xref: /netbsd-src/crypto/external/bsd/openssh/dist/utf8.c (revision d909946ca08dceb44d7d0f22ec9488679695d976)
1 /*	$NetBSD: utf8.c,v 1.3 2016/08/03 15:24:28 jakllsch Exp $	*/
2 /* $OpenBSD: utf8.c,v 1.3 2016/05/30 12:57:21 schwarze Exp $ */
3 /*
4  * Copyright (c) 2016 Ingo Schwarze <schwarze@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 #include "includes.h"
20 __RCSID("$NetBSD: utf8.c,v 1.3 2016/08/03 15:24:28 jakllsch Exp $");
21 /*
22  * Utility functions for multibyte-character handling,
23  * in particular to sanitize untrusted strings for terminal output.
24  */
25 
26 #include <sys/types.h>
27 #include <langinfo.h>
28 #include <limits.h>
29 #include <stdarg.h>
30 #include <stdio.h>
31 #include <stdlib.h>
32 #include <string.h>
33 #include <vis.h>
34 #include <wchar.h>
35 
36 #include "utf8.h"
37 
38 static int	 dangerous_locale(void);
39 static int	 grow_dst(char **, size_t *, size_t, char **, size_t);
40 static int	 vasnmprintf(char **, size_t, int *, const char *, va_list)
41 		     __attribute__((format(printf, 4, 0)));
42 
43 
44 /*
45  * For US-ASCII and UTF-8 encodings, we can safely recover from
46  * encoding errors and from non-printable characters.  For any
47  * other encodings, err to the side of caution and abort parsing:
48  * For state-dependent encodings, recovery is impossible.
49  * For arbitrary encodings, replacement of non-printable
50  * characters would be non-trivial and too fragile.
51  */
52 
53 static int
54 dangerous_locale(void) {
55 	char	*loc;
56 
57 	loc = nl_langinfo(CODESET);
58 	return strcmp(loc, "US-ASCII") && strcmp(loc, "UTF-8");
59 }
60 
61 static int
62 grow_dst(char **dst, size_t *sz, size_t maxsz, char **dp, size_t need)
63 {
64 	char	*tp;
65 	size_t	 tsz;
66 
67 	if (*dp + need < *dst + *sz)
68 		return 0;
69 	tsz = *sz + 128;
70 	if (tsz > maxsz)
71 		tsz = maxsz;
72 	if ((tp = realloc(*dst, tsz)) == NULL)
73 		return -1;
74 	*dp = tp + (*dp - *dst);
75 	*dst = tp;
76 	*sz = tsz;
77 	return 0;
78 }
79 
80 /*
81  * The following two functions limit the number of bytes written,
82  * including the terminating '\0', to sz.  Unless wp is NULL,
83  * they limit the number of display columns occupied to *wp.
84  * Whichever is reached first terminates the output string.
85  * To stay close to the standard interfaces, they return the number of
86  * non-NUL bytes that would have been written if both were unlimited.
87  * If wp is NULL, newline, carriage return, and tab are allowed;
88  * otherwise, the actual number of columns occupied by what was
89  * written is returned in *wp.
90  */
91 
92 static int
93 vasnmprintf(char **str, size_t maxsz, int *wp, const char *fmt, va_list ap)
94 {
95 	char	*src;	/* Source string returned from vasprintf. */
96 	char	*sp;	/* Pointer into src. */
97 	char	*dst;	/* Destination string to be returned. */
98 	char	*dp;	/* Pointer into dst. */
99 	char	*tp;	/* Temporary pointer for dst. */
100 	size_t	 sz;	/* Number of bytes allocated for dst. */
101 	wchar_t	 wc;	/* Wide character at sp. */
102 	int	 len;	/* Number of bytes in the character at sp. */
103 	int	 ret;	/* Number of bytes needed to format src. */
104 	int	 width;	/* Display width of the character wc. */
105 	int	 total_width, max_width, print;
106 
107 	src = NULL;
108 	if ((ret = vasprintf(&src, fmt, ap)) <= 0)
109 		goto fail;
110 
111 	sz = strlen(src) + 1;
112 	if ((dst = malloc(sz)) == NULL) {
113 		free(src);
114 		goto fail;
115 	}
116 
117 	if (maxsz > INT_MAX)
118 		maxsz = INT_MAX;
119 
120 	sp = src;
121 	dp = dst;
122 	ret = 0;
123 	print = 1;
124 	total_width = 0;
125 	max_width = wp == NULL ? INT_MAX : *wp;
126 	while (*sp != '\0') {
127 		if ((len = mbtowc(&wc, sp, MB_CUR_MAX)) == -1) {
128 			(void)mbtowc(NULL, NULL, MB_CUR_MAX);
129 			if (dangerous_locale()) {
130 				ret = -1;
131 				break;
132 			}
133 			len = 1;
134 			width = -1;
135 		} else if (wp == NULL &&
136 		    (wc == L'\n' || wc == L'\r' || wc == L'\t')) {
137 			/*
138 			 * Don't use width uninitialized; the actual
139 			 * value doesn't matter because total_width
140 			 * is only returned for wp != NULL.
141 			 */
142 			width = 0;
143 		} else if ((width = wcwidth(wc)) == -1 &&
144 		    dangerous_locale()) {
145 			ret = -1;
146 			break;
147 		}
148 
149 		/* Valid, printable character. */
150 
151 		if (width >= 0) {
152 			if (print && (dp - dst >= (int)maxsz - len ||
153 			    total_width > max_width - width))
154 				print = 0;
155 			if (print) {
156 				if (grow_dst(&dst, &sz, maxsz,
157 				    &dp, len) == -1) {
158 					ret = -1;
159 					break;
160 				}
161 				total_width += width;
162 				memcpy(dp, sp, len);
163 				dp += len;
164 			}
165 			sp += len;
166 			if (ret >= 0)
167 				ret += len;
168 			continue;
169 		}
170 
171 		/* Escaping required. */
172 
173 		while (len > 0) {
174 			if (print && (dp - dst >= (int)maxsz - 4 ||
175 			    total_width > max_width - 4))
176 				print = 0;
177 			if (print) {
178 				if (grow_dst(&dst, &sz, maxsz,
179 				    &dp, 4) == -1) {
180 					ret = -1;
181 					break;
182 				}
183 #ifndef VIS_ALL
184 #define VIS_ALL VIS_WHITE	/* XXX */
185 #endif
186 				tp = vis(dp, *sp, VIS_OCTAL | VIS_ALL, 0);
187 				width = tp - dp;
188 				total_width += width;
189 				dp = tp;
190 			} else
191 				width = 4;
192 			len--;
193 			sp++;
194 			if (ret >= 0)
195 				ret += width;
196 		}
197 		if (len > 0)
198 			break;
199 	}
200 	free(src);
201 	*dp = '\0';
202 	*str = dst;
203 	if (wp != NULL)
204 		*wp = total_width;
205 
206 	/*
207 	 * If the string was truncated by the width limit but
208 	 * would have fit into the size limit, the only sane way
209 	 * to report the problem is using the return value, such
210 	 * that the usual idiom "if (ret < 0 || ret >= sz) error"
211 	 * works as expected.
212 	 */
213 
214 	if (ret < (int)maxsz && !print)
215 		ret = -1;
216 	return ret;
217 
218 fail:
219 	if (wp != NULL)
220 		*wp = 0;
221 	if (ret == 0) {
222 		*str = src;
223 		return 0;
224 	} else {
225 		*str = NULL;
226 		return -1;
227 	}
228 }
229 
230 int
231 snmprintf(char *str, size_t sz, int *wp, const char *fmt, ...)
232 {
233 	va_list	 ap;
234 	char	*cp;
235 	int	 ret;
236 
237 	va_start(ap, fmt);
238 	ret = vasnmprintf(&cp, sz, wp, fmt, ap);
239 	va_end(ap);
240 	if (cp != NULL) {
241 		(void)strlcpy(str, cp, sz);
242 		free(cp);
243 	} else
244 		*str = '\0';
245 	return ret;
246 }
247 
248 /*
249  * To stay close to the standard interfaces, the following functions
250  * return the number of non-NUL bytes written.
251  */
252 
253 int
254 vfmprintf(FILE *stream, const char *fmt, va_list ap)
255 {
256 	char	*str;
257 	int	 ret;
258 
259 	if ((ret = vasnmprintf(&str, INT_MAX, NULL, fmt, ap)) < 0)
260 		return -1;
261 	if (fputs(str, stream) == EOF)
262 		ret = -1;
263 	free(str);
264 	return ret;
265 }
266 
267 int
268 fmprintf(FILE *stream, const char *fmt, ...)
269 {
270 	va_list	 ap;
271 	int	 ret;
272 
273 	va_start(ap, fmt);
274 	ret = vfmprintf(stream, fmt, ap);
275 	va_end(ap);
276 	return ret;
277 }
278 
279 int
280 mprintf(const char *fmt, ...)
281 {
282 	va_list	 ap;
283 	int	 ret;
284 
285 	va_start(ap, fmt);
286 	ret = vfmprintf(stdout, fmt, ap);
287 	va_end(ap);
288 	return ret;
289 }
290