#include "exim.h"
+#include <assert.h>
+static void gstring_rebuffer(gstring * g);
#ifndef COMPILE_UTILITY
/*************************************************
int
string_is_ip_address(const uschar *s, int *maskptr)
{
-int i;
int yield = 4;
/* If an optional mask is permitted, check for it. If found, pass back the
{
BOOL had_double_colon = FALSE;
BOOL v4end = FALSE;
- int count = 0;
yield = 6;
may be one and only one appearance of double colon, which implies any number
of binary zero bits. The number of preceding components is held in count. */
- for (count = 0; count < 8; count++)
+ for (int count = 0; count < 8; count++)
{
/* If the end of the string is reached before reading 8 components, the
address is valid provided a double colon has been read. This also applies
/* Test for IPv4 address, which may be the tail-end of an IPv6 address. */
-for (i = 0; i < 4; i++)
+for (int i = 0; i < 4; i++)
{
long n;
uschar * end;
uschar *
string_format_size(int size, uschar *buffer)
{
-if (size == 0) Ustrcpy(buffer, " ");
+if (size == 0) Ustrcpy(buffer, US" ");
else if (size < 1024) sprintf(CS buffer, "%5d", size);
else if (size < 10*1024)
sprintf(CS buffer, "%4.1fK", (double)size / 1024.0);
Arguments:
pp points a pointer to the initiating "\" in the string;
the pointer gets updated to point to the final character
+ If the backslash is the last character in the string, it
+ is not interpreted.
Returns: the value of the character escape
*/
int ch;
const uschar *p = *pp;
ch = *(++p);
+if (ch == '\0') return **pp;
if (isdigit(ch) && ch != '8' && ch != '9')
{
ch -= '0';
/* Get a new block of store guaranteed big enough to hold the
expanded string. */
-ss = store_get(length + nonprintcount * 3 + 1);
+ss = store_get(length + nonprintcount * 3 + 1, is_tainted(s));
/* Copy everything, escaping non printers. */
if (!p) return s;
len = Ustrlen(s) + 1;
-ss = store_get(len);
+ss = store_get(len, is_tainted(s));
q = ss;
off = p - s;
+#if (defined(HAVE_LOCAL_SCAN) || defined(EXPAND_DLFUNC)) \
+ && !defined(MACRO_PREDEF) && !defined(COMPILE_UTILITY)
/*************************************************
* Copy and save string *
*************************************************/
-/* This function assumes that memcpy() is faster than strcpy().
-
+/*
Argument: string to copy
-Returns: copy of string in new store
+Returns: copy of string in new store with the same taint status
*/
uschar *
-string_copy(const uschar *s)
+string_copy_function(const uschar *s)
{
-int len = Ustrlen(s) + 1;
-uschar *ss = store_get(len);
-memcpy(ss, s, len);
-return ss;
+return string_copy_taint(s, is_tainted(s));
}
-
-
-/*************************************************
-* Copy and save string in malloc'd store *
-*************************************************/
-
/* This function assumes that memcpy() is faster than strcpy().
-
-Argument: string to copy
-Returns: copy of string in new store
+As above, but explicitly specifying the result taint status
*/
uschar *
-string_copy_malloc(const uschar *s)
+string_copy_taint_function(const uschar * s, BOOL tainted)
{
int len = Ustrlen(s) + 1;
-uschar *ss = store_malloc(len);
+uschar *ss = store_get(len, tainted);
memcpy(ss, s, len);
return ss;
}
-/*************************************************
-* Copy, lowercase and save string *
-*************************************************/
-
-/*
-Argument: string to copy
-Returns: copy of string in new store, with letters lowercased
-*/
-
-uschar *
-string_copylc(const uschar *s)
-{
-uschar *ss = store_get(Ustrlen(s) + 1);
-uschar *p = ss;
-while (*s != 0) *p++ = tolower(*s++);
-*p = 0;
-return ss;
-}
-
-
-
/*************************************************
* Copy and save string, given length *
*************************************************/
*/
uschar *
-string_copyn(const uschar *s, int n)
+string_copyn_function(const uschar *s, int n)
{
-uschar *ss = store_get(n + 1);
+uschar *ss = store_get(n + 1, is_tainted(s));
Ustrncpy(ss, s, n);
ss[n] = 0;
return ss;
}
+#endif
/*************************************************
-* Copy, lowercase, and save string, given length *
+* Copy and save string in malloc'd store *
*************************************************/
-/* It is assumed the data contains no zeros. A zero is added
-onto the end.
-
-Arguments:
- s string to copy
- n number of characters
+/* This function assumes that memcpy() is faster than strcpy().
-Returns: copy of string in new store, with letters lowercased
+Argument: string to copy
+Returns: copy of string in new store
*/
uschar *
-string_copynlc(uschar *s, int n)
+string_copy_malloc(const uschar *s)
{
-uschar *ss = store_get(n + 1);
-uschar *p = ss;
-while (n-- > 0) *p++ = tolower(*s++);
-*p = 0;
+int len = Ustrlen(s) + 1;
+uschar *ss = store_malloc(len);
+memcpy(ss, s, len);
return ss;
}
string_copy_dnsdomain(uschar *s)
{
uschar *yield;
-uschar *ss = yield = store_get(Ustrlen(s) + 1);
+uschar *ss = yield = store_get(Ustrlen(s) + 1, is_tainted(s));
while (*s != 0)
{
/* First find the end of the string */
if (*s != '\"')
- {
while (*s != 0 && !isspace(*s)) s++;
- }
else
{
s++;
- while (*s != 0 && *s != '\"')
+ while (*s && *s != '\"')
{
if (*s == '\\') (void)string_interpret_escape(&s);
s++;
}
- if (*s != 0) s++;
+ if (*s) s++;
}
/* Get enough store to copy into */
-t = yield = store_get(s - *sptr + 1);
+t = yield = store_get(s - *sptr + 1, is_tainted(*sptr));
s = *sptr;
/* Do the copy */
if (*s != '\"')
- {
while (*s != 0 && !isspace(*s)) *t++ = *s++;
- }
else
{
s++;
while (*s != 0 && *s != '\"')
{
- if (*s == '\\') *t++ = string_interpret_escape(&s);
- else *t++ = *s;
+ *t++ = *s == '\\' ? string_interpret_escape(&s) : *s;
s++;
}
- if (*s != 0) s++;
+ if (*s) s++;
}
/* Update the pointer and return the terminated copy */
* Format a string and save it *
*************************************************/
-/* The formatting is done by string_format, which checks the length of
-everything.
+/* The formatting is done by string_vformat, which checks the length of
+everything. Taint is taken from the worst of the arguments.
Arguments:
format a printf() format - deliberately char * rather than uschar *
*/
uschar *
-string_sprintf(const char *format, ...)
+string_sprintf_trc(const char *format, const uschar * func, unsigned line, ...)
{
-va_list ap;
+#ifdef COMPILE_UTILITY
uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
-va_start(ap, format);
-if (!string_vformat(buffer, sizeof(buffer), format, ap))
- log_write(0, LOG_MAIN|LOG_PANIC_DIE,
- "string_sprintf expansion was longer than " SIZE_T_FMT
- "; format string was (%s)\nexpansion started '%.32s'",
- sizeof(buffer), format, buffer);
+gstring gs = { .size = STRING_SPRINTF_BUFFER_SIZE, .ptr = 0, .s = buffer };
+gstring * g = &gs;
+unsigned flags = 0;
+#else
+gstring * g = NULL;
+unsigned flags = SVFMT_REBUFFER|SVFMT_EXTEND;
+#endif
+
+va_list ap;
+va_start(ap, line);
+g = string_vformat_trc(g, func, line, STRING_SPRINTF_BUFFER_SIZE,
+ flags, format, ap);
va_end(ap);
-return string_copy(buffer);
+
+if (!g)
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE,
+ "string_sprintf expansion was longer than %d; format string was (%s)\n"
+ " called from %s %d\n",
+ STRING_SPRINTF_BUFFER_SIZE, format, func, line);
+
+#ifdef COMPILE_UTILITY
+return string_copyn(g->s, g->ptr);
+#else
+gstring_release_unused(g);
+return string_from_gstring(g);
+#endif
}
+#ifdef COMPILE_UTILITY
+/* Dummy version for this function; it should never be called */
+static void
+gstring_grow(gstring * g, int count)
+{
+assert(FALSE);
+}
+#endif
+
+
+
#ifndef COMPILE_UTILITY
/*************************************************
* Get next string from separated list *
const uschar *s = *listptr;
BOOL sep_is_special;
-if (s == NULL) return NULL;
+if (!s) return NULL;
/* This allows for a fixed specified separator to be an iscntrl() character,
but at the time of implementation, this is never the case. However, it's best
if (*s == '<' && (ispunct(s[1]) || iscntrl(s[1])))
{
sep = s[1];
- s += 2;
+ if (*++s) ++s;
while (isspace(*s) && *s != sep) s++;
}
else
- {
- sep = (sep == 0)? ':' : -sep;
- }
+ sep = sep ? -sep : ':';
*separator = sep;
}
/* An empty string has no list elements */
-if (*s == 0) return NULL;
+if (!*s) return NULL;
/* Note whether whether or not the separator is an iscntrl() character. */
if (buffer)
{
int p = 0;
- for (; *s != 0; s++)
+ for (; *s; s++)
{
if (*s == sep && (*(++s) != sep || sep_is_special)) break;
if (p < buflen - 1) buffer[p++] = *s;
}
while (p > 0 && isspace(buffer[p-1])) p--;
- buffer[p] = 0;
+ buffer[p] = '\0';
}
/* Handle the case when a buffer is not provided. */
else
{
- const uschar *ss;
gstring * g = NULL;
/* We know that *s != 0 at this point. However, it might be pointing to a
for (;;)
{
- for (ss = s + 1; *ss != 0 && *ss != sep; ss++) ;
+ const uschar * ss;
+ for (ss = s + 1; *ss && *ss != sep; ) ss++;
g = string_catn(g, s, ss-s);
s = ss;
- if (*s == 0 || *(++s) != sep || sep_is_special) break;
+ if (!*s || *++s != sep || sep_is_special) break;
}
while (g->ptr > 0 && isspace(g->s[g->ptr-1])) g->ptr--;
buffer = string_from_gstring(g);
- gstring_reset_unused(g);
+ gstring_release_unused(g);
}
/* Update the current pointer and return the new string */
string_append2_listele_n(gstring * list, const uschar * sepstr,
const uschar * ele, unsigned len)
{
-const uschar * sp;
-
if (list && list->ptr)
list = string_cat(list, sepstr);
/************************************************/
-/* Create a growable-string with some preassigned space */
-
-gstring *
-string_get(unsigned size)
-{
-gstring * g = store_get(sizeof(gstring) + size);
-g->size = size;
-g->ptr = 0;
-g->s = US(g + 1);
-return g;
-}
-
-/* NUL-terminate the C string in the growable-string, and return it. */
-
-uschar *
-string_from_gstring(gstring * g)
-{
-if (!g) return NULL;
-g->s[g->ptr] = '\0';
-return g->s;
-}
-
-void
-gstring_reset_unused(gstring * g)
-{
-store_reset(g->s + (g->size = g->ptr + 1));
-}
-
-/*************************************************
-* Add chars to string *
-*************************************************/
+/* Add more space to a growable-string. The caller should check
+first if growth is required. The gstring struct is modified on
+return; specifically, the string-base-pointer may have been changed.
-/* Arguments:
- g the grawable-string
- p current end of data
- count amount to grow by
+Arguments:
+ g the growable-string
+ count amount needed for g->ptr to increase by
*/
static void
-gstring_grow(gstring * g, int p, int count)
+gstring_grow(gstring * g, int count)
{
+int p = g->ptr;
int oldsize = g->size;
+BOOL tainted = is_tainted(g->s);
/* Mostly, string_cat() is used to build small strings of a few hundred
characters at most. There are times, however, when the strings are very much
existing length of the string. */
unsigned inc = oldsize < 4096 ? 127 : 1023;
-g->size = ((p + count + inc) & ~inc) + 1;
+
+if (count <= 0) return;
+g->size = (p + count + inc + 1) & ~inc; /* one for a NUL */
/* Try to extend an existing allocation. If the result of calling
store_extend() is false, either there isn't room in the current memory block,
was the last item on the dynamic memory stack. This is the case if it matches
store_last_get. */
-if (!store_extend(g->s, oldsize, g->size))
- g->s = store_newblock(g->s, g->size, p);
+if (!store_extend(g->s, tainted, oldsize, g->size))
+ g->s = store_newblock(g->s, tainted, g->size, p);
}
+/*************************************************
+* Add chars to string *
+*************************************************/
/* This function is used when building up strings of unknown length. Room is
always left for a terminating zero to be added to the string that is being
built. This function does not require the string that is being added to be NUL
string_catn(gstring * g, const uschar *s, int count)
{
int p;
+BOOL srctaint = is_tainted(s);
if (!g)
{
unsigned inc = count < 4096 ? 127 : 1023;
unsigned size = ((count + inc) & ~inc) + 1;
- g = string_get(size);
+ g = string_get_tainted(size, srctaint);
}
+else if (srctaint && !is_tainted(g->s))
+ gstring_rebuffer(g);
p = g->ptr;
if (p + count >= g->size)
- gstring_grow(g, p, count);
+ gstring_grow(g, count);
/* Because we always specify the exact number of characters to copy, we can
use memcpy(), which is likely to be more efficient than strncopy() because the
g->ptr = p + count;
return g;
}
-
-
+
+
gstring *
string_cat(gstring *string, const uschar *s)
{
*/
BOOL
-string_format(uschar *buffer, int buflen, const char *format, ...)
+string_format_trc(uschar * buffer, int buflen,
+ const uschar * func, unsigned line, const char * format, ...)
{
-BOOL yield;
+gstring g = { .size = buflen, .ptr = 0, .s = buffer }, *gp;
va_list ap;
va_start(ap, format);
-yield = string_vformat(buffer, buflen, format, ap);
+gp = string_vformat_trc(&g, func, line, STRING_SPRINTF_BUFFER_SIZE,
+ 0, format, ap);
va_end(ap);
-return yield;
+g.s[g.ptr] = '\0';
+return !!gp;
}
-BOOL
-string_vformat(uschar *buffer, int buflen, const char *format, va_list ap)
+
+/* Copy the content of a string to tainted memory */
+static void
+gstring_rebuffer(gstring * g)
{
-/* We assume numbered ascending order, C does not guarantee that */
-enum { L_NORMAL=1, L_SHORT=2, L_LONG=3, L_LONGLONG=4, L_LONGDOUBLE=5, L_SIZE=6 };
+uschar * s = store_get(g->size, TRUE);
+memcpy(s, g->s, g->ptr);
+g->s = s;
+}
+
+
+
+/* Build or append to a growing-string, sprintf-style.
+
+If the "extend" flag is true, the string passed in can be NULL,
+empty, or non-empty. Growing is subject to an overall limit given
+by the size_limit argument.
-BOOL yield = TRUE;
-int width, precision;
-const char *fp = format; /* Deliberately not unsigned */
-uschar *p = buffer;
-uschar *last = buffer + buflen - 1;
+If the "extend" flag is false, the string passed in may not be NULL,
+will not be grown, and is usable in the original place after return.
+The return value can be NULL to signify overflow.
+
+Returns the possibly-new (if copy for growth or taint-handling was needed)
+string, not nul-terminated.
+*/
+
+gstring *
+string_vformat_trc(gstring * g, const uschar * func, unsigned line,
+ unsigned size_limit, unsigned flags, const char *format, va_list ap)
+{
+enum ltypes { L_NORMAL=1, L_SHORT=2, L_LONG=3, L_LONGLONG=4, L_LONGDOUBLE=5, L_SIZE=6 };
+
+int width, precision, off, lim, need;
+const char * fp = format; /* Deliberately not unsigned */
+BOOL dest_tainted = FALSE;
+
+string_datestamp_offset = -1; /* Datestamp not inserted */
+string_datestamp_length = 0; /* Datestamp not inserted */
+string_datestamp_type = 0; /* Datestamp not inserted */
+
+#ifdef COMPILE_UTILITY
+assert(!(flags & SVFMT_EXTEND));
+assert(g);
+#else
+
+/* Ensure we have a string, to save on checking later */
+if (!g) g = string_get(16);
+else if (!(flags & SVFMT_TAINT_NOCHK)) dest_tainted = is_tainted(g->s);
+
+if (!(flags & SVFMT_TAINT_NOCHK) && !dest_tainted && is_tainted(format))
+ {
+#ifndef MACRO_PREDEF
+ if (!(flags & SVFMT_REBUFFER))
+ die_tainted(US"string_vformat", func, line);
+#endif
+ gstring_rebuffer(g);
+ dest_tainted = TRUE;
+ }
+#endif /*!COMPILE_UTILITY*/
-string_datestamp_offset = -1; /* Datestamp not inserted */
-string_datestamp_length = 0; /* Datestamp not inserted */
-string_datestamp_type = 0; /* Datestamp not inserted */
+lim = g->size - 1; /* leave one for a nul */
+off = g->ptr; /* remember initial offset in gstring */
/* Scan the format and handle the insertions */
-while (*fp != 0)
+while (*fp)
{
int length = L_NORMAL;
int *nptr;
int slen;
- const char *null = "NULL"; /* ) These variables */
- const char *item_start, *s; /* ) are deliberately */
- char newformat[16]; /* ) not unsigned */
+ const char *null = "NULL"; /* ) These variables */
+ const char *item_start, *s; /* ) are deliberately */
+ char newformat[16]; /* ) not unsigned */
+ char * gp = CS g->s + g->ptr; /* ) */
/* Non-% characters just get copied verbatim */
if (*fp != '%')
{
- if (p >= last) { yield = FALSE; break; }
- *p++ = (uschar)*fp++;
+ /* Avoid string_copyn() due to COMPILE_UTILITY */
+ if ((need = g->ptr + 1) > lim)
+ {
+ if (!(flags & SVFMT_EXTEND) || need > size_limit) return NULL;
+ gstring_grow(g, 1);
+ lim = g->size - 1;
+ }
+ g->s[g->ptr++] = (uschar) *fp++;
continue;
}
}
if (*fp == '.')
- {
if (*(++fp) == '*')
{
precision = va_arg(ap, int);
fp++;
}
else
- {
- precision = 0;
- while (isdigit((uschar)*fp))
- precision = precision*10 + *fp++ - '0';
- }
- }
+ for (precision = 0; isdigit((uschar)*fp); fp++)
+ precision = precision*10 + *fp - '0';
/* Skip over 'h', 'L', 'l', 'll' and 'z', remembering the item length */
else if (*fp == 'L')
{ fp++; length = L_LONGDOUBLE; }
else if (*fp == 'l')
- {
if (fp[1] == 'l')
- {
- fp += 2;
- length = L_LONGLONG;
- }
+ { fp += 2; length = L_LONGLONG; }
else
- {
- fp++;
- length = L_LONG;
- }
- }
+ { fp++; length = L_LONG; }
else if (*fp == 'z')
{ fp++; length = L_SIZE; }
switch (*fp++)
{
case 'n':
- nptr = va_arg(ap, int *);
- *nptr = p - buffer;
- break;
+ nptr = va_arg(ap, int *);
+ *nptr = g->ptr - off;
+ break;
case 'd':
case 'o':
case 'u':
case 'x':
case 'X':
- if (p >= last - ((length > L_LONG)? 24 : 12))
- { yield = FALSE; goto END_FORMAT; }
- strncpy(newformat, item_start, fp - item_start);
- newformat[fp - item_start] = 0;
+ width = length > L_LONG ? 24 : 12;
+ if ((need = g->ptr + width) > lim)
+ {
+ if (!(flags & SVFMT_EXTEND) || need >= size_limit) return NULL;
+ gstring_grow(g, width);
+ lim = g->size - 1;
+ gp = CS g->s + g->ptr;
+ }
+ strncpy(newformat, item_start, fp - item_start);
+ newformat[fp - item_start] = 0;
- /* Short int is promoted to int when passing through ..., so we must use
- int for va_arg(). */
+ /* Short int is promoted to int when passing through ..., so we must use
+ int for va_arg(). */
- switch(length)
- {
- case L_SHORT:
- case L_NORMAL: p += sprintf(CS p, newformat, va_arg(ap, int)); break;
- case L_LONG: p += sprintf(CS p, newformat, va_arg(ap, long int)); break;
- case L_LONGLONG: p += sprintf(CS p, newformat, va_arg(ap, LONGLONG_T)); break;
- case L_SIZE: p += sprintf(CS p, newformat, va_arg(ap, size_t)); break;
- }
- break;
+ switch(length)
+ {
+ case L_SHORT:
+ case L_NORMAL:
+ g->ptr += sprintf(gp, newformat, va_arg(ap, int)); break;
+ case L_LONG:
+ g->ptr += sprintf(gp, newformat, va_arg(ap, long int)); break;
+ case L_LONGLONG:
+ g->ptr += sprintf(gp, newformat, va_arg(ap, LONGLONG_T)); break;
+ case L_SIZE:
+ g->ptr += sprintf(gp, newformat, va_arg(ap, size_t)); break;
+ }
+ break;
case 'p':
{
void * ptr;
- if (p >= last - 24) { yield = FALSE; goto END_FORMAT; }
+ if ((need = g->ptr + 24) > lim)
+ {
+ if (!(flags & SVFMT_EXTEND || need >= size_limit)) return NULL;
+ gstring_grow(g, 24);
+ lim = g->size - 1;
+ gp = CS g->s + g->ptr;
+ }
/* sprintf() saying "(nil)" for a null pointer seems unreliable.
Handle it explicitly. */
if ((ptr = va_arg(ap, void *)))
{
strncpy(newformat, item_start, fp - item_start);
newformat[fp - item_start] = 0;
- p += sprintf(CS p, newformat, ptr);
+ g->ptr += sprintf(gp, newformat, ptr);
}
else
- p += sprintf(CS p, "(nil)");
+ g->ptr += sprintf(gp, "(nil)");
}
break;
case 'E':
case 'g':
case 'G':
- if (precision < 0) precision = 6;
- if (p >= last - precision - 8) { yield = FALSE; goto END_FORMAT; }
- strncpy(newformat, item_start, fp - item_start);
- newformat[fp-item_start] = 0;
- if (length == L_LONGDOUBLE)
- p += sprintf(CS p, newformat, va_arg(ap, long double));
- else
- p += sprintf(CS p, newformat, va_arg(ap, double));
- break;
+ if (precision < 0) precision = 6;
+ if ((need = g->ptr + precision + 8) > lim)
+ {
+ if (!(flags & SVFMT_EXTEND || need >= size_limit)) return NULL;
+ gstring_grow(g, precision+8);
+ lim = g->size - 1;
+ gp = CS g->s + g->ptr;
+ }
+ strncpy(newformat, item_start, fp - item_start);
+ newformat[fp-item_start] = 0;
+ if (length == L_LONGDOUBLE)
+ g->ptr += sprintf(gp, newformat, va_arg(ap, long double));
+ else
+ g->ptr += sprintf(gp, newformat, va_arg(ap, double));
+ break;
/* String types */
case '%':
- if (p >= last) { yield = FALSE; goto END_FORMAT; }
- *p++ = '%';
- break;
+ if ((need = g->ptr + 1) > lim)
+ {
+ if (!(flags & SVFMT_EXTEND || need >= size_limit)) return NULL;
+ gstring_grow(g, 1);
+ lim = g->size - 1;
+ }
+ g->s[g->ptr++] = (uschar) '%';
+ break;
case 'c':
- if (p >= last) { yield = FALSE; goto END_FORMAT; }
- *p++ = va_arg(ap, int);
- break;
+ if ((need = g->ptr + 1) > lim)
+ {
+ if (!(flags & SVFMT_EXTEND || need >= size_limit)) return NULL;
+ gstring_grow(g, 1);
+ lim = g->size - 1;
+ }
+ g->s[g->ptr++] = (uschar) va_arg(ap, int);
+ break;
case 'D': /* Insert daily datestamp for log file names */
- s = CS tod_stamp(tod_log_datestamp_daily);
- string_datestamp_offset = p - buffer; /* Passed back via global */
- string_datestamp_length = Ustrlen(s); /* Passed back via global */
- string_datestamp_type = tod_log_datestamp_daily;
- slen = string_datestamp_length;
- goto INSERT_STRING;
+ s = CS tod_stamp(tod_log_datestamp_daily);
+ string_datestamp_offset = g->ptr; /* Passed back via global */
+ string_datestamp_length = Ustrlen(s); /* Passed back via global */
+ string_datestamp_type = tod_log_datestamp_daily;
+ slen = string_datestamp_length;
+ goto INSERT_STRING;
case 'M': /* Insert monthly datestamp for log file names */
- s = CS tod_stamp(tod_log_datestamp_monthly);
- string_datestamp_offset = p - buffer; /* Passed back via global */
- string_datestamp_length = Ustrlen(s); /* Passed back via global */
- string_datestamp_type = tod_log_datestamp_monthly;
- slen = string_datestamp_length;
- goto INSERT_STRING;
+ s = CS tod_stamp(tod_log_datestamp_monthly);
+ string_datestamp_offset = g->ptr; /* Passed back via global */
+ string_datestamp_length = Ustrlen(s); /* Passed back via global */
+ string_datestamp_type = tod_log_datestamp_monthly;
+ slen = string_datestamp_length;
+ goto INSERT_STRING;
case 's':
case 'S': /* Forces *lower* case */
case 'T': /* Forces *upper* case */
- s = va_arg(ap, char *);
-
- if (s == NULL) s = null;
- slen = Ustrlen(s);
+ s = va_arg(ap, char *);
+
+ if (!s) s = null;
+ slen = Ustrlen(s);
+
+ if (!(flags & SVFMT_TAINT_NOCHK) && !dest_tainted && is_tainted(s))
+ if (flags & SVFMT_REBUFFER)
+ {
+ gstring_rebuffer(g);
+ gp = CS g->s + g->ptr;
+ dest_tainted = TRUE;
+ }
+#ifndef MACRO_PREDEF
+ else
+ die_tainted(US"string_vformat", func, line);
+#endif
INSERT_STRING: /* Come to from %D or %M above */
- /* If the width is specified, check that there is a precision
- set; if not, set it to the width to prevent overruns of long
- strings. */
-
- if (width >= 0)
{
- if (precision < 0) precision = width;
- }
+ BOOL truncated = FALSE;
- /* If a width is not specified and the precision is specified, set
- the width to the precision, or the string length if shorted. */
+ /* If the width is specified, check that there is a precision
+ set; if not, set it to the width to prevent overruns of long
+ strings. */
- else if (precision >= 0)
- {
- width = (precision < slen)? precision : slen;
- }
+ if (width >= 0)
+ {
+ if (precision < 0) precision = width;
+ }
- /* If neither are specified, set them both to the string length. */
+ /* If a width is not specified and the precision is specified, set
+ the width to the precision, or the string length if shorted. */
- else width = precision = slen;
+ else if (precision >= 0)
+ width = precision < slen ? precision : slen;
- /* Check string space, and add the string to the buffer if ok. If
- not OK, add part of the string (debugging uses this to show as
- much as possible). */
+ /* If neither are specified, set them both to the string length. */
- if (p == last)
- {
- yield = FALSE;
- goto END_FORMAT;
- }
- if (p >= last - width)
- {
- yield = FALSE;
- width = precision = last - p - 1;
- if (width < 0) width = 0;
- if (precision < 0) precision = 0;
+ else
+ width = precision = slen;
+
+ if ((need = g->ptr + width) >= size_limit || !(flags & SVFMT_EXTEND))
+ {
+ if (g->ptr == lim) return NULL;
+ if (need > lim)
+ {
+ truncated = TRUE;
+ width = precision = lim - g->ptr - 1;
+ if (width < 0) width = 0;
+ if (precision < 0) precision = 0;
+ }
+ }
+ else if (need > lim)
+ {
+ gstring_grow(g, width);
+ lim = g->size - 1;
+ gp = CS g->s + g->ptr;
+ }
+
+ g->ptr += sprintf(gp, "%*.*s", width, precision, s);
+ if (fp[-1] == 'S')
+ while (*gp) { *gp = tolower(*gp); gp++; }
+ else if (fp[-1] == 'T')
+ while (*gp) { *gp = toupper(*gp); gp++; }
+
+ if (truncated) return NULL;
+ break;
}
- sprintf(CS p, "%*.*s", width, precision, s);
- if (fp[-1] == 'S')
- while (*p) { *p = tolower(*p); p++; }
- else if (fp[-1] == 'T')
- while (*p) { *p = toupper(*p); p++; }
- else
- while (*p) p++;
- if (!yield) goto END_FORMAT;
- break;
/* Some things are never used in Exim; also catches junk. */
default:
- strncpy(newformat, item_start, fp - item_start);
- newformat[fp-item_start] = 0;
- log_write(0, LOG_MAIN|LOG_PANIC_DIE, "string_format: unsupported type "
- "in \"%s\" in \"%s\"", newformat, format);
- break;
+ strncpy(newformat, item_start, fp - item_start);
+ newformat[fp-item_start] = 0;
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE, "string_format: unsupported type "
+ "in \"%s\" in \"%s\"", newformat, format);
+ break;
}
}
-/* Ensure string is complete; return TRUE if got to the end of the format */
-
-END_FORMAT:
-
-*p = 0;
-return yield;
+if (g->ptr > g->size)
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE,
+ "string_format internal error: caller %s %d", func, line);
+return g;
}
*/
uschar *
-string_open_failed(int eno, const char *format, ...)
+string_open_failed_trc(int eno, const uschar * func, unsigned line,
+ const char *format, ...)
{
va_list ap;
-uschar buffer[1024];
+gstring * g = string_get(1024);
-Ustrcpy(buffer, "failed to open ");
-va_start(ap, format);
+g = string_catn(g, US"failed to open ", 15);
/* Use the checked formatting routine to ensure that the buffer
does not overflow. It should not, since this is called only for internally
specified messages. If it does, the message just gets truncated, and there
doesn't seem much we can do about that. */
-(void)string_vformat(buffer+15, sizeof(buffer) - 15, format, ap);
+va_start(ap, format);
+(void) string_vformat_trc(g, func, line, STRING_SPRINTF_BUFFER_SIZE,
+ 0, format, ap);
+string_from_gstring(g);
+gstring_release_unused(g);
va_end(ap);
-return (eno == EACCES)?
- string_sprintf("%s: %s (euid=%ld egid=%ld)", buffer, strerror(eno),
- (long int)geteuid(), (long int)getegid()) :
- string_sprintf("%s: %s", buffer, strerror(eno));
+return eno == EACCES
+ ? string_sprintf("%s: %s (euid=%ld egid=%ld)", g->s, strerror(eno),
+ (long int)geteuid(), (long int)getegid())
+ : string_sprintf("%s: %s", g->s, strerror(eno));
}
#endif /* COMPILE_UTILITY */
+
/*************************************************
**************************************************
* Stand-alone test program *
projects / exim.git / blobdiff