xref: /openssh-portable/utf8.c (revision df820722)
1 /* $OpenBSD: utf8.c,v 1.3 2016/05/30 12:57:21 schwarze Exp $ */
2 /*
3  * Copyright (c) 2016 Ingo Schwarze <schwarze@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 /*
19  * Utility functions for multibyte-character handling,
20  * in particular to sanitize untrusted strings for terminal output.
21  */
22 
23 #include "includes.h"
24 
25 #include <sys/types.h>
26 #include <langinfo.h>
27 #include <limits.h>
28 #include <stdarg.h>
29 #include <stdio.h>
30 #include <stdlib.h>
31 #include <string.h>
32 #if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS)
33 # include <vis.h>
34 #endif
35 #include <wchar.h>
36 
37 #include "utf8.h"
38 
39 static int	 dangerous_locale(void);
40 static int	 grow_dst(char **, size_t *, size_t, char **, size_t);
41 static int	 vasnmprintf(char **, size_t, int *, const char *, va_list);
42 
43 
44 /*
45  * For US-ASCII and UTF-8 encodings, we can safely recover from
46  * encoding errors and from non-printable characters.  For any
47  * other encodings, err to the side of caution and abort parsing:
48  * For state-dependent encodings, recovery is impossible.
49  * For arbitrary encodings, replacement of non-printable
50  * characters would be non-trivial and too fragile.
51  */
52 
53 static int
54 dangerous_locale(void) {
55 	char	*loc;
56 
57 	loc = nl_langinfo(CODESET);
58 	return strcmp(loc, "US-ASCII") && strcmp(loc, "UTF-8");
59 }
60 
61 static int
62 grow_dst(char **dst, size_t *sz, size_t maxsz, char **dp, size_t need)
63 {
64 	char	*tp;
65 	size_t	 tsz;
66 
67 	if (*dp + need < *dst + *sz)
68 		return 0;
69 	tsz = *sz + 128;
70 	if (tsz > maxsz)
71 		tsz = maxsz;
72 	if ((tp = realloc(*dst, tsz)) == NULL)
73 		return -1;
74 	*dp = tp + (*dp - *dst);
75 	*dst = tp;
76 	*sz = tsz;
77 	return 0;
78 }
79 
80 /*
81  * The following two functions limit the number of bytes written,
82  * including the terminating '\0', to sz.  Unless wp is NULL,
83  * they limit the number of display columns occupied to *wp.
84  * Whichever is reached first terminates the output string.
85  * To stay close to the standard interfaces, they return the number of
86  * non-NUL bytes that would have been written if both were unlimited.
87  * If wp is NULL, newline, carriage return, and tab are allowed;
88  * otherwise, the actual number of columns occupied by what was
89  * written is returned in *wp.
90  */
91 
92 static int
93 vasnmprintf(char **str, size_t maxsz, int *wp, const char *fmt, va_list ap)
94 {
95 	char	*src;	/* Source string returned from vasprintf. */
96 	char	*sp;	/* Pointer into src. */
97 	char	*dst;	/* Destination string to be returned. */
98 	char	*dp;	/* Pointer into dst. */
99 	char	*tp;	/* Temporary pointer for dst. */
100 	size_t	 sz;	/* Number of bytes allocated for dst. */
101 	wchar_t	 wc;	/* Wide character at sp. */
102 	int	 len;	/* Number of bytes in the character at sp. */
103 	int	 ret;	/* Number of bytes needed to format src. */
104 	int	 width;	/* Display width of the character wc. */
105 	int	 total_width, max_width, print;
106 
107 	src = NULL;
108 	if ((ret = vasprintf(&src, fmt, ap)) <= 0)
109 		goto fail;
110 
111 	sz = strlen(src) + 1;
112 	if ((dst = malloc(sz)) == NULL) {
113 		free(src);
114 		goto fail;
115 	}
116 
117 	if (maxsz > INT_MAX)
118 		maxsz = INT_MAX;
119 
120 	sp = src;
121 	dp = dst;
122 	ret = 0;
123 	print = 1;
124 	total_width = 0;
125 	max_width = wp == NULL ? INT_MAX : *wp;
126 	while (*sp != '\0') {
127 		if ((len = mbtowc(&wc, sp, MB_CUR_MAX)) == -1) {
128 			(void)mbtowc(NULL, NULL, MB_CUR_MAX);
129 			if (dangerous_locale()) {
130 				ret = -1;
131 				break;
132 			}
133 			len = 1;
134 			width = -1;
135 		} else if (wp == NULL &&
136 		    (wc == L'\n' || wc == L'\r' || wc == L'\t')) {
137 			/*
138 			 * Don't use width uninitialized; the actual
139 			 * value doesn't matter because total_width
140 			 * is only returned for wp != NULL.
141 			 */
142 			width = 0;
143 		} else if ((width = wcwidth(wc)) == -1 &&
144 		    dangerous_locale()) {
145 			ret = -1;
146 			break;
147 		}
148 
149 		/* Valid, printable character. */
150 
151 		if (width >= 0) {
152 			if (print && (dp - dst >= (int)maxsz - len ||
153 			    total_width > max_width - width))
154 				print = 0;
155 			if (print) {
156 				if (grow_dst(&dst, &sz, maxsz,
157 				    &dp, len) == -1) {
158 					ret = -1;
159 					break;
160 				}
161 				total_width += width;
162 				memcpy(dp, sp, len);
163 				dp += len;
164 			}
165 			sp += len;
166 			if (ret >= 0)
167 				ret += len;
168 			continue;
169 		}
170 
171 		/* Escaping required. */
172 
173 		while (len > 0) {
174 			if (print && (dp - dst >= (int)maxsz - 4 ||
175 			    total_width > max_width - 4))
176 				print = 0;
177 			if (print) {
178 				if (grow_dst(&dst, &sz, maxsz,
179 				    &dp, 4) == -1) {
180 					ret = -1;
181 					break;
182 				}
183 				tp = vis(dp, *sp, VIS_OCTAL | VIS_ALL, 0);
184 				width = tp - dp;
185 				total_width += width;
186 				dp = tp;
187 			} else
188 				width = 4;
189 			len--;
190 			sp++;
191 			if (ret >= 0)
192 				ret += width;
193 		}
194 		if (len > 0)
195 			break;
196 	}
197 	free(src);
198 	*dp = '\0';
199 	*str = dst;
200 	if (wp != NULL)
201 		*wp = total_width;
202 
203 	/*
204 	 * If the string was truncated by the width limit but
205 	 * would have fit into the size limit, the only sane way
206 	 * to report the problem is using the return value, such
207 	 * that the usual idiom "if (ret < 0 || ret >= sz) error"
208 	 * works as expected.
209 	 */
210 
211 	if (ret < (int)maxsz && !print)
212 		ret = -1;
213 	return ret;
214 
215 fail:
216 	if (wp != NULL)
217 		*wp = 0;
218 	if (ret == 0) {
219 		*str = src;
220 		return 0;
221 	} else {
222 		*str = NULL;
223 		return -1;
224 	}
225 }
226 
227 int
228 snmprintf(char *str, size_t sz, int *wp, const char *fmt, ...)
229 {
230 	va_list	 ap;
231 	char	*cp;
232 	int	 ret;
233 
234 	va_start(ap, fmt);
235 	ret = vasnmprintf(&cp, sz, wp, fmt, ap);
236 	va_end(ap);
237 	if (cp != NULL) {
238 		(void)strlcpy(str, cp, sz);
239 		free(cp);
240 	} else
241 		*str = '\0';
242 	return ret;
243 }
244 
245 /*
246  * To stay close to the standard interfaces, the following functions
247  * return the number of non-NUL bytes written.
248  */
249 
250 int
251 vfmprintf(FILE *stream, const char *fmt, va_list ap)
252 {
253 	char	*str;
254 	int	 ret;
255 
256 	if ((ret = vasnmprintf(&str, INT_MAX, NULL, fmt, ap)) < 0)
257 		return -1;
258 	if (fputs(str, stream) == EOF)
259 		ret = -1;
260 	free(str);
261 	return ret;
262 }
263 
264 int
265 fmprintf(FILE *stream, const char *fmt, ...)
266 {
267 	va_list	 ap;
268 	int	 ret;
269 
270 	va_start(ap, fmt);
271 	ret = vfmprintf(stream, fmt, ap);
272 	va_end(ap);
273 	return ret;
274 }
275 
276 int
277 mprintf(const char *fmt, ...)
278 {
279 	va_list	 ap;
280 	int	 ret;
281 
282 	va_start(ap, fmt);
283 	ret = vfmprintf(stdout, fmt, ap);
284 	va_end(ap);
285 	return ret;
286 }
287