1 /* $OpenBSD: utf8.c,v 1.5 2017/02/19 00:10:57 djm Exp $ */ 2 /* 3 * Copyright (c) 2016 Ingo Schwarze <schwarze@openbsd.org> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 /* 19 * Utility functions for multibyte-character handling, 20 * in particular to sanitize untrusted strings for terminal output. 21 */ 22 23 #include "includes.h" 24 25 #include <sys/types.h> 26 #ifdef HAVE_LANGINFO_H 27 # include <langinfo.h> 28 #endif 29 #include <limits.h> 30 #include <locale.h> 31 #include <stdarg.h> 32 #include <stdio.h> 33 #include <stdlib.h> 34 #include <string.h> 35 #if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS) 36 # include <vis.h> 37 #endif 38 #ifdef HAVE_WCHAR_H 39 # include <wchar.h> 40 #endif 41 42 #include "utf8.h" 43 44 static int dangerous_locale(void); 45 static int grow_dst(char **, size_t *, size_t, char **, size_t); 46 static int vasnmprintf(char **, size_t, int *, const char *, va_list); 47 48 49 /* 50 * For US-ASCII and UTF-8 encodings, we can safely recover from 51 * encoding errors and from non-printable characters. For any 52 * other encodings, err to the side of caution and abort parsing: 53 * For state-dependent encodings, recovery is impossible. 54 * For arbitrary encodings, replacement of non-printable 55 * characters would be non-trivial and too fragile. 56 */ 57 58 static int dangerous_locale(void)59 dangerous_locale(void) { 60 char *loc; 61 62 loc = nl_langinfo(CODESET); 63 return strcmp(loc, "US-ASCII") != 0 && strcmp(loc, "UTF-8") != 0 && 64 strcmp(loc, "ANSI_X3.4-1968") != 0 && strcmp(loc, "646") != 0; 65 } 66 67 static int grow_dst(char ** dst,size_t * sz,size_t maxsz,char ** dp,size_t need)68 grow_dst(char **dst, size_t *sz, size_t maxsz, char **dp, size_t need) 69 { 70 char *tp; 71 size_t tsz; 72 73 if (*dp + need < *dst + *sz) 74 return 0; 75 tsz = *sz + 128; 76 if (tsz > maxsz) 77 tsz = maxsz; 78 if ((tp = realloc(*dst, tsz)) == NULL) 79 return -1; 80 *dp = tp + (*dp - *dst); 81 *dst = tp; 82 *sz = tsz; 83 return 0; 84 } 85 86 /* 87 * The following two functions limit the number of bytes written, 88 * including the terminating '\0', to sz. Unless wp is NULL, 89 * they limit the number of display columns occupied to *wp. 90 * Whichever is reached first terminates the output string. 91 * To stay close to the standard interfaces, they return the number of 92 * non-NUL bytes that would have been written if both were unlimited. 93 * If wp is NULL, newline, carriage return, and tab are allowed; 94 * otherwise, the actual number of columns occupied by what was 95 * written is returned in *wp. 96 */ 97 98 static int vasnmprintf(char ** str,size_t maxsz,int * wp,const char * fmt,va_list ap)99 vasnmprintf(char **str, size_t maxsz, int *wp, const char *fmt, va_list ap) 100 { 101 char *src; /* Source string returned from vasprintf. */ 102 char *sp; /* Pointer into src. */ 103 char *dst; /* Destination string to be returned. */ 104 char *dp; /* Pointer into dst. */ 105 char *tp; /* Temporary pointer for dst. */ 106 size_t sz; /* Number of bytes allocated for dst. */ 107 wchar_t wc; /* Wide character at sp. */ 108 int len; /* Number of bytes in the character at sp. */ 109 int ret; /* Number of bytes needed to format src. */ 110 int width; /* Display width of the character wc. */ 111 int total_width, max_width, print; 112 113 src = NULL; 114 if ((ret = vasprintf(&src, fmt, ap)) <= 0) 115 goto fail; 116 117 sz = strlen(src) + 1; 118 if ((dst = malloc(sz)) == NULL) { 119 free(src); 120 ret = -1; 121 goto fail; 122 } 123 124 if (maxsz > INT_MAX) 125 maxsz = INT_MAX; 126 127 sp = src; 128 dp = dst; 129 ret = 0; 130 print = 1; 131 total_width = 0; 132 max_width = wp == NULL ? INT_MAX : *wp; 133 while (*sp != '\0') { 134 if ((len = mbtowc(&wc, sp, MB_CUR_MAX)) == -1) { 135 (void)mbtowc(NULL, NULL, MB_CUR_MAX); 136 if (dangerous_locale()) { 137 ret = -1; 138 break; 139 } 140 len = 1; 141 width = -1; 142 } else if (wp == NULL && 143 (wc == L'\n' || wc == L'\r' || wc == L'\t')) { 144 /* 145 * Don't use width uninitialized; the actual 146 * value doesn't matter because total_width 147 * is only returned for wp != NULL. 148 */ 149 width = 0; 150 } else if ((width = wcwidth(wc)) == -1 && 151 dangerous_locale()) { 152 ret = -1; 153 break; 154 } 155 156 /* Valid, printable character. */ 157 158 if (width >= 0) { 159 if (print && (dp - dst >= (int)maxsz - len || 160 total_width > max_width - width)) 161 print = 0; 162 if (print) { 163 if (grow_dst(&dst, &sz, maxsz, 164 &dp, len) == -1) { 165 ret = -1; 166 break; 167 } 168 total_width += width; 169 memcpy(dp, sp, len); 170 dp += len; 171 } 172 sp += len; 173 if (ret >= 0) 174 ret += len; 175 continue; 176 } 177 178 /* Escaping required. */ 179 180 while (len > 0) { 181 if (print && (dp - dst >= (int)maxsz - 4 || 182 total_width > max_width - 4)) 183 print = 0; 184 if (print) { 185 if (grow_dst(&dst, &sz, maxsz, 186 &dp, 4) == -1) { 187 ret = -1; 188 break; 189 } 190 tp = vis(dp, *sp, VIS_OCTAL | VIS_ALL, 0); 191 width = tp - dp; 192 total_width += width; 193 dp = tp; 194 } else 195 width = 4; 196 len--; 197 sp++; 198 if (ret >= 0) 199 ret += width; 200 } 201 if (len > 0) 202 break; 203 } 204 free(src); 205 *dp = '\0'; 206 *str = dst; 207 if (wp != NULL) 208 *wp = total_width; 209 210 /* 211 * If the string was truncated by the width limit but 212 * would have fit into the size limit, the only sane way 213 * to report the problem is using the return value, such 214 * that the usual idiom "if (ret < 0 || ret >= sz) error" 215 * works as expected. 216 */ 217 218 if (ret < (int)maxsz && !print) 219 ret = -1; 220 return ret; 221 222 fail: 223 if (wp != NULL) 224 *wp = 0; 225 if (ret == 0) { 226 *str = src; 227 return 0; 228 } else { 229 *str = NULL; 230 return -1; 231 } 232 } 233 234 int snmprintf(char * str,size_t sz,int * wp,const char * fmt,...)235 snmprintf(char *str, size_t sz, int *wp, const char *fmt, ...) 236 { 237 va_list ap; 238 char *cp; 239 int ret; 240 241 va_start(ap, fmt); 242 ret = vasnmprintf(&cp, sz, wp, fmt, ap); 243 va_end(ap); 244 if (cp != NULL) { 245 (void)strlcpy(str, cp, sz); 246 free(cp); 247 } else 248 *str = '\0'; 249 return ret; 250 } 251 252 /* 253 * To stay close to the standard interfaces, the following functions 254 * return the number of non-NUL bytes written. 255 */ 256 257 int vfmprintf(FILE * stream,const char * fmt,va_list ap)258 vfmprintf(FILE *stream, const char *fmt, va_list ap) 259 { 260 char *str; 261 int ret; 262 263 if ((ret = vasnmprintf(&str, INT_MAX, NULL, fmt, ap)) < 0) 264 return -1; 265 if (fputs(str, stream) == EOF) 266 ret = -1; 267 free(str); 268 return ret; 269 } 270 271 int fmprintf(FILE * stream,const char * fmt,...)272 fmprintf(FILE *stream, const char *fmt, ...) 273 { 274 va_list ap; 275 int ret; 276 277 va_start(ap, fmt); 278 ret = vfmprintf(stream, fmt, ap); 279 va_end(ap); 280 return ret; 281 } 282 283 int mprintf(const char * fmt,...)284 mprintf(const char *fmt, ...) 285 { 286 va_list ap; 287 int ret; 288 289 va_start(ap, fmt); 290 ret = vfmprintf(stdout, fmt, ap); 291 va_end(ap); 292 return ret; 293 } 294 295 /* 296 * Set up libc for multibyte output in the user's chosen locale. 297 * 298 * XXX: we are known to have problems with Turkish (i/I confusion) so we 299 * deliberately fall back to the C locale for now. Longer term we should 300 * always prefer to select C.[encoding] if possible, but there's no 301 * standardisation in locales between systems, so we'll need to survey 302 * what's out there first. 303 */ 304 void msetlocale(void)305 msetlocale(void) 306 { 307 const char *vars[] = { "LC_ALL", "LC_CTYPE", "LANG", NULL }; 308 char *cp; 309 int i; 310 311 /* 312 * We can't yet cope with dotless/dotted I in Turkish locales, 313 * so fall back to the C locale for these. 314 */ 315 for (i = 0; vars[i] != NULL; i++) { 316 if ((cp = getenv(vars[i])) == NULL) 317 continue; 318 if (strncasecmp(cp, "TR", 2) != 0) 319 break; 320 /* 321 * If we're in a UTF-8 locale then prefer to use 322 * the C.UTF-8 locale (or equivalent) if it exists. 323 */ 324 if ((strcasestr(cp, "UTF-8") != NULL || 325 strcasestr(cp, "UTF8") != NULL) && 326 (setlocale(LC_CTYPE, "C.UTF-8") != NULL || 327 setlocale(LC_CTYPE, "POSIX.UTF-8") != NULL)) 328 return; 329 setlocale(LC_CTYPE, "C"); 330 return; 331 } 332 /* We can handle this locale */ 333 setlocale(LC_CTYPE, ""); 334 } 335