• Home
  • History
  • Annotate
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1  /* $OpenBSD: utf8.c,v 1.5 2017/02/19 00:10:57 djm Exp $ */
2  /*
3   * Copyright (c) 2016 Ingo Schwarze <schwarze@openbsd.org>
4   *
5   * Permission to use, copy, modify, and distribute this software for any
6   * purpose with or without fee is hereby granted, provided that the above
7   * copyright notice and this permission notice appear in all copies.
8   *
9   * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10   * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11   * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12   * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13   * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14   * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15   * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16   */
17  
18  /*
19   * Utility functions for multibyte-character handling,
20   * in particular to sanitize untrusted strings for terminal output.
21   */
22  
23  #include "includes.h"
24  
25  #include <sys/types.h>
26  #ifdef HAVE_LANGINFO_H
27  # include <langinfo.h>
28  #endif
29  #include <limits.h>
30  #include <locale.h>
31  #include <stdarg.h>
32  #include <stdio.h>
33  #include <stdlib.h>
34  #include <string.h>
35  #if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS)
36  # include <vis.h>
37  #endif
38  #ifdef HAVE_WCHAR_H
39  # include <wchar.h>
40  #endif
41  
42  #include "utf8.h"
43  
44  static int	 dangerous_locale(void);
45  static int	 grow_dst(char **, size_t *, size_t, char **, size_t);
46  static int	 vasnmprintf(char **, size_t, int *, const char *, va_list);
47  
48  
49  /*
50   * For US-ASCII and UTF-8 encodings, we can safely recover from
51   * encoding errors and from non-printable characters.  For any
52   * other encodings, err to the side of caution and abort parsing:
53   * For state-dependent encodings, recovery is impossible.
54   * For arbitrary encodings, replacement of non-printable
55   * characters would be non-trivial and too fragile.
56   */
57  
58  static int
dangerous_locale(void)59  dangerous_locale(void) {
60  	char	*loc;
61  
62  	loc = nl_langinfo(CODESET);
63  	return strcmp(loc, "US-ASCII") != 0 && strcmp(loc, "UTF-8") != 0 &&
64  	    strcmp(loc, "ANSI_X3.4-1968") != 0 && strcmp(loc, "646") != 0;
65  }
66  
67  static int
grow_dst(char ** dst,size_t * sz,size_t maxsz,char ** dp,size_t need)68  grow_dst(char **dst, size_t *sz, size_t maxsz, char **dp, size_t need)
69  {
70  	char	*tp;
71  	size_t	 tsz;
72  
73  	if (*dp + need < *dst + *sz)
74  		return 0;
75  	tsz = *sz + 128;
76  	if (tsz > maxsz)
77  		tsz = maxsz;
78  	if ((tp = realloc(*dst, tsz)) == NULL)
79  		return -1;
80  	*dp = tp + (*dp - *dst);
81  	*dst = tp;
82  	*sz = tsz;
83  	return 0;
84  }
85  
86  /*
87   * The following two functions limit the number of bytes written,
88   * including the terminating '\0', to sz.  Unless wp is NULL,
89   * they limit the number of display columns occupied to *wp.
90   * Whichever is reached first terminates the output string.
91   * To stay close to the standard interfaces, they return the number of
92   * non-NUL bytes that would have been written if both were unlimited.
93   * If wp is NULL, newline, carriage return, and tab are allowed;
94   * otherwise, the actual number of columns occupied by what was
95   * written is returned in *wp.
96   */
97  
98  static int
vasnmprintf(char ** str,size_t maxsz,int * wp,const char * fmt,va_list ap)99  vasnmprintf(char **str, size_t maxsz, int *wp, const char *fmt, va_list ap)
100  {
101  	char	*src;	/* Source string returned from vasprintf. */
102  	char	*sp;	/* Pointer into src. */
103  	char	*dst;	/* Destination string to be returned. */
104  	char	*dp;	/* Pointer into dst. */
105  	char	*tp;	/* Temporary pointer for dst. */
106  	size_t	 sz;	/* Number of bytes allocated for dst. */
107  	wchar_t	 wc;	/* Wide character at sp. */
108  	int	 len;	/* Number of bytes in the character at sp. */
109  	int	 ret;	/* Number of bytes needed to format src. */
110  	int	 width;	/* Display width of the character wc. */
111  	int	 total_width, max_width, print;
112  
113  	src = NULL;
114  	if ((ret = vasprintf(&src, fmt, ap)) <= 0)
115  		goto fail;
116  
117  	sz = strlen(src) + 1;
118  	if ((dst = malloc(sz)) == NULL) {
119  		free(src);
120  		ret = -1;
121  		goto fail;
122  	}
123  
124  	if (maxsz > INT_MAX)
125  		maxsz = INT_MAX;
126  
127  	sp = src;
128  	dp = dst;
129  	ret = 0;
130  	print = 1;
131  	total_width = 0;
132  	max_width = wp == NULL ? INT_MAX : *wp;
133  	while (*sp != '\0') {
134  		if ((len = mbtowc(&wc, sp, MB_CUR_MAX)) == -1) {
135  			(void)mbtowc(NULL, NULL, MB_CUR_MAX);
136  			if (dangerous_locale()) {
137  				ret = -1;
138  				break;
139  			}
140  			len = 1;
141  			width = -1;
142  		} else if (wp == NULL &&
143  		    (wc == L'\n' || wc == L'\r' || wc == L'\t')) {
144  			/*
145  			 * Don't use width uninitialized; the actual
146  			 * value doesn't matter because total_width
147  			 * is only returned for wp != NULL.
148  			 */
149  			width = 0;
150  		} else if ((width = wcwidth(wc)) == -1 &&
151  		    dangerous_locale()) {
152  			ret = -1;
153  			break;
154  		}
155  
156  		/* Valid, printable character. */
157  
158  		if (width >= 0) {
159  			if (print && (dp - dst >= (int)maxsz - len ||
160  			    total_width > max_width - width))
161  				print = 0;
162  			if (print) {
163  				if (grow_dst(&dst, &sz, maxsz,
164  				    &dp, len) == -1) {
165  					ret = -1;
166  					break;
167  				}
168  				total_width += width;
169  				memcpy(dp, sp, len);
170  				dp += len;
171  			}
172  			sp += len;
173  			if (ret >= 0)
174  				ret += len;
175  			continue;
176  		}
177  
178  		/* Escaping required. */
179  
180  		while (len > 0) {
181  			if (print && (dp - dst >= (int)maxsz - 4 ||
182  			    total_width > max_width - 4))
183  				print = 0;
184  			if (print) {
185  				if (grow_dst(&dst, &sz, maxsz,
186  				    &dp, 4) == -1) {
187  					ret = -1;
188  					break;
189  				}
190  				tp = vis(dp, *sp, VIS_OCTAL | VIS_ALL, 0);
191  				width = tp - dp;
192  				total_width += width;
193  				dp = tp;
194  			} else
195  				width = 4;
196  			len--;
197  			sp++;
198  			if (ret >= 0)
199  				ret += width;
200  		}
201  		if (len > 0)
202  			break;
203  	}
204  	free(src);
205  	*dp = '\0';
206  	*str = dst;
207  	if (wp != NULL)
208  		*wp = total_width;
209  
210  	/*
211  	 * If the string was truncated by the width limit but
212  	 * would have fit into the size limit, the only sane way
213  	 * to report the problem is using the return value, such
214  	 * that the usual idiom "if (ret < 0 || ret >= sz) error"
215  	 * works as expected.
216  	 */
217  
218  	if (ret < (int)maxsz && !print)
219  		ret = -1;
220  	return ret;
221  
222  fail:
223  	if (wp != NULL)
224  		*wp = 0;
225  	if (ret == 0) {
226  		*str = src;
227  		return 0;
228  	} else {
229  		*str = NULL;
230  		return -1;
231  	}
232  }
233  
234  int
snmprintf(char * str,size_t sz,int * wp,const char * fmt,...)235  snmprintf(char *str, size_t sz, int *wp, const char *fmt, ...)
236  {
237  	va_list	 ap;
238  	char	*cp;
239  	int	 ret;
240  
241  	va_start(ap, fmt);
242  	ret = vasnmprintf(&cp, sz, wp, fmt, ap);
243  	va_end(ap);
244  	if (cp != NULL) {
245  		(void)strlcpy(str, cp, sz);
246  		free(cp);
247  	} else
248  		*str = '\0';
249  	return ret;
250  }
251  
252  /*
253   * To stay close to the standard interfaces, the following functions
254   * return the number of non-NUL bytes written.
255   */
256  
257  int
vfmprintf(FILE * stream,const char * fmt,va_list ap)258  vfmprintf(FILE *stream, const char *fmt, va_list ap)
259  {
260  	char	*str;
261  	int	 ret;
262  
263  	if ((ret = vasnmprintf(&str, INT_MAX, NULL, fmt, ap)) < 0)
264  		return -1;
265  	if (fputs(str, stream) == EOF)
266  		ret = -1;
267  	free(str);
268  	return ret;
269  }
270  
271  int
fmprintf(FILE * stream,const char * fmt,...)272  fmprintf(FILE *stream, const char *fmt, ...)
273  {
274  	va_list	 ap;
275  	int	 ret;
276  
277  	va_start(ap, fmt);
278  	ret = vfmprintf(stream, fmt, ap);
279  	va_end(ap);
280  	return ret;
281  }
282  
283  int
mprintf(const char * fmt,...)284  mprintf(const char *fmt, ...)
285  {
286  	va_list	 ap;
287  	int	 ret;
288  
289  	va_start(ap, fmt);
290  	ret = vfmprintf(stdout, fmt, ap);
291  	va_end(ap);
292  	return ret;
293  }
294  
295  /*
296   * Set up libc for multibyte output in the user's chosen locale.
297   *
298   * XXX: we are known to have problems with Turkish (i/I confusion) so we
299   *      deliberately fall back to the C locale for now. Longer term we should
300   *      always prefer to select C.[encoding] if possible, but there's no
301   *      standardisation in locales between systems, so we'll need to survey
302   *      what's out there first.
303   */
304  void
msetlocale(void)305  msetlocale(void)
306  {
307  	const char *vars[] = { "LC_ALL", "LC_CTYPE", "LANG", NULL };
308  	char *cp;
309  	int i;
310  
311  	/*
312  	 * We can't yet cope with dotless/dotted I in Turkish locales,
313  	 * so fall back to the C locale for these.
314  	 */
315  	for (i = 0; vars[i] != NULL; i++) {
316  		if ((cp = getenv(vars[i])) == NULL)
317  			continue;
318  		if (strncasecmp(cp, "TR", 2) != 0)
319  			break;
320  		/*
321  		 * If we're in a UTF-8 locale then prefer to use
322  		 * the C.UTF-8 locale (or equivalent) if it exists.
323  		 */
324  		if ((strcasestr(cp, "UTF-8") != NULL ||
325  		    strcasestr(cp, "UTF8") != NULL) &&
326  		    (setlocale(LC_CTYPE, "C.UTF-8") != NULL ||
327  		    setlocale(LC_CTYPE, "POSIX.UTF-8") != NULL))
328  			return;
329  		setlocale(LC_CTYPE, "C");
330  		return;
331  	}
332  	/* We can handle this locale */
333  	setlocale(LC_CTYPE, "");
334  }
335