv; anon_nasl_var *u, *av; tree_cell *tc, idx0; u = &v->u; if (idx == NULL) { #if NASL_DEBUG > 0 nasl_perror(ctxt, "get_array_elem: NULL index\n"); #endif /* Treat it as zero */ idx = &idx0; idx->x.i_val = 0; idx->type = CONST_INT; } switch (u->var_type) { case VAR2_UNDEF: /* We define the array here */ u->var_type = VAR2_ARRAY; case VAR2_ARRAY: switch(idx->type) { case CONST_INT: av = nasl_get_var_by_num(&u->v.v_arr, idx->x.i_val, 1); return var2cell(av); case CONST_STR: case CONST_DATA: nv = get_var_by_name(&u->v.v_arr, idx->x.str_val); return var2cell(nv != NULL ? &nv->u : NULL); default: nasl_perror(ctxt, "get_array_elem: unhandled index type 0x%x\n", idx->type); return NULL; } /*NOTREACHED*/ break; case VAR2_INT: nasl_perror(ctxt, "get_array_elem: variable %s is an integer\n", name); return NULL; case VAR2_STRING: case VAR2_DATA: if (idx->type == CONST_INT) { int l = u->v.v_str.s_siz; if (idx->x.i_val >= l) { nasl_perror(ctxt, "get_array_elem: requesting character after end of string %s (%d >= %d)\n", name, idx->x.i_val, l); tc = alloc_expr_cell(idx->line_nb, CONST_DATA /*CONST_STR*/, NULL, NULL); tc->x.str_val = estrdup(""); tc->size = 0; return tc; } else { if ( idx->x.i_val < 0) { nasl_perror(ctxt, "Negative index !\n"); return NULL; } tc = alloc_expr_cell(idx->line_nb, CONST_DATA /*CONST_STR*/, NULL, NULL); tc->x.str_val = emalloc(2); tc->x.str_val[0] = u->v.v_str.s_val[idx->x.i_val]; tc->x.str_val[1] = '\0'; tc->size = 1; return tc; } } else { nasl_perror(ctxt, "get_array_elem: Cannot use a non integer index (type 0x%x) in string\n", idx->type); return NULL; } /*NOTREACHED*/ break; default: nasl_perror(ctxt, "Severe bug: unknown variable type 0x%x %s\n", u->var_type, get_line_nb(idx)); return NULL; } /*NOTREACHED*/ return NULL; }
static tree_cell* affect_to_anon_var(anon_nasl_var* v1, tree_cell* rval) { anon_nasl_var *v2 = NULL, v0; nasl_array *a = NULL; int t1, t2; void *p; t1 = v1->var_type; if (rval == NULL || rval == FAKE_CELL) { #if NASL_DEBUG > 1 nasl_perror(NULL, "nasl_affect: affecting NULL or FAKE cell undefines variable %s %s\n", get_var_name(v1), get_line_nb(rval)); #endif clear_anon_var(v1); if(nasl_trace_enabled())nasl_trace(NULL, "NASL> %s <- undef\n", get_var_name(v1)); return NULL; } switch (rval->type) { case CONST_INT: t2 = VAR2_INT; break; case CONST_STR: t2 = VAR2_STRING; break; case CONST_DATA: t2 = VAR2_DATA; break; case REF_VAR: v2 = rval->x.ref_val; if (v2 == v1) { #if NASL_DEBUG > 1 nasl_perror(NULL, "Copying variable %s to itself is useless and dangerous!\n", get_var_name(v1)); #endif return FAKE_CELL; } t2 = v2->var_type; if (t2 == VAR2_ARRAY) a = &v2->v.v_arr; /* ? */ break; case REF_ARRAY: case DYN_ARRAY: a = rval->x.ref_val; t2 = VAR2_ARRAY; if (v1->var_type == VAR2_ARRAY && &v1->v.v_arr == a) { #if NASL_DEBUG > 1 nasl_perror(NULL, "Copying array %s to itself is useless and dangerous!\n", get_var_name(v1)); #endif return FAKE_CELL; } break; default: nasl_perror(NULL, "Cannot affect rvalue 0x%x to variable\n", rval->type); return NULL; } /* * Bug #146: when executing * x = 'abc'; x = x; or x = make_list(...); x = x[0]; * the rvalue will be freed before it is copied to the lvalue */ v0 = *v1; if (t1 != VAR2_UNDEF && t2 == VAR2_UNDEF) { #if NASL_DEBUG > 0 nasl_perror(NULL, "Warning: Undefining defined variable %s %s\n", get_var_name(v1), get_line_nb(rval)); #endif } else if (t1 == VAR2_ARRAY && t2 != VAR2_ARRAY) { #if NASL_DEBUG > 1 nasl_perror(NULL, "Warning: affecting non array (0x%x) to array variable %s\n", t2, get_line_nb(rval)); #endif } else if ((t1 == VAR2_INT || t1 == VAR2_STRING || t1 == VAR2_DATA) && t2 == VAR2_ARRAY) { #if NASL_DEBUG > 1 nasl_perror(NULL ,"Warning: affecting array to atomic variable (0x%x) %s\n", t2, get_line_nb(rval)); #endif } /* Bug #146: this fake clear is necessary if we copy an array*/ memset(v1, 0, sizeof(*v1)); /* Bug #146: no risk with the type, we already copied it */ v1->var_type = t2; if (rval->type != REF_VAR && rval->type != REF_ARRAY && rval->type != DYN_ARRAY) switch (t2) { case VAR2_INT: v1->v.v_int = rval->x.i_val; break; case VAR2_STRING: case VAR2_DATA: if( rval->x.str_val == NULL ) { v1->v.v_str.s_val = NULL; v1->v.v_str.s_siz = 0; } else { p = emalloc(rval->size+1); memcpy(p, rval->x.str_val, rval->size+1); v1->v.v_str.s_siz = rval->size; v1->v.v_str.s_val = p; } break; } else /* REF_xxx */ switch(t2) { case VAR2_INT: v1->v.v_int = v2->v.v_int; break; case VAR2_STRING: case VAR2_DATA: if(v2->v.v_str.s_val == NULL) { v1->v.v_str.s_val = NULL; v1->v.v_str.s_siz = 0; } else { p = emalloc(v2->v.v_str.s_siz); memcpy(p, v2->v.v_str.s_val, v2->v.v_str.s_siz); v1->v.v_str.s_siz = v2->v.v_str.s_siz; v1->v.v_str.s_val = p; } break; case VAR2_ARRAY: copy_array(&v1->v.v_arr, a); if (v0.var_type == VAR2_ARRAY) bzero(&v0, sizeof(v0)); /* So that we don't clear the variable twice */ break; } if (nasl_trace_fp != NULL) switch(t2) { case VAR2_INT: nasl_trace(NULL, "NASL> %s <- %d\n", get_var_name(v1), v1->v.v_int); break; case VAR2_STRING: case VAR2_DATA: nasl_trace(NULL, "NASL> %s <- \"%s\"\n", get_var_name(v1), v1->v.v_str.s_val); break; case VAR2_ARRAY: nasl_trace(NULL, "NASL> %s <- (VAR2_ARRAY)\n", get_var_name(v1)); break; default: nasl_trace(NULL, "NASL> %s <- (Type 0x%x)\n", get_var_name(v1), t2); break; } clear_anon_var(&v0); return FAKE_CELL; }
tree_cell* nasl_exec(lex_ctxt* lexic, tree_cell* st) { tree_cell *ret = NULL, *ret2 = NULL, *tc1 = NULL, *tc2 = NULL, *tc3 = NULL, *idx = NULL, *args; int flag, x, y, z; char *s1 = NULL, *s2 = NULL, *s3 = NULL, *p = NULL; char *p1, *p2; int len1, len2; nasl_func *pf = NULL; int i, n; unsigned long sz; #if 0 nasl_dump_tree(st); /* See rt.value, rt.type, rt.length */ #endif /* return */ if (lexic->ret_val != NULL) { ref_cell(lexic->ret_val); return lexic->ret_val; } /* break or continue */ if (lexic->break_flag || lexic->cont_flag) return FAKE_CELL; if (st == FAKE_CELL) return FAKE_CELL; if (st == NULL) { #if NASL_DEBUG > 0 nasl_perror(lexic, "nasl_exec: st == NULL\n"); #endif return NULL; } if (nasl_trace_fp != NULL) nasl_short_dump(nasl_trace_fp, st); switch(st->type) { case NODE_IF_ELSE: ret = nasl_exec(lexic, st->link[0]); #ifdef STOP_AT_FIRST_ERROR if (ret == NULL) return NULL; #endif if (cvt_bool(lexic, ret)) ret2 = nasl_exec(lexic, st->link[1]); else if (st->link[2] != NULL) /* else branch */ ret2 = nasl_exec(lexic, st->link[2]); else /* No else */ ret2 = FAKE_CELL; deref_cell(ret); return ret2; case NODE_INSTR_L: /* Block. [0] = first instr, [1] = tail */ ret = nasl_exec(lexic, st->link[0]); #if NASL_DEBUG > 1 if (ret == NULL) nasl_perror(lexic, "Instruction failed. Going on in block\n"); #endif if (st->link[1] == NULL || lexic->break_flag || lexic->cont_flag) return ret; deref_cell(ret); ret = nasl_exec(lexic, st->link[1]); return ret; case NODE_FOR: /* [0] = start expr, [1] = cond, [2] = end_expr, [3] = block */ ret2 = nasl_exec(lexic, st->link[0]); #ifdef STOP_AT_FIRST_ERROR if (ret2 == NULL) return NULL; #endif deref_cell(ret2); for (;;) { /* Break the loop if 'return' */ if (lexic->ret_val != NULL) { ref_cell(lexic->ret_val); return lexic->ret_val; } /* condition */ if ((ret = nasl_exec(lexic, st->link[1])) == NULL) return NULL; /* We can return here, as NULL is false */ flag = cvt_bool(lexic, ret); deref_cell(ret); if (! flag) break; /* block */ ret = nasl_exec(lexic, st->link[3]); #ifdef STOP_AT_FIRST_ERROR if (ret == NULL) return NULL; #endif deref_cell(ret); /* break */ if (lexic->break_flag) { lexic->break_flag = 0; return FAKE_CELL; } lexic->cont_flag = 0; /* No need to test if set */ /* end expression */ ret = nasl_exec(lexic, st->link[2]); #ifdef STOP_AT_FIRST_ERROR if (ret == NULL) return NULL; #endif deref_cell(ret); } return FAKE_CELL; case NODE_WHILE: /* [0] = cond, [1] = block */ for (;;) { /* return? */ if (lexic->ret_val != NULL) { ref_cell(lexic->ret_val); return lexic->ret_val; } /* Condition */ if ((ret = nasl_exec(lexic, st->link[0])) == NULL) return NULL; /* NULL is false */ flag = cvt_bool(lexic, ret); deref_cell(ret); if (! flag) break; /* Block */ ret = nasl_exec(lexic, st->link[1]); #ifdef STOP_AT_FIRST_ERROR if (ret == NULL) return NULL; #endif deref_cell(ret); /* break */ if (lexic->break_flag) { lexic->break_flag = 0; return FAKE_CELL; } lexic->cont_flag = 0; } return FAKE_CELL; case NODE_REPEAT_UNTIL: /* [0] = block, [1] = cond */ for (;;) { /* return? */ if (lexic->ret_val != NULL) { ref_cell(lexic->ret_val); return lexic->ret_val; } /* Block */ ret = nasl_exec(lexic, st->link[0]); #ifdef STOP_AT_FIRST_ERROR if (ret == NULL) return NULL; #endif deref_cell(ret); /* break */ if (lexic->break_flag) { lexic->break_flag = 0; return FAKE_CELL; } lexic->cont_flag = 0; /* Condition */ ret = nasl_exec(lexic, st->link[1]); #ifdef STOP_AT_FIRST_ERROR if (ret == NULL) return NULL; #endif flag = cvt_bool(lexic, ret); deref_cell(ret); if (flag) break; } return FAKE_CELL; case NODE_FOREACH: /* str_val = index name, [0] = array, [1] = block */ { nasl_iterator ai; tree_cell *v, *a, *val; v = get_variable_by_name(lexic, st->x.str_val); if (v == NULL) return NULL; /* We cannot go on if we have no variable to iterate */ a = nasl_exec(lexic, st->link[0]); ai = nasl_array_iterator(a); while ((val = nasl_iterate_array(&ai)) != NULL) { tc1 = nasl_affect(v, val); ret = nasl_exec(lexic, st->link[1]); deref_cell(val); deref_cell(tc1); #ifdef STOP_AT_FIRST_ERROR if (ret == NULL) break; #endif deref_cell(ret); /* return */ if (lexic->ret_val != NULL) break; /* break */ if (lexic->break_flag) { lexic->break_flag = 0; break; } lexic->cont_flag = 0; } deref_cell(a); deref_cell(v); } return FAKE_CELL; case NODE_FUN_DEF: /* x.str_val = function name, [0] = argdecl, [1] = block */ ret = decl_nasl_func(lexic, st); return ret; case NODE_FUN_CALL: pf = get_func_ref_by_name(lexic, st->x.str_val); if (pf == NULL) { nasl_perror(lexic, "Undefined function '%s'\n", st->x.str_val); return NULL; } args = st->link[0]; #if 0 printf("****************\n"); nasl_dump_tree(args); printf("****************\n"); #endif ret = nasl_func_call(lexic, pf, args); return ret; case NODE_REPEATED: n = cell2intW(lexic, st->link[1]); if (n <= 0) return NULL; #ifdef STOP_AT_FIRST_ERROR for (tc1 = NULL, i = 1; i <= n; i ++) { deref_cell(tc1); if ((tc1 = nasl_exec(lexic, st->link[0])) == NULL) return NULL; } return tc1; #else for (i = 1; i <= n; i ++) { tc1 = nasl_exec(lexic, st->link[0]); deref_cell(tc1); } return FAKE_CELL; #endif /* * I wonder... * Will nasl_exec be really called with NODE_EXEC or NODE_ARG? */ case NODE_DECL: /* Used in function declarations */ /* [0] = next arg in list */ /* TBD? */ return st; /* ? */ case NODE_ARG: /* Used function calls */ /* val = name can be NULL, [0] = val, [1] = next arg */ ret = nasl_exec(lexic, st->link[0]); /* Is this wise? */ return ret; case NODE_RETURN: /* [0] = ret val */ ret = nasl_return(lexic, st->link[0]); return ret; case NODE_BREAK: lexic->break_flag = 1; return FAKE_CELL; case NODE_CONTINUE: lexic->cont_flag = 1; return FAKE_CELL; case NODE_ARRAY_EL: /* val = array name, [0] = index */ idx = cell2atom(lexic, st->link[0]); ret = get_array_elem(lexic, st->x.str_val, idx); deref_cell(idx); return ret; case NODE_AFF: /* [0] = lvalue, [1] = rvalue */ tc1 = nasl_exec(lexic, st->link[0]); tc2 = nasl_exec(lexic, st->link[1]); ret = nasl_affect(tc1, tc2); deref_cell(tc1); /* Must free VAR_REF */ deref_cell(ret); return tc2; /* So that "a = b = e;" works */ case NODE_PLUS_EQ: tc1 = nasl_exec(lexic, st->link[0]); tc2 = nasl_exec(lexic, st->link[1]); tc3 = alloc_expr_cell(0, EXPR_PLUS, tc1, tc2); ret2 = nasl_exec(lexic, tc3); ret = nasl_affect(tc1, ret2); deref_cell(tc3); /* Frees tc1 and tc2 */ deref_cell(ret); return ret2; /* So that "a = b += e;" works */ case NODE_MINUS_EQ: tc1 = nasl_exec(lexic, st->link[0]); tc2 = nasl_exec(lexic, st->link[1]); tc3 = alloc_expr_cell(0, EXPR_MINUS, tc1, tc2); ret2 = nasl_exec(lexic, tc3); ret = nasl_affect(tc1, ret2); deref_cell(tc3); /* Frees tc1 and tc2 */ deref_cell(ret); return ret2; /* So that "a = b -= e;" works */ case NODE_MULT_EQ: tc1 = nasl_exec(lexic, st->link[0]); tc2 = nasl_exec(lexic, st->link[1]); tc3 = alloc_expr_cell(0, EXPR_MULT, tc1, tc2); ret2 = nasl_exec(lexic, tc3); ret = nasl_affect(tc1, ret2); deref_cell(tc3); /* Frees tc1 and tc2 */ deref_cell(ret); return ret2; case NODE_DIV_EQ: tc1 = nasl_exec(lexic, st->link[0]); tc2 = nasl_exec(lexic, st->link[1]); tc3 = alloc_expr_cell(0, EXPR_DIV, tc1, tc2); ret2 = nasl_exec(lexic, tc3); ret = nasl_affect(tc1, ret2); deref_cell(tc3); /* Frees tc1 and tc2 */ deref_cell(ret); return ret2; case NODE_MODULO_EQ: tc1 = nasl_exec(lexic, st->link[0]); tc2 = nasl_exec(lexic, st->link[1]); tc3 = alloc_expr_cell(0, EXPR_MODULO, tc1, tc2); ret2 = nasl_exec(lexic, tc3); ret = nasl_affect(tc1, ret2); deref_cell(tc3); /* Frees tc1 and tc2 */ deref_cell(ret); return ret2; case NODE_L_SHIFT_EQ: tc1 = nasl_exec(lexic, st->link[0]); tc2 = nasl_exec(lexic, st->link[1]); tc3 = alloc_expr_cell(0, EXPR_L_SHIFT, tc1, tc2); ret2 = nasl_exec(lexic, tc3); ret = nasl_affect(tc1, ret2); deref_cell(tc3); /* Frees tc1 and tc2 */ deref_cell(ret); return ret2; case NODE_R_SHIFT_EQ: tc1 = nasl_exec(lexic, st->link[0]); tc2 = nasl_exec(lexic, st->link[1]); tc3 = alloc_expr_cell(0, EXPR_R_SHIFT, tc1, tc2); ret2 = nasl_exec(lexic, tc3); ret = nasl_affect(tc1, ret2); deref_cell(tc3); /* Frees tc1 and tc2 */ deref_cell(ret); return ret2; case NODE_R_USHIFT_EQ: tc1 = nasl_exec(lexic, st->link[0]); tc2 = nasl_exec(lexic, st->link[1]); tc3 = alloc_expr_cell(0, EXPR_R_USHIFT, tc1, tc2); ret2 = nasl_exec(lexic, tc3); ret = nasl_affect(tc1, ret2); deref_cell(tc3); /* Frees tc1 and tc2 */ deref_cell(ret); return ret2; case NODE_VAR: /* val = variable name */ ret = get_variable_by_name(lexic, st->x.str_val); return ret; case NODE_LOCAL: /* [0] = argdecl */ ret = decl_local_variables(lexic, st->link[0]); return ret; case NODE_GLOBAL: /* [0] = argdecl */ ret = decl_global_variables(lexic, st->link[0]); return ret; case EXPR_AND: x = cell2bool(lexic, st->link[0]); if(! x) return bool2cell(0); y = cell2bool(lexic, st->link[1]); return bool2cell(y); case EXPR_OR: x = cell2bool(lexic, st->link[0]); if(x) return bool2cell(x); y = cell2bool(lexic, st->link[1]); return bool2cell(y); case EXPR_NOT: x = cell2bool(lexic, st->link[0]); return bool2cell(! x); case EXPR_INCR: case EXPR_DECR: x = (st->type == EXPR_INCR) ? 1 : -1; if (st->link[0] == NULL) { y = 1; /* pre */ tc1 = st->link[1]; } else { y = 0; /* post */ tc1 = st->link[0]; } tc2 = nasl_exec(lexic, tc1); if (tc2 == NULL) return NULL; ret = nasl_incr_variable(lexic, tc2, y, x); deref_cell(tc2); return ret; if (st->link[0] == NULL) ret = nasl_incr_variable(lexic, st->link[1], 1, 1); else ret = nasl_incr_variable(lexic, st->link[1], 0, 1); break; case EXPR_PLUS: s1 = s2 = NULL; tc1 = cell2atom(lexic, st->link[0]); #ifdef STOP_AT_FIRST_ERROR if (tc1 == NULL || tc1 == FAKE_CELL) return NULL; #endif tc2 = cell2atom(lexic, st->link[1]); if (tc2 == NULL || tc2 == FAKE_CELL) { #ifdef STOP_AT_FIRST_ERROR deref_cell(tc1); return NULL; #else return tc1; #endif } if (tc1 == NULL || tc1 == FAKE_CELL) return tc2; /* * Anything added to a string is converted to a string * Otherwise anything added to an intger is converted into an integer */ if (tc1->type == CONST_DATA || tc2->type == CONST_DATA) flag = CONST_DATA; else if (tc1->type == CONST_STR || tc2->type == CONST_STR) flag = CONST_STR; else if (tc1->type == CONST_INT || tc2->type == CONST_INT) flag = CONST_INT; else flag = NODE_EMPTY; #if NASL_DEBUG > 0 if ((flag == CONST_DATA || flag == CONST_STR) && (tc1->type == CONST_INT || tc2->type == CONST_INT)) nasl_perror(lexic, "Horrible type conversion (int -> str) for operator + %s\n", get_line_nb(st)); #endif switch (flag) { case CONST_INT: x = tc1->x.i_val; y = cell2int(lexic, tc2); ret = int2cell(x + y); break; case CONST_STR: case CONST_DATA: s1 = s2 = NULL; if (tc1->type == CONST_STR || tc1->type == CONST_DATA) len1 = tc1->size; else { s1 = cell2str(lexic, tc1); len1 = (s1 == NULL ? 0 : strlen(s1)); } if (tc2->type == CONST_STR || tc2->type == CONST_DATA) len2 = tc2->size; else { s2 = cell2str(lexic, tc2); len2 = (s2 == NULL ? 0 : strlen(s2)); } sz = len1 + len2; s3 = emalloc(sz); if (len1 > 0) memcpy(s3, s1 != NULL ? s1 : tc1->x.str_val, len1); if (len2 > 0) memcpy(s3 + len1, s2 != NULL ? s2 : tc2->x.str_val, len2); efree(&s1); efree(&s2); ret = alloc_tree_cell(0, s3); ret->type = flag; ret->size = sz; break; default: ret = NULL; break; } deref_cell(tc1); deref_cell(tc2); return ret; case EXPR_MINUS: /* Infamous duplicated code */ s1 = s2 = NULL; tc1 = cell2atom(lexic, st->link[0]); #ifdef STOP_AT_FIRST_ERROR if (tc1 == NULL || tc1 == FAKE_CELL) return NULL; #endif tc2 = cell2atom(lexic, st->link[1]); if (tc2 == NULL || tc2 == FAKE_CELL) { #ifdef STOP_AT_FIRST_ERROR deref_cell(tc1); return NULL; #else return tc1; #endif } if (tc1 == NULL || tc1 == FAKE_CELL) { if (tc2->type == CONST_INT) { y = cell2int(lexic, tc2); ret = int2cell(- y); } else ret = NULL; deref_cell(tc2); return ret; } /* * Anything substracted from a string is converted to a string * Otherwise anything substracted from integer is converted into an * integer */ if (tc1->type == CONST_DATA || tc2->type == CONST_DATA) flag = CONST_DATA; else if (tc1->type == CONST_STR || tc2->type == CONST_STR) flag = CONST_STR; else if (tc1->type == CONST_INT || tc2->type == CONST_INT) flag = CONST_INT; else flag = NODE_EMPTY; #if NASL_DEBUG > 0 if ((flag == CONST_DATA || flag == CONST_STR) && (tc1->type == CONST_INT || tc2->type == CONST_INT)) nasl_perror(lexic, "Horrible type conversion (int -> str) for operator - %s\n", get_line_nb(st)); #endif switch (flag) { case CONST_INT: x = cell2int(lexic, tc1); y = cell2int(lexic, tc2); ret = int2cell(x - y); break; case CONST_STR: case CONST_DATA: if (tc1->type == CONST_STR || tc1->type == CONST_DATA) { p1 = tc1->x.str_val; len1 = tc1->size; } else { p1 = s1 = cell2str(lexic, tc1); len1 = (s1 == NULL ? 0 : strlen(s1)); } if (tc2->type == CONST_STR || tc2->type == CONST_DATA) { p2 = tc2->x.str_val; len2 = tc2->size; } else { p2 = s2 = cell2str(lexic, tc2); len2 = (s2 == NULL ? 0 : strlen(s2)); } if (len2 == 0 || len1 < len2 || (p = (char*)nasl_memmem(p1, len1, p2, len2)) == NULL) { s3 = emalloc(len1); memcpy(s3, p1, len1); ret = alloc_tree_cell(0, s3); ret->type = flag; ret->size = len1; } else { sz = len1 - len2; if (sz <= 0) { sz = 0; s3 = estrdup(""); } else { s3 = emalloc(sz); if (p - p1 > 0) memcpy(s3, p1, p - p1); if (sz > p - p1) memcpy(s3 + (p - p1), p + len2, sz - (p - p1)); } ret = alloc_tree_cell(0, s3); ret->size = sz; ret->type = flag; } efree(&s1); efree(&s2); break; default: ret = NULL; break; } deref_cell(tc1); deref_cell(tc2); return ret; case EXPR_MULT: x = cell2intW(lexic, st->link[0]); y = cell2intW(lexic, st->link[1]); return int2cell(x * y); case EXPR_DIV: x = cell2intW(lexic, st->link[0]); y = cell2intW(lexic, st->link[1]); if( y != 0 ) return int2cell(x / y); else return int2cell(0); case EXPR_EXPO: x = cell2intW(lexic, st->link[0]); y = cell2intW(lexic, st->link[1]); return int2cell(expo(x, y)); case EXPR_MODULO: x = cell2intW(lexic, st->link[0]); y = cell2intW(lexic, st->link[1]); if( y != 0) return int2cell(x % y); else return int2cell(0); case EXPR_BIT_AND: x = cell2intW(lexic, st->link[0]); y = cell2intW(lexic, st->link[1]); return int2cell(x & y); case EXPR_BIT_OR: x = cell2intW(lexic, st->link[0]); y = cell2intW(lexic, st->link[1]); return int2cell(x | y); case EXPR_BIT_XOR: x = cell2intW(lexic, st->link[0]); y = cell2intW(lexic, st->link[1]); return int2cell(x ^ y); case EXPR_BIT_NOT: x = cell2intW(lexic, st->link[0]); return int2cell(~ x); case EXPR_U_MINUS: x = cell2intW(lexic, st->link[0]); return int2cell(- x); /* TBD: Handle shift for strings and arrays */ case EXPR_L_SHIFT: x = cell2intW(lexic, st->link[0]); y = cell2intW(lexic, st->link[1]); return int2cell(x << y); case EXPR_R_SHIFT: /* arithmetic right shift */ x = cell2intW(lexic, st->link[0]); y = cell2intW(lexic, st->link[1]); #if NASL_DEBUG > 0 if (y < 0) nasl_perror(lexic, "Warning: Negative count in right shift!\n"); #endif z = x >> y; #ifndef __GNUC__ if (x < 0 && z >= 0) /* Fix it */ { #if NASL_DEBUG > 1 nasl_perror(lexic, "Warning: arithmetic right shift is buggy! Fixing...\n"); #endif z |= (~0) << (sizeof(x) * 8 - y); } #endif return int2cell(z); case EXPR_R_USHIFT: x = cell2intW(lexic, st->link[0]); y = cell2intW(lexic, st->link[1]); #if NASL_DEBUG > 0 if (y < 0) nasl_perror(lexic, "Warning: Negative count in right shift!\n"); #endif z = (unsigned)x >> (unsigned)y; #ifndef __GNUC__ if (x < 0 && z <= 0) /* Fix it! */ { #if NASL_DEBUG > 1 nasl_perror(lexic, "Warning: Logical right shift is buggy! Fixing...\n"); #endif z &= ~((~0) << (sizeof(x) * 8 - y)); } #endif return int2cell(z); case COMP_MATCH: case COMP_NOMATCH: tc1 = cell2atom(lexic, st->link[0]); tc2 = cell2atom(lexic, st->link[1]); s1 = s2 = NULL; if (tc1 == NULL || tc1 == FAKE_CELL) { p1 = ""; len1 = 0; } else if (tc1->type == CONST_STR || tc1->type == CONST_DATA) { p1 = tc1->x.str_val; len1 = tc1->size; } else { #if NASL_DEBUG > 0 nasl_perror(lexic, "Horrible type conversion (%s -> str) for operator >< or >!< %s\n", nasl_type_name(tc1->type), get_line_nb(st)); #endif p1 = s1 = cell2str(lexic, tc1); len1 = strlen(s1); } if (tc2 == NULL || tc2 == FAKE_CELL) { p2 = ""; len2 = 0; } else if (tc2->type == CONST_STR || tc2->type == CONST_DATA) { p2 = tc2->x.str_val; len2 = tc2->size; } else { #if NASL_DEBUG > 0 nasl_perror(lexic, "Horrible type conversion (%s -> str) for operator >< or >!< %s\n", nasl_type_name(tc2->type), get_line_nb(st)); #endif p2 = s2 = cell2str(lexic, tc2); len2 = strlen(s2); } if(len1 <= len2) flag = ((void*)nasl_memmem(p2, len2, p1, len1) != NULL); else flag = 0; efree(&s1); efree(&s2); deref_cell(tc1); deref_cell(tc2); if (st->type == COMP_MATCH) return bool2cell(flag); else return bool2cell(! flag); case COMP_RE_MATCH: case COMP_RE_NOMATCH: if (st->x.ref_val == NULL) { nasl_perror(lexic, "nasl_exec: bad regex at or near line %d\n", st->line_nb); return NULL; } s1 = cell2str(lexic, st->link[0]); if (s1 == NULL) return 0; flag = nasl_regexec(st->x.ref_val, s1, 0, NULL, 0); free(s1); if (st->type == COMP_RE_MATCH) return bool2cell(flag != REG_NOMATCH); else return bool2cell(flag == REG_NOMATCH); case COMP_LT: return bool2cell(cell_cmp(lexic, st->link[0], st->link[1]) < 0); case COMP_LE: return bool2cell(cell_cmp(lexic, st->link[0], st->link[1]) <= 0); case COMP_EQ: return bool2cell(cell_cmp(lexic, st->link[0], st->link[1]) == 0); case COMP_NE: return bool2cell(cell_cmp(lexic, st->link[0], st->link[1]) != 0); case COMP_GT: return bool2cell(cell_cmp(lexic, st->link[0], st->link[1]) > 0); case COMP_GE: return bool2cell(cell_cmp(lexic, st->link[0], st->link[1]) >= 0); case REF_ARRAY: case DYN_ARRAY: case CONST_INT: case CONST_STR: case CONST_DATA: ref_cell(st); /* nasl_exec returns a cell that should be deref-ed */ return st; case REF_VAR: ret = nasl_read_var_ref(lexic, st); return ret; default: nasl_perror(lexic, "nasl_exec: unhandled node type %d\n", st->type); abort(); return NULL; } deref_cell(ret); deref_cell(ret2); return NULL; }