1 /* $OpenBSD: utf8.c,v 1.8 2018/08/21 13:56:27 schwarze Exp $ */ 2 /* 3 * Copyright (c) 2016 Ingo Schwarze <schwarze@openbsd.org> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 /* 19 * Utility functions for multibyte-character handling, 20 * in particular to sanitize untrusted strings for terminal output. 21 */ 22 23 #include <sys/types.h> 24 #include <langinfo.h> 25 #include <limits.h> 26 #include <stdarg.h> 27 #include <stdio.h> 28 #include <stdlib.h> 29 #include <string.h> 30 #include <vis.h> 31 #include <wchar.h> 32 33 #include "utf8.h" 34 35 static int dangerous_locale(void); 36 static int grow_dst(char **, size_t *, size_t, char **, size_t); 37 static int vasnmprintf(char **, size_t, int *, const char *, va_list); 38 39 40 /* 41 * For US-ASCII and UTF-8 encodings, we can safely recover from 42 * encoding errors and from non-printable characters. For any 43 * other encodings, err to the side of caution and abort parsing: 44 * For state-dependent encodings, recovery is impossible. 45 * For arbitrary encodings, replacement of non-printable 46 * characters would be non-trivial and too fragile. 47 * The comments indicate what nl_langinfo(CODESET) 48 * returns for US-ASCII on various operating systems. 49 */ 50 51 static int 52 dangerous_locale(void) { 53 char *loc; 54 55 loc = nl_langinfo(CODESET); 56 return strcmp(loc, "UTF-8") != 0 && 57 strcmp(loc, "US-ASCII") != 0 && /* OpenBSD */ 58 strcmp(loc, "ANSI_X3.4-1968") != 0 && /* Linux */ 59 strcmp(loc, "ISO8859-1") != 0 && /* AIX */ 60 strcmp(loc, "646") != 0 && /* Solaris, NetBSD */ 61 strcmp(loc, "") != 0; /* Solaris 6 */ 62 } 63 64 static int 65 grow_dst(char **dst, size_t *sz, size_t maxsz, char **dp, size_t need) 66 { 67 char *tp; 68 size_t tsz; 69 70 if (*dp + need < *dst + *sz) 71 return 0; 72 tsz = *sz + 128; 73 if (tsz > maxsz) 74 tsz = maxsz; 75 if ((tp = recallocarray(*dst, *sz, tsz, 1)) == NULL) 76 return -1; 77 *dp = tp + (*dp - *dst); 78 *dst = tp; 79 *sz = tsz; 80 return 0; 81 } 82 83 /* 84 * The following two functions limit the number of bytes written, 85 * including the terminating '\0', to sz. Unless wp is NULL, 86 * they limit the number of display columns occupied to *wp. 87 * Whichever is reached first terminates the output string. 88 * To stay close to the standard interfaces, they return the number of 89 * non-NUL bytes that would have been written if both were unlimited. 90 * If wp is NULL, newline, carriage return, and tab are allowed; 91 * otherwise, the actual number of columns occupied by what was 92 * written is returned in *wp. 93 */ 94 95 static int 96 vasnmprintf(char **str, size_t maxsz, int *wp, const char *fmt, va_list ap) 97 { 98 char *src; /* Source string returned from vasprintf. */ 99 char *sp; /* Pointer into src. */ 100 char *dst; /* Destination string to be returned. */ 101 char *dp; /* Pointer into dst. */ 102 char *tp; /* Temporary pointer for dst. */ 103 size_t sz; /* Number of bytes allocated for dst. */ 104 wchar_t wc; /* Wide character at sp. */ 105 int len; /* Number of bytes in the character at sp. */ 106 int ret; /* Number of bytes needed to format src. */ 107 int width; /* Display width of the character wc. */ 108 int total_width, max_width, print; 109 110 src = NULL; 111 if ((ret = vasprintf(&src, fmt, ap)) <= 0) 112 goto fail; 113 114 sz = strlen(src) + 1; 115 if ((dst = malloc(sz)) == NULL) { 116 free(src); 117 ret = -1; 118 goto fail; 119 } 120 121 if (maxsz > INT_MAX) 122 maxsz = INT_MAX; 123 124 sp = src; 125 dp = dst; 126 ret = 0; 127 print = 1; 128 total_width = 0; 129 max_width = wp == NULL ? INT_MAX : *wp; 130 while (*sp != '\0') { 131 if ((len = mbtowc(&wc, sp, MB_CUR_MAX)) == -1) { 132 (void)mbtowc(NULL, NULL, MB_CUR_MAX); 133 if (dangerous_locale()) { 134 ret = -1; 135 break; 136 } 137 len = 1; 138 width = -1; 139 } else if (wp == NULL && 140 (wc == L'\n' || wc == L'\r' || wc == L'\t')) { 141 /* 142 * Don't use width uninitialized; the actual 143 * value doesn't matter because total_width 144 * is only returned for wp != NULL. 145 */ 146 width = 0; 147 } else if ((width = wcwidth(wc)) == -1 && 148 dangerous_locale()) { 149 ret = -1; 150 break; 151 } 152 153 /* Valid, printable character. */ 154 155 if (width >= 0) { 156 if (print && (dp - dst >= (int)maxsz - len || 157 total_width > max_width - width)) 158 print = 0; 159 if (print) { 160 if (grow_dst(&dst, &sz, maxsz, 161 &dp, len) == -1) { 162 ret = -1; 163 break; 164 } 165 total_width += width; 166 memcpy(dp, sp, len); 167 dp += len; 168 } 169 sp += len; 170 if (ret >= 0) 171 ret += len; 172 continue; 173 } 174 175 /* Escaping required. */ 176 177 while (len > 0) { 178 if (print && (dp - dst >= (int)maxsz - 4 || 179 total_width > max_width - 4)) 180 print = 0; 181 if (print) { 182 if (grow_dst(&dst, &sz, maxsz, 183 &dp, 4) == -1) { 184 ret = -1; 185 break; 186 } 187 tp = vis(dp, *sp, VIS_OCTAL | VIS_ALL, 0); 188 width = tp - dp; 189 total_width += width; 190 dp = tp; 191 } else 192 width = 4; 193 len--; 194 sp++; 195 if (ret >= 0) 196 ret += width; 197 } 198 if (len > 0) 199 break; 200 } 201 free(src); 202 *dp = '\0'; 203 *str = dst; 204 if (wp != NULL) 205 *wp = total_width; 206 207 /* 208 * If the string was truncated by the width limit but 209 * would have fit into the size limit, the only sane way 210 * to report the problem is using the return value, such 211 * that the usual idiom "if (ret < 0 || ret >= sz) error" 212 * works as expected. 213 */ 214 215 if (ret < (int)maxsz && !print) 216 ret = -1; 217 return ret; 218 219 fail: 220 if (wp != NULL) 221 *wp = 0; 222 if (ret == 0) { 223 *str = src; 224 return 0; 225 } else { 226 *str = NULL; 227 return -1; 228 } 229 } 230 231 int 232 snmprintf(char *str, size_t sz, int *wp, const char *fmt, ...) 233 { 234 va_list ap; 235 char *cp; 236 int ret; 237 238 va_start(ap, fmt); 239 ret = vasnmprintf(&cp, sz, wp, fmt, ap); 240 va_end(ap); 241 if (cp != NULL) { 242 (void)strlcpy(str, cp, sz); 243 free(cp); 244 } else 245 *str = '\0'; 246 return ret; 247 } 248 249 /* 250 * To stay close to the standard interfaces, the following functions 251 * return the number of non-NUL bytes written. 252 */ 253 254 int 255 vfmprintf(FILE *stream, const char *fmt, va_list ap) 256 { 257 char *str; 258 int ret; 259 260 if ((ret = vasnmprintf(&str, INT_MAX, NULL, fmt, ap)) < 0) 261 return -1; 262 if (fputs(str, stream) == EOF) 263 ret = -1; 264 free(str); 265 return ret; 266 } 267 268 int 269 fmprintf(FILE *stream, const char *fmt, ...) 270 { 271 va_list ap; 272 int ret; 273 274 va_start(ap, fmt); 275 ret = vfmprintf(stream, fmt, ap); 276 va_end(ap); 277 return ret; 278 } 279 280 int 281 mprintf(const char *fmt, ...) 282 { 283 va_list ap; 284 int ret; 285 286 va_start(ap, fmt); 287 ret = vfmprintf(stdout, fmt, ap); 288 va_end(ap); 289 return ret; 290 } 291