1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim Maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
8
9 /* Miscellaneous string-handling functions. Some are not required for
10 utilities and tests, and are cut out by the COMPILE_UTILITY macro. */
11
12
13 #include "exim.h"
14 #include <assert.h>
15
16
17 #ifndef COMPILE_UTILITY
18 /*************************************************
19 * Test for IP address *
20 *************************************************/
21
22 /* This used just to be a regular expression, but with IPv6 things are a bit
23 more complicated. If the address contains a colon, it is assumed to be a v6
24 address (assuming HAVE_IPV6 is set). If a mask is permitted and one is present,
25 and maskptr is not NULL, its offset is placed there.
26
27 Arguments:
28 s a string
29 maskptr NULL if no mask is permitted to follow
30 otherwise, points to an int where the offset of '/' is placed
31 if there is no / followed by trailing digits, *maskptr is set 0
32
33 Returns: 0 if the string is not a textual representation of an IP address
34 4 if it is an IPv4 address
35 6 if it is an IPv6 address
36 */
37
38 int
string_is_ip_address(const uschar * s,int * maskptr)39 string_is_ip_address(const uschar *s, int *maskptr)
40 {
41 int yield = 4;
42
43 /* If an optional mask is permitted, check for it. If found, pass back the
44 offset. */
45
46 if (maskptr)
47 {
48 const uschar *ss = s + Ustrlen(s);
49 *maskptr = 0;
50 if (s != ss && isdigit(*(--ss)))
51 {
52 while (ss > s && isdigit(ss[-1])) ss--;
53 if (ss > s && *(--ss) == '/') *maskptr = ss - s;
54 }
55 }
56
57 /* A colon anywhere in the string => IPv6 address */
58
59 if (Ustrchr(s, ':') != NULL)
60 {
61 BOOL had_double_colon = FALSE;
62 BOOL v4end = FALSE;
63
64 yield = 6;
65
66 /* An IPv6 address must start with hex digit or double colon. A single
67 colon is invalid. */
68
69 if (*s == ':' && *(++s) != ':') return 0;
70
71 /* Now read up to 8 components consisting of up to 4 hex digits each. There
72 may be one and only one appearance of double colon, which implies any number
73 of binary zero bits. The number of preceding components is held in count. */
74
75 for (int count = 0; count < 8; count++)
76 {
77 /* If the end of the string is reached before reading 8 components, the
78 address is valid provided a double colon has been read. This also applies
79 if we hit the / that introduces a mask or the % that introduces the
80 interface specifier (scope id) of a link-local address. */
81
82 if (*s == 0 || *s == '%' || *s == '/') return had_double_colon ? yield : 0;
83
84 /* If a component starts with an additional colon, we have hit a double
85 colon. This is permitted to appear once only, and counts as at least
86 one component. The final component may be of this form. */
87
88 if (*s == ':')
89 {
90 if (had_double_colon) return 0;
91 had_double_colon = TRUE;
92 s++;
93 continue;
94 }
95
96 /* If the remainder of the string contains a dot but no colons, we
97 can expect a trailing IPv4 address. This is valid if either there has
98 been no double-colon and this is the 7th component (with the IPv4 address
99 being the 7th & 8th components), OR if there has been a double-colon
100 and fewer than 6 components. */
101
102 if (Ustrchr(s, ':') == NULL && Ustrchr(s, '.') != NULL)
103 {
104 if ((!had_double_colon && count != 6) ||
105 (had_double_colon && count > 6)) return 0;
106 v4end = TRUE;
107 yield = 6;
108 break;
109 }
110
111 /* Check for at least one and not more than 4 hex digits for this
112 component. */
113
114 if (!isxdigit(*s++)) return 0;
115 if (isxdigit(*s) && isxdigit(*(++s)) && isxdigit(*(++s))) s++;
116
117 /* If the component is terminated by colon and there is more to
118 follow, skip over the colon. If there is no more to follow the address is
119 invalid. */
120
121 if (*s == ':' && *(++s) == 0) return 0;
122 }
123
124 /* If about to handle a trailing IPv4 address, drop through. Otherwise
125 all is well if we are at the end of the string or at the mask or at a percent
126 sign, which introduces the interface specifier (scope id) of a link local
127 address. */
128
129 if (!v4end)
130 return (*s == 0 || *s == '%' ||
131 (*s == '/' && maskptr != NULL && *maskptr != 0))? yield : 0;
132 }
133
134 /* Test for IPv4 address, which may be the tail-end of an IPv6 address. */
135
136 for (int i = 0; i < 4; i++)
137 {
138 long n;
139 uschar * end;
140
141 if (i != 0 && *s++ != '.') return 0;
142 n = strtol(CCS s, CSS &end, 10);
143 if (n > 255 || n < 0 || end <= s || end > s+3) return 0;
144 s = end;
145 }
146
147 return !*s || (*s == '/' && maskptr && *maskptr != 0) ? yield : 0;
148 }
149 #endif /* COMPILE_UTILITY */
150
151
152 /*************************************************
153 * Format message size *
154 *************************************************/
155
156 /* Convert a message size in bytes to printing form, rounding
157 according to the magnitude of the number. A value of zero causes
158 a string of spaces to be returned.
159
160 Arguments:
161 size the message size in bytes
162 buffer where to put the answer
163
164 Returns: pointer to the buffer
165 a string of exactly 5 characters is normally returned
166 */
167
168 uschar *
string_format_size(int size,uschar * buffer)169 string_format_size(int size, uschar *buffer)
170 {
171 if (size == 0) Ustrcpy(buffer, US" ");
172 else if (size < 1024) sprintf(CS buffer, "%5d", size);
173 else if (size < 10*1024)
174 sprintf(CS buffer, "%4.1fK", (double)size / 1024.0);
175 else if (size < 1024*1024)
176 sprintf(CS buffer, "%4dK", (size + 512)/1024);
177 else if (size < 10*1024*1024)
178 sprintf(CS buffer, "%4.1fM", (double)size / (1024.0 * 1024.0));
179 else
180 sprintf(CS buffer, "%4dM", (size + 512 * 1024)/(1024*1024));
181 return buffer;
182 }
183
184
185
186 #ifndef COMPILE_UTILITY
187 /*************************************************
188 * Convert a number to base 62 format *
189 *************************************************/
190
191 /* Convert a long integer into an ASCII base 62 string. For Cygwin the value of
192 BASE_62 is actually 36. Always return exactly 6 characters plus zero, in a
193 static area.
194
195 Argument: a long integer
196 Returns: pointer to base 62 string
197 */
198
199 uschar *
string_base62(unsigned long int value)200 string_base62(unsigned long int value)
201 {
202 static uschar yield[7];
203 uschar *p = yield + sizeof(yield) - 1;
204 *p = 0;
205 while (p > yield)
206 {
207 *(--p) = base62_chars[value % BASE_62];
208 value /= BASE_62;
209 }
210 return yield;
211 }
212 #endif /* COMPILE_UTILITY */
213
214
215
216 /*************************************************
217 * Interpret escape sequence *
218 *************************************************/
219
220 /* This function is called from several places where escape sequences are to be
221 interpreted in strings.
222
223 Arguments:
224 pp points a pointer to the initiating "\" in the string;
225 the pointer gets updated to point to the final character
226 If the backslash is the last character in the string, it
227 is not interpreted.
228 Returns: the value of the character escape
229 */
230
231 int
string_interpret_escape(const uschar ** pp)232 string_interpret_escape(const uschar **pp)
233 {
234 #ifdef COMPILE_UTILITY
235 const uschar *hex_digits= CUS"0123456789abcdef";
236 #endif
237 int ch;
238 const uschar *p = *pp;
239 ch = *(++p);
240 if (ch == '\0') return **pp;
241 if (isdigit(ch) && ch != '8' && ch != '9')
242 {
243 ch -= '0';
244 if (isdigit(p[1]) && p[1] != '8' && p[1] != '9')
245 {
246 ch = ch * 8 + *(++p) - '0';
247 if (isdigit(p[1]) && p[1] != '8' && p[1] != '9')
248 ch = ch * 8 + *(++p) - '0';
249 }
250 }
251 else switch(ch)
252 {
253 case 'b': ch = '\b'; break;
254 case 'f': ch = '\f'; break;
255 case 'n': ch = '\n'; break;
256 case 'r': ch = '\r'; break;
257 case 't': ch = '\t'; break;
258 case 'v': ch = '\v'; break;
259 case 'x':
260 ch = 0;
261 if (isxdigit(p[1]))
262 {
263 ch = ch * 16 +
264 Ustrchr(hex_digits, tolower(*(++p))) - hex_digits;
265 if (isxdigit(p[1])) ch = ch * 16 +
266 Ustrchr(hex_digits, tolower(*(++p))) - hex_digits;
267 }
268 break;
269 }
270 *pp = p;
271 return ch;
272 }
273
274
275
276 #ifndef COMPILE_UTILITY
277 /*************************************************
278 * Ensure string is printable *
279 *************************************************/
280
281 /* This function is called for critical strings. It checks for any
282 non-printing characters, and if any are found, it makes a new copy
283 of the string with suitable escape sequences. It is most often called by the
284 macro string_printing(), which sets flags to 0.
285
286 Arguments:
287 s the input string
288 flags Bit 0: convert tabs. Bit 1: convert spaces.
289
290 Returns: string with non-printers encoded as printing sequences
291 */
292
293 const uschar *
string_printing2(const uschar * s,int flags)294 string_printing2(const uschar *s, int flags)
295 {
296 int nonprintcount = 0;
297 int length = 0;
298 const uschar *t = s;
299 uschar *ss, *tt;
300
301 while (*t != 0)
302 {
303 int c = *t++;
304 if ( !mac_isprint(c)
305 || flags & SP_TAB && c == '\t'
306 || flags & SP_SPACE && c == ' '
307 ) nonprintcount++;
308 length++;
309 }
310
311 if (nonprintcount == 0) return s;
312
313 /* Get a new block of store guaranteed big enough to hold the
314 expanded string. */
315
316 tt = ss = store_get(length + nonprintcount * 3 + 1, is_tainted(s));
317
318 /* Copy everything, escaping non printers. */
319
320 for (t = s; *t; )
321 {
322 int c = *t;
323 if ( mac_isprint(c)
324 && (!(flags & SP_TAB) || c != '\t')
325 && (!(flags & SP_SPACE) || c != ' ')
326 )
327 *tt++ = *t++;
328 else
329 {
330 *tt++ = '\\';
331 switch (*t)
332 {
333 case '\n': *tt++ = 'n'; break;
334 case '\r': *tt++ = 'r'; break;
335 case '\b': *tt++ = 'b'; break;
336 case '\v': *tt++ = 'v'; break;
337 case '\f': *tt++ = 'f'; break;
338 case '\t': *tt++ = 't'; break;
339 default: sprintf(CS tt, "%03o", *t); tt += 3; break;
340 }
341 t++;
342 }
343 }
344 *tt = 0;
345 return ss;
346 }
347 #endif /* COMPILE_UTILITY */
348
349 /*************************************************
350 * Undo printing escapes in string *
351 *************************************************/
352
353 /* This function is the reverse of string_printing2. It searches for
354 backslash characters and if any are found, it makes a new copy of the
355 string with escape sequences parsed. Otherwise it returns the original
356 string.
357
358 Arguments:
359 s the input string
360
361 Returns: string with printing escapes parsed back
362 */
363
364 uschar *
string_unprinting(uschar * s)365 string_unprinting(uschar *s)
366 {
367 uschar *p, *q, *r, *ss;
368 int len, off;
369
370 p = Ustrchr(s, '\\');
371 if (!p) return s;
372
373 len = Ustrlen(s) + 1;
374 ss = store_get(len, is_tainted(s));
375
376 q = ss;
377 off = p - s;
378 if (off)
379 {
380 memcpy(q, s, off);
381 q += off;
382 }
383
384 while (*p)
385 {
386 if (*p == '\\')
387 {
388 *q++ = string_interpret_escape((const uschar **)&p);
389 p++;
390 }
391 else
392 {
393 r = Ustrchr(p, '\\');
394 if (!r)
395 {
396 off = Ustrlen(p);
397 memcpy(q, p, off);
398 p += off;
399 q += off;
400 break;
401 }
402 else
403 {
404 off = r - p;
405 memcpy(q, p, off);
406 q += off;
407 p = r;
408 }
409 }
410 }
411 *q = '\0';
412
413 return ss;
414 }
415
416
417
418
419 #if (defined(HAVE_LOCAL_SCAN) || defined(EXPAND_DLFUNC)) \
420 && !defined(MACRO_PREDEF) && !defined(COMPILE_UTILITY)
421 /*************************************************
422 * Copy and save string *
423 *************************************************/
424
425 /*
426 Argument: string to copy
427 Returns: copy of string in new store with the same taint status
428 */
429
430 uschar *
string_copy_function(const uschar * s)431 string_copy_function(const uschar *s)
432 {
433 return string_copy_taint(s, is_tainted(s));
434 }
435
436 /* This function assumes that memcpy() is faster than strcpy().
437 As above, but explicitly specifying the result taint status
438 */
439
440 uschar *
string_copy_taint_function(const uschar * s,BOOL tainted)441 string_copy_taint_function(const uschar * s, BOOL tainted)
442 {
443 int len = Ustrlen(s) + 1;
444 uschar *ss = store_get(len, tainted);
445 memcpy(ss, s, len);
446 return ss;
447 }
448
449
450
451 /*************************************************
452 * Copy and save string, given length *
453 *************************************************/
454
455 /* It is assumed the data contains no zeros. A zero is added
456 onto the end.
457
458 Arguments:
459 s string to copy
460 n number of characters
461
462 Returns: copy of string in new store
463 */
464
465 uschar *
string_copyn_function(const uschar * s,int n)466 string_copyn_function(const uschar *s, int n)
467 {
468 uschar *ss = store_get(n + 1, is_tainted(s));
469 Ustrncpy(ss, s, n);
470 ss[n] = 0;
471 return ss;
472 }
473 #endif
474
475
476 /*************************************************
477 * Copy and save string in malloc'd store *
478 *************************************************/
479
480 /* This function assumes that memcpy() is faster than strcpy().
481
482 Argument: string to copy
483 Returns: copy of string in new store
484 */
485
486 uschar *
string_copy_malloc(const uschar * s)487 string_copy_malloc(const uschar *s)
488 {
489 int len = Ustrlen(s) + 1;
490 uschar *ss = store_malloc(len);
491 memcpy(ss, s, len);
492 return ss;
493 }
494
495
496
497 /*************************************************
498 * Copy string if long, inserting newlines *
499 *************************************************/
500
501 /* If the given string is longer than 75 characters, it is copied, and within
502 the copy, certain space characters are converted into newlines.
503
504 Argument: pointer to the string
505 Returns: pointer to the possibly altered string
506 */
507
508 uschar *
string_split_message(uschar * msg)509 string_split_message(uschar *msg)
510 {
511 uschar *s, *ss;
512
513 if (msg == NULL || Ustrlen(msg) <= 75) return msg;
514 s = ss = msg = string_copy(msg);
515
516 for (;;)
517 {
518 int i = 0;
519 while (i < 75 && *ss != 0 && *ss != '\n') ss++, i++;
520 if (*ss == 0) break;
521 if (*ss == '\n')
522 s = ++ss;
523 else
524 {
525 uschar *t = ss + 1;
526 uschar *tt = NULL;
527 while (--t > s + 35)
528 {
529 if (*t == ' ')
530 {
531 if (t[-1] == ':') { tt = t; break; }
532 if (tt == NULL) tt = t;
533 }
534 }
535
536 if (tt == NULL) /* Can't split behind - try ahead */
537 {
538 t = ss + 1;
539 while (*t != 0)
540 {
541 if (*t == ' ' || *t == '\n')
542 { tt = t; break; }
543 t++;
544 }
545 }
546
547 if (tt == NULL) break; /* Can't find anywhere to split */
548 *tt = '\n';
549 s = ss = tt+1;
550 }
551 }
552
553 return msg;
554 }
555
556
557
558 /*************************************************
559 * Copy returned DNS domain name, de-escaping *
560 *************************************************/
561
562 /* If a domain name contains top-bit characters, some resolvers return
563 the fully qualified name with those characters turned into escapes. The
564 convention is a backslash followed by _decimal_ digits. We convert these
565 back into the original binary values. This will be relevant when
566 allow_utf8_domains is set true and UTF-8 characters are used in domain
567 names. Backslash can also be used to escape other characters, though we
568 shouldn't come across them in domain names.
569
570 Argument: the domain name string
571 Returns: copy of string in new store, de-escaped
572 */
573
574 uschar *
string_copy_dnsdomain(uschar * s)575 string_copy_dnsdomain(uschar *s)
576 {
577 uschar *yield;
578 uschar *ss = yield = store_get(Ustrlen(s) + 1, TRUE); /* always treat as tainted */
579
580 while (*s != 0)
581 {
582 if (*s != '\\')
583 *ss++ = *s++;
584 else if (isdigit(s[1]))
585 {
586 *ss++ = (s[1] - '0')*100 + (s[2] - '0')*10 + s[3] - '0';
587 s += 4;
588 }
589 else if (*(++s) != 0)
590 *ss++ = *s++;
591 }
592
593 *ss = 0;
594 return yield;
595 }
596
597
598 #ifndef COMPILE_UTILITY
599 /*************************************************
600 * Copy space-terminated or quoted string *
601 *************************************************/
602
603 /* This function copies from a string until its end, or until whitespace is
604 encountered, unless the string begins with a double quote, in which case the
605 terminating quote is sought, and escaping within the string is done. The length
606 of a de-quoted string can be no longer than the original, since escaping always
607 turns n characters into 1 character.
608
609 Argument: pointer to the pointer to the first character, which gets updated
610 Returns: the new string
611 */
612
613 uschar *
string_dequote(const uschar ** sptr)614 string_dequote(const uschar **sptr)
615 {
616 const uschar *s = *sptr;
617 uschar *t, *yield;
618
619 /* First find the end of the string */
620
621 if (*s != '\"')
622 while (*s != 0 && !isspace(*s)) s++;
623 else
624 {
625 s++;
626 while (*s && *s != '\"')
627 {
628 if (*s == '\\') (void)string_interpret_escape(&s);
629 s++;
630 }
631 if (*s) s++;
632 }
633
634 /* Get enough store to copy into */
635
636 t = yield = store_get(s - *sptr + 1, is_tainted(*sptr));
637 s = *sptr;
638
639 /* Do the copy */
640
641 if (*s != '\"')
642 while (*s != 0 && !isspace(*s)) *t++ = *s++;
643 else
644 {
645 s++;
646 while (*s != 0 && *s != '\"')
647 {
648 *t++ = *s == '\\' ? string_interpret_escape(&s) : *s;
649 s++;
650 }
651 if (*s) s++;
652 }
653
654 /* Update the pointer and return the terminated copy */
655
656 *sptr = s;
657 *t = 0;
658 return yield;
659 }
660 #endif /* COMPILE_UTILITY */
661
662
663
664 /*************************************************
665 * Format a string and save it *
666 *************************************************/
667
668 /* The formatting is done by string_vformat, which checks the length of
669 everything. Taint is taken from the worst of the arguments.
670
671 Arguments:
672 format a printf() format - deliberately char * rather than uschar *
673 because it will most usually be a literal string
674 ... arguments for format
675
676 Returns: pointer to fresh piece of store containing sprintf'ed string
677 */
678
679 uschar *
string_sprintf_trc(const char * format,const uschar * func,unsigned line,...)680 string_sprintf_trc(const char *format, const uschar * func, unsigned line, ...)
681 {
682 #ifdef COMPILE_UTILITY
683 uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
684 gstring gs = { .size = STRING_SPRINTF_BUFFER_SIZE, .ptr = 0, .s = buffer };
685 gstring * g = &gs;
686 unsigned flags = 0;
687 #else
688 gstring * g = NULL;
689 unsigned flags = SVFMT_REBUFFER|SVFMT_EXTEND;
690 #endif
691
692 va_list ap;
693 va_start(ap, line);
694 g = string_vformat_trc(g, func, line, STRING_SPRINTF_BUFFER_SIZE,
695 flags, format, ap);
696 va_end(ap);
697
698 if (!g)
699 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
700 "string_sprintf expansion was longer than %d; format string was (%s)\n"
701 " called from %s %d\n",
702 STRING_SPRINTF_BUFFER_SIZE, format, func, line);
703
704 #ifdef COMPILE_UTILITY
705 return string_copyn(g->s, g->ptr);
706 #else
707 gstring_release_unused(g);
708 return string_from_gstring(g);
709 #endif
710 }
711
712
713
714 /*************************************************
715 * Case-independent strncmp() function *
716 *************************************************/
717
718 /*
719 Arguments:
720 s first string
721 t second string
722 n number of characters to compare
723
724 Returns: < 0, = 0, or > 0, according to the comparison
725 */
726
727 int
strncmpic(const uschar * s,const uschar * t,int n)728 strncmpic(const uschar *s, const uschar *t, int n)
729 {
730 while (n--)
731 {
732 int c = tolower(*s++) - tolower(*t++);
733 if (c) return c;
734 }
735 return 0;
736 }
737
738
739 /*************************************************
740 * Case-independent strcmp() function *
741 *************************************************/
742
743 /*
744 Arguments:
745 s first string
746 t second string
747
748 Returns: < 0, = 0, or > 0, according to the comparison
749 */
750
751 int
strcmpic(const uschar * s,const uschar * t)752 strcmpic(const uschar *s, const uschar *t)
753 {
754 while (*s != 0)
755 {
756 int c = tolower(*s++) - tolower(*t++);
757 if (c != 0) return c;
758 }
759 return *t;
760 }
761
762
763 /*************************************************
764 * Case-independent strstr() function *
765 *************************************************/
766
767 /* The third argument specifies whether whitespace is required
768 to follow the matched string.
769
770 Arguments:
771 s string to search
772 t substring to search for
773 space_follows if TRUE, match only if whitespace follows
774
775 Returns: pointer to substring in string, or NULL if not found
776 */
777
778 uschar *
strstric(uschar * s,uschar * t,BOOL space_follows)779 strstric(uschar *s, uschar *t, BOOL space_follows)
780 {
781 uschar *p = t;
782 uschar *yield = NULL;
783 int cl = tolower(*p);
784 int cu = toupper(*p);
785
786 while (*s)
787 {
788 if (*s == cl || *s == cu)
789 {
790 if (yield == NULL) yield = s;
791 if (*(++p) == 0)
792 {
793 if (!space_follows || s[1] == ' ' || s[1] == '\n' ) return yield;
794 yield = NULL;
795 p = t;
796 }
797 cl = tolower(*p);
798 cu = toupper(*p);
799 s++;
800 }
801 else if (yield != NULL)
802 {
803 yield = NULL;
804 p = t;
805 cl = tolower(*p);
806 cu = toupper(*p);
807 }
808 else s++;
809 }
810 return NULL;
811 }
812
813
814
815 #ifdef COMPILE_UTILITY
816 /* Dummy version for this function; it should never be called */
817 static void
gstring_grow(gstring * g,int count)818 gstring_grow(gstring * g, int count)
819 {
820 assert(FALSE);
821 }
822 #endif
823
824
825
826 #ifndef COMPILE_UTILITY
827 /*************************************************
828 * Get next string from separated list *
829 *************************************************/
830
831 /* Leading and trailing space is removed from each item. The separator in the
832 list is controlled by the int pointed to by the separator argument as follows:
833
834 If the value is > 0 it is used as the separator. This is typically used for
835 sublists such as slash-separated options. The value is always a printing
836 character.
837
838 (If the value is actually > UCHAR_MAX there is only one item in the list.
839 This is used for some cases when called via functions that sometimes
840 plough through lists, and sometimes are given single items.)
841
842 If the value is <= 0, the string is inspected for a leading <x, where x is an
843 ispunct() or an iscntrl() character. If found, x is used as the separator. If
844 not found:
845
846 (a) if separator == 0, ':' is used
847 (b) if separator <0, -separator is used
848
849 In all cases the value of the separator that is used is written back to the
850 int so that it is used on subsequent calls as we progress through the list.
851
852 A literal ispunct() separator can be represented in an item by doubling, but
853 there is no way to include an iscntrl() separator as part of the data.
854
855 Arguments:
856 listptr points to a pointer to the current start of the list; the
857 pointer gets updated to point after the end of the next item
858 separator a pointer to the separator character in an int (see above)
859 buffer where to put a copy of the next string in the list; or
860 NULL if the next string is returned in new memory
861 Note that if the list is tainted then a provided buffer must be
862 also (else we trap, with a message referencing the callsite).
863 If we do the allocation, taint is handled there.
864 buflen when buffer is not NULL, the size of buffer; otherwise ignored
865
866 Returns: pointer to buffer, containing the next substring,
867 or NULL if no more substrings
868 */
869
870 uschar *
string_nextinlist_trc(const uschar ** listptr,int * separator,uschar * buffer,int buflen,const uschar * func,int line)871 string_nextinlist_trc(const uschar **listptr, int *separator, uschar *buffer, int buflen,
872 const uschar * func, int line)
873 {
874 int sep = *separator;
875 const uschar *s = *listptr;
876 BOOL sep_is_special;
877
878 if (!s) return NULL;
879
880 /* This allows for a fixed specified separator to be an iscntrl() character,
881 but at the time of implementation, this is never the case. However, it's best
882 to be conservative. */
883
884 while (isspace(*s) && *s != sep) s++;
885
886 /* A change of separator is permitted, so look for a leading '<' followed by an
887 allowed character. */
888
889 if (sep <= 0)
890 {
891 if (*s == '<' && (ispunct(s[1]) || iscntrl(s[1])))
892 {
893 sep = s[1];
894 if (*++s) ++s;
895 while (isspace(*s) && *s != sep) s++;
896 }
897 else
898 sep = sep ? -sep : ':';
899 *separator = sep;
900 }
901
902 /* An empty string has no list elements */
903
904 if (!*s) return NULL;
905
906 /* Note whether whether or not the separator is an iscntrl() character. */
907
908 sep_is_special = iscntrl(sep);
909
910 /* Handle the case when a buffer is provided. */
911
912 if (buffer)
913 {
914 int p = 0;
915 if (is_tainted(s) && !is_tainted(buffer))
916 die_tainted(US"string_nextinlist", func, line);
917 for (; *s; s++)
918 {
919 if (*s == sep && (*(++s) != sep || sep_is_special)) break;
920 if (p < buflen - 1) buffer[p++] = *s;
921 }
922 while (p > 0 && isspace(buffer[p-1])) p--;
923 buffer[p] = '\0';
924 }
925
926 /* Handle the case when a buffer is not provided. */
927
928 else
929 {
930 gstring * g = NULL;
931
932 /* We know that *s != 0 at this point. However, it might be pointing to a
933 separator, which could indicate an empty string, or (if an ispunct()
934 character) could be doubled to indicate a separator character as data at the
935 start of a string. Avoid getting working memory for an empty item. */
936
937 if (*s == sep)
938 if (*++s != sep || sep_is_special)
939 {
940 *listptr = s;
941 return string_copy(US"");
942 }
943
944 /* Not an empty string; the first character is guaranteed to be a data
945 character. */
946
947 for (;;)
948 {
949 const uschar * ss;
950 for (ss = s + 1; *ss && *ss != sep; ) ss++;
951 g = string_catn(g, s, ss-s);
952 s = ss;
953 if (!*s || *++s != sep || sep_is_special) break;
954 }
955
956 /* Trim trailing spaces from the returned string */
957
958 /* while (g->ptr > 0 && isspace(g->s[g->ptr-1])) g->ptr--; */
959 while ( g->ptr > 0 && isspace(g->s[g->ptr-1])
960 && (g->ptr == 1 || g->s[g->ptr-2] != '\\') )
961 g->ptr--;
962 buffer = string_from_gstring(g);
963 gstring_release_unused_trc(g, CCS func, line);
964 }
965
966 /* Update the current pointer and return the new string */
967
968 *listptr = s;
969 return buffer;
970 }
971
972
973 static const uschar *
Ustrnchr(const uschar * s,int c,unsigned * len)974 Ustrnchr(const uschar * s, int c, unsigned * len)
975 {
976 unsigned siz = *len;
977 while (siz)
978 {
979 if (!*s) return NULL;
980 if (*s == c)
981 {
982 *len = siz;
983 return s;
984 }
985 s++;
986 siz--;
987 }
988 return NULL;
989 }
990
991
992 /************************************************
993 * Add element to separated list *
994 ************************************************/
995 /* This function is used to build a list, returning an allocated null-terminated
996 growable string. The given element has any embedded separator characters
997 doubled.
998
999 Despite having the same growable-string interface as string_cat() the list is
1000 always returned null-terminated.
1001
1002 Arguments:
1003 list expanding-string for the list that is being built, or NULL
1004 if this is a new list that has no contents yet
1005 sep list separator character
1006 ele new element to be appended to the list
1007
1008 Returns: pointer to the start of the list, changed if copied for expansion.
1009 */
1010
1011 gstring *
string_append_listele(gstring * list,uschar sep,const uschar * ele)1012 string_append_listele(gstring * list, uschar sep, const uschar * ele)
1013 {
1014 uschar * sp;
1015
1016 if (list && list->ptr)
1017 list = string_catn(list, &sep, 1);
1018
1019 while((sp = Ustrchr(ele, sep)))
1020 {
1021 list = string_catn(list, ele, sp-ele+1);
1022 list = string_catn(list, &sep, 1);
1023 ele = sp+1;
1024 }
1025 list = string_cat(list, ele);
1026 (void) string_from_gstring(list);
1027 return list;
1028 }
1029
1030
1031 gstring *
string_append_listele_n(gstring * list,uschar sep,const uschar * ele,unsigned len)1032 string_append_listele_n(gstring * list, uschar sep, const uschar * ele,
1033 unsigned len)
1034 {
1035 const uschar * sp;
1036
1037 if (list && list->ptr)
1038 list = string_catn(list, &sep, 1);
1039
1040 while((sp = Ustrnchr(ele, sep, &len)))
1041 {
1042 list = string_catn(list, ele, sp-ele+1);
1043 list = string_catn(list, &sep, 1);
1044 ele = sp+1;
1045 len--;
1046 }
1047 list = string_catn(list, ele, len);
1048 (void) string_from_gstring(list);
1049 return list;
1050 }
1051
1052
1053
1054 /* A slightly-bogus listmaker utility; the separator is a string so
1055 can be multiple chars - there is no checking for the element content
1056 containing any of the separator. */
1057
1058 gstring *
string_append2_listele_n(gstring * list,const uschar * sepstr,const uschar * ele,unsigned len)1059 string_append2_listele_n(gstring * list, const uschar * sepstr,
1060 const uschar * ele, unsigned len)
1061 {
1062 if (list && list->ptr)
1063 list = string_cat(list, sepstr);
1064
1065 list = string_catn(list, ele, len);
1066 (void) string_from_gstring(list);
1067 return list;
1068 }
1069
1070
1071
1072 /************************************************/
1073 /* Add more space to a growable-string. The caller should check
1074 first if growth is required. The gstring struct is modified on
1075 return; specifically, the string-base-pointer may have been changed.
1076
1077 Arguments:
1078 g the growable-string
1079 count amount needed for g->ptr to increase by
1080 */
1081
1082 static void
gstring_grow(gstring * g,int count)1083 gstring_grow(gstring * g, int count)
1084 {
1085 int p = g->ptr;
1086 int oldsize = g->size;
1087 BOOL tainted = is_tainted(g->s);
1088
1089 /* Mostly, string_cat() is used to build small strings of a few hundred
1090 characters at most. There are times, however, when the strings are very much
1091 longer (for example, a lookup that returns a vast number of alias addresses).
1092 To try to keep things reasonable, we use increments whose size depends on the
1093 existing length of the string. */
1094
1095 unsigned inc = oldsize < 4096 ? 127 : 1023;
1096
1097 if (g->ptr < 0 || g->ptr > g->size || g->size >= INT_MAX/2)
1098 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
1099 "internal error in gstring_grow (ptr %d size %d)", g->ptr, g->size);
1100
1101 if (count <= 0) return;
1102
1103 if (count >= INT_MAX/2 - g->ptr)
1104 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
1105 "internal error in gstring_grow (ptr %d count %d)", g->ptr, count);
1106
1107 g->size = (p + count + inc + 1) & ~inc; /* one for a NUL */
1108
1109 /* Try to extend an existing allocation. If the result of calling
1110 store_extend() is false, either there isn't room in the current memory block,
1111 or this string is not the top item on the dynamic store stack. We then have
1112 to get a new chunk of store and copy the old string. When building large
1113 strings, it is helpful to call store_release() on the old string, to release
1114 memory blocks that have become empty. (The block will be freed if the string
1115 is at its start.) However, we can do this only if we know that the old string
1116 was the last item on the dynamic memory stack. This is the case if it matches
1117 store_last_get. */
1118
1119 if (!store_extend(g->s, tainted, oldsize, g->size))
1120 g->s = store_newblock(g->s, tainted, g->size, p);
1121 }
1122
1123
1124
1125 /*************************************************
1126 * Add chars to string *
1127 *************************************************/
1128 /* This function is used when building up strings of unknown length. Room is
1129 always left for a terminating zero to be added to the string that is being
1130 built. This function does not require the string that is being added to be NUL
1131 terminated, because the number of characters to add is given explicitly. It is
1132 sometimes called to extract parts of other strings.
1133
1134 Arguments:
1135 string points to the start of the string that is being built, or NULL
1136 if this is a new string that has no contents yet
1137 s points to characters to add
1138 count count of characters to add; must not exceed the length of s, if s
1139 is a C string.
1140
1141 Returns: pointer to the start of the string, changed if copied for expansion.
1142 Note that a NUL is not added, though space is left for one. This is
1143 because string_cat() is often called multiple times to build up a
1144 string - there's no point adding the NUL till the end.
1145
1146 */
1147 /* coverity[+alloc] */
1148
1149 gstring *
string_catn(gstring * g,const uschar * s,int count)1150 string_catn(gstring * g, const uschar *s, int count)
1151 {
1152 int p;
1153 BOOL srctaint = is_tainted(s);
1154
1155 if (count < 0)
1156 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
1157 "internal error in string_catn (count %d)", count);
1158
1159 if (!g)
1160 {
1161 unsigned inc = count < 4096 ? 127 : 1023;
1162 unsigned size = ((count + inc) & ~inc) + 1; /* round up requested count */
1163 g = string_get_tainted(size, srctaint);
1164 }
1165 else if (srctaint && !is_tainted(g->s))
1166 gstring_rebuffer(g);
1167
1168 if (g->ptr < 0 || g->ptr > g->size)
1169 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
1170 "internal error in string_catn (ptr %d size %d)", g->ptr, g->size);
1171
1172 p = g->ptr;
1173 if (count >= g->size - p)
1174 gstring_grow(g, count);
1175
1176 /* Because we always specify the exact number of characters to copy, we can
1177 use memcpy(), which is likely to be more efficient than strncopy() because the
1178 latter has to check for zero bytes. */
1179
1180 memcpy(g->s + p, s, count);
1181 g->ptr = p + count;
1182 return g;
1183 }
1184
1185
1186 gstring *
string_cat(gstring * string,const uschar * s)1187 string_cat(gstring *string, const uschar *s)
1188 {
1189 return string_catn(string, s, Ustrlen(s));
1190 }
1191
1192
1193
1194 /*************************************************
1195 * Append strings to another string *
1196 *************************************************/
1197
1198 /* This function can be used to build a string from many other strings.
1199 It calls string_cat() to do the dirty work.
1200
1201 Arguments:
1202 string expanding-string that is being built, or NULL
1203 if this is a new string that has no contents yet
1204 count the number of strings to append
1205 ... "count" uschar* arguments, which must be valid zero-terminated
1206 C strings
1207
1208 Returns: pointer to the start of the string, changed if copied for expansion.
1209 The string is not zero-terminated - see string_cat() above.
1210 */
1211
1212 __inline__ gstring *
string_append(gstring * string,int count,...)1213 string_append(gstring *string, int count, ...)
1214 {
1215 va_list ap;
1216
1217 va_start(ap, count);
1218 while (count-- > 0)
1219 {
1220 uschar *t = va_arg(ap, uschar *);
1221 string = string_cat(string, t);
1222 }
1223 va_end(ap);
1224
1225 return string;
1226 }
1227 #endif
1228
1229
1230
1231 /*************************************************
1232 * Format a string with length checks *
1233 *************************************************/
1234
1235 /* This function is used to format a string with checking of the length of the
1236 output for all conversions. It protects Exim from absent-mindedness when
1237 calling functions like debug_printf and string_sprintf, and elsewhere. There
1238 are two different entry points to what is actually the same function, depending
1239 on whether the variable length list of data arguments are given explicitly or
1240 as a va_list item.
1241
1242 The formats are the usual printf() ones, with some omissions (never used) and
1243 three additions for strings: %S forces lower case, %T forces upper case, and
1244 %#s or %#S prints nothing for a NULL string. Without the # "NULL" is printed
1245 (useful in debugging). There is also the addition of %D and %M, which insert
1246 the date in the form used for datestamped log files.
1247
1248 Arguments:
1249 buffer a buffer in which to put the formatted string
1250 buflen the length of the buffer
1251 format the format string - deliberately char * and not uschar *
1252 ... or ap variable list of supplementary arguments
1253
1254 Returns: TRUE if the result fitted in the buffer
1255 */
1256
1257 BOOL
string_format_trc(uschar * buffer,int buflen,const uschar * func,unsigned line,const char * format,...)1258 string_format_trc(uschar * buffer, int buflen,
1259 const uschar * func, unsigned line, const char * format, ...)
1260 {
1261 gstring g = { .size = buflen, .ptr = 0, .s = buffer }, *gp;
1262 va_list ap;
1263 va_start(ap, format);
1264 gp = string_vformat_trc(&g, func, line, STRING_SPRINTF_BUFFER_SIZE,
1265 0, format, ap);
1266 va_end(ap);
1267 g.s[g.ptr] = '\0';
1268 return !!gp;
1269 }
1270
1271
1272
1273
1274 /* Build or append to a growing-string, sprintf-style.
1275
1276 Arguments:
1277 g a growable-string
1278 func called-from function name, for debug
1279 line called-from file line number, for debug
1280 limit maximum string size
1281 flags see below
1282 format printf-like format string
1283 ap variable-args pointer
1284
1285 Flags:
1286 SVFMT_EXTEND buffer can be created or exteded as needed
1287 SVFMT_REBUFFER buffer can be recopied to tainted mem as needed
1288 SVFMT_TAINT_NOCHK do not check inputs for taint
1289
1290 If the "extend" flag is true, the string passed in can be NULL,
1291 empty, or non-empty. Growing is subject to an overall limit given
1292 by the limit argument.
1293
1294 If the "extend" flag is false, the string passed in may not be NULL,
1295 will not be grown, and is usable in the original place after return.
1296 The return value can be NULL to signify overflow.
1297
1298 Returns the possibly-new (if copy for growth or taint-handling was needed)
1299 string, not nul-terminated.
1300 */
1301
1302 gstring *
string_vformat_trc(gstring * g,const uschar * func,unsigned line,unsigned size_limit,unsigned flags,const char * format,va_list ap)1303 string_vformat_trc(gstring * g, const uschar * func, unsigned line,
1304 unsigned size_limit, unsigned flags, const char *format, va_list ap)
1305 {
1306 enum ltypes { L_NORMAL=1, L_SHORT=2, L_LONG=3, L_LONGLONG=4, L_LONGDOUBLE=5, L_SIZE=6 };
1307
1308 int width, precision, off, lim, need;
1309 const char * fp = format; /* Deliberately not unsigned */
1310 BOOL dest_tainted = FALSE;
1311
1312 string_datestamp_offset = -1; /* Datestamp not inserted */
1313 string_datestamp_length = 0; /* Datestamp not inserted */
1314 string_datestamp_type = 0; /* Datestamp not inserted */
1315
1316 #ifdef COMPILE_UTILITY
1317 assert(!(flags & SVFMT_EXTEND));
1318 assert(g);
1319 #else
1320
1321 /* Ensure we have a string, to save on checking later */
1322 if (!g) g = string_get(16);
1323 else if (!(flags & SVFMT_TAINT_NOCHK)) dest_tainted = is_tainted(g->s);
1324
1325 if (!(flags & SVFMT_TAINT_NOCHK) && !dest_tainted && is_tainted(format))
1326 {
1327 #ifndef MACRO_PREDEF
1328 if (!(flags & SVFMT_REBUFFER))
1329 die_tainted(US"string_vformat", func, line);
1330 #endif
1331 gstring_rebuffer(g);
1332 dest_tainted = TRUE;
1333 }
1334 #endif /*!COMPILE_UTILITY*/
1335
1336 lim = g->size - 1; /* leave one for a nul */
1337 off = g->ptr; /* remember initial offset in gstring */
1338
1339 /* Scan the format and handle the insertions */
1340
1341 while (*fp)
1342 {
1343 int length = L_NORMAL;
1344 int *nptr;
1345 int slen;
1346 const char *null = "NULL"; /* ) These variables */
1347 const char *item_start, *s; /* ) are deliberately */
1348 char newformat[16]; /* ) not unsigned */
1349 char * gp = CS g->s + g->ptr; /* ) */
1350
1351 /* Non-% characters just get copied verbatim */
1352
1353 if (*fp != '%')
1354 {
1355 /* Avoid string_copyn() due to COMPILE_UTILITY */
1356 if ((need = g->ptr + 1) > lim)
1357 {
1358 if (!(flags & SVFMT_EXTEND) || need > size_limit) return NULL;
1359 gstring_grow(g, 1);
1360 lim = g->size - 1;
1361 }
1362 g->s[g->ptr++] = (uschar) *fp++;
1363 continue;
1364 }
1365
1366 /* Deal with % characters. Pick off the width and precision, for checking
1367 strings, skipping over the flag and modifier characters. */
1368
1369 item_start = fp;
1370 width = precision = -1;
1371
1372 if (strchr("-+ #0", *(++fp)) != NULL)
1373 {
1374 if (*fp == '#') null = "";
1375 fp++;
1376 }
1377
1378 if (isdigit((uschar)*fp))
1379 {
1380 width = *fp++ - '0';
1381 while (isdigit((uschar)*fp)) width = width * 10 + *fp++ - '0';
1382 }
1383 else if (*fp == '*')
1384 {
1385 width = va_arg(ap, int);
1386 fp++;
1387 }
1388
1389 if (*fp == '.')
1390 if (*(++fp) == '*')
1391 {
1392 precision = va_arg(ap, int);
1393 fp++;
1394 }
1395 else
1396 for (precision = 0; isdigit((uschar)*fp); fp++)
1397 precision = precision*10 + *fp - '0';
1398
1399 /* Skip over 'h', 'L', 'l', 'll' and 'z', remembering the item length */
1400
1401 if (*fp == 'h')
1402 { fp++; length = L_SHORT; }
1403 else if (*fp == 'L')
1404 { fp++; length = L_LONGDOUBLE; }
1405 else if (*fp == 'l')
1406 if (fp[1] == 'l')
1407 { fp += 2; length = L_LONGLONG; }
1408 else
1409 { fp++; length = L_LONG; }
1410 else if (*fp == 'z')
1411 { fp++; length = L_SIZE; }
1412
1413 /* Handle each specific format type. */
1414
1415 switch (*fp++)
1416 {
1417 case 'n':
1418 nptr = va_arg(ap, int *);
1419 *nptr = g->ptr - off;
1420 break;
1421
1422 case 'd':
1423 case 'o':
1424 case 'u':
1425 case 'x':
1426 case 'X':
1427 width = length > L_LONG ? 24 : 12;
1428 if ((need = g->ptr + width) > lim)
1429 {
1430 if (!(flags & SVFMT_EXTEND) || need >= size_limit) return NULL;
1431 gstring_grow(g, width);
1432 lim = g->size - 1;
1433 gp = CS g->s + g->ptr;
1434 }
1435 strncpy(newformat, item_start, fp - item_start);
1436 newformat[fp - item_start] = 0;
1437
1438 /* Short int is promoted to int when passing through ..., so we must use
1439 int for va_arg(). */
1440
1441 switch(length)
1442 {
1443 case L_SHORT:
1444 case L_NORMAL:
1445 g->ptr += sprintf(gp, newformat, va_arg(ap, int)); break;
1446 case L_LONG:
1447 g->ptr += sprintf(gp, newformat, va_arg(ap, long int)); break;
1448 case L_LONGLONG:
1449 g->ptr += sprintf(gp, newformat, va_arg(ap, LONGLONG_T)); break;
1450 case L_SIZE:
1451 g->ptr += sprintf(gp, newformat, va_arg(ap, size_t)); break;
1452 }
1453 break;
1454
1455 case 'p':
1456 {
1457 void * ptr;
1458 if ((need = g->ptr + 24) > lim)
1459 {
1460 if (!(flags & SVFMT_EXTEND || need >= size_limit)) return NULL;
1461 gstring_grow(g, 24);
1462 lim = g->size - 1;
1463 gp = CS g->s + g->ptr;
1464 }
1465 /* sprintf() saying "(nil)" for a null pointer seems unreliable.
1466 Handle it explicitly. */
1467 if ((ptr = va_arg(ap, void *)))
1468 {
1469 strncpy(newformat, item_start, fp - item_start);
1470 newformat[fp - item_start] = 0;
1471 g->ptr += sprintf(gp, newformat, ptr);
1472 }
1473 else
1474 g->ptr += sprintf(gp, "(nil)");
1475 }
1476 break;
1477
1478 /* %f format is inherently insecure if the numbers that it may be
1479 handed are unknown (e.g. 1e300). However, in Exim, %f is used for
1480 printing load averages, and these are actually stored as integers
1481 (load average * 1000) so the size of the numbers is constrained.
1482 It is also used for formatting sending rates, where the simplicity
1483 of the format prevents overflow. */
1484
1485 case 'f':
1486 case 'e':
1487 case 'E':
1488 case 'g':
1489 case 'G':
1490 if (precision < 0) precision = 6;
1491 if ((need = g->ptr + precision + 8) > lim)
1492 {
1493 if (!(flags & SVFMT_EXTEND || need >= size_limit)) return NULL;
1494 gstring_grow(g, precision+8);
1495 lim = g->size - 1;
1496 gp = CS g->s + g->ptr;
1497 }
1498 strncpy(newformat, item_start, fp - item_start);
1499 newformat[fp-item_start] = 0;
1500 if (length == L_LONGDOUBLE)
1501 g->ptr += sprintf(gp, newformat, va_arg(ap, long double));
1502 else
1503 g->ptr += sprintf(gp, newformat, va_arg(ap, double));
1504 break;
1505
1506 /* String types */
1507
1508 case '%':
1509 if ((need = g->ptr + 1) > lim)
1510 {
1511 if (!(flags & SVFMT_EXTEND || need >= size_limit)) return NULL;
1512 gstring_grow(g, 1);
1513 lim = g->size - 1;
1514 }
1515 g->s[g->ptr++] = (uschar) '%';
1516 break;
1517
1518 case 'c':
1519 if ((need = g->ptr + 1) > lim)
1520 {
1521 if (!(flags & SVFMT_EXTEND || need >= size_limit)) return NULL;
1522 gstring_grow(g, 1);
1523 lim = g->size - 1;
1524 }
1525 g->s[g->ptr++] = (uschar) va_arg(ap, int);
1526 break;
1527
1528 case 'D': /* Insert daily datestamp for log file names */
1529 s = CS tod_stamp(tod_log_datestamp_daily);
1530 string_datestamp_offset = g->ptr; /* Passed back via global */
1531 string_datestamp_length = Ustrlen(s); /* Passed back via global */
1532 string_datestamp_type = tod_log_datestamp_daily;
1533 slen = string_datestamp_length;
1534 goto INSERT_STRING;
1535
1536 case 'M': /* Insert monthly datestamp for log file names */
1537 s = CS tod_stamp(tod_log_datestamp_monthly);
1538 string_datestamp_offset = g->ptr; /* Passed back via global */
1539 string_datestamp_length = Ustrlen(s); /* Passed back via global */
1540 string_datestamp_type = tod_log_datestamp_monthly;
1541 slen = string_datestamp_length;
1542 goto INSERT_STRING;
1543
1544 case 's':
1545 case 'S': /* Forces *lower* case */
1546 case 'T': /* Forces *upper* case */
1547 s = va_arg(ap, char *);
1548
1549 if (!s) s = null;
1550 slen = Ustrlen(s);
1551
1552 if (!(flags & SVFMT_TAINT_NOCHK) && !dest_tainted && is_tainted(s))
1553 if (flags & SVFMT_REBUFFER)
1554 {
1555 gstring_rebuffer(g);
1556 gp = CS g->s + g->ptr;
1557 dest_tainted = TRUE;
1558 }
1559 #ifndef MACRO_PREDEF
1560 else
1561 die_tainted(US"string_vformat", func, line);
1562 #endif
1563
1564 INSERT_STRING: /* Come to from %D or %M above */
1565
1566 {
1567 BOOL truncated = FALSE;
1568
1569 /* If the width is specified, check that there is a precision
1570 set; if not, set it to the width to prevent overruns of long
1571 strings. */
1572
1573 if (width >= 0)
1574 {
1575 if (precision < 0) precision = width;
1576 }
1577
1578 /* If a width is not specified and the precision is specified, set
1579 the width to the precision, or the string length if shorted. */
1580
1581 else if (precision >= 0)
1582 width = precision < slen ? precision : slen;
1583
1584 /* If neither are specified, set them both to the string length. */
1585
1586 else
1587 width = precision = slen;
1588
1589 if ((need = g->ptr + width) >= size_limit || !(flags & SVFMT_EXTEND))
1590 {
1591 if (g->ptr == lim) return NULL;
1592 if (need > lim)
1593 {
1594 truncated = TRUE;
1595 width = precision = lim - g->ptr - 1;
1596 if (width < 0) width = 0;
1597 if (precision < 0) precision = 0;
1598 }
1599 }
1600 else if (need > lim)
1601 {
1602 gstring_grow(g, width);
1603 lim = g->size - 1;
1604 gp = CS g->s + g->ptr;
1605 }
1606
1607 g->ptr += sprintf(gp, "%*.*s", width, precision, s);
1608 if (fp[-1] == 'S')
1609 while (*gp) { *gp = tolower(*gp); gp++; }
1610 else if (fp[-1] == 'T')
1611 while (*gp) { *gp = toupper(*gp); gp++; }
1612
1613 if (truncated) return NULL;
1614 break;
1615 }
1616
1617 /* Some things are never used in Exim; also catches junk. */
1618
1619 default:
1620 strncpy(newformat, item_start, fp - item_start);
1621 newformat[fp-item_start] = 0;
1622 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "string_format: unsupported type "
1623 "in \"%s\" in \"%s\"", newformat, format);
1624 break;
1625 }
1626 }
1627
1628 if (g->ptr > g->size)
1629 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
1630 "string_format internal error: caller %s %d", func, line);
1631 return g;
1632 }
1633
1634
1635
1636 #ifndef COMPILE_UTILITY
1637 /*************************************************
1638 * Generate an "open failed" message *
1639 *************************************************/
1640
1641 /* This function creates a message after failure to open a file. It includes a
1642 string supplied as data, adds the strerror() text, and if the failure was
1643 "Permission denied", reads and includes the euid and egid.
1644
1645 Arguments:
1646 format a text format string - deliberately not uschar *
1647 ... arguments for the format string
1648
1649 Returns: a message, in dynamic store
1650 */
1651
1652 uschar *
string_open_failed_trc(const uschar * func,unsigned line,const char * format,...)1653 string_open_failed_trc(const uschar * func, unsigned line,
1654 const char *format, ...)
1655 {
1656 va_list ap;
1657 gstring * g = string_get(1024);
1658
1659 g = string_catn(g, US"failed to open ", 15);
1660
1661 /* Use the checked formatting routine to ensure that the buffer
1662 does not overflow. It should not, since this is called only for internally
1663 specified messages. If it does, the message just gets truncated, and there
1664 doesn't seem much we can do about that. */
1665
1666 va_start(ap, format);
1667 (void) string_vformat_trc(g, func, line, STRING_SPRINTF_BUFFER_SIZE,
1668 SVFMT_REBUFFER, format, ap);
1669 va_end(ap);
1670
1671 g = string_catn(g, US": ", 2);
1672 g = string_cat(g, US strerror(errno));
1673
1674 if (errno == EACCES)
1675 {
1676 int save_errno = errno;
1677 g = string_fmt_append(g, " (euid=%ld egid=%ld)",
1678 (long int)geteuid(), (long int)getegid());
1679 errno = save_errno;
1680 }
1681 gstring_release_unused(g);
1682 return string_from_gstring(g);
1683 }
1684
1685
1686
1687
1688
1689 /* qsort(3), currently used to sort the environment variables
1690 for -bP environment output, needs a function to compare two pointers to string
1691 pointers. Here it is. */
1692
1693 int
string_compare_by_pointer(const void * a,const void * b)1694 string_compare_by_pointer(const void *a, const void *b)
1695 {
1696 return Ustrcmp(* CUSS a, * CUSS b);
1697 }
1698 #endif /* COMPILE_UTILITY */
1699
1700
1701
1702
1703 /*************************************************
1704 **************************************************
1705 * Stand-alone test program *
1706 **************************************************
1707 *************************************************/
1708
1709 #ifdef STAND_ALONE
main(void)1710 int main(void)
1711 {
1712 uschar buffer[256];
1713
1714 printf("Testing is_ip_address\n");
1715 store_init();
1716
1717 while (fgets(CS buffer, sizeof(buffer), stdin) != NULL)
1718 {
1719 int offset;
1720 buffer[Ustrlen(buffer) - 1] = 0;
1721 printf("%d\n", string_is_ip_address(buffer, NULL));
1722 printf("%d %d %s\n", string_is_ip_address(buffer, &offset), offset, buffer);
1723 }
1724
1725 printf("Testing string_nextinlist\n");
1726
1727 while (fgets(CS buffer, sizeof(buffer), stdin) != NULL)
1728 {
1729 uschar *list = buffer;
1730 uschar *lp1, *lp2;
1731 uschar item[256];
1732 int sep1 = 0;
1733 int sep2 = 0;
1734
1735 if (*list == '<')
1736 {
1737 sep1 = sep2 = list[1];
1738 list += 2;
1739 }
1740
1741 lp1 = lp2 = list;
1742 for (;;)
1743 {
1744 uschar *item1 = string_nextinlist(&lp1, &sep1, item, sizeof(item));
1745 uschar *item2 = string_nextinlist(&lp2, &sep2, NULL, 0);
1746
1747 if (item1 == NULL && item2 == NULL) break;
1748 if (item == NULL || item2 == NULL || Ustrcmp(item1, item2) != 0)
1749 {
1750 printf("***ERROR\nitem1=\"%s\"\nitem2=\"%s\"\n",
1751 (item1 == NULL)? "NULL" : CS item1,
1752 (item2 == NULL)? "NULL" : CS item2);
1753 break;
1754 }
1755 else printf(" \"%s\"\n", CS item1);
1756 }
1757 }
1758
1759 /* This is a horrible lash-up, but it serves its purpose. */
1760
1761 printf("Testing string_format\n");
1762
1763 while (fgets(CS buffer, sizeof(buffer), stdin) != NULL)
1764 {
1765 void *args[3];
1766 long long llargs[3];
1767 double dargs[3];
1768 int dflag = 0;
1769 int llflag = 0;
1770 int n = 0;
1771 int count;
1772 int countset = 0;
1773 uschar format[256];
1774 uschar outbuf[256];
1775 uschar *s;
1776 buffer[Ustrlen(buffer) - 1] = 0;
1777
1778 s = Ustrchr(buffer, ',');
1779 if (s == NULL) s = buffer + Ustrlen(buffer);
1780
1781 Ustrncpy(format, buffer, s - buffer);
1782 format[s-buffer] = 0;
1783
1784 if (*s == ',') s++;
1785
1786 while (*s != 0)
1787 {
1788 uschar *ss = s;
1789 s = Ustrchr(ss, ',');
1790 if (s == NULL) s = ss + Ustrlen(ss);
1791
1792 if (isdigit(*ss))
1793 {
1794 Ustrncpy(outbuf, ss, s-ss);
1795 if (Ustrchr(outbuf, '.') != NULL)
1796 {
1797 dflag = 1;
1798 dargs[n++] = Ustrtod(outbuf, NULL);
1799 }
1800 else if (Ustrstr(outbuf, "ll") != NULL)
1801 {
1802 llflag = 1;
1803 llargs[n++] = strtoull(CS outbuf, NULL, 10);
1804 }
1805 else
1806 {
1807 args[n++] = (void *)Uatoi(outbuf);
1808 }
1809 }
1810
1811 else if (Ustrcmp(ss, "*") == 0)
1812 {
1813 args[n++] = (void *)(&count);
1814 countset = 1;
1815 }
1816
1817 else
1818 {
1819 uschar *sss = malloc(s - ss + 1);
1820 Ustrncpy(sss, ss, s-ss);
1821 args[n++] = sss;
1822 }
1823
1824 if (*s == ',') s++;
1825 }
1826
1827 if (!dflag && !llflag)
1828 printf("%s\n", string_format(outbuf, sizeof(outbuf), CS format,
1829 args[0], args[1], args[2])? "True" : "False");
1830
1831 else if (dflag)
1832 printf("%s\n", string_format(outbuf, sizeof(outbuf), CS format,
1833 dargs[0], dargs[1], dargs[2])? "True" : "False");
1834
1835 else printf("%s\n", string_format(outbuf, sizeof(outbuf), CS format,
1836 llargs[0], llargs[1], llargs[2])? "True" : "False");
1837
1838 printf("%s\n", CS outbuf);
1839 if (countset) printf("count=%d\n", count);
1840 }
1841
1842 return 0;
1843 }
1844 #endif
1845
1846 /* End of string.c */
1847