1 /* $OpenBSD: utf8.c,v 1.11 2020/05/01 06:28:52 djm Exp $ */
2 /*
3 * Copyright (c) 2016 Ingo Schwarze <schwarze@openbsd.org>
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18 /*
19 * Utility functions for multibyte-character handling,
20 * in particular to sanitize untrusted strings for terminal output.
21 */
22
23 #include <sys/types.h>
24 #include <langinfo.h>
25 #include <limits.h>
26 #include <stdarg.h>
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <string.h>
30 #include <vis.h>
31 #include <wchar.h>
32
33 #include "utf8.h"
34
35 static int dangerous_locale(void);
36 static int grow_dst(char **, size_t *, size_t, char **, size_t);
37
38
39 /*
40 * For US-ASCII and UTF-8 encodings, we can safely recover from
41 * encoding errors and from non-printable characters. For any
42 * other encodings, err to the side of caution and abort parsing:
43 * For state-dependent encodings, recovery is impossible.
44 * For arbitrary encodings, replacement of non-printable
45 * characters would be non-trivial and too fragile.
46 * The comments indicate what nl_langinfo(CODESET)
47 * returns for US-ASCII on various operating systems.
48 */
49
50 static int
dangerous_locale(void)51 dangerous_locale(void) {
52 char *loc;
53
54 loc = nl_langinfo(CODESET);
55 return strcmp(loc, "UTF-8") != 0 &&
56 strcmp(loc, "US-ASCII") != 0 && /* OpenBSD */
57 strcmp(loc, "ANSI_X3.4-1968") != 0 && /* Linux */
58 strcmp(loc, "ISO8859-1") != 0 && /* AIX */
59 strcmp(loc, "646") != 0 && /* Solaris, NetBSD */
60 strcmp(loc, "") != 0; /* Solaris 6 */
61 }
62
63 static int
grow_dst(char ** dst,size_t * sz,size_t maxsz,char ** dp,size_t need)64 grow_dst(char **dst, size_t *sz, size_t maxsz, char **dp, size_t need)
65 {
66 char *tp;
67 size_t tsz;
68
69 if (*dp + need < *dst + *sz)
70 return 0;
71 tsz = *sz + 128;
72 if (tsz > maxsz)
73 tsz = maxsz;
74 if ((tp = recallocarray(*dst, *sz, tsz, 1)) == NULL)
75 return -1;
76 *dp = tp + (*dp - *dst);
77 *dst = tp;
78 *sz = tsz;
79 return 0;
80 }
81
82 /*
83 * The following two functions limit the number of bytes written,
84 * including the terminating '\0', to sz. Unless wp is NULL,
85 * they limit the number of display columns occupied to *wp.
86 * Whichever is reached first terminates the output string.
87 * To stay close to the standard interfaces, they return the number of
88 * non-NUL bytes that would have been written if both were unlimited.
89 * If wp is NULL, newline, carriage return, and tab are allowed;
90 * otherwise, the actual number of columns occupied by what was
91 * written is returned in *wp.
92 */
93
94 int
vasnmprintf(char ** str,size_t maxsz,int * wp,const char * fmt,va_list ap)95 vasnmprintf(char **str, size_t maxsz, int *wp, const char *fmt, va_list ap)
96 {
97 char *src; /* Source string returned from vasprintf. */
98 char *sp; /* Pointer into src. */
99 char *dst; /* Destination string to be returned. */
100 char *dp; /* Pointer into dst. */
101 char *tp; /* Temporary pointer for dst. */
102 size_t sz; /* Number of bytes allocated for dst. */
103 wchar_t wc; /* Wide character at sp. */
104 int len; /* Number of bytes in the character at sp. */
105 int ret; /* Number of bytes needed to format src. */
106 int width; /* Display width of the character wc. */
107 int total_width, max_width, print;
108
109 src = NULL;
110 if ((ret = vasprintf(&src, fmt, ap)) <= 0)
111 goto fail;
112
113 sz = strlen(src) + 1;
114 if ((dst = malloc(sz)) == NULL) {
115 free(src);
116 ret = -1;
117 goto fail;
118 }
119
120 if (maxsz > INT_MAX)
121 maxsz = INT_MAX;
122
123 sp = src;
124 dp = dst;
125 ret = 0;
126 print = 1;
127 total_width = 0;
128 max_width = wp == NULL ? INT_MAX : *wp;
129 while (*sp != '\0') {
130 if ((len = mbtowc(&wc, sp, MB_CUR_MAX)) == -1) {
131 (void)mbtowc(NULL, NULL, MB_CUR_MAX);
132 if (dangerous_locale()) {
133 ret = -1;
134 break;
135 }
136 len = 1;
137 width = -1;
138 } else if (wp == NULL &&
139 (wc == L'\n' || wc == L'\r' || wc == L'\t')) {
140 /*
141 * Don't use width uninitialized; the actual
142 * value doesn't matter because total_width
143 * is only returned for wp != NULL.
144 */
145 width = 0;
146 } else if ((width = wcwidth(wc)) == -1 &&
147 dangerous_locale()) {
148 ret = -1;
149 break;
150 }
151
152 /* Valid, printable character. */
153
154 if (width >= 0) {
155 if (print && (dp - dst >= (int)maxsz - len ||
156 total_width > max_width - width))
157 print = 0;
158 if (print) {
159 if (grow_dst(&dst, &sz, maxsz,
160 &dp, len) == -1) {
161 ret = -1;
162 break;
163 }
164 total_width += width;
165 memcpy(dp, sp, len);
166 dp += len;
167 }
168 sp += len;
169 if (ret >= 0)
170 ret += len;
171 continue;
172 }
173
174 /* Escaping required. */
175
176 while (len > 0) {
177 if (print && (dp - dst >= (int)maxsz - 4 ||
178 total_width > max_width - 4))
179 print = 0;
180 if (print) {
181 if (grow_dst(&dst, &sz, maxsz,
182 &dp, 4) == -1) {
183 ret = -1;
184 break;
185 }
186 tp = vis(dp, *sp, VIS_OCTAL | VIS_ALL, 0);
187 width = tp - dp;
188 total_width += width;
189 dp = tp;
190 } else
191 width = 4;
192 len--;
193 sp++;
194 if (ret >= 0)
195 ret += width;
196 }
197 if (len > 0)
198 break;
199 }
200 free(src);
201 *dp = '\0';
202 *str = dst;
203 if (wp != NULL)
204 *wp = total_width;
205
206 /*
207 * If the string was truncated by the width limit but
208 * would have fit into the size limit, the only sane way
209 * to report the problem is using the return value, such
210 * that the usual idiom "if (ret < 0 || ret >= sz) error"
211 * works as expected.
212 */
213
214 if (ret < (int)maxsz && !print)
215 ret = -1;
216 return ret;
217
218 fail:
219 if (wp != NULL)
220 *wp = 0;
221 if (ret == 0) {
222 *str = src;
223 return 0;
224 } else {
225 *str = NULL;
226 return -1;
227 }
228 }
229
230 int
snmprintf(char * str,size_t sz,int * wp,const char * fmt,...)231 snmprintf(char *str, size_t sz, int *wp, const char *fmt, ...)
232 {
233 va_list ap;
234 char *cp = NULL;
235 int ret;
236
237 va_start(ap, fmt);
238 ret = vasnmprintf(&cp, sz, wp, fmt, ap);
239 va_end(ap);
240 if (cp != NULL) {
241 (void)strlcpy(str, cp, sz);
242 free(cp);
243 } else
244 *str = '\0';
245 return ret;
246 }
247
248 int
asmprintf(char ** outp,size_t sz,int * wp,const char * fmt,...)249 asmprintf(char **outp, size_t sz, int *wp, const char *fmt, ...)
250 {
251 va_list ap;
252 int ret;
253
254 *outp = NULL;
255 va_start(ap, fmt);
256 ret = vasnmprintf(outp, sz, wp, fmt, ap);
257 va_end(ap);
258
259 return ret;
260 }
261
262 /*
263 * To stay close to the standard interfaces, the following functions
264 * return the number of non-NUL bytes written.
265 */
266
267 int
vfmprintf(FILE * stream,const char * fmt,va_list ap)268 vfmprintf(FILE *stream, const char *fmt, va_list ap)
269 {
270 char *str = NULL;
271 int ret;
272
273 if ((ret = vasnmprintf(&str, INT_MAX, NULL, fmt, ap)) < 0) {
274 free(str);
275 return -1;
276 }
277 if (fputs(str, stream) == EOF)
278 ret = -1;
279 free(str);
280 return ret;
281 }
282
283 int
fmprintf(FILE * stream,const char * fmt,...)284 fmprintf(FILE *stream, const char *fmt, ...)
285 {
286 va_list ap;
287 int ret;
288
289 va_start(ap, fmt);
290 ret = vfmprintf(stream, fmt, ap);
291 va_end(ap);
292 return ret;
293 }
294
295 int
mprintf(const char * fmt,...)296 mprintf(const char *fmt, ...)
297 {
298 va_list ap;
299 int ret;
300
301 va_start(ap, fmt);
302 ret = vfmprintf(stdout, fmt, ap);
303 va_end(ap);
304 return ret;
305 }
306