1 /* $NetBSD: utf8.c,v 1.9 2020/05/28 17:05:49 christos Exp $ */
2 /* $OpenBSD: utf8.c,v 1.11 2020/05/01 06:28:52 djm Exp $ */
3 /*
4 * Copyright (c) 2016 Ingo Schwarze <schwarze@openbsd.org>
5 *
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19 #include "includes.h"
20 __RCSID("$NetBSD: utf8.c,v 1.9 2020/05/28 17:05:49 christos Exp $");
21 /*
22 * Utility functions for multibyte-character handling,
23 * in particular to sanitize untrusted strings for terminal output.
24 */
25
26 #include <sys/types.h>
27 #include <langinfo.h>
28 #include <limits.h>
29 #include <stdarg.h>
30 #include <stdio.h>
31 #include <stdlib.h>
32 #include <string.h>
33 #include <vis.h>
34 #include <wchar.h>
35
36 #include "utf8.h"
37
38 static int dangerous_locale(void);
39 static int grow_dst(char **, size_t *, size_t, char **, size_t);
40
41
42 /*
43 * For US-ASCII and UTF-8 encodings, we can safely recover from
44 * encoding errors and from non-printable characters. For any
45 * other encodings, err to the side of caution and abort parsing:
46 * For state-dependent encodings, recovery is impossible.
47 * For arbitrary encodings, replacement of non-printable
48 * characters would be non-trivial and too fragile.
49 * The comments indicate what nl_langinfo(CODESET)
50 * returns for US-ASCII on various operating systems.
51 */
52
53 static int
dangerous_locale(void)54 dangerous_locale(void) {
55 char *loc;
56
57 loc = nl_langinfo(CODESET);
58 return strcmp(loc, "UTF-8") != 0 &&
59 strcmp(loc, "US-ASCII") != 0 && /* OpenBSD */
60 strcmp(loc, "ANSI_X3.4-1968") != 0 && /* Linux */
61 strcmp(loc, "ISO8859-1") != 0 && /* AIX */
62 strcmp(loc, "646") != 0 && /* Solaris, NetBSD */
63 strcmp(loc, "") != 0; /* Solaris 6 */
64 }
65
66 static int
grow_dst(char ** dst,size_t * sz,size_t maxsz,char ** dp,size_t need)67 grow_dst(char **dst, size_t *sz, size_t maxsz, char **dp, size_t need)
68 {
69 char *tp;
70 size_t tsz;
71
72 if (*dp + need < *dst + *sz)
73 return 0;
74 tsz = *sz + 128;
75 if (tsz > maxsz)
76 tsz = maxsz;
77 if ((tp = recallocarray(*dst, *sz, tsz, 1)) == NULL)
78 return -1;
79 *dp = tp + (*dp - *dst);
80 *dst = tp;
81 *sz = tsz;
82 return 0;
83 }
84
85 /*
86 * The following two functions limit the number of bytes written,
87 * including the terminating '\0', to sz. Unless wp is NULL,
88 * they limit the number of display columns occupied to *wp.
89 * Whichever is reached first terminates the output string.
90 * To stay close to the standard interfaces, they return the number of
91 * non-NUL bytes that would have been written if both were unlimited.
92 * If wp is NULL, newline, carriage return, and tab are allowed;
93 * otherwise, the actual number of columns occupied by what was
94 * written is returned in *wp.
95 */
96
97 int
vasnmprintf(char ** str,size_t maxsz,int * wp,const char * fmt,va_list ap)98 vasnmprintf(char **str, size_t maxsz, int *wp, const char *fmt, va_list ap)
99 {
100 char *src; /* Source string returned from vasprintf. */
101 char *sp; /* Pointer into src. */
102 char *dst; /* Destination string to be returned. */
103 char *dp; /* Pointer into dst. */
104 char *tp; /* Temporary pointer for dst. */
105 size_t sz; /* Number of bytes allocated for dst. */
106 wchar_t wc; /* Wide character at sp. */
107 int len; /* Number of bytes in the character at sp. */
108 int ret; /* Number of bytes needed to format src. */
109 int width; /* Display width of the character wc. */
110 int total_width, max_width, print;
111
112 src = NULL;
113 if ((ret = vasprintf(&src, fmt, ap)) <= 0)
114 goto fail;
115
116 sz = strlen(src) + 1;
117 if ((dst = malloc(sz)) == NULL) {
118 free(src);
119 ret = -1;
120 goto fail;
121 }
122
123 if (maxsz > INT_MAX)
124 maxsz = INT_MAX;
125
126 sp = src;
127 dp = dst;
128 ret = 0;
129 print = 1;
130 total_width = 0;
131 max_width = wp == NULL ? INT_MAX : *wp;
132 while (*sp != '\0') {
133 if ((len = mbtowc(&wc, sp, MB_CUR_MAX)) == -1) {
134 (void)mbtowc(NULL, NULL, MB_CUR_MAX);
135 if (dangerous_locale()) {
136 ret = -1;
137 break;
138 }
139 len = 1;
140 width = -1;
141 } else if (wp == NULL &&
142 (wc == L'\n' || wc == L'\r' || wc == L'\t')) {
143 /*
144 * Don't use width uninitialized; the actual
145 * value doesn't matter because total_width
146 * is only returned for wp != NULL.
147 */
148 width = 0;
149 } else if ((width = wcwidth(wc)) == -1 &&
150 dangerous_locale()) {
151 ret = -1;
152 break;
153 }
154
155 /* Valid, printable character. */
156
157 if (width >= 0) {
158 if (print && (dp - dst >= (int)maxsz - len ||
159 total_width > max_width - width))
160 print = 0;
161 if (print) {
162 if (grow_dst(&dst, &sz, maxsz,
163 &dp, len) == -1) {
164 ret = -1;
165 break;
166 }
167 total_width += width;
168 memcpy(dp, sp, len);
169 dp += len;
170 }
171 sp += len;
172 if (ret >= 0)
173 ret += len;
174 continue;
175 }
176
177 /* Escaping required. */
178
179 while (len > 0) {
180 if (print && (dp - dst >= (int)maxsz - 4 ||
181 total_width > max_width - 4))
182 print = 0;
183 if (print) {
184 if (grow_dst(&dst, &sz, maxsz,
185 &dp, 4) == -1) {
186 ret = -1;
187 break;
188 }
189 #ifndef VIS_ALL
190 #define VIS_ALL VIS_WHITE /* XXX */
191 #endif
192 tp = vis(dp, *sp, VIS_OCTAL | VIS_ALL, 0);
193 width = tp - dp;
194 total_width += width;
195 dp = tp;
196 } else
197 width = 4;
198 len--;
199 sp++;
200 if (ret >= 0)
201 ret += width;
202 }
203 if (len > 0)
204 break;
205 }
206 free(src);
207 *dp = '\0';
208 *str = dst;
209 if (wp != NULL)
210 *wp = total_width;
211
212 /*
213 * If the string was truncated by the width limit but
214 * would have fit into the size limit, the only sane way
215 * to report the problem is using the return value, such
216 * that the usual idiom "if (ret < 0 || ret >= sz) error"
217 * works as expected.
218 */
219
220 if (ret < (int)maxsz && !print)
221 ret = -1;
222 return ret;
223
224 fail:
225 if (wp != NULL)
226 *wp = 0;
227 if (ret == 0) {
228 *str = src;
229 return 0;
230 } else {
231 *str = NULL;
232 return -1;
233 }
234 }
235
236 int
snmprintf(char * str,size_t sz,int * wp,const char * fmt,...)237 snmprintf(char *str, size_t sz, int *wp, const char *fmt, ...)
238 {
239 va_list ap;
240 char *cp = NULL;
241 int ret;
242
243 va_start(ap, fmt);
244 ret = vasnmprintf(&cp, sz, wp, fmt, ap);
245 va_end(ap);
246 if (cp != NULL) {
247 (void)strlcpy(str, cp, sz);
248 free(cp);
249 } else
250 *str = '\0';
251 return ret;
252 }
253
254 int
asmprintf(char ** outp,size_t sz,int * wp,const char * fmt,...)255 asmprintf(char **outp, size_t sz, int *wp, const char *fmt, ...)
256 {
257 va_list ap;
258 int ret;
259
260 *outp = NULL;
261 va_start(ap, fmt);
262 ret = vasnmprintf(outp, sz, wp, fmt, ap);
263 va_end(ap);
264
265 return ret;
266 }
267
268 /*
269 * To stay close to the standard interfaces, the following functions
270 * return the number of non-NUL bytes written.
271 */
272
273 int
vfmprintf(FILE * stream,const char * fmt,va_list ap)274 vfmprintf(FILE *stream, const char *fmt, va_list ap)
275 {
276 char *str = NULL;
277 int ret;
278
279 if ((ret = vasnmprintf(&str, INT_MAX, NULL, fmt, ap)) < 0) {
280 free(str);
281 return -1;
282 }
283 if (fputs(str, stream) == EOF)
284 ret = -1;
285 free(str);
286 return ret;
287 }
288
289 int
fmprintf(FILE * stream,const char * fmt,...)290 fmprintf(FILE *stream, const char *fmt, ...)
291 {
292 va_list ap;
293 int ret;
294
295 va_start(ap, fmt);
296 ret = vfmprintf(stream, fmt, ap);
297 va_end(ap);
298 return ret;
299 }
300
301 int
mprintf(const char * fmt,...)302 mprintf(const char *fmt, ...)
303 {
304 va_list ap;
305 int ret;
306
307 va_start(ap, fmt);
308 ret = vfmprintf(stdout, fmt, ap);
309 va_end(ap);
310 return ret;
311 }
312