1/*	$NetBSD: utf8.c,v 1.9 2020/05/28 17:05:49 christos Exp $	*/
2/* $OpenBSD: utf8.c,v 1.11 2020/05/01 06:28:52 djm Exp $ */
3/*
4 * Copyright (c) 2016 Ingo Schwarze <schwarze@openbsd.org>
5 *
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19#include "includes.h"
20__RCSID("$NetBSD: utf8.c,v 1.9 2020/05/28 17:05:49 christos Exp $");
21/*
22 * Utility functions for multibyte-character handling,
23 * in particular to sanitize untrusted strings for terminal output.
24 */
25
26#include <sys/types.h>
27#include <langinfo.h>
28#include <limits.h>
29#include <stdarg.h>
30#include <stdio.h>
31#include <stdlib.h>
32#include <string.h>
33#include <vis.h>
34#include <wchar.h>
35
36#include "utf8.h"
37
38static int	 dangerous_locale(void);
39static int	 grow_dst(char **, size_t *, size_t, char **, size_t);
40
41
42/*
43 * For US-ASCII and UTF-8 encodings, we can safely recover from
44 * encoding errors and from non-printable characters.  For any
45 * other encodings, err to the side of caution and abort parsing:
46 * For state-dependent encodings, recovery is impossible.
47 * For arbitrary encodings, replacement of non-printable
48 * characters would be non-trivial and too fragile.
49 * The comments indicate what nl_langinfo(CODESET)
50 * returns for US-ASCII on various operating systems.
51 */
52
53static int
54dangerous_locale(void) {
55	char	*loc;
56
57	loc = nl_langinfo(CODESET);
58	return strcmp(loc, "UTF-8") != 0 &&
59	    strcmp(loc, "US-ASCII") != 0 &&		/* OpenBSD */
60	    strcmp(loc, "ANSI_X3.4-1968") != 0 &&	/* Linux */
61	    strcmp(loc, "ISO8859-1") != 0 &&		/* AIX */
62	    strcmp(loc, "646") != 0 &&			/* Solaris, NetBSD */
63	    strcmp(loc, "") != 0;			/* Solaris 6 */
64}
65
66static int
67grow_dst(char **dst, size_t *sz, size_t maxsz, char **dp, size_t need)
68{
69	char	*tp;
70	size_t	 tsz;
71
72	if (*dp + need < *dst + *sz)
73		return 0;
74	tsz = *sz + 128;
75	if (tsz > maxsz)
76		tsz = maxsz;
77	if ((tp = recallocarray(*dst, *sz, tsz, 1)) == NULL)
78		return -1;
79	*dp = tp + (*dp - *dst);
80	*dst = tp;
81	*sz = tsz;
82	return 0;
83}
84
85/*
86 * The following two functions limit the number of bytes written,
87 * including the terminating '\0', to sz.  Unless wp is NULL,
88 * they limit the number of display columns occupied to *wp.
89 * Whichever is reached first terminates the output string.
90 * To stay close to the standard interfaces, they return the number of
91 * non-NUL bytes that would have been written if both were unlimited.
92 * If wp is NULL, newline, carriage return, and tab are allowed;
93 * otherwise, the actual number of columns occupied by what was
94 * written is returned in *wp.
95 */
96
97int
98vasnmprintf(char **str, size_t maxsz, int *wp, const char *fmt, va_list ap)
99{
100	char	*src;	/* Source string returned from vasprintf. */
101	char	*sp;	/* Pointer into src. */
102	char	*dst;	/* Destination string to be returned. */
103	char	*dp;	/* Pointer into dst. */
104	char	*tp;	/* Temporary pointer for dst. */
105	size_t	 sz;	/* Number of bytes allocated for dst. */
106	wchar_t	 wc;	/* Wide character at sp. */
107	int	 len;	/* Number of bytes in the character at sp. */
108	int	 ret;	/* Number of bytes needed to format src. */
109	int	 width;	/* Display width of the character wc. */
110	int	 total_width, max_width, print;
111
112	src = NULL;
113	if ((ret = vasprintf(&src, fmt, ap)) <= 0)
114		goto fail;
115
116	sz = strlen(src) + 1;
117	if ((dst = malloc(sz)) == NULL) {
118		free(src);
119		ret = -1;
120		goto fail;
121	}
122
123	if (maxsz > INT_MAX)
124		maxsz = INT_MAX;
125
126	sp = src;
127	dp = dst;
128	ret = 0;
129	print = 1;
130	total_width = 0;
131	max_width = wp == NULL ? INT_MAX : *wp;
132	while (*sp != '\0') {
133		if ((len = mbtowc(&wc, sp, MB_CUR_MAX)) == -1) {
134			(void)mbtowc(NULL, NULL, MB_CUR_MAX);
135			if (dangerous_locale()) {
136				ret = -1;
137				break;
138			}
139			len = 1;
140			width = -1;
141		} else if (wp == NULL &&
142		    (wc == L'\n' || wc == L'\r' || wc == L'\t')) {
143			/*
144			 * Don't use width uninitialized; the actual
145			 * value doesn't matter because total_width
146			 * is only returned for wp != NULL.
147			 */
148			width = 0;
149		} else if ((width = wcwidth(wc)) == -1 &&
150		    dangerous_locale()) {
151			ret = -1;
152			break;
153		}
154
155		/* Valid, printable character. */
156
157		if (width >= 0) {
158			if (print && (dp - dst >= (int)maxsz - len ||
159			    total_width > max_width - width))
160				print = 0;
161			if (print) {
162				if (grow_dst(&dst, &sz, maxsz,
163				    &dp, len) == -1) {
164					ret = -1;
165					break;
166				}
167				total_width += width;
168				memcpy(dp, sp, len);
169				dp += len;
170			}
171			sp += len;
172			if (ret >= 0)
173				ret += len;
174			continue;
175		}
176
177		/* Escaping required. */
178
179		while (len > 0) {
180			if (print && (dp - dst >= (int)maxsz - 4 ||
181			    total_width > max_width - 4))
182				print = 0;
183			if (print) {
184				if (grow_dst(&dst, &sz, maxsz,
185				    &dp, 4) == -1) {
186					ret = -1;
187					break;
188				}
189#ifndef VIS_ALL
190#define VIS_ALL VIS_WHITE	/* XXX */
191#endif
192				tp = vis(dp, *sp, VIS_OCTAL | VIS_ALL, 0);
193				width = tp - dp;
194				total_width += width;
195				dp = tp;
196			} else
197				width = 4;
198			len--;
199			sp++;
200			if (ret >= 0)
201				ret += width;
202		}
203		if (len > 0)
204			break;
205	}
206	free(src);
207	*dp = '\0';
208	*str = dst;
209	if (wp != NULL)
210		*wp = total_width;
211
212	/*
213	 * If the string was truncated by the width limit but
214	 * would have fit into the size limit, the only sane way
215	 * to report the problem is using the return value, such
216	 * that the usual idiom "if (ret < 0 || ret >= sz) error"
217	 * works as expected.
218	 */
219
220	if (ret < (int)maxsz && !print)
221		ret = -1;
222	return ret;
223
224fail:
225	if (wp != NULL)
226		*wp = 0;
227	if (ret == 0) {
228		*str = src;
229		return 0;
230	} else {
231		*str = NULL;
232		return -1;
233	}
234}
235
236int
237snmprintf(char *str, size_t sz, int *wp, const char *fmt, ...)
238{
239	va_list	 ap;
240	char	*cp = NULL;
241	int	 ret;
242
243	va_start(ap, fmt);
244	ret = vasnmprintf(&cp, sz, wp, fmt, ap);
245	va_end(ap);
246	if (cp != NULL) {
247		(void)strlcpy(str, cp, sz);
248		free(cp);
249	} else
250		*str = '\0';
251	return ret;
252}
253
254int
255asmprintf(char **outp, size_t sz, int *wp, const char *fmt, ...)
256{
257	va_list	 ap;
258	int	 ret;
259
260	*outp = NULL;
261	va_start(ap, fmt);
262	ret = vasnmprintf(outp, sz, wp, fmt, ap);
263	va_end(ap);
264
265	return ret;
266}
267
268/*
269 * To stay close to the standard interfaces, the following functions
270 * return the number of non-NUL bytes written.
271 */
272
273int
274vfmprintf(FILE *stream, const char *fmt, va_list ap)
275{
276	char	*str = NULL;
277	int	 ret;
278
279	if ((ret = vasnmprintf(&str, INT_MAX, NULL, fmt, ap)) < 0) {
280		free(str);
281		return -1;
282	}
283	if (fputs(str, stream) == EOF)
284		ret = -1;
285	free(str);
286	return ret;
287}
288
289int
290fmprintf(FILE *stream, const char *fmt, ...)
291{
292	va_list	 ap;
293	int	 ret;
294
295	va_start(ap, fmt);
296	ret = vfmprintf(stream, fmt, ap);
297	va_end(ap);
298	return ret;
299}
300
301int
302mprintf(const char *fmt, ...)
303{
304	va_list	 ap;
305	int	 ret;
306
307	va_start(ap, fmt);
308	ret = vfmprintf(stdout, fmt, ap);
309	va_end(ap);
310	return ret;
311}
312