Further harden glibc malloc metadata against 1-byte overflows.
[glibc.git] / wcsmbs / mbsrtowcs_l.c
blob4ffb652b26de88f3b70f22f94a017a9a65b2c2eb
1 /* Copyright (C) 2002-2017 Free Software Foundation, Inc.
2 This file is part of the GNU C Library.
3 Contributed by Ulrich Drepper <drepper@gnu.org>, 2002.
5 The GNU C Library is free software; you can redistribute it and/or
6 modify it under the terms of the GNU Lesser General Public
7 License as published by the Free Software Foundation; either
8 version 2.1 of the License, or (at your option) any later version.
10 The GNU C Library is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 Lesser General Public License for more details.
15 You should have received a copy of the GNU Lesser General Public
16 License along with the GNU C Library; if not, see
17 <http://www.gnu.org/licenses/>. */
19 #include <assert.h>
20 #include <ctype.h>
21 #include <string.h>
22 #include "wcsmbsload.h"
23 #include <dlfcn.h>
24 #include <errno.h>
25 #include <gconv.h>
26 #include <stdlib.h>
27 #include <string.h>
28 #include <wchar.h>
29 #include <wcsmbsload.h>
31 #include <sysdep.h>
33 #ifndef EILSEQ
34 # define EILSEQ EINVAL
35 #endif
38 size_t
39 attribute_hidden
40 __mbsrtowcs_l (wchar_t *dst, const char **src, size_t len, mbstate_t *ps,
41 __locale_t l)
43 struct __gconv_step_data data;
44 size_t result;
45 int status;
46 struct __gconv_step *towc;
47 size_t non_reversible;
48 const struct gconv_fcts *fcts;
50 /* Tell where we want the result. */
51 data.__invocation_counter = 0;
52 data.__internal_use = 1;
53 data.__flags = __GCONV_IS_LAST;
54 data.__statep = ps;
56 /* Get the conversion functions. */
57 fcts = get_gconv_fcts (l->__locales[LC_CTYPE]);
59 /* Get the structure with the function pointers. */
60 towc = fcts->towc;
61 __gconv_fct fct = towc->__fct;
62 #ifdef PTR_DEMANGLE
63 if (towc->__shlib_handle != NULL)
64 PTR_DEMANGLE (fct);
65 #endif
67 /* We have to handle DST == NULL special. */
68 if (dst == NULL)
70 mbstate_t temp_state;
71 wchar_t buf[64]; /* Just an arbitrary size. */
72 const unsigned char *inbuf = (const unsigned char *) *src;
73 const unsigned char *srcend = inbuf + strlen (*src) + 1;
75 temp_state = *data.__statep;
76 data.__statep = &temp_state;
78 result = 0;
79 data.__outbufend = (unsigned char *) buf + sizeof (buf);
82 data.__outbuf = (unsigned char *) buf;
84 status = DL_CALL_FCT (fct, (towc, &data, &inbuf, srcend, NULL,
85 &non_reversible, 0, 1));
87 result += (wchar_t *) data.__outbuf - buf;
89 while (status == __GCONV_FULL_OUTPUT);
91 if (status == __GCONV_OK || status == __GCONV_EMPTY_INPUT)
93 /* There better should be a NUL wide char at the end. */
94 assert (((wchar_t *) data.__outbuf)[-1] == L'\0');
95 /* Don't count the NUL character in. */
96 --result;
99 else
101 /* This code is based on the safe assumption that all internal
102 multi-byte encodings use the NUL byte only to mark the end
103 of the string. */
104 const unsigned char *srcp = (const unsigned char *) *src;
105 const unsigned char *srcend;
107 data.__outbuf = (unsigned char *) dst;
108 data.__outbufend = data.__outbuf + len * sizeof (wchar_t);
110 status = __GCONV_FULL_OUTPUT;
112 while (len > 0)
114 /* Pessimistic guess as to how much input we can use. In the
115 worst case we need one input byte for one output wchar_t. */
116 srcend = srcp + __strnlen ((const char *) srcp, len) + 1;
118 status = DL_CALL_FCT (fct, (towc, &data, &srcp, srcend, NULL,
119 &non_reversible, 0, 1));
120 if ((status != __GCONV_EMPTY_INPUT
121 && status != __GCONV_INCOMPLETE_INPUT)
122 /* Not all input read. */
123 || srcp != srcend
124 /* Reached the end of the input. */
125 || srcend[-1] == '\0')
126 break;
128 len = (wchar_t *) data.__outbufend - (wchar_t *) data.__outbuf;
131 /* Make the end if the input known to the caller. */
132 *src = (const char *) srcp;
134 result = (wchar_t *) data.__outbuf - dst;
136 /* We have to determine whether the last character converted
137 is the NUL character. */
138 if ((status == __GCONV_OK || status == __GCONV_EMPTY_INPUT)
139 && ((wchar_t *) dst)[result - 1] == L'\0')
141 assert (result > 0);
142 assert (__mbsinit (data.__statep));
143 *src = NULL;
144 --result;
148 /* There must not be any problems with the conversion but illegal input
149 characters. */
150 assert (status == __GCONV_OK || status == __GCONV_EMPTY_INPUT
151 || status == __GCONV_ILLEGAL_INPUT
152 || status == __GCONV_INCOMPLETE_INPUT
153 || status == __GCONV_FULL_OUTPUT);
155 if (status != __GCONV_OK && status != __GCONV_FULL_OUTPUT
156 && status != __GCONV_EMPTY_INPUT && status != __GCONV_INCOMPLETE_INPUT)
158 result = (size_t) -1;
159 __set_errno (EILSEQ);
162 return result;