1 /* $OpenBSD: utf8.c,v 1.8 2018/08/21 13:56:27 schwarze Exp $ */
3 * Copyright (c) 2016 Ingo Schwarze <schwarze@openbsd.org>
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 * Utility functions for multibyte-character handling,
20 * in particular to sanitize untrusted strings for terminal output.
25 #include <sys/types.h>
26 #ifdef HAVE_LANGINFO_H
27 # include <langinfo.h>
35 #if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS)
44 static int dangerous_locale(void);
45 static int grow_dst(char **, size_t *, size_t, char **, size_t);
46 static int vasnmprintf(char **, size_t, int *, const char *, va_list);
50 * For US-ASCII and UTF-8 encodings, we can safely recover from
51 * encoding errors and from non-printable characters. For any
52 * other encodings, err to the side of caution and abort parsing:
53 * For state-dependent encodings, recovery is impossible.
54 * For arbitrary encodings, replacement of non-printable
55 * characters would be non-trivial and too fragile.
56 * The comments indicate what nl_langinfo(CODESET)
57 * returns for US-ASCII on various operating systems.
61 dangerous_locale(void) {
64 loc = nl_langinfo(CODESET);
65 return strcmp(loc, "UTF-8") != 0 &&
66 strcmp(loc, "US-ASCII") != 0 && /* OpenBSD */
67 strcmp(loc, "ANSI_X3.4-1968") != 0 && /* Linux */
68 strcmp(loc, "ISO8859-1") != 0 && /* AIX */
69 strcmp(loc, "646") != 0 && /* Solaris, NetBSD */
70 strcmp(loc, "") != 0; /* Solaris 6 */
74 grow_dst(char **dst, size_t *sz, size_t maxsz, char **dp, size_t need)
79 if (*dp + need < *dst + *sz)
84 if ((tp = recallocarray(*dst, *sz, tsz, 1)) == NULL)
86 *dp = tp + (*dp - *dst);
93 * The following two functions limit the number of bytes written,
94 * including the terminating '\0', to sz. Unless wp is NULL,
95 * they limit the number of display columns occupied to *wp.
96 * Whichever is reached first terminates the output string.
97 * To stay close to the standard interfaces, they return the number of
98 * non-NUL bytes that would have been written if both were unlimited.
99 * If wp is NULL, newline, carriage return, and tab are allowed;
100 * otherwise, the actual number of columns occupied by what was
101 * written is returned in *wp.
105 vasnmprintf(char **str, size_t maxsz, int *wp, const char *fmt, va_list ap)
107 char *src; /* Source string returned from vasprintf. */
108 char *sp; /* Pointer into src. */
109 char *dst; /* Destination string to be returned. */
110 char *dp; /* Pointer into dst. */
111 char *tp; /* Temporary pointer for dst. */
112 size_t sz; /* Number of bytes allocated for dst. */
113 wchar_t wc; /* Wide character at sp. */
114 int len; /* Number of bytes in the character at sp. */
115 int ret; /* Number of bytes needed to format src. */
116 int width; /* Display width of the character wc. */
117 int total_width, max_width, print;
120 if ((ret = vasprintf(&src, fmt, ap)) <= 0)
123 sz = strlen(src) + 1;
124 if ((dst = malloc(sz)) == NULL) {
138 max_width = wp == NULL ? INT_MAX : *wp;
139 while (*sp != '\0') {
140 if ((len = mbtowc(&wc, sp, MB_CUR_MAX)) == -1) {
141 (void)mbtowc(NULL, NULL, MB_CUR_MAX);
142 if (dangerous_locale()) {
148 } else if (wp == NULL &&
149 (wc == L'\n' || wc == L'\r' || wc == L'\t')) {
151 * Don't use width uninitialized; the actual
152 * value doesn't matter because total_width
153 * is only returned for wp != NULL.
156 } else if ((width = wcwidth(wc)) == -1 &&
157 dangerous_locale()) {
162 /* Valid, printable character. */
165 if (print && (dp - dst >= (int)maxsz - len ||
166 total_width > max_width - width))
169 if (grow_dst(&dst, &sz, maxsz,
174 total_width += width;
184 /* Escaping required. */
187 if (print && (dp - dst >= (int)maxsz - 4 ||
188 total_width > max_width - 4))
191 if (grow_dst(&dst, &sz, maxsz,
196 tp = vis(dp, *sp, VIS_OCTAL | VIS_ALL, 0);
198 total_width += width;
217 * If the string was truncated by the width limit but
218 * would have fit into the size limit, the only sane way
219 * to report the problem is using the return value, such
220 * that the usual idiom "if (ret < 0 || ret >= sz) error"
224 if (ret < (int)maxsz && !print)
241 snmprintf(char *str, size_t sz, int *wp, const char *fmt, ...)
248 ret = vasnmprintf(&cp, sz, wp, fmt, ap);
251 (void)strlcpy(str, cp, sz);
259 * To stay close to the standard interfaces, the following functions
260 * return the number of non-NUL bytes written.
264 vfmprintf(FILE *stream, const char *fmt, va_list ap)
269 if ((ret = vasnmprintf(&str, INT_MAX, NULL, fmt, ap)) < 0)
271 if (fputs(str, stream) == EOF)
278 fmprintf(FILE *stream, const char *fmt, ...)
284 ret = vfmprintf(stream, fmt, ap);
290 mprintf(const char *fmt, ...)
296 ret = vfmprintf(stdout, fmt, ap);
302 * Set up libc for multibyte output in the user's chosen locale.
304 * XXX: we are known to have problems with Turkish (i/I confusion) so we
305 * deliberately fall back to the C locale for now. Longer term we should
306 * always prefer to select C.[encoding] if possible, but there's no
307 * standardisation in locales between systems, so we'll need to survey
308 * what's out there first.
313 const char *vars[] = { "LC_ALL", "LC_CTYPE", "LANG", NULL };
318 * We can't yet cope with dotless/dotted I in Turkish locales,
319 * so fall back to the C locale for these.
321 for (i = 0; vars[i] != NULL; i++) {
322 if ((cp = getenv(vars[i])) == NULL)
324 if (strncasecmp(cp, "TR", 2) != 0)
327 * If we're in a UTF-8 locale then prefer to use
328 * the C.UTF-8 locale (or equivalent) if it exists.
330 if ((strcasestr(cp, "UTF-8") != NULL ||
331 strcasestr(cp, "UTF8") != NULL) &&
332 (setlocale(LC_CTYPE, "C.UTF-8") != NULL ||
333 setlocale(LC_CTYPE, "POSIX.UTF-8") != NULL))
335 setlocale(LC_CTYPE, "C");
338 /* We can handle this locale */
339 setlocale(LC_CTYPE, "");