1/* $NetBSD: utf8.c,v 1.9 2020/05/28 17:05:49 christos Exp $ */ 2/* $OpenBSD: utf8.c,v 1.11 2020/05/01 06:28:52 djm Exp $ */ 3/* 4 * Copyright (c) 2016 Ingo Schwarze <schwarze@openbsd.org> 5 * 6 * Permission to use, copy, modify, and distribute this software for any 7 * purpose with or without fee is hereby granted, provided that the above 8 * copyright notice and this permission notice appear in all copies. 9 * 10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 */ 18 19#include "includes.h" 20__RCSID("$NetBSD: utf8.c,v 1.9 2020/05/28 17:05:49 christos Exp $"); 21/* 22 * Utility functions for multibyte-character handling, 23 * in particular to sanitize untrusted strings for terminal output. 24 */ 25 26#include <sys/types.h> 27#include <langinfo.h> 28#include <limits.h> 29#include <stdarg.h> 30#include <stdio.h> 31#include <stdlib.h> 32#include <string.h> 33#include <vis.h> 34#include <wchar.h> 35 36#include "utf8.h" 37 38static int dangerous_locale(void); 39static int grow_dst(char **, size_t *, size_t, char **, size_t); 40 41 42/* 43 * For US-ASCII and UTF-8 encodings, we can safely recover from 44 * encoding errors and from non-printable characters. For any 45 * other encodings, err to the side of caution and abort parsing: 46 * For state-dependent encodings, recovery is impossible. 47 * For arbitrary encodings, replacement of non-printable 48 * characters would be non-trivial and too fragile. 49 * The comments indicate what nl_langinfo(CODESET) 50 * returns for US-ASCII on various operating systems. 51 */ 52 53static int 54dangerous_locale(void) { 55 char *loc; 56 57 loc = nl_langinfo(CODESET); 58 return strcmp(loc, "UTF-8") != 0 && 59 strcmp(loc, "US-ASCII") != 0 && /* OpenBSD */ 60 strcmp(loc, "ANSI_X3.4-1968") != 0 && /* Linux */ 61 strcmp(loc, "ISO8859-1") != 0 && /* AIX */ 62 strcmp(loc, "646") != 0 && /* Solaris, NetBSD */ 63 strcmp(loc, "") != 0; /* Solaris 6 */ 64} 65 66static int 67grow_dst(char **dst, size_t *sz, size_t maxsz, char **dp, size_t need) 68{ 69 char *tp; 70 size_t tsz; 71 72 if (*dp + need < *dst + *sz) 73 return 0; 74 tsz = *sz + 128; 75 if (tsz > maxsz) 76 tsz = maxsz; 77 if ((tp = recallocarray(*dst, *sz, tsz, 1)) == NULL) 78 return -1; 79 *dp = tp + (*dp - *dst); 80 *dst = tp; 81 *sz = tsz; 82 return 0; 83} 84 85/* 86 * The following two functions limit the number of bytes written, 87 * including the terminating '\0', to sz. Unless wp is NULL, 88 * they limit the number of display columns occupied to *wp. 89 * Whichever is reached first terminates the output string. 90 * To stay close to the standard interfaces, they return the number of 91 * non-NUL bytes that would have been written if both were unlimited. 92 * If wp is NULL, newline, carriage return, and tab are allowed; 93 * otherwise, the actual number of columns occupied by what was 94 * written is returned in *wp. 95 */ 96 97int 98vasnmprintf(char **str, size_t maxsz, int *wp, const char *fmt, va_list ap) 99{ 100 char *src; /* Source string returned from vasprintf. */ 101 char *sp; /* Pointer into src. */ 102 char *dst; /* Destination string to be returned. */ 103 char *dp; /* Pointer into dst. */ 104 char *tp; /* Temporary pointer for dst. */ 105 size_t sz; /* Number of bytes allocated for dst. */ 106 wchar_t wc; /* Wide character at sp. */ 107 int len; /* Number of bytes in the character at sp. */ 108 int ret; /* Number of bytes needed to format src. */ 109 int width; /* Display width of the character wc. */ 110 int total_width, max_width, print; 111 112 src = NULL; 113 if ((ret = vasprintf(&src, fmt, ap)) <= 0) 114 goto fail; 115 116 sz = strlen(src) + 1; 117 if ((dst = malloc(sz)) == NULL) { 118 free(src); 119 ret = -1; 120 goto fail; 121 } 122 123 if (maxsz > INT_MAX) 124 maxsz = INT_MAX; 125 126 sp = src; 127 dp = dst; 128 ret = 0; 129 print = 1; 130 total_width = 0; 131 max_width = wp == NULL ? INT_MAX : *wp; 132 while (*sp != '\0') { 133 if ((len = mbtowc(&wc, sp, MB_CUR_MAX)) == -1) { 134 (void)mbtowc(NULL, NULL, MB_CUR_MAX); 135 if (dangerous_locale()) { 136 ret = -1; 137 break; 138 } 139 len = 1; 140 width = -1; 141 } else if (wp == NULL && 142 (wc == L'\n' || wc == L'\r' || wc == L'\t')) { 143 /* 144 * Don't use width uninitialized; the actual 145 * value doesn't matter because total_width 146 * is only returned for wp != NULL. 147 */ 148 width = 0; 149 } else if ((width = wcwidth(wc)) == -1 && 150 dangerous_locale()) { 151 ret = -1; 152 break; 153 } 154 155 /* Valid, printable character. */ 156 157 if (width >= 0) { 158 if (print && (dp - dst >= (int)maxsz - len || 159 total_width > max_width - width)) 160 print = 0; 161 if (print) { 162 if (grow_dst(&dst, &sz, maxsz, 163 &dp, len) == -1) { 164 ret = -1; 165 break; 166 } 167 total_width += width; 168 memcpy(dp, sp, len); 169 dp += len; 170 } 171 sp += len; 172 if (ret >= 0) 173 ret += len; 174 continue; 175 } 176 177 /* Escaping required. */ 178 179 while (len > 0) { 180 if (print && (dp - dst >= (int)maxsz - 4 || 181 total_width > max_width - 4)) 182 print = 0; 183 if (print) { 184 if (grow_dst(&dst, &sz, maxsz, 185 &dp, 4) == -1) { 186 ret = -1; 187 break; 188 } 189#ifndef VIS_ALL 190#define VIS_ALL VIS_WHITE /* XXX */ 191#endif 192 tp = vis(dp, *sp, VIS_OCTAL | VIS_ALL, 0); 193 width = tp - dp; 194 total_width += width; 195 dp = tp; 196 } else 197 width = 4; 198 len--; 199 sp++; 200 if (ret >= 0) 201 ret += width; 202 } 203 if (len > 0) 204 break; 205 } 206 free(src); 207 *dp = '\0'; 208 *str = dst; 209 if (wp != NULL) 210 *wp = total_width; 211 212 /* 213 * If the string was truncated by the width limit but 214 * would have fit into the size limit, the only sane way 215 * to report the problem is using the return value, such 216 * that the usual idiom "if (ret < 0 || ret >= sz) error" 217 * works as expected. 218 */ 219 220 if (ret < (int)maxsz && !print) 221 ret = -1; 222 return ret; 223 224fail: 225 if (wp != NULL) 226 *wp = 0; 227 if (ret == 0) { 228 *str = src; 229 return 0; 230 } else { 231 *str = NULL; 232 return -1; 233 } 234} 235 236int 237snmprintf(char *str, size_t sz, int *wp, const char *fmt, ...) 238{ 239 va_list ap; 240 char *cp = NULL; 241 int ret; 242 243 va_start(ap, fmt); 244 ret = vasnmprintf(&cp, sz, wp, fmt, ap); 245 va_end(ap); 246 if (cp != NULL) { 247 (void)strlcpy(str, cp, sz); 248 free(cp); 249 } else 250 *str = '\0'; 251 return ret; 252} 253 254int 255asmprintf(char **outp, size_t sz, int *wp, const char *fmt, ...) 256{ 257 va_list ap; 258 int ret; 259 260 *outp = NULL; 261 va_start(ap, fmt); 262 ret = vasnmprintf(outp, sz, wp, fmt, ap); 263 va_end(ap); 264 265 return ret; 266} 267 268/* 269 * To stay close to the standard interfaces, the following functions 270 * return the number of non-NUL bytes written. 271 */ 272 273int 274vfmprintf(FILE *stream, const char *fmt, va_list ap) 275{ 276 char *str = NULL; 277 int ret; 278 279 if ((ret = vasnmprintf(&str, INT_MAX, NULL, fmt, ap)) < 0) { 280 free(str); 281 return -1; 282 } 283 if (fputs(str, stream) == EOF) 284 ret = -1; 285 free(str); 286 return ret; 287} 288 289int 290fmprintf(FILE *stream, const char *fmt, ...) 291{ 292 va_list ap; 293 int ret; 294 295 va_start(ap, fmt); 296 ret = vfmprintf(stream, fmt, ap); 297 va_end(ap); 298 return ret; 299} 300 301int 302mprintf(const char *fmt, ...) 303{ 304 va_list ap; 305 int ret; 306 307 va_start(ap, fmt); 308 ret = vfmprintf(stdout, fmt, ap); 309 va_end(ap); 310 return ret; 311} 312