1/* $OpenBSD: utf8.c,v 1.11 2020/05/01 06:28:52 djm Exp $ */
2/*
3 * Copyright (c) 2016 Ingo Schwarze <schwarze@openbsd.org>
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18/*
19 * Utility functions for multibyte-character handling,
20 * in particular to sanitize untrusted strings for terminal output.
21 */
22
23#include "includes.h"
24
25#include <sys/types.h>
26#ifdef HAVE_LANGINFO_H
27# include <langinfo.h>
28#endif
29#include <limits.h>
30#include <locale.h>
31#include <stdarg.h>
32#include <stdio.h>
33#include <stdlib.h>
34#include <string.h>
35#if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS)
36# include <vis.h>
37#endif
38#ifdef HAVE_WCHAR_H
39# include <wchar.h>
40#endif
41
42#include "utf8.h"
43
44static int	 dangerous_locale(void);
45static int	 grow_dst(char **, size_t *, size_t, char **, size_t);
46
47
48/*
49 * For US-ASCII and UTF-8 encodings, we can safely recover from
50 * encoding errors and from non-printable characters.  For any
51 * other encodings, err to the side of caution and abort parsing:
52 * For state-dependent encodings, recovery is impossible.
53 * For arbitrary encodings, replacement of non-printable
54 * characters would be non-trivial and too fragile.
55 * The comments indicate what nl_langinfo(CODESET)
56 * returns for US-ASCII on various operating systems.
57 */
58
59static int
60dangerous_locale(void) {
61	char	*loc;
62
63	loc = nl_langinfo(CODESET);
64	return strcmp(loc, "UTF-8") != 0 &&
65	    strcmp(loc, "US-ASCII") != 0 &&		/* OpenBSD */
66	    strcmp(loc, "ANSI_X3.4-1968") != 0 &&	/* Linux */
67	    strcmp(loc, "ISO8859-1") != 0 &&		/* AIX */
68	    strcmp(loc, "646") != 0 &&			/* Solaris, NetBSD */
69	    strcmp(loc, "") != 0;			/* Solaris 6 */
70}
71
72static int
73grow_dst(char **dst, size_t *sz, size_t maxsz, char **dp, size_t need)
74{
75	char	*tp;
76	size_t	 tsz;
77
78	if (*dp + need < *dst + *sz)
79		return 0;
80	tsz = *sz + 128;
81	if (tsz > maxsz)
82		tsz = maxsz;
83	if ((tp = recallocarray(*dst, *sz, tsz, 1)) == NULL)
84		return -1;
85	*dp = tp + (*dp - *dst);
86	*dst = tp;
87	*sz = tsz;
88	return 0;
89}
90
91/*
92 * The following two functions limit the number of bytes written,
93 * including the terminating '\0', to sz.  Unless wp is NULL,
94 * they limit the number of display columns occupied to *wp.
95 * Whichever is reached first terminates the output string.
96 * To stay close to the standard interfaces, they return the number of
97 * non-NUL bytes that would have been written if both were unlimited.
98 * If wp is NULL, newline, carriage return, and tab are allowed;
99 * otherwise, the actual number of columns occupied by what was
100 * written is returned in *wp.
101 */
102
103int
104vasnmprintf(char **str, size_t maxsz, int *wp, const char *fmt, va_list ap)
105{
106	char	*src;	/* Source string returned from vasprintf. */
107	char	*sp;	/* Pointer into src. */
108	char	*dst;	/* Destination string to be returned. */
109	char	*dp;	/* Pointer into dst. */
110	char	*tp;	/* Temporary pointer for dst. */
111	size_t	 sz;	/* Number of bytes allocated for dst. */
112	wchar_t	 wc;	/* Wide character at sp. */
113	int	 len;	/* Number of bytes in the character at sp. */
114	int	 ret;	/* Number of bytes needed to format src. */
115	int	 width;	/* Display width of the character wc. */
116	int	 total_width, max_width, print;
117
118	src = NULL;
119	if ((ret = vasprintf(&src, fmt, ap)) <= 0)
120		goto fail;
121
122	sz = strlen(src) + 1;
123	if ((dst = malloc(sz)) == NULL) {
124		free(src);
125		ret = -1;
126		goto fail;
127	}
128
129	if (maxsz > INT_MAX)
130		maxsz = INT_MAX;
131
132	sp = src;
133	dp = dst;
134	ret = 0;
135	print = 1;
136	total_width = 0;
137	max_width = wp == NULL ? INT_MAX : *wp;
138	while (*sp != '\0') {
139		if ((len = mbtowc(&wc, sp, MB_CUR_MAX)) == -1) {
140			(void)mbtowc(NULL, NULL, MB_CUR_MAX);
141			if (dangerous_locale()) {
142				ret = -1;
143				break;
144			}
145			len = 1;
146			width = -1;
147		} else if (wp == NULL &&
148		    (wc == L'\n' || wc == L'\r' || wc == L'\t')) {
149			/*
150			 * Don't use width uninitialized; the actual
151			 * value doesn't matter because total_width
152			 * is only returned for wp != NULL.
153			 */
154			width = 0;
155		} else if ((width = wcwidth(wc)) == -1 &&
156		    dangerous_locale()) {
157			ret = -1;
158			break;
159		}
160
161		/* Valid, printable character. */
162
163		if (width >= 0) {
164			if (print && (dp - dst >= (int)maxsz - len ||
165			    total_width > max_width - width))
166				print = 0;
167			if (print) {
168				if (grow_dst(&dst, &sz, maxsz,
169				    &dp, len) == -1) {
170					ret = -1;
171					break;
172				}
173				total_width += width;
174				memcpy(dp, sp, len);
175				dp += len;
176			}
177			sp += len;
178			if (ret >= 0)
179				ret += len;
180			continue;
181		}
182
183		/* Escaping required. */
184
185		while (len > 0) {
186			if (print && (dp - dst >= (int)maxsz - 4 ||
187			    total_width > max_width - 4))
188				print = 0;
189			if (print) {
190				if (grow_dst(&dst, &sz, maxsz,
191				    &dp, 4) == -1) {
192					ret = -1;
193					break;
194				}
195				tp = vis(dp, *sp, VIS_OCTAL | VIS_ALL, 0);
196				width = tp - dp;
197				total_width += width;
198				dp = tp;
199			} else
200				width = 4;
201			len--;
202			sp++;
203			if (ret >= 0)
204				ret += width;
205		}
206		if (len > 0)
207			break;
208	}
209	free(src);
210	*dp = '\0';
211	*str = dst;
212	if (wp != NULL)
213		*wp = total_width;
214
215	/*
216	 * If the string was truncated by the width limit but
217	 * would have fit into the size limit, the only sane way
218	 * to report the problem is using the return value, such
219	 * that the usual idiom "if (ret < 0 || ret >= sz) error"
220	 * works as expected.
221	 */
222
223	if (ret < (int)maxsz && !print)
224		ret = -1;
225	return ret;
226
227fail:
228	if (wp != NULL)
229		*wp = 0;
230	if (ret == 0) {
231		*str = src;
232		return 0;
233	} else {
234		*str = NULL;
235		return -1;
236	}
237}
238
239int
240snmprintf(char *str, size_t sz, int *wp, const char *fmt, ...)
241{
242	va_list	 ap;
243	char	*cp = NULL;
244	int	 ret;
245
246	va_start(ap, fmt);
247	ret = vasnmprintf(&cp, sz, wp, fmt, ap);
248	va_end(ap);
249	if (cp != NULL) {
250		(void)strlcpy(str, cp, sz);
251		free(cp);
252	} else
253		*str = '\0';
254	return ret;
255}
256
257int
258asmprintf(char **outp, size_t sz, int *wp, const char *fmt, ...)
259{
260	va_list	 ap;
261	int	 ret;
262
263	*outp = NULL;
264	va_start(ap, fmt);
265	ret = vasnmprintf(outp, sz, wp, fmt, ap);
266	va_end(ap);
267
268	return ret;
269}
270
271/*
272 * To stay close to the standard interfaces, the following functions
273 * return the number of non-NUL bytes written.
274 */
275
276int
277vfmprintf(FILE *stream, const char *fmt, va_list ap)
278{
279	char	*str = NULL;
280	int	 ret;
281
282	if ((ret = vasnmprintf(&str, INT_MAX, NULL, fmt, ap)) < 0) {
283		free(str);
284		return -1;
285	}
286	if (fputs(str, stream) == EOF)
287		ret = -1;
288	free(str);
289	return ret;
290}
291
292int
293fmprintf(FILE *stream, const char *fmt, ...)
294{
295	va_list	 ap;
296	int	 ret;
297
298	va_start(ap, fmt);
299	ret = vfmprintf(stream, fmt, ap);
300	va_end(ap);
301	return ret;
302}
303
304int
305mprintf(const char *fmt, ...)
306{
307	va_list	 ap;
308	int	 ret;
309
310	va_start(ap, fmt);
311	ret = vfmprintf(stdout, fmt, ap);
312	va_end(ap);
313	return ret;
314}
315
316/*
317 * Set up libc for multibyte output in the user's chosen locale.
318 *
319 * XXX: we are known to have problems with Turkish (i/I confusion) so we
320 *      deliberately fall back to the C locale for now. Longer term we should
321 *      always prefer to select C.[encoding] if possible, but there's no
322 *      standardisation in locales between systems, so we'll need to survey
323 *      what's out there first.
324 */
325void
326msetlocale(void)
327{
328	const char *vars[] = { "LC_ALL", "LC_CTYPE", "LANG", NULL };
329	char *cp;
330	int i;
331
332	/*
333	 * We can't yet cope with dotless/dotted I in Turkish locales,
334	 * so fall back to the C locale for these.
335	 */
336	for (i = 0; vars[i] != NULL; i++) {
337		if ((cp = getenv(vars[i])) == NULL)
338			continue;
339		if (strncasecmp(cp, "TR", 2) != 0)
340			break;
341		/*
342		 * If we're in a UTF-8 locale then prefer to use
343		 * the C.UTF-8 locale (or equivalent) if it exists.
344		 */
345		if ((strcasestr(cp, "UTF-8") != NULL ||
346		    strcasestr(cp, "UTF8") != NULL) &&
347		    (setlocale(LC_CTYPE, "C.UTF-8") != NULL ||
348		    setlocale(LC_CTYPE, "POSIX.UTF-8") != NULL))
349			return;
350		setlocale(LC_CTYPE, "C");
351		return;
352	}
353	/* We can handle this locale */
354	setlocale(LC_CTYPE, "");
355}
356