1 /* $OpenBSD: utf8.c,v 1.11 2020/05/01 06:28:52 djm Exp $ */ 2 /* 3 * Copyright (c) 2016 Ingo Schwarze <schwarze@openbsd.org> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 /* 19 * Utility functions for multibyte-character handling, 20 * in particular to sanitize untrusted strings for terminal output. 21 */ 22 23 #include <sys/types.h> 24 #include <langinfo.h> 25 #include <limits.h> 26 #include <stdarg.h> 27 #include <stdio.h> 28 #include <stdlib.h> 29 #include <string.h> 30 #include <vis.h> 31 #include <wchar.h> 32 33 #include "utf8.h" 34 35 static int dangerous_locale(void); 36 static int grow_dst(char **, size_t *, size_t, char **, size_t); 37 38 39 /* 40 * For US-ASCII and UTF-8 encodings, we can safely recover from 41 * encoding errors and from non-printable characters. For any 42 * other encodings, err to the side of caution and abort parsing: 43 * For state-dependent encodings, recovery is impossible. 44 * For arbitrary encodings, replacement of non-printable 45 * characters would be non-trivial and too fragile. 46 * The comments indicate what nl_langinfo(CODESET) 47 * returns for US-ASCII on various operating systems. 48 */ 49 50 static int 51 dangerous_locale(void) { 52 char *loc; 53 54 loc = nl_langinfo(CODESET); 55 return strcmp(loc, "UTF-8") != 0 && 56 strcmp(loc, "US-ASCII") != 0 && /* OpenBSD */ 57 strcmp(loc, "ANSI_X3.4-1968") != 0 && /* Linux */ 58 strcmp(loc, "ISO8859-1") != 0 && /* AIX */ 59 strcmp(loc, "646") != 0 && /* Solaris, NetBSD */ 60 strcmp(loc, "") != 0; /* Solaris 6 */ 61 } 62 63 static int 64 grow_dst(char **dst, size_t *sz, size_t maxsz, char **dp, size_t need) 65 { 66 char *tp; 67 size_t tsz; 68 69 if (*dp + need < *dst + *sz) 70 return 0; 71 tsz = *sz + 128; 72 if (tsz > maxsz) 73 tsz = maxsz; 74 if ((tp = recallocarray(*dst, *sz, tsz, 1)) == NULL) 75 return -1; 76 *dp = tp + (*dp - *dst); 77 *dst = tp; 78 *sz = tsz; 79 return 0; 80 } 81 82 /* 83 * The following two functions limit the number of bytes written, 84 * including the terminating '\0', to sz. Unless wp is NULL, 85 * they limit the number of display columns occupied to *wp. 86 * Whichever is reached first terminates the output string. 87 * To stay close to the standard interfaces, they return the number of 88 * non-NUL bytes that would have been written if both were unlimited. 89 * If wp is NULL, newline, carriage return, and tab are allowed; 90 * otherwise, the actual number of columns occupied by what was 91 * written is returned in *wp. 92 */ 93 94 int 95 vasnmprintf(char **str, size_t maxsz, int *wp, const char *fmt, va_list ap) 96 { 97 char *src; /* Source string returned from vasprintf. */ 98 char *sp; /* Pointer into src. */ 99 char *dst; /* Destination string to be returned. */ 100 char *dp; /* Pointer into dst. */ 101 char *tp; /* Temporary pointer for dst. */ 102 size_t sz; /* Number of bytes allocated for dst. */ 103 wchar_t wc; /* Wide character at sp. */ 104 int len; /* Number of bytes in the character at sp. */ 105 int ret; /* Number of bytes needed to format src. */ 106 int width; /* Display width of the character wc. */ 107 int total_width, max_width, print; 108 109 src = NULL; 110 if ((ret = vasprintf(&src, fmt, ap)) <= 0) 111 goto fail; 112 113 sz = strlen(src) + 1; 114 if ((dst = malloc(sz)) == NULL) { 115 free(src); 116 ret = -1; 117 goto fail; 118 } 119 120 if (maxsz > INT_MAX) 121 maxsz = INT_MAX; 122 123 sp = src; 124 dp = dst; 125 ret = 0; 126 print = 1; 127 total_width = 0; 128 max_width = wp == NULL ? INT_MAX : *wp; 129 while (*sp != '\0') { 130 if ((len = mbtowc(&wc, sp, MB_CUR_MAX)) == -1) { 131 (void)mbtowc(NULL, NULL, MB_CUR_MAX); 132 if (dangerous_locale()) { 133 ret = -1; 134 break; 135 } 136 len = 1; 137 width = -1; 138 } else if (wp == NULL && 139 (wc == L'\n' || wc == L'\r' || wc == L'\t')) { 140 /* 141 * Don't use width uninitialized; the actual 142 * value doesn't matter because total_width 143 * is only returned for wp != NULL. 144 */ 145 width = 0; 146 } else if ((width = wcwidth(wc)) == -1 && 147 dangerous_locale()) { 148 ret = -1; 149 break; 150 } 151 152 /* Valid, printable character. */ 153 154 if (width >= 0) { 155 if (print && (dp - dst >= (int)maxsz - len || 156 total_width > max_width - width)) 157 print = 0; 158 if (print) { 159 if (grow_dst(&dst, &sz, maxsz, 160 &dp, len) == -1) { 161 ret = -1; 162 break; 163 } 164 total_width += width; 165 memcpy(dp, sp, len); 166 dp += len; 167 } 168 sp += len; 169 if (ret >= 0) 170 ret += len; 171 continue; 172 } 173 174 /* Escaping required. */ 175 176 while (len > 0) { 177 if (print && (dp - dst >= (int)maxsz - 4 || 178 total_width > max_width - 4)) 179 print = 0; 180 if (print) { 181 if (grow_dst(&dst, &sz, maxsz, 182 &dp, 4) == -1) { 183 ret = -1; 184 break; 185 } 186 tp = vis(dp, *sp, VIS_OCTAL | VIS_ALL, 0); 187 width = tp - dp; 188 total_width += width; 189 dp = tp; 190 } else 191 width = 4; 192 len--; 193 sp++; 194 if (ret >= 0) 195 ret += width; 196 } 197 if (len > 0) 198 break; 199 } 200 free(src); 201 *dp = '\0'; 202 *str = dst; 203 if (wp != NULL) 204 *wp = total_width; 205 206 /* 207 * If the string was truncated by the width limit but 208 * would have fit into the size limit, the only sane way 209 * to report the problem is using the return value, such 210 * that the usual idiom "if (ret < 0 || ret >= sz) error" 211 * works as expected. 212 */ 213 214 if (ret < (int)maxsz && !print) 215 ret = -1; 216 return ret; 217 218 fail: 219 if (wp != NULL) 220 *wp = 0; 221 if (ret == 0) { 222 *str = src; 223 return 0; 224 } else { 225 *str = NULL; 226 return -1; 227 } 228 } 229 230 int 231 snmprintf(char *str, size_t sz, int *wp, const char *fmt, ...) 232 { 233 va_list ap; 234 char *cp = NULL; 235 int ret; 236 237 va_start(ap, fmt); 238 ret = vasnmprintf(&cp, sz, wp, fmt, ap); 239 va_end(ap); 240 if (cp != NULL) { 241 (void)strlcpy(str, cp, sz); 242 free(cp); 243 } else 244 *str = '\0'; 245 return ret; 246 } 247 248 int 249 asmprintf(char **outp, size_t sz, int *wp, const char *fmt, ...) 250 { 251 va_list ap; 252 int ret; 253 254 *outp = NULL; 255 va_start(ap, fmt); 256 ret = vasnmprintf(outp, sz, wp, fmt, ap); 257 va_end(ap); 258 259 return ret; 260 } 261 262 /* 263 * To stay close to the standard interfaces, the following functions 264 * return the number of non-NUL bytes written. 265 */ 266 267 int 268 vfmprintf(FILE *stream, const char *fmt, va_list ap) 269 { 270 char *str = NULL; 271 int ret; 272 273 if ((ret = vasnmprintf(&str, INT_MAX, NULL, fmt, ap)) < 0) { 274 free(str); 275 return -1; 276 } 277 if (fputs(str, stream) == EOF) 278 ret = -1; 279 free(str); 280 return ret; 281 } 282 283 int 284 fmprintf(FILE *stream, const char *fmt, ...) 285 { 286 va_list ap; 287 int ret; 288 289 va_start(ap, fmt); 290 ret = vfmprintf(stream, fmt, ap); 291 va_end(ap); 292 return ret; 293 } 294 295 int 296 mprintf(const char *fmt, ...) 297 { 298 va_list ap; 299 int ret; 300 301 va_start(ap, fmt); 302 ret = vfmprintf(stdout, fmt, ap); 303 va_end(ap); 304 return ret; 305 } 306