broadway-server.c

Bug Summary

File:	cdk/broadway/broadway-server.c
Warning:	line 411, column 3 Returned pointer value points outside the original object (potential buffer overflow)
Note:	line 411, column 10 Original object is an array of 0 'unsigned int' objects, returned pointer points at index 12
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name broadway-server.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/rootdir/cdk/broadway -resource-dir /usr/lib/llvm-16/lib/clang/16 -D HAVE_CONFIG_H -I . -I ../.. -D G_LOG_DOMAIN="Cdk" -D G_LOG_USE_STRUCTURED=1 -D CDK_COMPILATION -D CDK_DISABLE_DEPRECATION_WARNINGS -I ../.. -I ../../cdk -I ../../cdk -D G_ENABLE_DEBUG -D G_ENABLE_CONSISTENCY_CHECKS -D GLIB_MIN_REQUIRED_VERSION=GLIB_VERSION_2_66 -D GLIB_MAX_ALLOWED_VERSION=GLIB_VERSION_2_66 -I /usr/include/pango-1.0 -I /usr/include/glib-2.0 -I /usr/lib/x86_64-linux-gnu/glib-2.0/include -I /usr/include/sysprof-6 -I /usr/include/harfbuzz -I /usr/include/freetype2 -I /usr/include/libpng16 -I /usr/include/libmount -I /usr/include/blkid -I /usr/include/fribidi -I /usr/include/cairo -I /usr/include/pixman-1 -I /usr/include/gdk-pixbuf-2.0 -I /usr/include/x86_64-linux-gnu -I /usr/include/webp -I /usr/include/gio-unix-2.0 -internal-isystem /usr/lib/llvm-16/lib/clang/16/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -fdebug-compilation-dir=/rootdir/cdk/broadway -ferror-limit 19 -fvisibility=hidden -fgnuc-version=4.2.1 -analyzer-checker deadcode.DeadStores -analyzer-checker alpha.deadcode.UnreachableCode -analyzer-checker alpha.core.CastSize -analyzer-checker alpha.core.CastToStruct -analyzer-checker alpha.core.IdenticalExpr -analyzer-checker alpha.core.SizeofPtr -analyzer-checker alpha.security.ArrayBoundV2 -analyzer-checker alpha.security.MallocOverflow -analyzer-checker alpha.security.ReturnPtrRange -analyzer-checker alpha.unix.SimpleStream -analyzer-checker alpha.unix.cstring.BufferOverlap -analyzer-checker alpha.unix.cstring.NotNullTerminated -analyzer-checker alpha.unix.cstring.OutOfBounds -analyzer-checker alpha.core.FixedAddr -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /rootdir/html-report/2024-09-19-170037-43636-1 -x c broadway-server.c
1#include "config.h"

3#include "broadway-server.h"

5#include "broadway-output.h"

7#include <glib.h>
8#include <glib/gprintf.h>
9#include "cdktypes.h"
10#include <stdlib.h>
11#include <string.h>
12#include <errno(*__errno_location ()).h>

14#ifdef HAVE_UNISTD_H1
15#include <unistd.h>
16#elif defined (G_OS_WIN32)
17#include <io.h>
18#endif
19#ifdef HAVE_SYS_MMAN_H1
20#include <sys/mman.h>
21#endif
22#include <sys/stat.h>
23#include <fcntl.h>
24#include <sys/types.h>
25#ifdef G_OS_UNIX
26#include <sys/socket.h>
27#include <netinet/in.h>
28#include <netinet/tcp.h>
29#endif
30#ifdef HAVE_GIO_UNIX1
31#include <gio/gunixsocketaddress.h>
32#endif
33#ifdef G_OS_WIN32
34#include <windows.h>
35#include <string.h>
36#endif

38typedef struct BroadwayInput BroadwayInput;
39typedef struct BroadwayWindow BroadwayWindow;
40struct _BroadwayServer {
GObject parent_instance;

char *address;
int port;
char *ssl_cert;
char *ssl_key;
GSocketService *service;
BroadwayOutput *output;
guint32 id_counter;
guint32 saved_serial;
guint64 last_seen_time;
BroadwayInput *input;
GList *input_messages;
guint process_input_idle;

GHashTable *id_ht;
GList *toplevels;
BroadwayWindow *root;
gint32 focused_window_id; /* -1 => none */
gint show_keyboard;

guint32 screen_width;
guint32 screen_height;

gint32 mouse_in_toplevel_id;
int last_x, last_y; /* in root coords */
guint32 last_state;
gint32 real_mouse_in_toplevel_id; /* Not affected by grabs */

/* Explicit pointer grabs: */
gint32 pointer_grab_window_id; /* -1 => none */
gint32 pointer_grab_client_id; /* -1 => none */
guint32 pointer_grab_time;
gboolean pointer_grab_owner_events;

/* Future data, from the currently queued events */
int future_root_x;
int future_root_y;
guint32 future_state;
int future_mouse_in_toplevel;
81};

83struct _BroadwayServerClass
84{
GObjectClass parent_class;
86};

88typedef struct HttpRequest {
BroadwayServer *server;
GSocketConnection *socket_connection;
GIOStream *connection;
GDataInputStream *data;
GString *request;
94}  HttpRequest;

96struct BroadwayInput {
BroadwayServer *server;
BroadwayOutput *output;
GIOStream *connection;
GByteArray *buffer;
GSource *source;
gboolean seen_time;
gint64 time_base;
gboolean active;
105};

107struct BroadwayWindow {
gint32 id;
gint32 x;
gint32 y;
gint32 width;
gint32 height;
gboolean is_temp;
gboolean visible;
gint32 transient_for;

BroadwayBuffer *buffer;
gboolean buffer_synced;

char *cached_surface_name;
cairo_surface_t *cached_surface;
122};

124static void broadway_server_resync_windows (BroadwayServer *server);

126static GType broadway_server_get_type (void);

128G_DEFINE_TYPE (BroadwayServer, broadway_server, G_TYPE_OBJECT)static void broadway_server_init (BroadwayServer *self); static
 void broadway_server_class_init (BroadwayServerClass *klass)
; static GType broadway_server_get_type_once (void); static gpointer
 broadway_server_parent_class = ((void*)0); static gint BroadwayServer_private_offset
; static void broadway_server_class_intern_init (gpointer klass
) { broadway_server_parent_class = g_type_class_peek_parent (
klass); if (BroadwayServer_private_offset != 0) g_type_class_adjust_private_offset
 (klass, &BroadwayServer_private_offset); broadway_server_class_init
 ((BroadwayServerClass*) klass); } __attribute__ ((__unused__
)) static inline gpointer broadway_server_get_instance_private
 (BroadwayServer *self) { return (((gpointer) ((guint8*) (self
) + (glong) (BroadwayServer_private_offset)))); } GType broadway_server_get_type
 (void) { static GType static_g_define_type_id = 0; if ((__extension__
 ({ _Static_assert (sizeof *(&static_g_define_type_id) ==
 sizeof (gpointer), "Expression evaluates to false"); (void) (
? (gpointer) * (&static_g_define_type_id) : ((void*)0))
; (!(__extension__ ({ _Static_assert (sizeof *(&static_g_define_type_id
) == sizeof (gpointer), "Expression evaluates to false"); __typeof__
 (*(&static_g_define_type_id)) gapg_temp_newval; __typeof__
 ((&static_g_define_type_id)) gapg_temp_atomic = (&static_g_define_type_id
); __atomic_load (gapg_temp_atomic, &gapg_temp_newval, 5)
; gapg_temp_newval; })) && g_once_init_enter_pointer (
&static_g_define_type_id)); })) ) { GType g_define_type_id
 = broadway_server_get_type_once (); (__extension__ ({ _Static_assert
 (sizeof *(&static_g_define_type_id) == sizeof (gpointer)
, "Expression evaluates to false"); 0 ? (void) (*(&static_g_define_type_id
) = (g_define_type_id)) : (void) 0; g_once_init_leave_pointer
 ((&static_g_define_type_id), (gpointer) (guintptr) (g_define_type_id
)); })) ; } return static_g_define_type_id; } __attribute__ (
(__noinline__)) static GType broadway_server_get_type_once (void
) { GType g_define_type_id = g_type_register_static_simple ((
(GType) ((20) << (2))), g_intern_static_string ("BroadwayServer"
), sizeof (BroadwayServerClass), (GClassInitFunc)(void (*)(void
)) broadway_server_class_intern_init, sizeof (BroadwayServer)
, (GInstanceInitFunc)(void (*)(void)) broadway_server_init, (
GTypeFlags) 0); { {{};} } return g_define_type_id; }

130static void
131broadway_server_init (BroadwayServer *server)
132{
BroadwayWindow *root;

server->service = g_socket_service_new ();
server->pointer_grab_window_id = -1;
server->saved_serial = 1;
server->last_seen_time = 1;
server->id_ht = g_hash_table_new (NULL((void*)0), NULL((void*)0));
server->id_counter = 0;

root = g_new0 (BroadwayWindow, 1)((BroadwayWindow *) g_malloc0_n ((1), sizeof (BroadwayWindow)
));
root->id = server->id_counter++;
root->width = 1024;
root->height = 768;
root->visible = TRUE(!(0));

server->root = root;

g_hash_table_insert (server->id_ht,
       GINT_TO_POINTER (root->id)((gpointer) (glong) (root->id)),
       root);
153}

155static void
156broadway_server_finalize (GObject *object)
157{
BroadwayServer *server = BROADWAY_SERVER (object)((((BroadwayServer*) (void *) g_type_check_instance_cast ((GTypeInstance
*) ((object)), ((broadway_server_get_type()))))));

g_free (server->address);
g_free (server->ssl_cert);
g_free (server->ssl_key);

G_OBJECT_CLASS (broadway_server_parent_class)((((GObjectClass*) (void *) g_type_check_class_cast ((GTypeClass
*) ((broadway_server_parent_class)), (((GType) ((20) <<
 (2))))))))->finalize (object);
165}

167static void
168broadway_server_class_init (BroadwayServerClass * class)
169{
GObjectClass *object_class = G_OBJECT_CLASS (class)((((GObjectClass*) (void *) g_type_check_class_cast ((GTypeClass
*) ((class)), (((GType) ((20) << (2))))))));

object_class->finalize = broadway_server_finalize;
173}

175static void start (BroadwayInput *input);

177static void
178http_request_free (HttpRequest *request)
179{
g_object_unref (request->socket_connection);
g_object_unref (request->connection);
g_object_unref (request->data);
g_string_free (request->request, TRUE)(__builtin_constant_p ((!(0))) ? (((!(0))) ? (g_string_free) (
(request->request), ((!(0)))) : g_string_free_and_steal (request
->request)) : (g_string_free) ((request->request), ((!(
0)))));
g_free (request);
185}

187static void
188broadway_input_free (BroadwayInput *input)
189{
g_object_unref (input->connection);
g_byte_array_free (input->buffer, FALSE(0));
g_source_destroy (input->source);
g_free (input);
194}

196static void
197update_event_state (BroadwayServer *server,
    BroadwayInputMsg *message)
199{
BroadwayWindow *window;

switch (message->base.type) {
case BROADWAY_EVENT_ENTER:
  server->last_x = message->pointer.root_x;
  server->last_y = message->pointer.root_y;
  server->last_state = message->pointer.state;
  server->real_mouse_in_toplevel_id = message->pointer.mouse_window_id;

  /* TODO: Unset when it dies */
  server->mouse_in_toplevel_id = message->pointer.event_window_id;
  break;
case BROADWAY_EVENT_LEAVE:
  server->last_x = message->pointer.root_x;
  server->last_y = message->pointer.root_y;
  server->last_state = message->pointer.state;
  server->real_mouse_in_toplevel_id = message->pointer.mouse_window_id;

  server->mouse_in_toplevel_id = 0;
  break;
case BROADWAY_EVENT_POINTER_MOVE:
  server->last_x = message->pointer.root_x;
  server->last_y = message->pointer.root_y;
  server->last_state = message->pointer.state;
  server->real_mouse_in_toplevel_id = message->pointer.mouse_window_id;
  break;
case BROADWAY_EVENT_BUTTON_PRESS:
case BROADWAY_EVENT_BUTTON_RELEASE:
  if (message->base.type == BROADWAY_EVENT_BUTTON_PRESS &&
      server->focused_window_id != message->pointer.mouse_window_id &&
      server->pointer_grab_window_id == -1)
    {
      broadway_server_window_raise (server, message->pointer.mouse_window_id);
      broadway_server_focus_window (server, message->pointer.mouse_window_id);
      broadway_server_flush (server);
    }

  server->last_x = message->pointer.root_x;
  server->last_y = message->pointer.root_y;
  server->last_state = message->pointer.state;
  server->real_mouse_in_toplevel_id = message->pointer.mouse_window_id;
  break;
case BROADWAY_EVENT_SCROLL:
  server->last_x = message->pointer.root_x;
  server->last_y = message->pointer.root_y;
  server->last_state = message->pointer.state;
  server->real_mouse_in_toplevel_id = message->pointer.mouse_window_id;
  break;
case BROADWAY_EVENT_TOUCH:
  if (message->touch.touch_type == 0 && message->touch.is_emulated &&
      server->focused_window_id != message->touch.event_window_id)
    {
      broadway_server_window_raise (server, message->touch.event_window_id);
      broadway_server_focus_window (server, message->touch.event_window_id);
      broadway_server_flush (server);
    }

  if (message->touch.is_emulated)
    {
      server->last_x = message->pointer.root_x;
      server->last_y = message->pointer.root_y;
    }

  server->last_state = message->touch.state;
  break;
case BROADWAY_EVENT_KEY_PRESS:
case BROADWAY_EVENT_KEY_RELEASE:
  server->last_state = message->key.state;
  break;
case BROADWAY_EVENT_GRAB_NOTIFY:
case BROADWAY_EVENT_UNGRAB_NOTIFY:
  break;
case BROADWAY_EVENT_CONFIGURE_NOTIFY:
  window = g_hash_table_lookup (server->id_ht,
		  GINT_TO_POINTER (message->configure_notify.id)((gpointer) (glong) (message->configure_notify.id)));
  if (window != NULL((void*)0))
    {
window->x = message->configure_notify.x;
window->y = message->configure_notify.y;
    }
  break;
case BROADWAY_EVENT_DELETE_NOTIFY:
  break;
case BROADWAY_EVENT_SCREEN_SIZE_CHANGED:
  server->root->width = message->screen_resize_notify.width;
  server->root->height = message->screen_resize_notify.height;
  break;

default:
  g_printerr ("update_event_state - Unknown input command %c\n", message->base.type);
  break;
}
292}

294gboolean
295broadway_server_lookahead_event (BroadwayServer  *server,
		 const char         *types)
297{
GList *l;

for (l = server->input_messages; l != NULL((void*)0); l = l->next)
  {
    BroadwayInputMsg *message;

    message = l->data;
    if (strchr (types, message->base.type) != NULL((void*)0))
return TRUE(!(0));
  }

return FALSE(0);
310}

312static gboolean
313is_pointer_event (BroadwayInputMsg *message)
314{
return
  message->base.type == BROADWAY_EVENT_ENTER ||
  message->base.type == BROADWAY_EVENT_LEAVE ||
  message->base.type == BROADWAY_EVENT_POINTER_MOVE ||
  message->base.type == BROADWAY_EVENT_BUTTON_PRESS ||
  message->base.type == BROADWAY_EVENT_BUTTON_RELEASE ||
  message->base.type == BROADWAY_EVENT_SCROLL ||
  message->base.type == BROADWAY_EVENT_GRAB_NOTIFY ||
  message->base.type == BROADWAY_EVENT_UNGRAB_NOTIFY;
324}

326static void
327process_input_message (BroadwayServer *server,
       BroadwayInputMsg *message)
329{
gint32 client;

update_event_state (server, message);
client = -1;
if (is_pointer_event (message) &&
    server->pointer_grab_window_id != -1)
  client = server->pointer_grab_client_id;

broadway_events_got_input (message, client);
339}

341static void
342process_input_messages (BroadwayServer *server)
343{
while (server->input_messages)
  {
    BroadwayInputMsg *message;

    message = server->input_messages->data;
    server->input_messages =
g_list_delete_link (server->input_messages,
	    server->input_messages);

    if (message->base.serial == 0)
{
 /* This was sent before we got any requests, but we don't want the
    daemon serials to go backwards, so we fix it up to be the last used
    serial */
 message->base.serial = server->saved_serial - 1;
}

    process_input_message (server, message);
    g_free (message);
  }
364}

366static void
367fake_configure_notify (BroadwayServer *server,
       BroadwayWindow *window)
369{
BroadwayInputMsg ev = { {0} };

ev.base.type = BROADWAY_EVENT_CONFIGURE_NOTIFY;
ev.base.serial = server->saved_serial - 1;
ev.base.time = server->last_seen_time;
ev.configure_notify.id = window->id;
ev.configure_notify.x = window->x;
ev.configure_notify.y = window->y;
ev.configure_notify.width = window->width;
ev.configure_notify.height = window->height;

process_input_message (server, &ev);
382}

384static guint32 *
385parse_pointer_data (guint32 *p, BroadwayInputPointerMsg *data)
386{
data->mouse_window_id = ntohl (*p++);
data->event_window_id = ntohl (*p++);
data->root_x = ntohl (*p++);
data->root_y = ntohl (*p++);
data->win_x = ntohl (*p++);
data->win_y = ntohl (*p++);
data->state = ntohl (*p++);

return p;
396}

398static guint32 *
399parse_touch_data (guint32 *p, BroadwayInputTouchMsg *data)
400{
data->touch_type = ntohl (*p++);
data->event_window_id = ntohl (*p++);
data->sequence_id = ntohl (*p++);
data->is_emulated = ntohl (*p++);
data->root_x = ntohl (*p++);
data->root_y = ntohl (*p++);
data->win_x = ntohl (*p++);
data->win_y = ntohl (*p++);
data->state = ntohl (*p++);
31
←
Value assigned to 'p'→

return p;
Original object is an array of 0 'unsigned int' objects, returned pointer points at index 12
32
←
Returned pointer value points outside the original object (potential buffer overflow)
412}

414static void
415update_future_pointer_info (BroadwayServer *server, BroadwayInputPointerMsg *data)
416{
server->future_root_x = data->root_x;
server->future_root_y = data->root_y;
server->future_state = data->state;
server->future_mouse_in_toplevel = data->mouse_window_id;
421}

423static void
424parse_input_message (BroadwayInput *input, const unsigned char *message)
425{
BroadwayServer *server = input->server;
BroadwayInputMsg msg;
guint32 *p;
gint64 time_;

memset (&msg, 0, sizeof (msg));

p = (guint32 *) message;

msg.base.type = ntohl (*p++);
msg.base.serial = ntohl (*p++);
time_ = ntohl (*p++);

if (time_ == 0) {
27
←
Assuming 'time_' is equal to 0→
28
←
Taking true branch→
  time_ = server->last_seen_time;
} else {
  if (!input->seen_time) {
    input->seen_time = TRUE(!(0));
    /* Calculate time base so that any following times are normalized to start
5 seconds after last_seen_time, to avoid issues that could appear when
a long hiatus due to a reconnect seems to be instant */
    input->time_base = time_ - (server->last_seen_time + 5000);
  }
  time_ = time_ - input->time_base;
}

server->last_seen_time = time_;

msg.base.time = time_;

switch (msg.base.type) {
29
←
Control jumps to 'case BROADWAY_EVENT_TOUCH:'  at line 482→
case BROADWAY_EVENT_ENTER:
case BROADWAY_EVENT_LEAVE:
  p = parse_pointer_data (p, &msg.pointer);
  update_future_pointer_info (server, &msg.pointer);
  msg.crossing.mode = ntohl (*p++);
  break;

case BROADWAY_EVENT_POINTER_MOVE: /* Mouse move */
  p = parse_pointer_data (p, &msg.pointer);
  update_future_pointer_info (server, &msg.pointer);
  break;

case BROADWAY_EVENT_BUTTON_PRESS:
case BROADWAY_EVENT_BUTTON_RELEASE:
  p = parse_pointer_data (p, &msg.pointer);
  update_future_pointer_info (server, &msg.pointer);
  msg.button.button = ntohl (*p++);
  break;

case BROADWAY_EVENT_SCROLL:
  p = parse_pointer_data (p, &msg.pointer);
  update_future_pointer_info (server, &msg.pointer);
  msg.scroll.dir = ntohl (*p++);
  break;

case BROADWAY_EVENT_TOUCH:
  p = parse_touch_data (p, &msg.touch);
30
←
Calling 'parse_touch_data'→
  break;

case BROADWAY_EVENT_KEY_PRESS:
case BROADWAY_EVENT_KEY_RELEASE:
  msg.key.window_id = server->focused_window_id;
  msg.key.key = ntohl (*p++);
  msg.key.state = ntohl (*p++);
  break;

case BROADWAY_EVENT_GRAB_NOTIFY:
case BROADWAY_EVENT_UNGRAB_NOTIFY:
  msg.grab_reply.res = ntohl (*p++);
  break;

case BROADWAY_EVENT_CONFIGURE_NOTIFY:
  msg.configure_notify.id = ntohl (*p++);
  msg.configure_notify.x = ntohl (*p++);
  msg.configure_notify.y = ntohl (*p++);
  msg.configure_notify.width = ntohl (*p++);
  msg.configure_notify.height = ntohl (*p++);
  break;

case BROADWAY_EVENT_DELETE_NOTIFY:
  msg.delete_notify.id = ntohl (*p++);
  break;

case BROADWAY_EVENT_SCREEN_SIZE_CHANGED:
  msg.screen_resize_notify.width = ntohl (*p++);
  msg.screen_resize_notify.height = ntohl (*p++);
  break;

default:
  g_printerr ("parse_input_message - Unknown input command %c (%s)\n", msg.base.type, message);
  break;
}

server->input_messages = g_list_append (server->input_messages, g_memdup2 (&msg, sizeof (msg)));

522}

524static inline void
525hex_dump (guchar *data G_GNUC_UNUSED__attribute__ ((__unused__)),
 gsize   len G_GNUC_UNUSED__attribute__ ((__unused__)))
527{
528#ifdef DEBUG_WEBSOCKETS
gsize i, j;
for (j = 0; j < len + 15; j += 16)
  {
    fprintf (stderrstderr, "0x%.4x  ", j);
    for (i = 0; i < 16; i++)
{
   if ((j + i) < len)
     fprintf (stderrstderr, "%.2x ", data[j+i]);
   else
     fprintf (stderrstderr, "  ");
   if (i == 8)
     fprintf (stderrstderr, " ");
}
    fprintf (stderrstderr, " | ");

    for (i = 0; i < 16; i++)
if ((j + i) < len && g_ascii_isalnum(data[j+i])((g_ascii_table[(guchar) (data[j+i])] & G_ASCII_ALNUM) !=
 0))
 fprintf (stderrstderr, "%c", data[j+i]);
else
 fprintf (stderrstderr, ".");
    fprintf (stderrstderr, "\n");
  }
551#endif
552}

554static void
555parse_input (BroadwayInput *input)
556{
if (!input->buffer->len)
10
←
Assuming field 'len' is not equal to 0→
11
←
Taking false branch→
  return;

hex_dump (input->buffer->data, input->buffer->len);

while (input->buffer->len > 2)
12
←
Assuming field 'len' is > 2→
13
←
Loop condition is true.  Entering loop body→
  {
    gsize len, payload_len;
    BroadwayWSOpCode code;
    gboolean is_mask, fin;
    guchar *buf, *data, *mask;

    buf = input->buffer->data;
    len = input->buffer->len;

572#ifdef DEBUG_WEBSOCKETS
    g_print ("Parse input first byte 0x%2x 0x%2x\n", buf[0], buf[1]);
574#endif

    fin = buf[0] & 0x80;
    code = buf[0] & 0x0f;
    payload_len = buf[1] & 0x7f;
    is_mask = buf[1] & 0x80;
    data = buf + 2;

    if (payload_len == 126)
14
←
Assuming 'payload_len' is not equal to 126→
15
←
Taking false branch→
      {
        if (len < 4)
          return;
        payload_len = GUINT16_FROM_BE( *(guint16 *) data )(((((guint16) ( (guint16) ((guint16) (*(guint16 *) data) >>
 8) | (guint16) ((guint16) (*(guint16 *) data) << 8))))
));
        data += 2;
      }
    else if (payload_len == 127)
16
←
Assuming 'payload_len' is not equal to 127→
17
←
Taking false branch→
      {
        if (len < 10)
          return;
        payload_len = GUINT64_FROM_BE( *(guint64 *) data )(((((guint64) ( (((guint64) (*(guint64 *) data) & (guint64
) (0x00000000000000ffUL)) << 56) | (((guint64) (*(guint64
 *) data) & (guint64) (0x000000000000ff00UL)) << 40
) | (((guint64) (*(guint64 *) data) & (guint64) (0x0000000000ff0000UL
)) << 24) | (((guint64) (*(guint64 *) data) & (guint64
) (0x00000000ff000000UL)) << 8) | (((guint64) (*(guint64
 *) data) & (guint64) (0x000000ff00000000UL)) >> 8)
 | (((guint64) (*(guint64 *) data) & (guint64) (0x0000ff0000000000UL
)) >> 24) | (((guint64) (*(guint64 *) data) & (guint64
) (0x00ff000000000000UL)) >> 40) | (((guint64) (*(guint64
 *) data) & (guint64) (0xff00000000000000UL)) >> 56
))))));
        data += 8;
      }

    mask = NULL((void*)0);
    if (is_mask)
18
←
Assuming 'is_mask' is 0→
19
←
Taking false branch→
      {
        if (data - buf + 4 > len)
          return;
        mask = data;
        data += 4;
      }

    if (data - buf + payload_len > len)
20
←
Assuming the condition is false→
21
←
Taking false branch→
      return; /* wait to accumulate more */

    if (is_mask21.1
'is_mask' is 0
)
22
←
Taking false branch→
      {
        gsize i;
        for (i = 0; i < payload_len; i++)
          data[i] ^= mask[i%4];
      }

    switch (code) {
23
←
Control jumps to 'case BROADWAY_WS_BINARY:'  at line 619→
    case BROADWAY_WS_CNX_CLOSE:
      break; /* hang around anyway */
    case BROADWAY_WS_BINARY:
      if (!fin)
24
←
Assuming 'fin' is not equal to 0→
25
←
Taking false branch→
        {
622#ifdef DEBUG_WEBSOCKETS
          g_warning ("can't yet accept fragmented input");
624#endif
        }
      else
        {
          parse_input_message (input, data);
26
←
Calling 'parse_input_message'→
        }
      break;
    case BROADWAY_WS_CNX_PING:
      broadway_output_pong (input->output);
      break;
    case BROADWAY_WS_CNX_PONG:
      break; /* we never send pings, but tolerate pongs */
    case BROADWAY_WS_TEXT:
    case BROADWAY_WS_CONTINUATION:
    default:
      {
        g_warning ("fragmented or unknown input code 0x%2x with fin set", code);
        break;
      }
    }

    g_byte_array_remove_range (input->buffer, 0, data - buf + payload_len);
  }
647}


650static gboolean
651process_input_idle_cb (BroadwayServer *server)
652{
server->process_input_idle = 0;
process_input_messages (server);
return G_SOURCE_REMOVE(0);
656}

658static void
659queue_process_input_at_idle (BroadwayServer *server)
660{
if (server->process_input_idle == 0)
  server->process_input_idle =
    g_idle_add_full (G_PRIORITY_DEFAULT0, (GSourceFunc)process_input_idle_cb, server, NULL((void*)0));
664}

666static gboolean
667broadway_server_read_all_input_nonblocking (BroadwayInput *input)
668{
GInputStream *in;
gssize res;
guint8 buffer[1024];
GError *error = NULL((void*)0);

if (input == NULL((void*)0))
5
←
Assuming 'input' is not equal to NULL→
6
←
Taking false branch→
  return FALSE(0);

in = g_io_stream_get_input_stream (input->connection);

res = g_pollable_input_stream_read_nonblocking (G_POLLABLE_INPUT_STREAM (in)((((GPollableInputStream*) (void *) g_type_check_instance_cast
 ((GTypeInstance*) ((in)), ((g_pollable_input_stream_get_type
 ())))))),
				  buffer, sizeof (buffer), NULL((void*)0), &error);

if (res <= 0)
7
←
Assuming 'res' is > 0→
8
←
Taking false branch→
  {
    if (res < 0 &&
 g_error_matches (error, G_IO_ERRORg_io_error_quark(), G_IO_ERROR_WOULD_BLOCK))
{
 g_error_free (error);
 return TRUE(!(0));
}

    if (input->server->input == input)
input->server->input = NULL((void*)0);
    broadway_input_free (input);
    if (res < 0)
{
 g_printerr ("input error %s\n", error->message);
 g_error_free (error);
}
    return FALSE(0);
  }

g_byte_array_append (input->buffer, buffer, res);

parse_input (input);
9
←
Calling 'parse_input'→
return TRUE(!(0));
706}

708static void
709broadway_server_consume_all_input (BroadwayServer *server)
710{
broadway_server_read_all_input_nonblocking (server->input);
4
←
Calling 'broadway_server_read_all_input_nonblocking'→

/* Since we're parsing input but not processing the resulting messages
   we might not get a readable callback on the stream, so queue an idle to
   process the messages */
queue_process_input_at_idle (server);
717}


720static gboolean
721input_data_cb (GObject       *stream G_GNUC_UNUSED__attribute__ ((__unused__)),
      BroadwayInput *input)
723{
BroadwayServer *server = input->server;

if (!broadway_server_read_all_input_nonblocking (input))
  return FALSE(0);

if (input->active)
  process_input_messages (server);

return TRUE(!(0));
733}

735guint32
736broadway_server_get_next_serial (BroadwayServer *server)
737{
if (server->output)
  return broadway_output_get_next_serial (server->output);

return server->saved_serial;
742}

744void
745broadway_server_get_screen_size (BroadwayServer   *server,
		 guint32          *width,
		 guint32          *height)
748{
*width = server->root->width;
*height = server->root->height;
751}


754void
755broadway_server_flush (BroadwayServer *server)
756{
if (server->output &&
    !broadway_output_flush (server->output))
  {
    server->saved_serial = broadway_output_get_next_serial (server->output);
    broadway_output_free (server->output);
    server->output = NULL((void*)0);
  }
764}

766#if 0
767/* TODO: This is not used atm, is it needed? */
768/* Note: This may be called while handling a message (i.e. sorta recursively) */
769static BroadwayInputMsg *
770broadway_server_block_for_input (BroadwayServer *server, char op,
		 guint32 serial, gboolean remove_message)
772{
BroadwayInputMsg *message;
gssize res;
guint8 buffer[1024];
BroadwayInput *input;
GInputStream *in;
GList *l;

broadway_server_flush (server);

if (server->input == NULL((void*)0))
  return NULL((void*)0);

input = server->input;

while (TRUE(!(0))) {
  /* Check for existing reply in queue */

  for (l = server->input_messages; l != NULL((void*)0); l = l->next)
    {
message = l->data;

if (message->base.type == op)
 {
   if (message->base.serial == serial)
     {
if (remove_message)
  server->input_messages =
    g_list_delete_link (server->input_messages, l);
return message;
     }
 }
    }

  /* Not found, read more, blocking */

  in = g_io_stream_get_input_stream (input->connection);

  res = g_input_stream_read (in, buffer, sizeof (buffer), NULL((void*)0), NULL((void*)0));
  if (res <= 0)
    return NULL((void*)0);
  g_byte_array_append (input->buffer, buffer, res);

  parse_input (input);

  /* Since we're parsing input but not processing the resulting messages
     we might not get a readable callback on the stream, so queue an idle to
     process the messages */
  queue_process_input_at_idle (server);
}
822}
823#endif

825static void *
826map_named_shm (char *name, gsize size)
827{
828#ifdef G_OS_UNIX

int fd;
void *ptr;
char *filename = NULL((void*)0);

fd = shm_open (name, O_RDONLY00, 0600);
if (fd == -1)
  {
    filename = g_build_filename (g_get_tmp_dir (), name, NULL((void*)0));
    fd = open (filename, O_RDONLY00);
    if (fd == -1)
{
 perror ("Failed to map shm");
 g_free (filename);

 return NULL((void*)0);
}
  }

ptr = mmap (0, size, PROT_READ0x1, MAP_SHARED0x01, fd, 0);

(void) close (fd);

if (filename)
  {
    unlink (filename);
    g_free (filename);
  }
else
  shm_unlink (name);

return ptr;

862#elif defined(G_OS_WIN32)

int fd;
void *ptr;
char *shmpath;
void *map = ((void *)-1);

if (*name == '/')
  ++name;
shmpath = g_build_filename (g_get_tmp_dir (), name, NULL((void*)0));

fd = open(shmpath, O_RDONLY00, 0600);
if (fd == -1)
  {
    g_free (shmpath);
    perror ("Failed to shm_open");
    return NULL((void*)0);
  }

if (size == 0)
  ptr = map;
else
  {
    HANDLE h, fm;
    h = (HANDLE)_get_osfhandle (fd);
    fm = CreateFileMapping (h, NULL((void*)0), PAGE_READONLY, 0, (DWORD)size, NULL((void*)0));
    ptr = MapViewOfFile (fm, FILE_MAP_READ, 0, 0, (size_t)size);
    CloseHandle (fm);
  }

(void) close(fd);

remove (shmpath);
g_free (shmpath);

return ptr;

899#else
900#error "No shm mapping supported"

return NULL((void*)0);
903#endif
904}

906static char *
907parse_line (char *line, char *key)
908{
char *p;

if (!g_str_has_prefix (line, key)(__builtin_constant_p (key)? __extension__ ({ const char * const
 __str = (line); const char * const __prefix = (key); gboolean
 __result = (0); if (__str == ((void*)0) || __prefix == ((void
*)0)) __result = (g_str_has_prefix) (__str, __prefix); else {
 const size_t __str_len = strlen (((__str) + !(__str))); const
 size_t __prefix_len = strlen (((__prefix) + !(__prefix))); if
 (__str_len >= __prefix_len) __result = memcmp (((__str) +
 !(__str)), ((__prefix) + !(__prefix)), __prefix_len) == 0; }
 __result; }) : (g_str_has_prefix) (line, key) ))
  return NULL((void*)0);
p = line + strlen (key);
if (*p != ':')
  return NULL((void*)0);
p++;
/* Skip optional initial space */
if (*p == ' ')
  p++;
return p;
921}

923static void
924send_error (HttpRequest *request,
   int error_code,
   const char *reason)
927{
char *res;

res = g_strdup_printf ("HTTP/1.0 %d %s\r\n\r\n"
	 "<html><head><title>%d %s</title></head>"
	 "<body>%s</body></html>",
	 error_code, reason,
	 error_code, reason,
	 reason);

/* TODO: This should really be async */
g_output_stream_write_all (g_io_stream_get_output_stream (request->connection),
                           res, strlen (res), NULL((void*)0), NULL((void*)0), NULL((void*)0));

g_free (res);
http_request_free (request);
943}

945/* magic from: http://tools.ietf.org/html/draft-ietf-hybi-thewebsocketprotocol-17 */
946#define SEC_WEB_SOCKET_KEY_MAGIC"258EAFA5-E914-47DA-95CA-C5AB0DC85B11" "258EAFA5-E914-47DA-95CA-C5AB0DC85B11"

948/* 'x3JJHMbDL1EzLkh9GBhXDw==' generates 'HSmrc0sMlYUkAGmm5OPpG2HaGWk=' */
949static gchar *
950generate_handshake_response_wsietf_v7 (const gchar *key)
951{
gsize digest_len = 20;
guchar digest[20];
GChecksum *checksum;

checksum = g_checksum_new (G_CHECKSUM_SHA1);
if (!checksum)
  return NULL((void*)0);

g_checksum_update (checksum, (guchar *)key, -1);
g_checksum_update (checksum, (guchar *)SEC_WEB_SOCKET_KEY_MAGIC"258EAFA5-E914-47DA-95CA-C5AB0DC85B11", -1);

g_checksum_get_digest (checksum, digest, &digest_len);
g_checksum_free (checksum);

g_assert (digest_len == 20)do { if (digest_len == 20) ; else g_assertion_message_expr ("Cdk"
, "broadway-server.c", 966, ((const char*) (__func__)), "digest_len == 20"
); } while (0);

return g_base64_encode (digest, digest_len);
969}

971static void
972start_input (HttpRequest *request)
973{
char **lines;
char *p;
int i;
char *res;
char *origin, *host;
BroadwayInput *input;
const void *data_buffer;
gsize data_buffer_size;
GInputStream *in;
char *key;
GSocket *socket;
int flag = 1;

987#ifdef DEBUG_WEBSOCKETS
g_print ("incoming request:\n%s\n", request->request->str);
989#endif
lines = g_strsplit (request->request->str, "\n", 0);

key = NULL((void*)0);
origin = NULL((void*)0);
host = NULL((void*)0);
for (i = 0; lines[i] != NULL((void*)0); i++)
  {
    if ((p = parse_line (lines[i], "Sec-WebSocket-Key")))
      key = p;
    else if ((p = parse_line (lines[i], "Origin")))
      origin = p;
    else if ((p = parse_line (lines[i], "Host")))
      host = p;
    else if ((p = parse_line (lines[i], "Sec-WebSocket-Origin")))
      origin = p;
  }

if (host == NULL((void*)0))
  {
    g_strfreev (lines);
    send_error (request, 400, "Bad websocket request");
    return;
  }

if (key != NULL((void*)0))
  {
    char* accept = generate_handshake_response_wsietf_v7 (key);
    res = g_strdup_printf ("HTTP/1.1 101 Switching Protocols\r\n"
	     "Upgrade: websocket\r\n"
	     "Connection: Upgrade\r\n"
	     "Sec-WebSocket-Accept: %s\r\n"
	     "%s%s%s"
	     "Sec-WebSocket-Location: ws://%s/socket\r\n"
	     "Sec-WebSocket-Protocol: broadway\r\n"
	     "\r\n", accept,
	     origin?"Sec-WebSocket-Origin: ":"", origin?origin:"", origin?"\r\n":"",
	     host);
    g_free (accept);

1029#ifdef DEBUG_WEBSOCKETS
    g_print ("v7 proto response:\n%s", res);
1031#endif

    g_output_stream_write_all (g_io_stream_get_output_stream (request->connection),
                               res, strlen (res), NULL((void*)0), NULL((void*)0), NULL((void*)0));
    g_free (res);
  }
else
  {
    g_strfreev (lines);
    send_error (request, 400, "Bad websocket request");
    return;
  }

socket = g_socket_connection_get_socket (request->socket_connection);
setsockopt (g_socket_get_fd (socket), IPPROTO_TCPIPPROTO_TCP,
     TCP_NODELAY1, (char *) &flag, sizeof(int));

input = g_new0 (BroadwayInput, 1)((BroadwayInput *) g_malloc0_n ((1), sizeof (BroadwayInput)));
input->server = request->server;
input->connection = g_object_ref (request->connection)((__typeof__ (request->connection)) (g_object_ref) (request
->connection));

data_buffer = g_buffered_input_stream_peek_buffer (G_BUFFERED_INPUT_STREAM (request->data)((((GBufferedInputStream*) (void *) g_type_check_instance_cast
 ((GTypeInstance*) ((request->data)), ((g_buffered_input_stream_get_type
 ())))))), &data_buffer_size);
input->buffer = g_byte_array_sized_new (data_buffer_size);
g_byte_array_append (input->buffer, data_buffer, data_buffer_size);

input->output =
  broadway_output_new (g_io_stream_get_output_stream (request->connection), 0);

/* This will free and close the data input stream, but we got all the buffered content already */
http_request_free (request);

in = g_io_stream_get_input_stream (input->connection);

input->source = g_pollable_input_stream_create_source (G_POLLABLE_INPUT_STREAM (in)((((GPollableInputStream*) (void *) g_type_check_instance_cast
 ((GTypeInstance*) ((in)), ((g_pollable_input_stream_get_type
 ())))))), NULL((void*)0));
g_source_set_callback (input->source, (GSourceFunc)input_data_cb, input, NULL((void*)0));
g_source_attach (input->source, NULL((void*)0));

start (input);

/* Process any data in the pipe already */
parse_input (input);

g_strfreev (lines);
1074}

1076static void
1077start (BroadwayInput *input)
1078{
BroadwayServer *server;

input->active = TRUE(!(0));

server = BROADWAY_SERVER (input->server)((((BroadwayServer*) (void *) g_type_check_instance_cast ((GTypeInstance
*) ((input->server)), ((broadway_server_get_type()))))));

if (server->output)
  {
    broadway_output_disconnected (server->output);
    broadway_output_flush (server->output);
  }

if (server->input != NULL((void*)0))
  {
    broadway_input_free (server->input);
    server->input = NULL((void*)0);
  }

server->input = input;

if (server->output)
  {
    server->saved_serial = broadway_output_get_next_serial (server->output);
    broadway_output_free (server->output);
  }
server->output = input->output;

broadway_output_set_next_serial (server->output, server->saved_serial);
broadway_output_flush (server->output);

broadway_server_resync_windows (server);

if (server->pointer_grab_window_id != -1)
  broadway_output_grab_pointer (server->output,
		  server->pointer_grab_window_id,
		  server->pointer_grab_owner_events);

process_input_messages (server);
1117}

1119static void
1120send_data (HttpRequest *request,
    const char *mimetype,
    const char *data, gsize len)
1123{
char *res;

res = g_strdup_printf ("HTTP/1.0 200 OK\r\n"
	 "Content-Type: %s\r\n"
	 "Content-Length: %"G_GSIZE_FORMAT"lu""\r\n"
	 "\r\n",
	 mimetype, len);

/* TODO: This should really be async */
g_output_stream_write_all (g_io_stream_get_output_stream (request->connection),
	     res, strlen (res), NULL((void*)0), NULL((void*)0), NULL((void*)0));
g_free (res);
g_output_stream_write_all (g_io_stream_get_output_stream (request->connection),
	     data, len, NULL((void*)0), NULL((void*)0), NULL((void*)0));
http_request_free (request);
1139}

1141#include "clienthtml.h"
1142#include "broadwayjs.h"

1144static void
1145got_request (HttpRequest *request)
1146{
char *start, *escaped, *tmp, *version, *query;

if (!g_str_has_prefix (request->request->str, "GET ")(__builtin_constant_p ("GET ")? __extension__ ({ const char *
 const __str = (request->request->str); const char * const
 __prefix = ("GET "); gboolean __result = (0); if (__str == (
(void*)0) || __prefix == ((void*)0)) __result = (g_str_has_prefix
) (__str, __prefix); else { const size_t __str_len = strlen (
((__str) + !(__str))); const size_t __prefix_len = strlen (((
__prefix) + !(__prefix))); if (__str_len >= __prefix_len) __result
 = memcmp (((__str) + !(__str)), ((__prefix) + !(__prefix)), __prefix_len
) == 0; } __result; }) : (g_str_has_prefix) (request->request
->str, "GET ") ))
  {
    send_error (request, 501, "Only GET implemented");
    return;
  }

start = request->request->str + 4; /* Skip "GET " */

while (*start == ' ')
  start++;

for (tmp = start; *tmp != 0 && *tmp != ' ' && *tmp != '\n'; tmp++)
  ;
escaped = g_strndup (start, tmp - start);
version = NULL((void*)0);
if (*tmp == ' ')
  {
    start = tmp;
    while (*start == ' ')
start++;
    for (tmp = start; *tmp != 0 && *tmp != ' ' && *tmp != '\n'; tmp++)
;
    version = g_strndup (start, tmp - start);
  }

query = strchr (escaped, '?');
if (query)
  *query = 0;

if (strcmp (escaped, "/client.html") == 0 || strcmp (escaped, "/") == 0)
  send_data (request, "text/html", client_html, G_N_ELEMENTS(client_html)(sizeof (client_html) / sizeof ((client_html)[0])) - 1);
else if (strcmp (escaped, "/broadway.js") == 0)
  send_data (request, "text/javascript", broadway_js, G_N_ELEMENTS(broadway_js)(sizeof (broadway_js) / sizeof ((broadway_js)[0])) - 1);
else if (strcmp (escaped, "/socket") == 0)
  start_input (request);
else
  send_error (request, 404, "File not found");

g_free (escaped);
g_free (version);
1189}

1191static void
1192got_http_request_line (GInputStream *stream,
       GAsyncResult *result,
       HttpRequest *request)
1195{
char *line;

line = g_data_input_stream_read_line_finish (G_DATA_INPUT_STREAM (stream)((((GDataInputStream*) (void *) g_type_check_instance_cast ((
GTypeInstance*) ((stream)), ((g_data_input_stream_get_type ()
)))))), result, NULL((void*)0), NULL((void*)0));
if (line == NULL((void*)0))
  {
    http_request_free (request);
    g_printerr ("Error reading request lines\n");
    return;
  }
if (strlen (line) == 0)
  got_request (request);
else
  {
    /* Protect against overflow in request length */
    if (request->request->len > 1024 * 5)
{
 send_error (request, 400, "Request too long");
}
    else
{
 g_string_append_printf (request->request, "%s\n", line);
 g_data_input_stream_read_line_async (request->data, 0, NULL((void*)0),
			       (GAsyncReadyCallback)got_http_request_line, request);
}
  }
g_free (line);
1222}

1224static gboolean
1225handle_incoming_connection (GSocketService    *service G_GNUC_UNUSED__attribute__ ((__unused__)),
	    GSocketConnection *connection,
	    GObject           *source_object)
1228{
HttpRequest *request;
GInputStream *in;

request = g_new0 (HttpRequest, 1)((HttpRequest *) g_malloc0_n ((1), sizeof (HttpRequest)));
request->socket_connection = g_object_ref (connection)((__typeof__ (connection)) (g_object_ref) (connection));
request->server = BROADWAY_SERVER (source_object)((((BroadwayServer*) (void *) g_type_check_instance_cast ((GTypeInstance
*) ((source_object)), ((broadway_server_get_type()))))));
request->request = g_string_new ("");

if (request->server->ssl_cert && request->server->ssl_key)
  {
    GError *error = NULL((void*)0);
    GTlsCertificate *certificate;

    certificate = g_tls_certificate_new_from_files (request->server->ssl_cert,
                                                    request->server->ssl_key,
                                                    &error);
    if (!certificate)
      {
        g_warning ("Cannot create TLS certificate: %s", error->message);
        g_error_free (error);
        return FALSE(0);
      }

    request->connection = g_tls_server_connection_new (G_IO_STREAM (connection)((((GIOStream*) (void *) g_type_check_instance_cast ((GTypeInstance
*) ((connection)), ((g_io_stream_get_type ())))))),
                                                       certificate,
                                                       &error);
    if (!request->connection)
      {
        g_warning ("Cannot create TLS connection: %s", error->message);
        g_error_free (error);
        return FALSE(0);
      }

    if (!g_tls_connection_handshake (G_TLS_CONNECTION (request->connection)((((GTlsConnection*) (void *) g_type_check_instance_cast ((GTypeInstance
*) ((request->connection)), ((g_tls_connection_get_type ()
)))))),
                                     NULL((void*)0), &error))
      {
        g_warning ("Cannot create TLS connection: %s", error->message);
        g_error_free (error);
        return FALSE(0);
      }
  }
else
  {
    request->connection = G_IO_STREAM (g_object_ref (connection))((((GIOStream*) (void *) g_type_check_instance_cast ((GTypeInstance
*) ((((__typeof__ (connection)) (g_object_ref) (connection)))
), ((g_io_stream_get_type ()))))));
  }

in = g_io_stream_get_input_stream (request->connection);

request->data = g_data_input_stream_new (in);
g_filter_input_stream_set_close_base_stream (G_FILTER_INPUT_STREAM (request->data)((((GFilterInputStream*) (void *) g_type_check_instance_cast (
(GTypeInstance*) ((request->data)), ((g_filter_input_stream_get_type
 ())))))), FALSE(0));
/* Be tolerant of input */
g_data_input_stream_set_newline_type (request->data, G_DATA_STREAM_NEWLINE_TYPE_ANY);

g_data_input_stream_read_line_async (request->data, 0, NULL((void*)0),
		       (GAsyncReadyCallback)got_http_request_line, request);
return TRUE(!(0));
1285}

1287BroadwayServer *
1288broadway_server_new (char        *address,
                   int          port,
                   const char  *ssl_cert,
                   const char  *ssl_key,
                   GError     **error)
1293{
BroadwayServer *server;

server = g_object_new (BROADWAY_TYPE_SERVER(broadway_server_get_type()), NULL((void*)0));
server->port = port;
server->address = g_strdup (address)g_strdup_inline (address);
server->ssl_cert = g_strdup (ssl_cert)g_strdup_inline (ssl_cert);
server->ssl_key = g_strdup (ssl_key)g_strdup_inline (ssl_key);

if (address == NULL((void*)0))
  {
    if (!g_socket_listener_add_inet_port (G_SOCKET_LISTENER (server->service)((((GSocketListener*) (void *) g_type_check_instance_cast ((GTypeInstance
*) ((server->service)), ((g_socket_listener_get_type ())))
))),
			    server->port,
			    G_OBJECT (server)((((GObject*) (void *) g_type_check_instance_cast ((GTypeInstance
*) ((server)), (((GType) ((20) << (2)))))))),
			    error))
{
 g_prefix_error (error, "Unable to listen to port %d: ", server->port);
 g_object_unref (server);
 return NULL((void*)0);
}
  }
else
  {
    GInetAddress *inet_address;
    GSocketAddress *socket_address;

    inet_address = g_inet_address_new_from_string (address);
    if (inet_address == NULL((void*)0))
{
 g_set_error (error, G_IO_ERRORg_io_error_quark(), G_IO_ERROR_INVALID_DATA, "Invalid ip address %s: ", address);
 g_object_unref (server);
 return NULL((void*)0);
}
    socket_address = g_inet_socket_address_new (inet_address, port);
    g_object_unref (inet_address);
    if (!g_socket_listener_add_address (G_SOCKET_LISTENER (server->service)((((GSocketListener*) (void *) g_type_check_instance_cast ((GTypeInstance
*) ((server->service)), ((g_socket_listener_get_type ())))
))),
			  socket_address,
			  G_SOCKET_TYPE_STREAM,
			  G_SOCKET_PROTOCOL_TCP,
			  G_OBJECT (server)((((GObject*) (void *) g_type_check_instance_cast ((GTypeInstance
*) ((server)), (((GType) ((20) << (2)))))))),
			  NULL((void*)0),
			  error))
{
 g_prefix_error (error, "Unable to listen to %s:%d: ", server->address, server->port);
 g_object_unref (socket_address);
 g_object_unref (server);
 return NULL((void*)0);
}
    g_object_unref (socket_address);
  }

g_signal_connect (server->service, "incoming",g_signal_connect_data ((server->service), ("incoming"), ((
(GCallback) (handle_incoming_connection))), (((void*)0)), ((void
*)0), (GConnectFlags) 0)
    G_CALLBACK (handle_incoming_connection), NULL)g_signal_connect_data ((server->service), ("incoming"), ((
(GCallback) (handle_incoming_connection))), (((void*)0)), ((void
*)0), (GConnectFlags) 0);
return server;
1347}

1349BroadwayServer *
1350broadway_server_on_unix_socket_new (char *address, GError **error)
1351{
BroadwayServer *server;
GSocketAddress *socket_address = NULL((void*)0);

server = g_object_new (BROADWAY_TYPE_SERVER(broadway_server_get_type()), NULL((void*)0));
server->port = -1;
server->address = g_strdup (address)g_strdup_inline (address);

if (address == NULL((void*)0))
  {
    g_set_error (error, G_IO_ERRORg_io_error_quark(), G_IO_ERROR_INVALID_DATA, "Unspecified unix domain socket address");
    g_object_unref (server);
    return NULL((void*)0);
  }
else
  {
1367#ifdef HAVE_GIO_UNIX1
    socket_address = g_unix_socket_address_new (address);
1369#endif
    if (socket_address == NULL((void*)0))
{
 g_set_error (error, G_IO_ERRORg_io_error_quark(), G_IO_ERROR_INVALID_DATA, "Invalid unix domain socket address %s: ", address);
 g_object_unref (server);
 return NULL((void*)0);
}
    if (!g_socket_listener_add_address (G_SOCKET_LISTENER (server->service)((((GSocketListener*) (void *) g_type_check_instance_cast ((GTypeInstance
*) ((server->service)), ((g_socket_listener_get_type ())))
))),
			  socket_address,
			  G_SOCKET_TYPE_STREAM,
			  G_SOCKET_PROTOCOL_DEFAULT,
			  G_OBJECT (server)((((GObject*) (void *) g_type_check_instance_cast ((GTypeInstance
*) ((server)), (((GType) ((20) << (2)))))))),
			  NULL((void*)0),
			  error))
{
 g_prefix_error (error, "Unable to listen to %s: ", server->address);
 g_object_unref (socket_address);
 g_object_unref (server);
 return NULL((void*)0);
}
    g_object_unref (socket_address);
  }

g_signal_connect (server->service, "incoming",g_signal_connect_data ((server->service), ("incoming"), ((
(GCallback) (handle_incoming_connection))), (((void*)0)), ((void
*)0), (GConnectFlags) 0)
    G_CALLBACK (handle_incoming_connection), NULL)g_signal_connect_data ((server->service), ("incoming"), ((
(GCallback) (handle_incoming_connection))), (((void*)0)), ((void
*)0), (GConnectFlags) 0);
return server;
1395}

1397guint32
1398broadway_server_get_last_seen_time (BroadwayServer *server)
1399{
broadway_server_consume_all_input (server);
return (guint32) server->last_seen_time;
1402}

1404void
1405broadway_server_query_mouse (BroadwayServer *server,
	     guint32            *toplevel,
	     gint32             *root_x,
	     gint32             *root_y,
	     guint32            *mask)
1410{
if (server->output)
1
Assuming field 'output' is non-null→
2
←
Taking true branch→
  {
    broadway_server_consume_all_input (server);
3
←
Calling 'broadway_server_consume_all_input'→
    if (root_x)
*root_x = server->future_root_x;
    if (root_y)
*root_y = server->future_root_y;
    if (mask)
*mask = server->future_state;
    if (toplevel)
*toplevel = server->future_mouse_in_toplevel;
    return;
  }

/* Fallback when unconnected */
if (root_x)
  *root_x = server->last_x;
if (root_y)
  *root_y = server->last_y;
if (mask)
  *mask = server->last_state;
if (toplevel)
  *toplevel = server->mouse_in_toplevel_id;
1434}

1436void
1437broadway_server_destroy_window (BroadwayServer *server,
		gint id)
1439{
BroadwayWindow *window;

if (server->mouse_in_toplevel_id == id)
  {
    /* TODO: Send leave + enter event, update cursors, etc */
    server->mouse_in_toplevel_id = 0;
  }

if (server->pointer_grab_window_id == id)
  server->pointer_grab_window_id = -1;

if (server->output)
  broadway_output_destroy_surface (server->output,
		     id);

window = g_hash_table_lookup (server->id_ht,
		GINT_TO_POINTER (id)((gpointer) (glong) (id)));
if (window != NULL((void*)0))
  {
    server->toplevels = g_list_remove (server->toplevels, window);
    g_hash_table_remove (server->id_ht,
	   GINT_TO_POINTER (id)((gpointer) (glong) (id)));

    g_free (window->cached_surface_name);
    if (window->cached_surface != NULL((void*)0))
cairo_surface_destroy (window->cached_surface);

    g_free (window);
  }
1469}

1471gboolean
1472broadway_server_window_show (BroadwayServer *server,
	     gint id)
1474{
BroadwayWindow *window;
gboolean sent = FALSE(0);

window = g_hash_table_lookup (server->id_ht,
		GINT_TO_POINTER (id)((gpointer) (glong) (id)));
if (window == NULL((void*)0))
  return FALSE(0);

window->visible = TRUE(!(0));

if (server->output)
  {
    broadway_output_show_surface (server->output, window->id);
    sent = TRUE(!(0));
  }

return sent;
1492}

1494gboolean
1495broadway_server_window_hide (BroadwayServer *server,
	     gint id)
1497{
BroadwayWindow *window;
gboolean sent = FALSE(0);

window = g_hash_table_lookup (server->id_ht,
		GINT_TO_POINTER (id)((gpointer) (glong) (id)));
if (window == NULL((void*)0))
  return FALSE(0);

window->visible = FALSE(0);

if (server->mouse_in_toplevel_id == id)
  {
    /* TODO: Send leave + enter event, update cursors, etc */
    server->mouse_in_toplevel_id = 0;
  }

if (server->pointer_grab_window_id == id)
  server->pointer_grab_window_id = -1;

if (server->output)
  {
    broadway_output_hide_surface (server->output, window->id);
    sent = TRUE(!(0));
  }
return sent;
1523}

1525void
1526broadway_server_window_raise (BroadwayServer *server,
                            gint id)
1528{
BroadwayWindow *window;

window = g_hash_table_lookup (server->id_ht,
		GINT_TO_POINTER (id)((gpointer) (glong) (id)));
if (window == NULL((void*)0))
  return;

server->toplevels = g_list_remove (server->toplevels, window);
server->toplevels = g_list_append (server->toplevels, window);

if (server->output)
  broadway_output_raise_surface (server->output, window->id);
1541}

1543void
1544broadway_server_set_show_keyboard (BroadwayServer *server,
                                 gboolean show)
1546{
server->show_keyboard = show;

if (server->output)
  {
    broadway_output_set_show_keyboard (server->output, server->show_keyboard);
    broadway_server_flush (server);
 }
1554}

1556void
1557broadway_server_window_lower (BroadwayServer *server,
                            gint id)
1559{
BroadwayWindow *window;

window = g_hash_table_lookup (server->id_ht,
		GINT_TO_POINTER (id)((gpointer) (glong) (id)));
if (window == NULL((void*)0))
  return;

server->toplevels = g_list_remove (server->toplevels, window);
server->toplevels = g_list_prepend (server->toplevels, window);

if (server->output)
  broadway_output_lower_surface (server->output, window->id);
1572}

1574void
1575broadway_server_window_set_transient_for (BroadwayServer *server,
			  gint id, gint parent)
1577{
BroadwayWindow *window;

window = g_hash_table_lookup (server->id_ht,
		GINT_TO_POINTER (id)((gpointer) (glong) (id)));
if (window == NULL((void*)0))
  return;

window->transient_for = parent;

if (server->output)
  {
    broadway_output_set_transient_for (server->output, window->id, window->transient_for);
    broadway_server_flush (server);
  }
1592}

1594gboolean
1595broadway_server_has_client (BroadwayServer *server)
1596{
return server->output != NULL((void*)0);
1598}

1600void
1601broadway_server_window_update (BroadwayServer *server,
	       gint id,
	       cairo_surface_t *surface)
1604{
BroadwayWindow *window;
BroadwayBuffer *buffer;

if (surface == NULL((void*)0))
  return;

window = g_hash_table_lookup (server->id_ht,
		GINT_TO_POINTER (id)((gpointer) (glong) (id)));
if (window == NULL((void*)0))
  return;

g_assert (window->width == cairo_image_surface_get_width (surface))do { if (window->width == cairo_image_surface_get_width (surface
)) ; else g_assertion_message_expr ("Cdk", "broadway-server.c"
, 1616, ((const char*) (__func__)), "window->width == cairo_image_surface_get_width (surface)"
); } while (0);
g_assert (window->height == cairo_image_surface_get_height (surface))do { if (window->height == cairo_image_surface_get_height (
surface)) ; else g_assertion_message_expr ("Cdk", "broadway-server.c"
, 1617, ((const char*) (__func__)), "window->height == cairo_image_surface_get_height (surface)"
); } while (0);

buffer = broadway_buffer_create (window->width, window->height,
                                 cairo_image_surface_get_data (surface),
                                 cairo_image_surface_get_stride (surface));

if (server->output != NULL((void*)0))
  {
    window->buffer_synced = TRUE(!(0));
    broadway_output_put_buffer (server->output, window->id,
                                window->buffer, buffer);
  }

if (window->buffer)
  broadway_buffer_destroy (window->buffer);

window->buffer = buffer;
1634}

1636gboolean
1637broadway_server_window_move_resize (BroadwayServer *server,
		    gint id,
		    gboolean with_move,
		    int x,
		    int y,
		    int width,
		    int height)
1644{
BroadwayWindow *window;
gboolean with_resize;
gboolean sent = FALSE(0);

window = g_hash_table_lookup (server->id_ht,
		GINT_TO_POINTER (id)((gpointer) (glong) (id)));
if (window == NULL((void*)0))
  return FALSE(0);

with_resize = width != window->width || height != window->height;
window->width = width;
window->height = height;

if (server->output != NULL((void*)0))
  {
    broadway_output_move_resize_surface (server->output,
			   window->id,
			   with_move, x, y,
			   with_resize, window->width, window->height);
    sent = TRUE(!(0));
  }
else
  {
    if (with_move)
{
 window->x = x;
 window->y = y;
}

    fake_configure_notify (server, window);
  }

return sent;
1678}

1680void
1681broadway_server_focus_window (BroadwayServer *server,
                            gint new_focused_window)
1683{
BroadwayInputMsg focus_msg;

if (server->focused_window_id == new_focused_window)
  return;

memset (&focus_msg, 0, sizeof (focus_msg));
focus_msg.base.type = BROADWAY_EVENT_FOCUS;
focus_msg.base.time = broadway_server_get_last_seen_time (server);
focus_msg.focus.old_id = server->focused_window_id;
focus_msg.focus.new_id = new_focused_window;

broadway_events_got_input (&focus_msg, -1);

/* Keep track of the new focused window */
server->focused_window_id = new_focused_window;
1699}

1701guint32
1702broadway_server_grab_pointer (BroadwayServer *server,
	      gint            client_id,
	      gint            id,
	      gboolean        owner_events,
	      guint32         event_mask G_GNUC_UNUSED__attribute__ ((__unused__)),
	      guint32         time_)
1708{
if (server->pointer_grab_window_id != -1 &&
    time_ != 0 && server->pointer_grab_time > time_)
  return CDK_GRAB_ALREADY_GRABBED;

if (time_ == 0)
  time_ = server->last_seen_time;

server->pointer_grab_window_id = id;
server->pointer_grab_client_id = client_id;
server->pointer_grab_owner_events = owner_events;
server->pointer_grab_time = time_;

if (server->output)
  {
    broadway_output_grab_pointer (server->output,
		    id,
		    owner_events);
    broadway_server_flush (server);
  }

/* TODO: What about toplevel grab events if we're not connected? */

return CDK_GRAB_SUCCESS;
1732}

1734guint32
1735broadway_server_ungrab_pointer (BroadwayServer *server,
		guint32    time_)
1737{
guint32 serial;

if (server->pointer_grab_window_id != -1 &&
    time_ != 0 && server->pointer_grab_time > time_)
  return 0;

/* TODO: What about toplevel grab events if we're not connected? */

if (server->output)
  {
    serial = broadway_output_ungrab_pointer (server->output);
    broadway_server_flush (server);
  }
else
  {
    serial = server->saved_serial;
  }

server->pointer_grab_window_id = -1;

return serial;
1759}

1761static const cairo_user_data_key_t shm_cairo_key;

1763typedef struct {
void *data;
gsize data_size;
1766} ShmSurfaceData;

1768static void
1769shm_data_unmap (void *_data)
1770{
ShmSurfaceData *data = _data;
1772#ifdef G_OS_UNIX
munmap (data->data, data->data_size);
1774#elif defined(G_OS_WIN32)
UnmapViewOfFile (data->data);
1776#endif
g_free (data);
1778}

1780cairo_surface_t *
1781broadway_server_open_surface (BroadwayServer *server,
	      guint32 id,
	      char *name,
	      int width,
	      int height)
1786{
BroadwayWindow *window;
ShmSurfaceData *data;
cairo_surface_t *surface;
gsize size;
void *ptr;

window = g_hash_table_lookup (server->id_ht,
		GINT_TO_POINTER (id)((gpointer) (glong) (id)));
if (window == NULL((void*)0))
  return NULL((void*)0);

if (window->cached_surface_name != NULL((void*)0) &&
    strcmp (name, window->cached_surface_name) == 0)
  return cairo_surface_reference (window->cached_surface);

size = width * height * sizeof (guint32);

ptr = map_named_shm (name, size);

if (ptr == NULL((void*)0))
  return NULL((void*)0);

data = g_new0 (ShmSurfaceData, 1)((ShmSurfaceData *) g_malloc0_n ((1), sizeof (ShmSurfaceData)
));

data->data = ptr;
data->data_size = size;

surface = cairo_image_surface_create_for_data ((guchar *)data->data,
				 CAIRO_FORMAT_ARGB32,
				 width, height,
				 width * sizeof (guint32));
g_assert (surface != NULL)do { if (surface != ((void*)0)) ; else g_assertion_message_expr
 ("Cdk", "broadway-server.c", 1818, ((const char*) (__func__)
), "surface != NULL"); } while (0);

cairo_surface_set_user_data (surface, &shm_cairo_key,
	       data, shm_data_unmap);

g_free (window->cached_surface_name);
window->cached_surface_name = g_strdup (name)g_strdup_inline (name);

if (window->cached_surface != NULL((void*)0))
  cairo_surface_destroy (window->cached_surface);
window->cached_surface = cairo_surface_reference (surface);

return surface;
1831}

1833guint32
1834broadway_server_new_window (BroadwayServer *server,
	    int x,
	    int y,
	    int width,
	    int height,
	    gboolean is_temp)
1840{
BroadwayWindow *window;

window = g_new0 (BroadwayWindow, 1)((BroadwayWindow *) g_malloc0_n ((1), sizeof (BroadwayWindow)
));
window->id = server->id_counter++;
window->x = x;
window->y = y;
if (x == 0 && y == 0 && !is_temp)
  {
    /* TODO: Better way to know if we should pick default pos */
    window->x = 100;
    window->y = 100;
  }
window->width = width;
window->height = height;
window->is_temp = is_temp;

g_hash_table_insert (server->id_ht,
       GINT_TO_POINTER (window->id)((gpointer) (glong) (window->id)),
       window);

server->toplevels = g_list_append (server->toplevels, window);

if (server->output)
  broadway_output_new_surface (server->output,
		 window->id,
		 window->x,
		 window->y,
		 window->width,
		 window->height,
		 window->is_temp);
else
  fake_configure_notify (server, window);

return window->id;
1875}

1877static void
1878broadway_server_resync_windows (BroadwayServer *server)
1879{
GList *l;

if (server->output == NULL((void*)0))
  return;

/* First create all windows */
for (l = server->toplevels; l != NULL((void*)0); l = l->next)
  {
    BroadwayWindow *window = l->data;

    if (window->id == 0)
continue; /* Skip root */

    window->buffer_synced = FALSE(0);
    broadway_output_new_surface (server->output,
		   window->id,
		   window->x,
		   window->y,
		   window->width,
		   window->height,
		   window->is_temp);
  }

/* Then do everything that may reference other windows */
for (l = server->toplevels; l != NULL((void*)0); l = l->next)
  {
    BroadwayWindow *window = l->data;

    if (window->id == 0)
continue; /* Skip root */

    if (window->transient_for != -1)
broadway_output_set_transient_for (server->output, window->id, window->transient_for);
    if (window->visible)
{
 broadway_output_show_surface (server->output, window->id);

 if (window->buffer != NULL((void*)0))
   {
     window->buffer_synced = TRUE(!(0));
            broadway_output_put_buffer (server->output, window->id,
                                        NULL((void*)0), window->buffer);
   }
}
  }

if (server->show_keyboard)
  broadway_output_set_show_keyboard (server->output, TRUE(!(0)));

broadway_server_flush (server);
1930}