static int var_cmp(const void * a, const void * b) { anon_nasl_var ** pv1 = (anon_nasl_var **)a, ** pv2 = (anon_nasl_var**)b; tree_cell *t1, *t2; t1 = var2cell((anon_nasl_var*)*pv1); t2 = var2cell((anon_nasl_var*)*pv2); return cell_cmp(mylexic, t1, t2); }
/** Test two edges for equality. * * @param x1 one edge * @param x2 another edge * * @return 0 if the two edges are equal (i.e., have the same cells * as endpoints in either order), non-0 otherwise. */ static int edge_cmp(void* x1, void* x2) { edge_t* e1 = x1 ; edge_t* e2 = x2 ; return (cell_cmp(e1->a, e2->a) + cell_cmp(e1->b, e2->b))* (cell_cmp(e1->a, e2->b) + cell_cmp(e1->b, e2->a)) ; }
tree_cell* nasl_exec(lex_ctxt* lexic, tree_cell* st) { tree_cell *ret = NULL, *ret2 = NULL, *tc1 = NULL, *tc2 = NULL, *tc3 = NULL, *idx = NULL, *args; int flag, x, y, z; char *s1 = NULL, *s2 = NULL, *s3 = NULL, *p = NULL; char *p1, *p2; int len1, len2; nasl_func *pf = NULL; int i, n; unsigned long sz; #if 0 nasl_dump_tree(st); /* See rt.value, rt.type, rt.length */ #endif /* return */ if (lexic->ret_val != NULL) { ref_cell(lexic->ret_val); return lexic->ret_val; } /* break or continue */ if (lexic->break_flag || lexic->cont_flag) return FAKE_CELL; if (st == FAKE_CELL) return FAKE_CELL; if (st == NULL) { #if NASL_DEBUG > 0 nasl_perror(lexic, "nasl_exec: st == NULL\n"); #endif return NULL; } if (nasl_trace_fp != NULL) nasl_short_dump(nasl_trace_fp, st); switch(st->type) { case NODE_IF_ELSE: ret = nasl_exec(lexic, st->link[0]); #ifdef STOP_AT_FIRST_ERROR if (ret == NULL) return NULL; #endif if (cvt_bool(lexic, ret)) ret2 = nasl_exec(lexic, st->link[1]); else if (st->link[2] != NULL) /* else branch */ ret2 = nasl_exec(lexic, st->link[2]); else /* No else */ ret2 = FAKE_CELL; deref_cell(ret); return ret2; case NODE_INSTR_L: /* Block. [0] = first instr, [1] = tail */ ret = nasl_exec(lexic, st->link[0]); #if NASL_DEBUG > 1 if (ret == NULL) nasl_perror(lexic, "Instruction failed. Going on in block\n"); #endif if (st->link[1] == NULL || lexic->break_flag || lexic->cont_flag) return ret; deref_cell(ret); ret = nasl_exec(lexic, st->link[1]); return ret; case NODE_FOR: /* [0] = start expr, [1] = cond, [2] = end_expr, [3] = block */ ret2 = nasl_exec(lexic, st->link[0]); #ifdef STOP_AT_FIRST_ERROR if (ret2 == NULL) return NULL; #endif deref_cell(ret2); for (;;) { /* Break the loop if 'return' */ if (lexic->ret_val != NULL) { ref_cell(lexic->ret_val); return lexic->ret_val; } /* condition */ if ((ret = nasl_exec(lexic, st->link[1])) == NULL) return NULL; /* We can return here, as NULL is false */ flag = cvt_bool(lexic, ret); deref_cell(ret); if (! flag) break; /* block */ ret = nasl_exec(lexic, st->link[3]); #ifdef STOP_AT_FIRST_ERROR if (ret == NULL) return NULL; #endif deref_cell(ret); /* break */ if (lexic->break_flag) { lexic->break_flag = 0; return FAKE_CELL; } lexic->cont_flag = 0; /* No need to test if set */ /* end expression */ ret = nasl_exec(lexic, st->link[2]); #ifdef STOP_AT_FIRST_ERROR if (ret == NULL) return NULL; #endif deref_cell(ret); } return FAKE_CELL; case NODE_WHILE: /* [0] = cond, [1] = block */ for (;;) { /* return? */ if (lexic->ret_val != NULL) { ref_cell(lexic->ret_val); return lexic->ret_val; } /* Condition */ if ((ret = nasl_exec(lexic, st->link[0])) == NULL) return NULL; /* NULL is false */ flag = cvt_bool(lexic, ret); deref_cell(ret); if (! flag) break; /* Block */ ret = nasl_exec(lexic, st->link[1]); #ifdef STOP_AT_FIRST_ERROR if (ret == NULL) return NULL; #endif deref_cell(ret); /* break */ if (lexic->break_flag) { lexic->break_flag = 0; return FAKE_CELL; } lexic->cont_flag = 0; } return FAKE_CELL; case NODE_REPEAT_UNTIL: /* [0] = block, [1] = cond */ for (;;) { /* return? */ if (lexic->ret_val != NULL) { ref_cell(lexic->ret_val); return lexic->ret_val; } /* Block */ ret = nasl_exec(lexic, st->link[0]); #ifdef STOP_AT_FIRST_ERROR if (ret == NULL) return NULL; #endif deref_cell(ret); /* break */ if (lexic->break_flag) { lexic->break_flag = 0; return FAKE_CELL; } lexic->cont_flag = 0; /* Condition */ ret = nasl_exec(lexic, st->link[1]); #ifdef STOP_AT_FIRST_ERROR if (ret == NULL) return NULL; #endif flag = cvt_bool(lexic, ret); deref_cell(ret); if (flag) break; } return FAKE_CELL; case NODE_FOREACH: /* str_val = index name, [0] = array, [1] = block */ { nasl_iterator ai; tree_cell *v, *a, *val; v = get_variable_by_name(lexic, st->x.str_val); if (v == NULL) return NULL; /* We cannot go on if we have no variable to iterate */ a = nasl_exec(lexic, st->link[0]); ai = nasl_array_iterator(a); while ((val = nasl_iterate_array(&ai)) != NULL) { tc1 = nasl_affect(v, val); ret = nasl_exec(lexic, st->link[1]); deref_cell(val); deref_cell(tc1); #ifdef STOP_AT_FIRST_ERROR if (ret == NULL) break; #endif deref_cell(ret); /* return */ if (lexic->ret_val != NULL) break; /* break */ if (lexic->break_flag) { lexic->break_flag = 0; break; } lexic->cont_flag = 0; } deref_cell(a); deref_cell(v); } return FAKE_CELL; case NODE_FUN_DEF: /* x.str_val = function name, [0] = argdecl, [1] = block */ ret = decl_nasl_func(lexic, st); return ret; case NODE_FUN_CALL: pf = get_func_ref_by_name(lexic, st->x.str_val); if (pf == NULL) { nasl_perror(lexic, "Undefined function '%s'\n", st->x.str_val); return NULL; } args = st->link[0]; #if 0 printf("****************\n"); nasl_dump_tree(args); printf("****************\n"); #endif ret = nasl_func_call(lexic, pf, args); return ret; case NODE_REPEATED: n = cell2intW(lexic, st->link[1]); if (n <= 0) return NULL; #ifdef STOP_AT_FIRST_ERROR for (tc1 = NULL, i = 1; i <= n; i ++) { deref_cell(tc1); if ((tc1 = nasl_exec(lexic, st->link[0])) == NULL) return NULL; } return tc1; #else for (i = 1; i <= n; i ++) { tc1 = nasl_exec(lexic, st->link[0]); deref_cell(tc1); } return FAKE_CELL; #endif /* * I wonder... * Will nasl_exec be really called with NODE_EXEC or NODE_ARG? */ case NODE_DECL: /* Used in function declarations */ /* [0] = next arg in list */ /* TBD? */ return st; /* ? */ case NODE_ARG: /* Used function calls */ /* val = name can be NULL, [0] = val, [1] = next arg */ ret = nasl_exec(lexic, st->link[0]); /* Is this wise? */ return ret; case NODE_RETURN: /* [0] = ret val */ ret = nasl_return(lexic, st->link[0]); return ret; case NODE_BREAK: lexic->break_flag = 1; return FAKE_CELL; case NODE_CONTINUE: lexic->cont_flag = 1; return FAKE_CELL; case NODE_ARRAY_EL: /* val = array name, [0] = index */ idx = cell2atom(lexic, st->link[0]); ret = get_array_elem(lexic, st->x.str_val, idx); deref_cell(idx); return ret; case NODE_AFF: /* [0] = lvalue, [1] = rvalue */ tc1 = nasl_exec(lexic, st->link[0]); tc2 = nasl_exec(lexic, st->link[1]); ret = nasl_affect(tc1, tc2); deref_cell(tc1); /* Must free VAR_REF */ deref_cell(ret); return tc2; /* So that "a = b = e;" works */ case NODE_PLUS_EQ: tc1 = nasl_exec(lexic, st->link[0]); tc2 = nasl_exec(lexic, st->link[1]); tc3 = alloc_expr_cell(0, EXPR_PLUS, tc1, tc2); ret2 = nasl_exec(lexic, tc3); ret = nasl_affect(tc1, ret2); deref_cell(tc3); /* Frees tc1 and tc2 */ deref_cell(ret); return ret2; /* So that "a = b += e;" works */ case NODE_MINUS_EQ: tc1 = nasl_exec(lexic, st->link[0]); tc2 = nasl_exec(lexic, st->link[1]); tc3 = alloc_expr_cell(0, EXPR_MINUS, tc1, tc2); ret2 = nasl_exec(lexic, tc3); ret = nasl_affect(tc1, ret2); deref_cell(tc3); /* Frees tc1 and tc2 */ deref_cell(ret); return ret2; /* So that "a = b -= e;" works */ case NODE_MULT_EQ: tc1 = nasl_exec(lexic, st->link[0]); tc2 = nasl_exec(lexic, st->link[1]); tc3 = alloc_expr_cell(0, EXPR_MULT, tc1, tc2); ret2 = nasl_exec(lexic, tc3); ret = nasl_affect(tc1, ret2); deref_cell(tc3); /* Frees tc1 and tc2 */ deref_cell(ret); return ret2; case NODE_DIV_EQ: tc1 = nasl_exec(lexic, st->link[0]); tc2 = nasl_exec(lexic, st->link[1]); tc3 = alloc_expr_cell(0, EXPR_DIV, tc1, tc2); ret2 = nasl_exec(lexic, tc3); ret = nasl_affect(tc1, ret2); deref_cell(tc3); /* Frees tc1 and tc2 */ deref_cell(ret); return ret2; case NODE_MODULO_EQ: tc1 = nasl_exec(lexic, st->link[0]); tc2 = nasl_exec(lexic, st->link[1]); tc3 = alloc_expr_cell(0, EXPR_MODULO, tc1, tc2); ret2 = nasl_exec(lexic, tc3); ret = nasl_affect(tc1, ret2); deref_cell(tc3); /* Frees tc1 and tc2 */ deref_cell(ret); return ret2; case NODE_L_SHIFT_EQ: tc1 = nasl_exec(lexic, st->link[0]); tc2 = nasl_exec(lexic, st->link[1]); tc3 = alloc_expr_cell(0, EXPR_L_SHIFT, tc1, tc2); ret2 = nasl_exec(lexic, tc3); ret = nasl_affect(tc1, ret2); deref_cell(tc3); /* Frees tc1 and tc2 */ deref_cell(ret); return ret2; case NODE_R_SHIFT_EQ: tc1 = nasl_exec(lexic, st->link[0]); tc2 = nasl_exec(lexic, st->link[1]); tc3 = alloc_expr_cell(0, EXPR_R_SHIFT, tc1, tc2); ret2 = nasl_exec(lexic, tc3); ret = nasl_affect(tc1, ret2); deref_cell(tc3); /* Frees tc1 and tc2 */ deref_cell(ret); return ret2; case NODE_R_USHIFT_EQ: tc1 = nasl_exec(lexic, st->link[0]); tc2 = nasl_exec(lexic, st->link[1]); tc3 = alloc_expr_cell(0, EXPR_R_USHIFT, tc1, tc2); ret2 = nasl_exec(lexic, tc3); ret = nasl_affect(tc1, ret2); deref_cell(tc3); /* Frees tc1 and tc2 */ deref_cell(ret); return ret2; case NODE_VAR: /* val = variable name */ ret = get_variable_by_name(lexic, st->x.str_val); return ret; case NODE_LOCAL: /* [0] = argdecl */ ret = decl_local_variables(lexic, st->link[0]); return ret; case NODE_GLOBAL: /* [0] = argdecl */ ret = decl_global_variables(lexic, st->link[0]); return ret; case EXPR_AND: x = cell2bool(lexic, st->link[0]); if(! x) return bool2cell(0); y = cell2bool(lexic, st->link[1]); return bool2cell(y); case EXPR_OR: x = cell2bool(lexic, st->link[0]); if(x) return bool2cell(x); y = cell2bool(lexic, st->link[1]); return bool2cell(y); case EXPR_NOT: x = cell2bool(lexic, st->link[0]); return bool2cell(! x); case EXPR_INCR: case EXPR_DECR: x = (st->type == EXPR_INCR) ? 1 : -1; if (st->link[0] == NULL) { y = 1; /* pre */ tc1 = st->link[1]; } else { y = 0; /* post */ tc1 = st->link[0]; } tc2 = nasl_exec(lexic, tc1); if (tc2 == NULL) return NULL; ret = nasl_incr_variable(lexic, tc2, y, x); deref_cell(tc2); return ret; if (st->link[0] == NULL) ret = nasl_incr_variable(lexic, st->link[1], 1, 1); else ret = nasl_incr_variable(lexic, st->link[1], 0, 1); break; case EXPR_PLUS: s1 = s2 = NULL; tc1 = cell2atom(lexic, st->link[0]); #ifdef STOP_AT_FIRST_ERROR if (tc1 == NULL || tc1 == FAKE_CELL) return NULL; #endif tc2 = cell2atom(lexic, st->link[1]); if (tc2 == NULL || tc2 == FAKE_CELL) { #ifdef STOP_AT_FIRST_ERROR deref_cell(tc1); return NULL; #else return tc1; #endif } if (tc1 == NULL || tc1 == FAKE_CELL) return tc2; /* * Anything added to a string is converted to a string * Otherwise anything added to an intger is converted into an integer */ if (tc1->type == CONST_DATA || tc2->type == CONST_DATA) flag = CONST_DATA; else if (tc1->type == CONST_STR || tc2->type == CONST_STR) flag = CONST_STR; else if (tc1->type == CONST_INT || tc2->type == CONST_INT) flag = CONST_INT; else flag = NODE_EMPTY; #if NASL_DEBUG > 0 if ((flag == CONST_DATA || flag == CONST_STR) && (tc1->type == CONST_INT || tc2->type == CONST_INT)) nasl_perror(lexic, "Horrible type conversion (int -> str) for operator + %s\n", get_line_nb(st)); #endif switch (flag) { case CONST_INT: x = tc1->x.i_val; y = cell2int(lexic, tc2); ret = int2cell(x + y); break; case CONST_STR: case CONST_DATA: s1 = s2 = NULL; if (tc1->type == CONST_STR || tc1->type == CONST_DATA) len1 = tc1->size; else { s1 = cell2str(lexic, tc1); len1 = (s1 == NULL ? 0 : strlen(s1)); } if (tc2->type == CONST_STR || tc2->type == CONST_DATA) len2 = tc2->size; else { s2 = cell2str(lexic, tc2); len2 = (s2 == NULL ? 0 : strlen(s2)); } sz = len1 + len2; s3 = emalloc(sz); if (len1 > 0) memcpy(s3, s1 != NULL ? s1 : tc1->x.str_val, len1); if (len2 > 0) memcpy(s3 + len1, s2 != NULL ? s2 : tc2->x.str_val, len2); efree(&s1); efree(&s2); ret = alloc_tree_cell(0, s3); ret->type = flag; ret->size = sz; break; default: ret = NULL; break; } deref_cell(tc1); deref_cell(tc2); return ret; case EXPR_MINUS: /* Infamous duplicated code */ s1 = s2 = NULL; tc1 = cell2atom(lexic, st->link[0]); #ifdef STOP_AT_FIRST_ERROR if (tc1 == NULL || tc1 == FAKE_CELL) return NULL; #endif tc2 = cell2atom(lexic, st->link[1]); if (tc2 == NULL || tc2 == FAKE_CELL) { #ifdef STOP_AT_FIRST_ERROR deref_cell(tc1); return NULL; #else return tc1; #endif } if (tc1 == NULL || tc1 == FAKE_CELL) { if (tc2->type == CONST_INT) { y = cell2int(lexic, tc2); ret = int2cell(- y); } else ret = NULL; deref_cell(tc2); return ret; } /* * Anything substracted from a string is converted to a string * Otherwise anything substracted from integer is converted into an * integer */ if (tc1->type == CONST_DATA || tc2->type == CONST_DATA) flag = CONST_DATA; else if (tc1->type == CONST_STR || tc2->type == CONST_STR) flag = CONST_STR; else if (tc1->type == CONST_INT || tc2->type == CONST_INT) flag = CONST_INT; else flag = NODE_EMPTY; #if NASL_DEBUG > 0 if ((flag == CONST_DATA || flag == CONST_STR) && (tc1->type == CONST_INT || tc2->type == CONST_INT)) nasl_perror(lexic, "Horrible type conversion (int -> str) for operator - %s\n", get_line_nb(st)); #endif switch (flag) { case CONST_INT: x = cell2int(lexic, tc1); y = cell2int(lexic, tc2); ret = int2cell(x - y); break; case CONST_STR: case CONST_DATA: if (tc1->type == CONST_STR || tc1->type == CONST_DATA) { p1 = tc1->x.str_val; len1 = tc1->size; } else { p1 = s1 = cell2str(lexic, tc1); len1 = (s1 == NULL ? 0 : strlen(s1)); } if (tc2->type == CONST_STR || tc2->type == CONST_DATA) { p2 = tc2->x.str_val; len2 = tc2->size; } else { p2 = s2 = cell2str(lexic, tc2); len2 = (s2 == NULL ? 0 : strlen(s2)); } if (len2 == 0 || len1 < len2 || (p = (char*)nasl_memmem(p1, len1, p2, len2)) == NULL) { s3 = emalloc(len1); memcpy(s3, p1, len1); ret = alloc_tree_cell(0, s3); ret->type = flag; ret->size = len1; } else { sz = len1 - len2; if (sz <= 0) { sz = 0; s3 = estrdup(""); } else { s3 = emalloc(sz); if (p - p1 > 0) memcpy(s3, p1, p - p1); if (sz > p - p1) memcpy(s3 + (p - p1), p + len2, sz - (p - p1)); } ret = alloc_tree_cell(0, s3); ret->size = sz; ret->type = flag; } efree(&s1); efree(&s2); break; default: ret = NULL; break; } deref_cell(tc1); deref_cell(tc2); return ret; case EXPR_MULT: x = cell2intW(lexic, st->link[0]); y = cell2intW(lexic, st->link[1]); return int2cell(x * y); case EXPR_DIV: x = cell2intW(lexic, st->link[0]); y = cell2intW(lexic, st->link[1]); if( y != 0 ) return int2cell(x / y); else return int2cell(0); case EXPR_EXPO: x = cell2intW(lexic, st->link[0]); y = cell2intW(lexic, st->link[1]); return int2cell(expo(x, y)); case EXPR_MODULO: x = cell2intW(lexic, st->link[0]); y = cell2intW(lexic, st->link[1]); if( y != 0) return int2cell(x % y); else return int2cell(0); case EXPR_BIT_AND: x = cell2intW(lexic, st->link[0]); y = cell2intW(lexic, st->link[1]); return int2cell(x & y); case EXPR_BIT_OR: x = cell2intW(lexic, st->link[0]); y = cell2intW(lexic, st->link[1]); return int2cell(x | y); case EXPR_BIT_XOR: x = cell2intW(lexic, st->link[0]); y = cell2intW(lexic, st->link[1]); return int2cell(x ^ y); case EXPR_BIT_NOT: x = cell2intW(lexic, st->link[0]); return int2cell(~ x); case EXPR_U_MINUS: x = cell2intW(lexic, st->link[0]); return int2cell(- x); /* TBD: Handle shift for strings and arrays */ case EXPR_L_SHIFT: x = cell2intW(lexic, st->link[0]); y = cell2intW(lexic, st->link[1]); return int2cell(x << y); case EXPR_R_SHIFT: /* arithmetic right shift */ x = cell2intW(lexic, st->link[0]); y = cell2intW(lexic, st->link[1]); #if NASL_DEBUG > 0 if (y < 0) nasl_perror(lexic, "Warning: Negative count in right shift!\n"); #endif z = x >> y; #ifndef __GNUC__ if (x < 0 && z >= 0) /* Fix it */ { #if NASL_DEBUG > 1 nasl_perror(lexic, "Warning: arithmetic right shift is buggy! Fixing...\n"); #endif z |= (~0) << (sizeof(x) * 8 - y); } #endif return int2cell(z); case EXPR_R_USHIFT: x = cell2intW(lexic, st->link[0]); y = cell2intW(lexic, st->link[1]); #if NASL_DEBUG > 0 if (y < 0) nasl_perror(lexic, "Warning: Negative count in right shift!\n"); #endif z = (unsigned)x >> (unsigned)y; #ifndef __GNUC__ if (x < 0 && z <= 0) /* Fix it! */ { #if NASL_DEBUG > 1 nasl_perror(lexic, "Warning: Logical right shift is buggy! Fixing...\n"); #endif z &= ~((~0) << (sizeof(x) * 8 - y)); } #endif return int2cell(z); case COMP_MATCH: case COMP_NOMATCH: tc1 = cell2atom(lexic, st->link[0]); tc2 = cell2atom(lexic, st->link[1]); s1 = s2 = NULL; if (tc1 == NULL || tc1 == FAKE_CELL) { p1 = ""; len1 = 0; } else if (tc1->type == CONST_STR || tc1->type == CONST_DATA) { p1 = tc1->x.str_val; len1 = tc1->size; } else { #if NASL_DEBUG > 0 nasl_perror(lexic, "Horrible type conversion (%s -> str) for operator >< or >!< %s\n", nasl_type_name(tc1->type), get_line_nb(st)); #endif p1 = s1 = cell2str(lexic, tc1); len1 = strlen(s1); } if (tc2 == NULL || tc2 == FAKE_CELL) { p2 = ""; len2 = 0; } else if (tc2->type == CONST_STR || tc2->type == CONST_DATA) { p2 = tc2->x.str_val; len2 = tc2->size; } else { #if NASL_DEBUG > 0 nasl_perror(lexic, "Horrible type conversion (%s -> str) for operator >< or >!< %s\n", nasl_type_name(tc2->type), get_line_nb(st)); #endif p2 = s2 = cell2str(lexic, tc2); len2 = strlen(s2); } if(len1 <= len2) flag = ((void*)nasl_memmem(p2, len2, p1, len1) != NULL); else flag = 0; efree(&s1); efree(&s2); deref_cell(tc1); deref_cell(tc2); if (st->type == COMP_MATCH) return bool2cell(flag); else return bool2cell(! flag); case COMP_RE_MATCH: case COMP_RE_NOMATCH: if (st->x.ref_val == NULL) { nasl_perror(lexic, "nasl_exec: bad regex at or near line %d\n", st->line_nb); return NULL; } s1 = cell2str(lexic, st->link[0]); if (s1 == NULL) return 0; flag = nasl_regexec(st->x.ref_val, s1, 0, NULL, 0); free(s1); if (st->type == COMP_RE_MATCH) return bool2cell(flag != REG_NOMATCH); else return bool2cell(flag == REG_NOMATCH); case COMP_LT: return bool2cell(cell_cmp(lexic, st->link[0], st->link[1]) < 0); case COMP_LE: return bool2cell(cell_cmp(lexic, st->link[0], st->link[1]) <= 0); case COMP_EQ: return bool2cell(cell_cmp(lexic, st->link[0], st->link[1]) == 0); case COMP_NE: return bool2cell(cell_cmp(lexic, st->link[0], st->link[1]) != 0); case COMP_GT: return bool2cell(cell_cmp(lexic, st->link[0], st->link[1]) > 0); case COMP_GE: return bool2cell(cell_cmp(lexic, st->link[0], st->link[1]) >= 0); case REF_ARRAY: case DYN_ARRAY: case CONST_INT: case CONST_STR: case CONST_DATA: ref_cell(st); /* nasl_exec returns a cell that should be deref-ed */ return st; case REF_VAR: ret = nasl_read_var_ref(lexic, st); return ret; default: nasl_perror(lexic, "nasl_exec: unhandled node type %d\n", st->type); abort(); return NULL; } deref_cell(ret); deref_cell(ret2); return NULL; }