Reject passing an arg to an option that doesn't take one (bug 6915).

[rsync.git] / popt / popt.c

diff --git a/popt/popt.c b/popt/popt.c
index ae608f19782b0800c0db8a2e9e62e1a15d7fbcba..ec6f3bd8be7420575eb713eeaf83b63ec7e26793 100644 (file)
--- a/popt/popt.c
+++ b/popt/popt.c
@@ -1,13 +1,35 @@
-/* (C) 1998 Red Hat Software, Inc. -- Licensing details are in the COPYING
+/** \ingroup popt
+ * \file popt/popt.c
+ */
+
+/* (C) 1998-2002 Red Hat, Inc. -- Licensing details are in the COPYING

    file accompanying popt source distributions, available from
    file accompanying popt source distributions, available from

-   ftp://ftp.redhat.com/pub/code/popt */
+   ftp://ftp.rpm.org/pub/rpm/dist */
+
+#undef MYDEBUG

 
 #include "system.h"
 
 #include "system.h"

+
+#if HAVE_FLOAT_H
+#include <float.h>
+#endif
+#include <math.h>
+

 #include "findme.h"
 #include "poptint.h"
 
 #include "findme.h"
 #include "poptint.h"
 

-#ifndef HAVE_STRERROR
-static char * strerror(int errno) {
+#ifndef DBL_EPSILON
+#define DBL_EPSILON 2.2204460492503131e-16
+#endif
+
+#ifdef MYDEBUG
+/*@unchecked@*/
+int _popt_debug = 0;
+#endif
+
+#if !defined(HAVE_STRERROR) && !defined(__LCLINT__)
+static char * strerror(int errno)
+{

     extern int sys_nerr;
     extern char * sys_errlist[];
 
     extern int sys_nerr;
     extern char * sys_errlist[];
 


@@ -18,47 +40,159 @@ static char * strerror(int errno) {
 }
 #endif
 
 }
 #endif
 

-void poptSetExecPath(poptContext con, const char * path, int allowAbsolute) {
-    if (con->execPath) xfree(con->execPath);
+#ifdef MYDEBUG
+/*@unused@*/
+static void prtcon(const char *msg, poptContext con)
+{
+    if (msg) fprintf(stderr, "%s", msg);
+    fprintf(stderr, "\tcon %p os %p nextCharArg \"%s\" nextArg \"%s\" argv[%d] \"%s\"\n",
+       con, con->os,
+       (con->os->nextCharArg ? con->os->nextCharArg : ""),
+       (con->os->nextArg ? con->os->nextArg : ""),
+       con->os->next,
+       (con->os->argv && con->os->argv[con->os->next]
+               ? con->os->argv[con->os->next] : ""));
+}
+#endif
+
+void poptSetExecPath(poptContext con, const char * path, int allowAbsolute)
+{
+    con->execPath = _free(con->execPath);

     con->execPath = xstrdup(path);
     con->execAbsolute = allowAbsolute;
     con->execPath = xstrdup(path);
     con->execAbsolute = allowAbsolute;

+    /*@-nullstate@*/ /* LCL: con->execPath not NULL */
+    return;
+    /*@=nullstate@*/

 }
 
 }
 

-static void invokeCallbacks(poptContext con, const struct poptOption * table,
-                           int post) {
-    const struct poptOption * opt = table;
-    poptCallbackType cb;
+static void invokeCallbacksPRE(poptContext con, const struct poptOption * opt)
+       /*@globals internalState@*/
+       /*@modifies internalState@*/
+{
+    if (opt != NULL)
+    for (; opt->longName || opt->shortName || opt->arg; opt++) {
+       if (opt->arg == NULL) continue;         /* XXX program error. */
+       if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_INCLUDE_TABLE) {
+           void * arg = opt->arg;
+/*@-branchstate@*/
+           /* XXX sick hack to preserve pretense of ABI. */
+           if (arg == poptHelpOptions) arg = poptHelpOptionsI18N;
+/*@=branchstate@*/
+           /* Recurse on included sub-tables. */
+           invokeCallbacksPRE(con, arg);
+       } else if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_CALLBACK &&
+                  (opt->argInfo & POPT_CBFLAG_PRE))
+       {   /*@-castfcnptr@*/
+           poptCallbackType cb = (poptCallbackType)opt->arg;
+           /*@=castfcnptr@*/
+           /* Perform callback. */
+           /*@-noeffectuncon @*/
+           cb(con, POPT_CALLBACK_REASON_PRE, NULL, NULL, opt->descrip);
+           /*@=noeffectuncon @*/
+       }
+    }
+}
+
+static void invokeCallbacksPOST(poptContext con, const struct poptOption * opt)
+       /*@globals internalState@*/
+       /*@modifies internalState@*/
+{
+    if (opt != NULL)
+    for (; opt->longName || opt->shortName || opt->arg; opt++) {
+       if (opt->arg == NULL) continue;         /* XXX program error. */
+       if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_INCLUDE_TABLE) {
+           void * arg = opt->arg;
+/*@-branchstate@*/
+           /* XXX sick hack to preserve pretense of ABI. */
+           if (arg == poptHelpOptions) arg = poptHelpOptionsI18N;
+/*@=branchstate@*/
+           /* Recurse on included sub-tables. */
+           invokeCallbacksPOST(con, arg);
+       } else if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_CALLBACK &&
+                  (opt->argInfo & POPT_CBFLAG_POST))
+       {   /*@-castfcnptr@*/
+           poptCallbackType cb = (poptCallbackType)opt->arg;
+           /*@=castfcnptr@*/
+           /* Perform callback. */
+           /*@-noeffectuncon @*/
+           cb(con, POPT_CALLBACK_REASON_POST, NULL, NULL, opt->descrip);
+           /*@=noeffectuncon @*/
+       }
+    }
+}
+
+static void invokeCallbacksOPTION(poptContext con,
+                                 const struct poptOption * opt,
+                                 const struct poptOption * myOpt,
+                                 /*@null@*/ const void * myData, int shorty)
+       /*@globals internalState@*/
+       /*@modifies internalState@*/
+{
+    const struct poptOption * cbopt = NULL;

 
 

-    while (opt->longName || opt->shortName || opt->arg) {
+    if (opt != NULL)
+    for (; opt->longName || opt->shortName || opt->arg; opt++) {

        if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_INCLUDE_TABLE) {
        if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_INCLUDE_TABLE) {

-           invokeCallbacks(con, opt->arg, post);
-       } else if (((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_CALLBACK) &&
-                  ((!post && (opt->argInfo & POPT_CBFLAG_PRE)) ||
-                   ( post && (opt->argInfo & POPT_CBFLAG_POST)))) {
-           cb = (poptCallbackType)opt->arg;
-           cb(con, post ? POPT_CALLBACK_REASON_POST : POPT_CALLBACK_REASON_PRE,
-              NULL, NULL, opt->descrip);
+           void * arg = opt->arg;
+/*@-branchstate@*/
+           /* XXX sick hack to preserve pretense of ABI. */
+           if (arg == poptHelpOptions) arg = poptHelpOptionsI18N;
+/*@=branchstate@*/
+           /* Recurse on included sub-tables. */
+           if (opt->arg != NULL)       /* XXX program error */
+               invokeCallbacksOPTION(con, opt->arg, myOpt, myData, shorty);
+       } else if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_CALLBACK &&
+                 !(opt->argInfo & POPT_CBFLAG_SKIPOPTION)) {
+           /* Save callback info. */
+           cbopt = opt;
+       } else if (cbopt != NULL &&
+                  ((myOpt->shortName && opt->shortName && shorty &&
+                       myOpt->shortName == opt->shortName) ||
+                   (myOpt->longName && opt->longName &&
+               /*@-nullpass@*/         /* LCL: opt->longName != NULL */
+                       !strcmp(myOpt->longName, opt->longName)))
+               /*@=nullpass@*/
+                  )
+       {   /*@-castfcnptr@*/
+           poptCallbackType cb = (poptCallbackType)cbopt->arg;
+           /*@=castfcnptr@*/
+           const void * cbData = (cbopt->descrip ? cbopt->descrip : myData);
+           /* Perform callback. */
+           if (cb != NULL) {   /* XXX program error */
+               /*@-noeffectuncon @*/
+               cb(con, POPT_CALLBACK_REASON_OPTION, myOpt,
+                       con->os->nextArg, cbData);
+               /*@=noeffectuncon @*/
+           }
+           /* Terminate (unless explcitly continuing). */
+           if (!(cbopt->argInfo & POPT_CBFLAG_CONTINUE))
+               return;

        }
        }

-       opt++;

     }
 }
 
 poptContext poptGetContext(const char * name, int argc, const char ** argv,
     }
 }
 
 poptContext poptGetContext(const char * name, int argc, const char ** argv,

-                          const struct poptOption * options, int flags) {
+                          const struct poptOption * options, int flags)
+{

     poptContext con = malloc(sizeof(*con));
 
     poptContext con = malloc(sizeof(*con));
 

+    if (con == NULL) return NULL;      /* XXX can't happen */

     memset(con, 0, sizeof(*con));
 
     con->os = con->optionStack;
     con->os->argc = argc;
     memset(con, 0, sizeof(*con));
 
     con->os = con->optionStack;
     con->os->argc = argc;

+    /*@-dependenttrans -assignexpose@*/        /* FIX: W2DO? */

     con->os->argv = argv;
     con->os->argv = argv;

+    /*@=dependenttrans =assignexpose@*/

     con->os->argb = NULL;
 
     if (!(flags & POPT_CONTEXT_KEEP_FIRST))
        con->os->next = 1;                      /* skip argv[0] */
 
     con->os->argb = NULL;
 
     if (!(flags & POPT_CONTEXT_KEEP_FIRST))
        con->os->next = 1;                      /* skip argv[0] */
 

-    con->leftovers = calloc( (argc + 1), sizeof(char *) );
+    con->leftovers = calloc( (argc + 1), sizeof(*con->leftovers) );
+    /*@-dependenttrans -assignexpose@*/        /* FIX: W2DO? */

     con->options = options;
     con->options = options;

+    /*@=dependenttrans =assignexpose@*/

     con->aliases = NULL;
     con->numAliases = 0;
     con->flags = flags;
     con->aliases = NULL;
     con->numAliases = 0;
     con->flags = flags;


@@ -72,40 +206,42 @@ poptContext poptGetContext(const char * name, int argc, const char ** argv,
     if (getenv("POSIXLY_CORRECT") || getenv("POSIX_ME_HARDER"))
        con->flags |= POPT_CONTEXT_POSIXMEHARDER;
 
     if (getenv("POSIXLY_CORRECT") || getenv("POSIX_ME_HARDER"))
        con->flags |= POPT_CONTEXT_POSIXMEHARDER;
 

-    if (name)
-       con->appName = strcpy(malloc(strlen(name) + 1), name);
+    if (name) {
+       size_t bufsize = strlen(name) + 1;
+       char * t = malloc(bufsize);
+       if (t) {
+           strlcpy(t, name, bufsize);
+           con->appName = t;
+       }
+    }

 
 

-    invokeCallbacks(con, con->options, 0);
+    /*@-internalglobs@*/
+    invokeCallbacksPRE(con, con->options);
+    /*@=internalglobs@*/

 
     return con;
 }
 
 
     return con;
 }
 

-static void cleanOSE(struct optionStackEntry *os)
+static void cleanOSE(/*@special@*/ struct optionStackEntry *os)
+       /*@uses os @*/
+       /*@releases os->nextArg, os->argv, os->argb @*/
+       /*@modifies os @*/

 {
 {

-    if (os->nextArg) {
-       xfree(os->nextArg);
-       os->nextArg = NULL;
-    }
-    if (os->argv) {
-       xfree(os->argv);
-       os->argv = NULL;
-    }
-    if (os->argb) {
-       PBM_FREE(os->argb);
-       os->argb = NULL;
-    }
+    os->nextArg = _free(os->nextArg);
+    os->argv = _free(os->argv);
+    os->argb = PBM_FREE(os->argb);

 }
 
 }
 

-void poptResetContext(poptContext con) {
+/*@-boundswrite@*/
+void poptResetContext(poptContext con)
+{

     int i;
 
     int i;
 

+    if (con == NULL) return;

     while (con->os > con->optionStack) {
        cleanOSE(con->os--);
     }
     while (con->os > con->optionStack) {
        cleanOSE(con->os--);
     }

-    if (con->os->argb) {
-       PBM_FREE(con->os->argb);
-       con->os->argb = NULL;
-    }
+    con->os->argb = PBM_FREE(con->os->argb);

     con->os->currAlias = NULL;
     con->os->nextCharArg = NULL;
     con->os->nextArg = NULL;
     con->os->currAlias = NULL;
     con->os->nextCharArg = NULL;
     con->os->nextArg = NULL;


@@ -116,36 +252,47 @@ void poptResetContext(poptContext con) {
     con->restLeftover = 0;
     con->doExec = NULL;
 
     con->restLeftover = 0;
     con->doExec = NULL;
 

+    if (con->finalArgv != NULL)

     for (i = 0; i < con->finalArgvCount; i++) {
     for (i = 0; i < con->finalArgvCount; i++) {

-       if (con->finalArgv[i]) {
-           xfree(con->finalArgv[i]);
-           con->finalArgv[i] = NULL;
-       }
+       /*@-unqualifiedtrans@*/         /* FIX: typedef double indirection. */
+       con->finalArgv[i] = _free(con->finalArgv[i]);
+       /*@=unqualifiedtrans@*/

     }
 
     con->finalArgvCount = 0;
     }
 
     con->finalArgvCount = 0;

-
-    if (con->arg_strip) {
-       PBM_FREE(con->arg_strip);
-       con->arg_strip = NULL;
-    }
+    con->arg_strip = PBM_FREE(con->arg_strip);
+    /*@-nullstate@*/   /* FIX: con->finalArgv != NULL */
+    return;
+    /*@=nullstate@*/

 }
 }

-
-/* Only one of longName, shortName may be set at a time */
-static int handleExec(poptContext con, char * longName, char shortName) {
+/*@=boundswrite@*/
+
+/* Only one of longName, shortName should be set, not both. */
+/*@-boundswrite@*/
+static int handleExec(/*@special@*/ poptContext con,
+               /*@null@*/ const char * longName, char shortName)
+       /*@uses con->execs, con->numExecs, con->flags, con->doExec,
+               con->finalArgv, con->finalArgvAlloced, con->finalArgvCount @*/
+       /*@modifies con @*/
+{
+    poptItem item;

     int i;
 
     int i;
 

-    i = con->numExecs - 1;
-    if (longName) {
-       while (i >= 0 && (!con->execs[i].longName ||
-           strcmp(con->execs[i].longName, longName))) i--;
-    } else {
-       while (i >= 0 &&
-           con->execs[i].shortName != shortName) i--;
-    }
+    if (con->execs == NULL || con->numExecs <= 0) /* XXX can't happen */
+       return 0;

 
 

+    for (i = con->numExecs - 1; i >= 0; i--) {
+       item = con->execs + i;
+       if (longName && !(item->option.longName &&
+                       !strcmp(longName, item->option.longName)))
+           continue;
+       else if (shortName != item->option.shortName)
+           continue;
+       break;
+    }

     if (i < 0) return 0;
 
     if (i < 0) return 0;
 

+

     if (con->flags & POPT_CONTEXT_NO_EXEC)
        return 1;
 
     if (con->flags & POPT_CONTEXT_NO_EXEC)
        return 1;
 


@@ -163,45 +310,66 @@ static int handleExec(poptContext con, char * longName, char shortName) {
     }
 
     i = con->finalArgvCount++;
     }
 
     i = con->finalArgvCount++;

-    {  char *s  = malloc((longName ? strlen(longName) : 0) + 3);
-       if (longName)
-           sprintf(s, "--%s", longName);
-       else
-           sprintf(s, "-%c", shortName);
-       con->finalArgv[i] = s;
+    if (con->finalArgv != NULL)        /* XXX can't happen */
+    {  size_t bufsize = (longName ? strlen(longName) : 0) + 3;
+       char *s  = malloc(bufsize);
+       if (s != NULL) {        /* XXX can't happen */
+           if (longName)
+               snprintf(s, bufsize, "--%s", longName);
+           else
+               snprintf(s, bufsize, "-%c", shortName);
+           con->finalArgv[i] = s;
+       } else
+           con->finalArgv[i] = NULL;

     }
 
     }
 

+    /*@-nullstate@*/   /* FIX: con->finalArgv[] == NULL */

     return 1;
     return 1;

+    /*@=nullstate@*/

 }
 }

+/*@=boundswrite@*/

 
 /* Only one of longName, shortName may be set at a time */
 
 /* Only one of longName, shortName may be set at a time */

-static int handleAlias(poptContext con, const char * longName, char shortName,
-                      /*@keep@*/ const char * nextCharArg) {
+static int handleAlias(/*@special@*/ poptContext con,
+               /*@null@*/ const char * longName, char shortName,
+               /*@exposed@*/ /*@null@*/ const char * nextCharArg)
+       /*@uses con->aliases, con->numAliases, con->optionStack, con->os,
+               con->os->currAlias, con->os->currAlias->option.longName @*/
+       /*@modifies con @*/
+{
+    poptItem item = con->os->currAlias;
+    int rc;

     int i;
 
     int i;
 

-    if (con->os->currAlias && con->os->currAlias->longName && longName &&
-       !strcmp(con->os->currAlias->longName, longName))
-       return 0;
-    if (con->os->currAlias && shortName &&
-           shortName == con->os->currAlias->shortName)
+    if (item) {
+       if (longName && (item->option.longName &&
+               !strcmp(longName, item->option.longName)))
+           return 0;
+       if (shortName && shortName == item->option.shortName)
+           return 0;
+    }
+
+    if (con->aliases == NULL || con->numAliases <= 0) /* XXX can't happen */

        return 0;
 
        return 0;
 

-    i = con->numAliases - 1;
-    if (longName) {
-       while (i >= 0 && (!con->aliases[i].longName ||
-           strcmp(con->aliases[i].longName, longName))) i--;
-    } else {
-       while (i >= 0 &&
-           con->aliases[i].shortName != shortName) i--;
+    for (i = con->numAliases - 1; i >= 0; i--) {
+       item = con->aliases + i;
+       if (longName && !(item->option.longName &&
+                       !strcmp(longName, item->option.longName)))
+           continue;
+       else if (shortName != item->option.shortName)
+           continue;
+       break;

     }
     }

-

     if (i < 0) return 0;
 
     if ((con->os - con->optionStack + 1) == POPT_OPTION_DEPTH)
        return POPT_ERROR_OPTSTOODEEP;
 
     if (i < 0) return 0;
 
     if ((con->os - con->optionStack + 1) == POPT_OPTION_DEPTH)
        return POPT_ERROR_OPTSTOODEEP;
 

+/*@-boundsread@*/

     if (nextCharArg && *nextCharArg)
        con->os->nextCharArg = nextCharArg;
     if (nextCharArg && *nextCharArg)
        con->os->nextCharArg = nextCharArg;

+/*@=boundsread@*/

 
     con->os++;
     con->os->next = 0;
 
     con->os++;
     con->os->next = 0;


@@ -209,49 +377,66 @@ static int handleAlias(poptContext con, const char * longName, char shortName,
     con->os->nextArg = NULL;
     con->os->nextCharArg = NULL;
     con->os->currAlias = con->aliases + i;
     con->os->nextArg = NULL;
     con->os->nextCharArg = NULL;
     con->os->currAlias = con->aliases + i;

-    poptDupArgv(con->os->currAlias->argc, con->os->currAlias->argv,
+    rc = poptDupArgv(con->os->currAlias->argc, con->os->currAlias->argv,

                &con->os->argc, &con->os->argv);
     con->os->argb = NULL;
 
                &con->os->argc, &con->os->argv);
     con->os->argb = NULL;
 

-    return 1;
+    return (rc ? rc : 1);

 }
 
 }
 

-static void execCommand(poptContext con) {
+/*@-bounds -boundswrite @*/
+static int execCommand(poptContext con)
+       /*@globals internalState @*/
+       /*@modifies internalState @*/
+{
+    poptItem item = con->doExec;

     const char ** argv;
     const char ** argv;

-    int pos = 0;
-    const char * script = con->doExec->script;
+    int argc = 0;

 
 

-    argv = malloc(sizeof(*argv) *
-                       (6 + con->numLeftovers + con->finalArgvCount));
+    if (item == NULL) /*XXX can't happen*/
+       return POPT_ERROR_NOARG;

 
 

-    if (!con->execAbsolute && strchr(script, '/')) return;
+    if (item->argv == NULL || item->argc < 1 ||
+       (!con->execAbsolute && strchr(item->argv[0], '/')))
+           return POPT_ERROR_NOARG;

 
 

-    if (!strchr(script, '/') && con->execPath) {
-       char *s = alloca(strlen(con->execPath) + strlen(script) + 2);
-       sprintf(s, "%s/%s", con->execPath, script);
-       argv[pos] = s;
-    } else {
-       argv[pos] = script;
+    argv = malloc(sizeof(*argv) *
+                       (6 + item->argc + con->numLeftovers + con->finalArgvCount));
+    if (argv == NULL) return POPT_ERROR_MALLOC;
+
+    if (!strchr(item->argv[0], '/') && con->execPath != NULL) {
+       size_t bufsize = strlen(con->execPath) + strlen(item->argv[0]) + sizeof "/";
+       char *s = alloca(bufsize);
+       snprintf(s, bufsize, "%s/%s", con->execPath, item->argv[0]);
+       argv[argc] = s;
+    } else
+       argv[argc] = findProgramPath(item->argv[0]);
+    if (argv[argc++] == NULL) return POPT_ERROR_NOARG;
+
+    if (item->argc > 1) {
+       memcpy(argv + argc, item->argv + 1, sizeof(*argv) * (item->argc - 1));
+       argc += (item->argc - 1);

     }
     }

-    pos++;
-
-    argv[pos] = findProgramPath(con->os->argv[0]);
-    if (argv[pos]) pos++;
-    argv[pos++] = ";";

 
 

-    memcpy(argv + pos, con->finalArgv, sizeof(*argv) * con->finalArgvCount);
-    pos += con->finalArgvCount;
+    if (con->finalArgv != NULL && con->finalArgvCount > 0) {
+       memcpy(argv + argc, con->finalArgv,
+               sizeof(*argv) * con->finalArgvCount);
+       argc += con->finalArgvCount;
+    }

 
 

-    if (con->numLeftovers) {
-       argv[pos++] = "--";
-       memcpy(argv + pos, con->leftovers, sizeof(*argv) * con->numLeftovers);
-       pos += con->numLeftovers;
+    if (con->leftovers != NULL && con->numLeftovers > 0) {
+       memcpy(argv + argc, con->leftovers, sizeof(*argv) * con->numLeftovers);
+       argc += con->numLeftovers;

     }
 
     }
 

-    argv[pos++] = NULL;
+    argv[argc] = NULL;

 
 

+  {

 #ifdef __hpux
 #ifdef __hpux

-    setresuid(getuid(), getuid(),-1);
+    int rc = setresgid(getgid(), getgid(),-1);
+    if (rc) return POPT_ERROR_ERRNO;
+    rc = setresuid(getuid(), getuid(),-1);
+    if (rc) return POPT_ERROR_ERRNO;

 #else
 /*
  * XXX " ... on BSD systems setuid() should be preferred over setreuid()"
 #else
 /*
  * XXX " ... on BSD systems setuid() should be preferred over setreuid()"


@@ -259,65 +444,119 @@ static void execCommand(poptContext con) {
  * XXX from Norbert Warmuth <nwarmuth@privat.circular.de>
  */
 #if defined(HAVE_SETUID)
  * XXX from Norbert Warmuth <nwarmuth@privat.circular.de>
  */
 #if defined(HAVE_SETUID)

-    setuid(getuid());
+    int rc = setgid(getgid());
+    if (rc) return POPT_ERROR_ERRNO;
+    rc = setuid(getuid());
+    if (rc) return POPT_ERROR_ERRNO;

 #elif defined (HAVE_SETREUID)
 #elif defined (HAVE_SETREUID)

-    setreuid(getuid(), getuid()); /*hlauer: not portable to hpux9.01 */
+    int rc = setregid(getgid(), getgid());
+    if (rc) return POPT_ERROR_ERRNO;
+    rc = setreuid(getuid(), getuid());
+    if (rc) return POPT_ERROR_ERRNO;

 #else
     ; /* Can't drop privileges */
 #endif
 #else
     ; /* Can't drop privileges */
 #endif

+#endif
+  }
+
+    if (argv[0] == NULL)
+       return POPT_ERROR_NOARG;
+
+#ifdef MYDEBUG
+if (_popt_debug)
+    {  const char ** avp;
+       fprintf(stderr, "==> execvp(%s) argv[%d]:", argv[0], argc);
+       for (avp = argv; *avp; avp++)
+           fprintf(stderr, " '%s'", *avp);
+       fprintf(stderr, "\n");
+    }

 #endif
 
     execvp(argv[0], (char *const *)argv);
 #endif
 
     execvp(argv[0], (char *const *)argv);

-}

 
 

-/*@observer@*/ static const struct poptOption *
-findOption(const struct poptOption * table, const char * longName,
-    char shortName,
-    /*@out@*/ poptCallbackType * callback, /*@out@*/ const void ** callbackData,
-    int singleDash)
+    return POPT_ERROR_ERRNO;
+}
+/*@=bounds =boundswrite @*/
+
+/*@-boundswrite@*/
+/*@observer@*/ /*@null@*/ static const struct poptOption *
+findOption(const struct poptOption * opt, /*@null@*/ const char * longName,
+               char shortName,
+               /*@null@*/ /*@out@*/ poptCallbackType * callback,
+               /*@null@*/ /*@out@*/ const void ** callbackData,
+               int singleDash)
+       /*@modifies *callback, *callbackData */

 {
 {

-    const struct poptOption * opt = table;
-    const struct poptOption * opt2;

     const struct poptOption * cb = NULL;
 
     /* This happens when a single - is given */
     const struct poptOption * cb = NULL;
 
     /* This happens when a single - is given */

-    if (singleDash && !shortName && !*longName)
+    if (singleDash && !shortName && (longName && *longName == '\0'))

        shortName = '-';
 
        shortName = '-';
 

-    while (opt->longName || opt->shortName || opt->arg) {
+    for (; opt->longName || opt->shortName || opt->arg; opt++) {
+

        if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_INCLUDE_TABLE) {
        if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_INCLUDE_TABLE) {

-           opt2 = findOption(opt->arg, longName, shortName, callback,
+           const struct poptOption * opt2;
+           void * arg = opt->arg;
+
+/*@-branchstate@*/
+           /* XXX sick hack to preserve pretense of ABI. */
+           if (arg == poptHelpOptions) arg = poptHelpOptionsI18N;
+/*@=branchstate@*/
+           /* Recurse on included sub-tables. */
+           if (arg == NULL) continue;  /* XXX program error */
+           opt2 = findOption(arg, longName, shortName, callback,

                              callbackData, singleDash);
                              callbackData, singleDash);

-           if (opt2) {
-               if (*callback && !*callbackData)
-                   *callbackData = opt->descrip;
-               return opt2;
-           }
+           if (opt2 == NULL) continue;
+           /* Sub-table data will be inheirited if no data yet. */
+           if (!(callback && *callback)) return opt2;
+           if (!(callbackData && *callbackData == NULL)) return opt2;
+           /*@-observertrans -dependenttrans @*/
+           *callbackData = opt->descrip;
+           /*@=observertrans =dependenttrans @*/
+           return opt2;

        } else if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_CALLBACK) {
            cb = opt;
        } else if (longName && opt->longName &&
                   (!singleDash || (opt->argInfo & POPT_ARGFLAG_ONEDASH)) &&
        } else if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_CALLBACK) {
            cb = opt;
        } else if (longName && opt->longName &&
                   (!singleDash || (opt->argInfo & POPT_ARGFLAG_ONEDASH)) &&

-                  !strcmp(longName, opt->longName)) {
+               /*@-nullpass@*/         /* LCL: opt->longName != NULL */
+                  !strcmp(longName, opt->longName))
+               /*@=nullpass@*/
+       {

            break;
        } else if (shortName && shortName == opt->shortName) {
            break;
        }
            break;
        } else if (shortName && shortName == opt->shortName) {
            break;
        }

-       opt++;

     }
 
     }
 

-    if (!opt->longName && !opt->shortName) return NULL;
-    *callbackData = NULL;
-    *callback = NULL;
+    if (!opt->longName && !opt->shortName)
+       return NULL;
+    /*@-modobserver -mods @*/
+    if (callback) *callback = NULL;
+    if (callbackData) *callbackData = NULL;

     if (cb) {
     if (cb) {

-       *callback = (poptCallbackType)cb->arg;
-       if (!(cb->argInfo & POPT_CBFLAG_INC_DATA))
-           *callbackData = cb->descrip;
+       if (callback)
+       /*@-castfcnptr@*/
+           *callback = (poptCallbackType)cb->arg;
+       /*@=castfcnptr@*/
+       if (!(cb->argInfo & POPT_CBFLAG_INC_DATA)) {
+           if (callbackData)
+               /*@-observertrans@*/    /* FIX: typedef double indirection. */
+               *callbackData = cb->descrip;
+               /*@=observertrans@*/
+       }

     }
     }

+    /*@=modobserver =mods @*/

 
     return opt;
 }
 
     return opt;
 }

+/*@=boundswrite@*/

 
 

-static const char *findNextArg(poptContext con, unsigned argx, int delete)
+static const char * findNextArg(/*@special@*/ poptContext con,
+               unsigned argx, int delete_arg)
+       /*@uses con->optionStack, con->os,
+               con->os->next, con->os->argb, con->os->argc, con->os->argv @*/
+       /*@modifies con @*/

 {
     struct optionStackEntry * os = con->os;
     const char * arg;
 {
     struct optionStackEntry * os = con->os;
     const char * arg;


@@ -327,91 +566,178 @@ static const char *findNextArg(poptContext con, unsigned argx, int delete)
        arg = NULL;
        while (os->next == os->argc && os > con->optionStack) os--;
        if (os->next == os->argc && os == con->optionStack) break;
        arg = NULL;
        while (os->next == os->argc && os > con->optionStack) os--;
        if (os->next == os->argc && os == con->optionStack) break;

+       if (os->argv != NULL)

        for (i = os->next; i < os->argc; i++) {
        for (i = os->next; i < os->argc; i++) {

-           if (os->argb && PBM_ISSET(i, os->argb)) continue;
-           if (*os->argv[i] == '-') continue;
-           if (--argx > 0) continue;
+           /*@-sizeoftype@*/
+           if (os->argb && PBM_ISSET(i, os->argb))
+               /*@innercontinue@*/ continue;
+           if (*os->argv[i] == '-')
+               /*@innercontinue@*/ continue;
+           if (--argx > 0)
+               /*@innercontinue@*/ continue;

            arg = os->argv[i];
            arg = os->argv[i];

-           if (delete) {
+           if (delete_arg) {

                if (os->argb == NULL) os->argb = PBM_ALLOC(os->argc);
                if (os->argb == NULL) os->argb = PBM_ALLOC(os->argc);

+               if (os->argb != NULL)   /* XXX can't happen */

                PBM_SET(i, os->argb);
            }
                PBM_SET(i, os->argb);
            }

-           break;
+           /*@innerbreak@*/ break;
+           /*@=sizeoftype@*/

        }
        if (os > con->optionStack) os--;
     } while (arg == NULL);
     return arg;
 }
 
        }
        if (os > con->optionStack) os--;
     } while (arg == NULL);
     return arg;
 }
 

-static /*@only@*/ const char * expandNextArg(poptContext con, const char * s)
+/*@-boundswrite@*/
+static /*@only@*/ /*@null@*/ const char *
+expandNextArg(/*@special@*/ poptContext con, const char * s)
+       /*@uses con->optionStack, con->os,
+               con->os->next, con->os->argb, con->os->argc, con->os->argv @*/
+       /*@modifies con @*/

 {
 {

-    const char *a;
-    size_t alen;
+    const char * a = NULL;
+    size_t alen, pos;

     char *t, *te;
     size_t tn = strlen(s) + 1;
     char c;
 
     te = t = malloc(tn);;
     char *t, *te;
     size_t tn = strlen(s) + 1;
     char c;
 
     te = t = malloc(tn);;

+    if (t == NULL) return NULL;                /* XXX can't happen */

     while ((c = *s++) != '\0') {
        switch (c) {
 #if 0  /* XXX can't do this */
        case '\\':      /* escape */
            c = *s++;
     while ((c = *s++) != '\0') {
        switch (c) {
 #if 0  /* XXX can't do this */
        case '\\':      /* escape */
            c = *s++;

-           break;
+           /*@switchbreak@*/ break;

 #endif
        case '!':
            if (!(s[0] == '#' && s[1] == ':' && s[2] == '+'))
 #endif
        case '!':
            if (!(s[0] == '#' && s[1] == ':' && s[2] == '+'))

-               break;
-           if ((a = findNextArg(con, 1, 1)) == NULL)
-               break;
+               /*@switchbreak@*/ break;
+           /* XXX Make sure that findNextArg deletes only next arg. */
+           if (a == NULL) {
+               if ((a = findNextArg(con, 1, 1)) == NULL)
+                   /*@switchbreak@*/ break;
+           }

            s += 3;
 
            alen = strlen(a);
            tn += alen;
            s += 3;
 
            alen = strlen(a);
            tn += alen;

-           *te = '\0';
+           pos = te - t;

            t = realloc(t, tn);
            t = realloc(t, tn);

-           te = t + strlen(t);
+           te = t + pos;

            strncpy(te, a, alen); te += alen;
            continue;
            strncpy(te, a, alen); te += alen;
            continue;

-           /*@notreached@*/ break;
+           /*@notreached@*/ /*@switchbreak@*/ break;

        default:
        default:

-           break;
+           /*@switchbreak@*/ break;

        }
        *te++ = c;
     }
     *te = '\0';
        }
        *te++ = c;
     }
     *te = '\0';

-    t = realloc(t, strlen(t)+1);       /* XXX memory leak, hard to plug */
+    t = realloc(t, strlen(t) + 1);     /* XXX memory leak, hard to plug */

     return t;
 }
     return t;
 }

+/*@=boundswrite@*/

 
 

-static void poptStripArg(poptContext con, int which)
+static void poptStripArg(/*@special@*/ poptContext con, int which)
+       /*@uses con->arg_strip, con->optionStack @*/
+       /*@defines con->arg_strip @*/
+       /*@modifies con @*/

 {
 {

-    if(con->arg_strip == NULL) {
+    /*@-sizeoftype@*/
+    if (con->arg_strip == NULL)

        con->arg_strip = PBM_ALLOC(con->optionStack[0].argc);
        con->arg_strip = PBM_ALLOC(con->optionStack[0].argc);

-    }
+    if (con->arg_strip != NULL)                /* XXX can't happen */

     PBM_SET(which, con->arg_strip);
     PBM_SET(which, con->arg_strip);

+    /*@=sizeoftype@*/
+    /*@-compdef@*/ /* LCL: con->arg_strip udefined? */
+    return;
+    /*@=compdef@*/
+}
+
+int poptSaveLong(long * arg, int argInfo, long aLong)
+{
+    /* XXX Check alignment, may fail on funky platforms. */
+    if (arg == NULL || (((unsigned long)arg) & (sizeof(*arg)-1)))
+       return POPT_ERROR_NULLARG;
+
+    if (argInfo & POPT_ARGFLAG_NOT)
+       aLong = ~aLong;
+    switch (argInfo & POPT_ARGFLAG_LOGICALOPS) {
+    case 0:
+       *arg = aLong;
+       break;
+    case POPT_ARGFLAG_OR:
+       *arg |= aLong;
+       break;
+    case POPT_ARGFLAG_AND:
+       *arg &= aLong;
+       break;
+    case POPT_ARGFLAG_XOR:
+       *arg ^= aLong;
+       break;
+    default:
+       return POPT_ERROR_BADOPERATION;
+       /*@notreached@*/ break;
+    }
+    return 0;

 }
 
 }
 

+int poptSaveInt(/*@null@*/ int * arg, int argInfo, long aLong)
+{
+    /* XXX Check alignment, may fail on funky platforms. */
+    if (arg == NULL || (((unsigned long)arg) & (sizeof(*arg)-1)))
+       return POPT_ERROR_NULLARG;
+
+    if (argInfo & POPT_ARGFLAG_NOT)
+       aLong = ~aLong;
+    switch (argInfo & POPT_ARGFLAG_LOGICALOPS) {
+    case 0:
+       *arg = aLong;
+       break;
+    case POPT_ARGFLAG_OR:
+       *arg |= aLong;
+       break;
+    case POPT_ARGFLAG_AND:
+       *arg &= aLong;
+       break;
+    case POPT_ARGFLAG_XOR:
+       *arg ^= aLong;
+       break;
+    default:
+       return POPT_ERROR_BADOPERATION;
+       /*@notreached@*/ break;
+    }
+    return 0;
+}
+
+/*@-boundswrite@*/

 /* returns 'val' element, -1 on last item, POPT_ERROR_* on error */
 int poptGetNextOpt(poptContext con)
 {
     const struct poptOption * opt = NULL;
     int done = 0;
 
 /* returns 'val' element, -1 on last item, POPT_ERROR_* on error */
 int poptGetNextOpt(poptContext con)
 {
     const struct poptOption * opt = NULL;
     int done = 0;
 

+    if (con == NULL)
+       return -1;

     while (!done) {
        const char * origOptString = NULL;
        poptCallbackType cb = NULL;
        const void * cbData = NULL;
        const char * longArg = NULL;
        int canstrip = 0;
     while (!done) {
        const char * origOptString = NULL;
        poptCallbackType cb = NULL;
        const void * cbData = NULL;
        const char * longArg = NULL;
        int canstrip = 0;

+       int shorty = 0;

 
        while (!con->os->nextCharArg && con->os->next == con->os->argc
                && con->os > con->optionStack) {
            cleanOSE(con->os--);
        }
        if (!con->os->nextCharArg && con->os->next == con->os->argc) {
 
        while (!con->os->nextCharArg && con->os->next == con->os->argc
                && con->os > con->optionStack) {
            cleanOSE(con->os--);
        }
        if (!con->os->nextCharArg && con->os->next == con->os->argc) {

-           invokeCallbacks(con, con->options, 1);
-           if (con->doExec) execCommand(con);
+           /*@-internalglobs@*/
+           invokeCallbacksPOST(con, con->options);
+           /*@=internalglobs@*/
+           if (con->doExec) return execCommand(con);

            return -1;
        }
 
            return -1;
        }
 


@@ -420,26 +746,40 @@ int poptGetNextOpt(poptContext con)
            char * localOptString, * optString;
            int thisopt;
 
            char * localOptString, * optString;
            int thisopt;
 

+           /*@-sizeoftype@*/

            if (con->os->argb && PBM_ISSET(con->os->next, con->os->argb)) {
                con->os->next++;
                continue;
            }
            if (con->os->argb && PBM_ISSET(con->os->next, con->os->argb)) {
                con->os->next++;
                continue;
            }

-           thisopt=con->os->next;
+           /*@=sizeoftype@*/
+           thisopt = con->os->next;
+           if (con->os->argv != NULL)  /* XXX can't happen */

            origOptString = con->os->argv[con->os->next++];
 
            origOptString = con->os->argv[con->os->next++];
 

+           if (origOptString == NULL)  /* XXX can't happen */
+               return POPT_ERROR_BADOPT;
+

            if (con->restLeftover || *origOptString != '-') {
            if (con->restLeftover || *origOptString != '-') {

-               con->leftovers[con->numLeftovers++] = origOptString;

                if (con->flags & POPT_CONTEXT_POSIXMEHARDER)
                    con->restLeftover = 1;
                if (con->flags & POPT_CONTEXT_POSIXMEHARDER)
                    con->restLeftover = 1;

+               if (con->flags & POPT_CONTEXT_ARG_OPTS) {
+                   con->os->nextArg = xstrdup(origOptString);
+                   return 0;
+               }
+               if (con->leftovers != NULL)     /* XXX can't happen */
+                   con->leftovers[con->numLeftovers++] = origOptString;

                continue;
            }
 
            /* Make a copy we can hack at */
                continue;
            }
 
            /* Make a copy we can hack at */

-           localOptString = optString =
-                       strcpy(alloca(strlen(origOptString) + 1),
-                       origOptString);
+           {   size_t bufsize = strlen(origOptString) + 1;
+               localOptString = optString = alloca(bufsize);
+               if (optString == NULL) /* XXX can't happen */
+                   return POPT_ERROR_BADOPT;
+               strlcpy(optString, origOptString, bufsize);
+           }

 
 

-           if (!optString[0])
+           if (optString[0] == '\0')

                return POPT_ERROR_BADOPT;
 
            if (optString[1] == '-' && !optString[2]) {
                return POPT_ERROR_BADOPT;
 
            if (optString[1] == '-' && !optString[2]) {


@@ -458,131 +798,202 @@ int poptGetNextOpt(poptContext con)
                /* XXX aliases with arg substitution need "--alias=arg" */
                if (handleAlias(con, optString, '\0', NULL))
                    continue;
                /* XXX aliases with arg substitution need "--alias=arg" */
                if (handleAlias(con, optString, '\0', NULL))
                    continue;

+

                if (handleExec(con, optString, '\0'))
                    continue;
 
                /* Check for "--long=arg" option. */
                for (oe = optString; *oe && *oe != '='; oe++)
                if (handleExec(con, optString, '\0'))
                    continue;
 
                /* Check for "--long=arg" option. */
                for (oe = optString; *oe && *oe != '='; oe++)

-                   ;
+                   {};

                if (*oe == '=') {
                    *oe++ = '\0';
                    /* XXX longArg is mapped back to persistent storage. */
                    longArg = origOptString + (oe - localOptString);
                if (*oe == '=') {
                    *oe++ = '\0';
                    /* XXX longArg is mapped back to persistent storage. */
                    longArg = origOptString + (oe - localOptString);

-               }
+               } else
+                   oe = NULL;

 
                opt = findOption(con->options, optString, '\0', &cb, &cbData,
                                 singleDash);
                if (!opt && !singleDash)
                    return POPT_ERROR_BADOPT;
 
                opt = findOption(con->options, optString, '\0', &cb, &cbData,
                                 singleDash);
                if (!opt && !singleDash)
                    return POPT_ERROR_BADOPT;

+               if (!opt && oe)
+                   oe[-1] = '='; /* restore overwritten '=' */

            }
 
            if (!opt) {
                con->os->nextCharArg = origOptString + 1;
            }
 
            if (!opt) {
                con->os->nextCharArg = origOptString + 1;

+               longArg = NULL;

            } else {
            } else {

-               if(con->os == con->optionStack &&
-                  opt->argInfo & POPT_ARGFLAG_STRIP) {
+               if (con->os == con->optionStack &&
+                  opt->argInfo & POPT_ARGFLAG_STRIP)
+               {

                    canstrip = 1;
                    poptStripArg(con, thisopt);
                }
                    canstrip = 1;
                    poptStripArg(con, thisopt);
                }

+               shorty = 0;

            }
        }
 
        /* Process next short option */
            }
        }
 
        /* Process next short option */

+       /*@-branchstate@*/              /* FIX: W2DO? */

        if (con->os->nextCharArg) {
            origOptString = con->os->nextCharArg;
 
            con->os->nextCharArg = NULL;
 
        if (con->os->nextCharArg) {
            origOptString = con->os->nextCharArg;
 
            con->os->nextCharArg = NULL;
 

-           if (handleAlias(con, NULL, *origOptString,
-                           origOptString + 1)) {
+           if (handleAlias(con, NULL, *origOptString, origOptString + 1))
+               continue;
+
+           if (handleExec(con, NULL, *origOptString)) {
+               /* Restore rest of short options for further processing */

                origOptString++;
                origOptString++;

+               if (*origOptString != '\0')
+                   con->os->nextCharArg = origOptString;

                continue;
            }
                continue;
            }

-           if (handleExec(con, NULL, *origOptString))
-               continue;

 
            opt = findOption(con->options, NULL, *origOptString, &cb,
                             &cbData, 0);
            if (!opt)
                return POPT_ERROR_BADOPT;
 
            opt = findOption(con->options, NULL, *origOptString, &cb,
                             &cbData, 0);
            if (!opt)
                return POPT_ERROR_BADOPT;

+           shorty = 1;

 
            origOptString++;
 
            origOptString++;

-           if (*origOptString)
+           if (*origOptString != '\0')

                con->os->nextCharArg = origOptString;
        }
                con->os->nextCharArg = origOptString;
        }

+       /*@=branchstate@*/

 
 

-       if (opt->arg && (opt->argInfo & POPT_ARG_MASK) == POPT_ARG_NONE) {
-           *((int *)opt->arg) = 1;
-       } else if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_VAL) {
-           if (opt->arg)
-               *((int *) opt->arg) = opt->val;
-       } else if ((opt->argInfo & POPT_ARG_MASK) != POPT_ARG_NONE) {
-           if (con->os->nextArg) {
-               xfree(con->os->nextArg);
-               con->os->nextArg = NULL;
+       if (opt == NULL) return POPT_ERROR_BADOPT;      /* XXX can't happen */
+       if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_NONE
+        || (opt->argInfo & POPT_ARG_MASK) == POPT_ARG_VAL) {
+           if (longArg || (con->os->nextCharArg && con->os->nextCharArg[0] == '='))
+               return POPT_ERROR_UNWANTEDARG;
+           if (opt->arg) {
+               long val = (opt->argInfo & POPT_ARG_MASK) == POPT_ARG_VAL ? opt->val : 1;
+               if (poptSaveInt((int *)opt->arg, opt->argInfo, val))
+                   return POPT_ERROR_BADOPERATION;

            }
            }

+       } else {
+           con->os->nextArg = _free(con->os->nextArg);
+           /*@-usedef@*/       /* FIX: W2DO? */

            if (longArg) {
            if (longArg) {

-               con->os->nextArg = expandNextArg(con, longArg);
+           /*@=usedef@*/
+               longArg = expandNextArg(con, longArg);
+               con->os->nextArg = longArg;

            } else if (con->os->nextCharArg) {
            } else if (con->os->nextCharArg) {

-               con->os->nextArg = expandNextArg(con, con->os->nextCharArg);
+               longArg = expandNextArg(con, con->os->nextCharArg + (con->os->nextCharArg[0] == '='));
+               con->os->nextArg = longArg;

                con->os->nextCharArg = NULL;
            } else {
                while (con->os->next == con->os->argc &&
                       con->os > con->optionStack) {
                    cleanOSE(con->os--);
                }
                con->os->nextCharArg = NULL;
            } else {
                while (con->os->next == con->os->argc &&
                       con->os > con->optionStack) {
                    cleanOSE(con->os--);
                }

-               if (con->os->next == con->os->argc)
-                   return POPT_ERROR_NOARG;
-
-               /* make sure this isn't part of a short arg or the
-                   result of an alias expansion */
-               if(con->os == con->optionStack &&
-                  opt->argInfo & POPT_ARGFLAG_STRIP &&
-                  canstrip) {
-                   poptStripArg(con, con->os->next);
-               }
+               if (con->os->next == con->os->argc) {
+                   if (!(opt->argInfo & POPT_ARGFLAG_OPTIONAL))
+                       /*@-compdef@*/  /* FIX: con->os->argv not defined */
+                       return POPT_ERROR_NOARG;
+                       /*@=compdef@*/
+                   con->os->nextArg = NULL;
+               } else {
+
+                   /*
+                    * Make sure this isn't part of a short arg or the
+                    * result of an alias expansion.
+                    */
+                   if (con->os == con->optionStack &&
+                       (opt->argInfo & POPT_ARGFLAG_STRIP) &&
+                       canstrip) {
+                       poptStripArg(con, con->os->next);
+                   }

                
                

-               con->os->nextArg = expandNextArg(con, con->os->argv[con->os->next++]);
+                   if (con->os->argv != NULL) {        /* XXX can't happen */
+                       /* XXX watchout: subtle side-effects live here. */
+                       longArg = con->os->argv[con->os->next++];
+                       longArg = expandNextArg(con, longArg);
+                       con->os->nextArg = longArg;
+                   }
+               }

            }
            }

+           longArg = NULL;

 
            if (opt->arg) {
 
            if (opt->arg) {

-               long aLong;
-               char *end;
-

                switch (opt->argInfo & POPT_ARG_MASK) {
                switch (opt->argInfo & POPT_ARG_MASK) {

-                 case POPT_ARG_STRING:
+               case POPT_ARG_STRING:

                    /* XXX memory leak, hard to plug */
                    /* XXX memory leak, hard to plug */

-                   *((const char **) opt->arg) = xstrdup(con->os->nextArg);
-                   break;
-
-                 case POPT_ARG_INT:
-                 case POPT_ARG_LONG:
-                   aLong = strtol(con->os->nextArg, &end, 0);
-                   if (!(end && *end == '\0'))
-                       return POPT_ERROR_BADNUMBER;
+                   *((const char **) opt->arg) = (con->os->nextArg)
+                       ? xstrdup(con->os->nextArg) : NULL;
+                   /*@switchbreak@*/ break;
+
+               case POPT_ARG_INT:
+               case POPT_ARG_LONG:
+               {   long aLong = 0;
+                   char *end;
+
+                   if (con->os->nextArg) {
+                       aLong = strtol(con->os->nextArg, &end, 0);
+                       if (!(end && *end == '\0'))
+                           return POPT_ERROR_BADNUMBER;
+                   }

 
 

-                   if (aLong == LONG_MIN || aLong == LONG_MAX)
-                       return POPT_ERROR_OVERFLOW;

                    if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_LONG) {
                    if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_LONG) {

-                       *((long *) opt->arg) = aLong;
+                       if (aLong == LONG_MIN || aLong == LONG_MAX)
+                           return POPT_ERROR_OVERFLOW;
+                       if (poptSaveLong((long *)opt->arg, opt->argInfo, aLong))
+                           return POPT_ERROR_BADOPERATION;

                    } else {
                        if (aLong > INT_MAX || aLong < INT_MIN)
                            return POPT_ERROR_OVERFLOW;
                    } else {
                        if (aLong > INT_MAX || aLong < INT_MIN)
                            return POPT_ERROR_OVERFLOW;

-                       *((int *) opt->arg) = aLong;
+                       if (poptSaveInt((int *)opt->arg, opt->argInfo, aLong))
+                           return POPT_ERROR_BADOPERATION;
+                   }
+               }   /*@switchbreak@*/ break;
+
+               case POPT_ARG_FLOAT:
+               case POPT_ARG_DOUBLE:
+               {   double aDouble = 0.0;
+                   char *end;
+
+                   if (con->os->nextArg) {
+                       /*@-mods@*/
+                       int saveerrno = errno;
+                       errno = 0;
+                       aDouble = strtod(con->os->nextArg, &end);
+                       if (errno == ERANGE)
+                           return POPT_ERROR_OVERFLOW;
+                       errno = saveerrno;
+                       /*@=mods@*/
+                       if (*end != '\0')
+                           return POPT_ERROR_BADNUMBER;

                    }
                    }

-                   break;

 
 

-                 default:
-                   fprintf(stdout, POPT_("option type (%d) not implemented in popt\n"),
-                     opt->argInfo & POPT_ARG_MASK);
+                   if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_DOUBLE) {
+                       *((double *) opt->arg) = aDouble;
+                   } else {
+#define MY_ABS(a) ((((a) - 0.0) < DBL_EPSILON) ? -(a) : (a))
+                       if ((MY_ABS(aDouble) - FLT_MAX) > DBL_EPSILON)
+                           return POPT_ERROR_OVERFLOW;
+                       if ((FLT_MIN - MY_ABS(aDouble)) > DBL_EPSILON)
+                           return POPT_ERROR_OVERFLOW;
+                       *((float *) opt->arg) = aDouble;
+                   }
+               }   /*@switchbreak@*/ break;
+               default:
+                   fprintf(stdout,
+                       POPT_("option type (%d) not implemented in popt\n"),
+                       (opt->argInfo & POPT_ARG_MASK));

                    exit(EXIT_FAILURE);
                    exit(EXIT_FAILURE);

+                   /*@notreached@*/ /*@switchbreak@*/ break;

                }
            }
        }
 
                }
            }
        }
 

-       if (cb)
-           cb(con, POPT_CALLBACK_REASON_OPTION, opt, con->os->nextArg, cbData);
-       else if (opt->val && ((opt->argInfo & POPT_ARG_MASK) != POPT_ARG_VAL))
+       if (cb) {
+           /*@-internalglobs@*/
+           invokeCallbacksOPTION(con, con->options, opt, cbData, shorty);
+           /*@=internalglobs@*/
+       } else if (opt->val && ((opt->argInfo & POPT_ARG_MASK) != POPT_ARG_VAL))

            done = 1;
 
        if ((con->finalArgvCount + 2) >= (con->finalArgvAlloced)) {
            done = 1;
 
        if ((con->finalArgvCount + 2) >= (con->finalArgvAlloced)) {


@@ -591,131 +1002,225 @@ int poptGetNextOpt(poptContext con)
                            sizeof(*con->finalArgv) * con->finalArgvAlloced);
        }
 
                            sizeof(*con->finalArgv) * con->finalArgvAlloced);
        }
 

-       {    char *s = malloc((opt->longName ? strlen(opt->longName) : 0) + 3);
-           if (opt->longName)
-               sprintf(s, "--%s", opt->longName);
-           else
-               sprintf(s, "-%c", opt->shortName);
-           con->finalArgv[con->finalArgvCount++] = s;
+       if (con->finalArgv != NULL)
+       {   ssize_t bufsize = (opt->longName ? strlen(opt->longName) : 0) + 3;
+           char *s = malloc(bufsize);
+           if (s != NULL) {    /* XXX can't happen */
+               if (opt->longName)
+                   snprintf(s, bufsize, "%s%s",
+                       ((opt->argInfo & POPT_ARGFLAG_ONEDASH) ? "-" : "--"),
+                       opt->longName);
+               else
+                   snprintf(s, bufsize, "-%c", opt->shortName);
+               con->finalArgv[con->finalArgvCount++] = s;
+           } else
+               con->finalArgv[con->finalArgvCount++] = NULL;

        }
 
        }
 

-       if (opt->arg && (opt->argInfo & POPT_ARG_MASK) != POPT_ARG_NONE
-                    && (opt->argInfo & POPT_ARG_MASK) != POPT_ARG_VAL) {
-           con->finalArgv[con->finalArgvCount++] = xstrdup(con->os->nextArg);
+       if (opt->arg && (opt->argInfo & POPT_ARG_MASK) == POPT_ARG_NONE)
+           /*@-ifempty@*/ ; /*@=ifempty@*/
+       else if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_VAL)
+           /*@-ifempty@*/ ; /*@=ifempty@*/
+       else if ((opt->argInfo & POPT_ARG_MASK) != POPT_ARG_NONE) {
+           if (con->finalArgv != NULL && con->os->nextArg)
+               con->finalArgv[con->finalArgvCount++] =
+                       /*@-nullpass@*/ /* LCL: con->os->nextArg != NULL */
+                       xstrdup(con->os->nextArg);
+                       /*@=nullpass@*/

        }
     }
 
        }
     }
 

-    return opt->val;
+    return (opt ? opt->val : -1);      /* XXX can't happen */

 }
 }

+/*@=boundswrite@*/

 
 

-const char * poptGetOptArg(poptContext con) {
-    const char * ret = con->os->nextArg;
-    con->os->nextArg = NULL;
+const char * poptGetOptArg(poptContext con)
+{
+    const char * ret = NULL;
+    /*@-branchstate@*/
+    if (con) {
+       ret = con->os->nextArg;
+       con->os->nextArg = NULL;
+    }
+    /*@=branchstate@*/

     return ret;
 }
 
     return ret;
 }
 

-const char * poptGetArg(poptContext con) {
-    if (con->numLeftovers == con->nextLeftover) return NULL;
-    return con->leftovers[con->nextLeftover++];
+const char * poptGetArg(poptContext con)
+{
+    const char * ret = NULL;
+    if (con && con->leftovers != NULL && con->nextLeftover < con->numLeftovers)
+       ret = con->leftovers[con->nextLeftover++];
+    return ret;

 }
 
 }
 

-const char * poptPeekArg(poptContext con) {
-    if (con->numLeftovers == con->nextLeftover) return NULL;
-    return con->leftovers[con->nextLeftover];
+const char * poptPeekArg(poptContext con)
+{
+    const char * ret = NULL;
+    if (con && con->leftovers != NULL && con->nextLeftover < con->numLeftovers)
+       ret = con->leftovers[con->nextLeftover];
+    return ret;

 }
 
 }
 

-const char ** poptGetArgs(poptContext con) {
-    if (con->numLeftovers == con->nextLeftover) return NULL;
+/*@-boundswrite@*/
+const char ** poptGetArgs(poptContext con)
+{
+    if (con == NULL ||
+       con->leftovers == NULL || con->numLeftovers == con->nextLeftover)
+       return NULL;

 
     /* some apps like [like RPM ;-) ] need this NULL terminated */
     con->leftovers[con->numLeftovers] = NULL;
 
 
     /* some apps like [like RPM ;-) ] need this NULL terminated */
     con->leftovers[con->numLeftovers] = NULL;
 

+    /*@-nullret -nullstate @*/ /* FIX: typedef double indirection. */

     return (con->leftovers + con->nextLeftover);
     return (con->leftovers + con->nextLeftover);

+    /*@=nullret =nullstate @*/

 }
 }

+/*@=boundswrite@*/

 
 

-void poptFreeContext(poptContext con) {
+poptContext poptFreeContext(poptContext con)
+{
+    poptItem item;

     int i;
 
     int i;
 

+    if (con == NULL) return con;

     poptResetContext(con);
     poptResetContext(con);

-    if (con->os->argb) free(con->os->argb);
+    con->os->argb = _free(con->os->argb);

 
 

+    if (con->aliases != NULL)

     for (i = 0; i < con->numAliases; i++) {
     for (i = 0; i < con->numAliases; i++) {

-       if (con->aliases[i].longName) xfree(con->aliases[i].longName);
-       free(con->aliases[i].argv);
+       item = con->aliases + i;
+       /*@-modobserver -observertrans -dependenttrans@*/
+       item->option.longName = _free(item->option.longName);
+       item->option.descrip = _free(item->option.descrip);
+       item->option.argDescrip = _free(item->option.argDescrip);
+       /*@=modobserver =observertrans =dependenttrans@*/
+       item->argv = _free(item->argv);

     }
     }

+    con->aliases = _free(con->aliases);

 
 

+    if (con->execs != NULL)

     for (i = 0; i < con->numExecs; i++) {
     for (i = 0; i < con->numExecs; i++) {

-       if (con->execs[i].longName) xfree(con->execs[i].longName);
-       xfree(con->execs[i].script);
+       item = con->execs + i;
+       /*@-modobserver -observertrans -dependenttrans@*/
+       item->option.longName = _free(item->option.longName);
+       item->option.descrip = _free(item->option.descrip);
+       item->option.argDescrip = _free(item->option.argDescrip);
+       /*@=modobserver =observertrans =dependenttrans@*/
+       item->argv = _free(item->argv);

     }
     }

-    if (con->execs) xfree(con->execs);
-
-    free(con->leftovers);
-    free(con->finalArgv);
-    if (con->appName) xfree(con->appName);
-    if (con->aliases) free(con->aliases);
-    if (con->otherHelp) xfree(con->otherHelp);
-    if (con->execPath) xfree(con->execPath);
-    if (con->arg_strip) PBM_FREE(con->arg_strip);
+    con->execs = _free(con->execs);
+
+    con->leftovers = _free(con->leftovers);
+    con->finalArgv = _free(con->finalArgv);
+    con->appName = _free(con->appName);
+    con->otherHelp = _free(con->otherHelp);
+    con->execPath = _free(con->execPath);
+    con->arg_strip = PBM_FREE(con->arg_strip);

     
     

-    free(con);
+    con = _free(con);
+    return con;

 }
 
 }
 

-int poptAddAlias(poptContext con, struct poptAlias newAlias,
-               /*@unused@*/ int flags)
+int poptAddAlias(poptContext con, struct poptAlias alias,
+               /*@unused@*/ UNUSED(int flags))

 {
 {

-    int aliasNum = con->numAliases++;
-    struct poptAlias * alias;
+    poptItem item = (poptItem) alloca(sizeof(*item));
+    memset(item, 0, sizeof(*item));
+    item->option.longName = alias.longName;
+    item->option.shortName = alias.shortName;
+    item->option.argInfo = POPT_ARGFLAG_DOC_HIDDEN;
+    item->option.arg = 0;
+    item->option.val = 0;
+    item->option.descrip = NULL;
+    item->option.argDescrip = NULL;
+    item->argc = alias.argc;
+    item->argv = alias.argv;
+    return poptAddItem(con, item, 0);
+}

 
 

-    /* SunOS won't realloc(NULL, ...) */
-    if (!con->aliases)
-       con->aliases = malloc(sizeof(newAlias) * con->numAliases);
-    else
-       con->aliases = realloc(con->aliases,
-                              sizeof(newAlias) * con->numAliases);
-    alias = con->aliases + aliasNum;
+/*@-boundswrite@*/
+/*@-mustmod@*/ /* LCL: con not modified? */
+int poptAddItem(poptContext con, poptItem newItem, int flags)
+{
+    poptItem * items, item;
+    int * nitems;
+
+    switch (flags) {
+    case 1:
+       items = &con->execs;
+       nitems = &con->numExecs;
+       break;
+    case 0:
+       items = &con->aliases;
+       nitems = &con->numAliases;
+       break;
+    default:
+       return 1;
+       /*@notreached@*/ break;
+    }
+
+    *items = realloc((*items), ((*nitems) + 1) * sizeof(**items));
+    if ((*items) == NULL)
+       return 1;
+
+    item = (*items) + (*nitems);
+
+    item->option.longName =
+       (newItem->option.longName ? xstrdup(newItem->option.longName) : NULL);
+    item->option.shortName = newItem->option.shortName;
+    item->option.argInfo = newItem->option.argInfo;
+    item->option.arg = newItem->option.arg;
+    item->option.val = newItem->option.val;
+    item->option.descrip =
+       (newItem->option.descrip ? xstrdup(newItem->option.descrip) : NULL);
+    item->option.argDescrip =
+       (newItem->option.argDescrip ? xstrdup(newItem->option.argDescrip) : NULL);
+    item->argc = newItem->argc;
+    item->argv = newItem->argv;

 
 

-    alias->longName = (newAlias.longName)
-       ? strcpy(malloc(strlen(newAlias.longName) + 1), newAlias.longName)
-       : NULL;
-    alias->shortName = newAlias.shortName;
-    alias->argc = newAlias.argc;
-    alias->argv = newAlias.argv;
+    (*nitems)++;

 
     return 0;
 }
 
     return 0;
 }

+/*@=mustmod@*/
+/*@=boundswrite@*/

 
 

-const char * poptBadOption(poptContext con, int flags) {
-    struct optionStackEntry * os;
+const char * poptBadOption(poptContext con, int flags)
+{
+    struct optionStackEntry * os = NULL;

 
 

-    if (flags & POPT_BADOPTION_NOALIAS)
-       os = con->optionStack;
-    else
-       os = con->os;
+    if (con != NULL)
+       os = (flags & POPT_BADOPTION_NOALIAS) ? con->optionStack : con->os;

 
 

-    return os->argv[os->next - 1];
+    /*@-nullderef@*/   /* LCL: os->argv != NULL */
+    return (os && os->argv ? os->argv[os->next - 1] : NULL);
+    /*@=nullderef@*/

 }
 
 }
 

-#define POPT_ERROR_NOARG       -10
-#define POPT_ERROR_BADOPT      -11
-#define POPT_ERROR_OPTSTOODEEP -13
-#define POPT_ERROR_BADQUOTE    -15     /* only from poptParseArgString() */
-#define POPT_ERROR_ERRNO       -16     /* only from poptParseArgString() */
-
-const char *const poptStrerror(const int error) {
+const char * poptStrerror(const int error)
+{

     switch (error) {
       case POPT_ERROR_NOARG:
        return POPT_("missing argument");
     switch (error) {
       case POPT_ERROR_NOARG:
        return POPT_("missing argument");

+      case POPT_ERROR_UNWANTEDARG:
+       return POPT_("option does not take an argument");

       case POPT_ERROR_BADOPT:
        return POPT_("unknown option");
       case POPT_ERROR_BADOPT:
        return POPT_("unknown option");

+      case POPT_ERROR_BADOPERATION:
+       return POPT_("mutually exclusive logical operations requested");
+      case POPT_ERROR_NULLARG:
+       return POPT_("opt->arg should not be NULL");

       case POPT_ERROR_OPTSTOODEEP:
        return POPT_("aliases nested too deeply");
       case POPT_ERROR_BADQUOTE:
       case POPT_ERROR_OPTSTOODEEP:
        return POPT_("aliases nested too deeply");
       case POPT_ERROR_BADQUOTE:

-       return POPT_("error in paramter quoting");
+       return POPT_("error in parameter quoting");

       case POPT_ERROR_BADNUMBER:
        return POPT_("invalid numeric value");
       case POPT_ERROR_OVERFLOW:
        return POPT_("number too large or too small");
       case POPT_ERROR_BADNUMBER:
        return POPT_("invalid numeric value");
       case POPT_ERROR_OVERFLOW:
        return POPT_("number too large or too small");

+      case POPT_ERROR_MALLOC:
+       return POPT_("memory allocation failed");

       case POPT_ERROR_ERRNO:
        return strerror(errno);
       default:
       case POPT_ERROR_ERRNO:
        return strerror(errno);
       default:


@@ -723,52 +1228,56 @@ const char *const poptStrerror(const int error) {
     }
 }
 
     }
 }
 

-int poptStuffArgs(poptContext con, const char ** argv) {
+int poptStuffArgs(poptContext con, const char ** argv)
+{

     int argc;
     int argc;

+    int rc;

 
     if ((con->os - con->optionStack) == POPT_OPTION_DEPTH)
        return POPT_ERROR_OPTSTOODEEP;
 
     for (argc = 0; argv[argc]; argc++)
 
     if ((con->os - con->optionStack) == POPT_OPTION_DEPTH)
        return POPT_ERROR_OPTSTOODEEP;
 
     for (argc = 0; argv[argc]; argc++)

-       ;
+       {};

 
     con->os++;
     con->os->next = 0;
     con->os->nextArg = NULL;
     con->os->nextCharArg = NULL;
     con->os->currAlias = NULL;
 
     con->os++;
     con->os->next = 0;
     con->os->nextArg = NULL;
     con->os->nextCharArg = NULL;
     con->os->currAlias = NULL;

-    poptDupArgv(argc, argv, &con->os->argc, &con->os->argv);
+    rc = poptDupArgv(argc, argv, &con->os->argc, &con->os->argv);

     con->os->argb = NULL;
     con->os->stuffed = 1;
 
     con->os->argb = NULL;
     con->os->stuffed = 1;
 

-    return 0;
+    return rc;

 }
 
 }
 

-const char * poptGetInvocationName(poptContext con) {
-    return con->os->argv[0];
+const char * poptGetInvocationName(poptContext con)
+{
+    return (con->os->argv ? con->os->argv[0] : "");

 }
 
 }
 

-int poptStrippedArgv(poptContext con, int argc, char **argv)
+/*@-boundswrite@*/
+int poptStrippedArgv(poptContext con, int argc, char ** argv)

 {
 {

-    int i,j=1, numargs=argc;
+    int numargs = argc;
+    int j = 1;
+    int i;

     
     

-    for(i=1; i<argc; i++) {
-       if(PBM_ISSET(i, con->arg_strip)) {
+    /*@-sizeoftype@*/
+    if (con->arg_strip)
+    for (i = 1; i < argc; i++) {
+       if (PBM_ISSET(i, con->arg_strip))

            numargs--;
            numargs--;

-       }

     }
     
     }
     

-    for(i=1; i<argc; i++) {
-       if(PBM_ISSET(i, con->arg_strip)) {
+    for (i = 1; i < argc; i++) {
+       if (con->arg_strip && PBM_ISSET(i, con->arg_strip))

            continue;
            continue;

-       } else {
-           if(j<numargs) {
-               argv[j++]=argv[i];
-           } else {
-               argv[j++]='\0';
-           }
-       }
+       argv[j] = (j < numargs) ? argv[i] : NULL;
+       j++;

     }
     }

+    /*@=sizeoftype@*/

     
     

-    return(numargs);
+    return numargs;

 }
 }

+/*@=boundswrite@*/