1 /* $OpenBSD: utf8.c,v 1.3 2016/05/30 12:57:21 schwarze Exp $ */
3 * Copyright (c) 2016 Ingo Schwarze <schwarze@openbsd.org>
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 * Utility functions for multibyte-character handling,
20 * in particular to sanitize untrusted strings for terminal output.
25 #include <sys/types.h>
26 #ifdef HAVE_LANGINFO_H
27 # include <langinfo.h>
34 #if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS)
43 static int dangerous_locale(void);
44 static int grow_dst(char **, size_t *, size_t, char **, size_t);
45 static int vasnmprintf(char **, size_t, int *, const char *, va_list);
49 * For US-ASCII and UTF-8 encodings, we can safely recover from
50 * encoding errors and from non-printable characters. For any
51 * other encodings, err to the side of caution and abort parsing:
52 * For state-dependent encodings, recovery is impossible.
53 * For arbitrary encodings, replacement of non-printable
54 * characters would be non-trivial and too fragile.
58 dangerous_locale(void) {
61 loc
= nl_langinfo(CODESET
);
62 return strcmp(loc
, "US-ASCII") && strcmp(loc
, "UTF-8");
66 grow_dst(char **dst
, size_t *sz
, size_t maxsz
, char **dp
, size_t need
)
71 if (*dp
+ need
< *dst
+ *sz
)
76 if ((tp
= realloc(*dst
, tsz
)) == NULL
)
78 *dp
= tp
+ (*dp
- *dst
);
85 * The following two functions limit the number of bytes written,
86 * including the terminating '\0', to sz. Unless wp is NULL,
87 * they limit the number of display columns occupied to *wp.
88 * Whichever is reached first terminates the output string.
89 * To stay close to the standard interfaces, they return the number of
90 * non-NUL bytes that would have been written if both were unlimited.
91 * If wp is NULL, newline, carriage return, and tab are allowed;
92 * otherwise, the actual number of columns occupied by what was
93 * written is returned in *wp.
97 vasnmprintf(char **str
, size_t maxsz
, int *wp
, const char *fmt
, va_list ap
)
99 char *src
; /* Source string returned from vasprintf. */
100 char *sp
; /* Pointer into src. */
101 char *dst
; /* Destination string to be returned. */
102 char *dp
; /* Pointer into dst. */
103 char *tp
; /* Temporary pointer for dst. */
104 size_t sz
; /* Number of bytes allocated for dst. */
105 wchar_t wc
; /* Wide character at sp. */
106 int len
; /* Number of bytes in the character at sp. */
107 int ret
; /* Number of bytes needed to format src. */
108 int width
; /* Display width of the character wc. */
109 int total_width
, max_width
, print
;
112 if ((ret
= vasprintf(&src
, fmt
, ap
)) <= 0)
115 sz
= strlen(src
) + 1;
116 if ((dst
= malloc(sz
)) == NULL
) {
129 max_width
= wp
== NULL
? INT_MAX
: *wp
;
130 while (*sp
!= '\0') {
131 if ((len
= mbtowc(&wc
, sp
, MB_CUR_MAX
)) == -1) {
132 (void)mbtowc(NULL
, NULL
, MB_CUR_MAX
);
133 if (dangerous_locale()) {
139 } else if (wp
== NULL
&&
140 (wc
== L
'\n' || wc
== L
'\r' || wc
== L
'\t')) {
142 * Don't use width uninitialized; the actual
143 * value doesn't matter because total_width
144 * is only returned for wp != NULL.
147 } else if ((width
= wcwidth(wc
)) == -1 &&
148 dangerous_locale()) {
153 /* Valid, printable character. */
156 if (print
&& (dp
- dst
>= (int)maxsz
- len
||
157 total_width
> max_width
- width
))
160 if (grow_dst(&dst
, &sz
, maxsz
,
165 total_width
+= width
;
175 /* Escaping required. */
178 if (print
&& (dp
- dst
>= (int)maxsz
- 4 ||
179 total_width
> max_width
- 4))
182 if (grow_dst(&dst
, &sz
, maxsz
,
187 tp
= vis(dp
, *sp
, VIS_OCTAL
| VIS_ALL
, 0);
189 total_width
+= width
;
208 * If the string was truncated by the width limit but
209 * would have fit into the size limit, the only sane way
210 * to report the problem is using the return value, such
211 * that the usual idiom "if (ret < 0 || ret >= sz) error"
215 if (ret
< (int)maxsz
&& !print
)
232 snmprintf(char *str
, size_t sz
, int *wp
, const char *fmt
, ...)
239 ret
= vasnmprintf(&cp
, sz
, wp
, fmt
, ap
);
242 (void)strlcpy(str
, cp
, sz
);
250 * To stay close to the standard interfaces, the following functions
251 * return the number of non-NUL bytes written.
255 vfmprintf(FILE *stream
, const char *fmt
, va_list ap
)
260 if ((ret
= vasnmprintf(&str
, INT_MAX
, NULL
, fmt
, ap
)) < 0)
262 if (fputs(str
, stream
) == EOF
)
269 fmprintf(FILE *stream
, const char *fmt
, ...)
275 ret
= vfmprintf(stream
, fmt
, ap
);
281 mprintf(const char *fmt
, ...)
287 ret
= vfmprintf(stdout
, fmt
, ap
);