Use offset into parser buffer to avoid potential heap overflow.

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>

diff --git a/delta.c b/delta.c
index 32628dcb719c11a4934f780e72fbfffb15c981e2..082633b1c2ccd75f6889efe7c46e19091c8b7f4f 100644 (file)
--- a/delta.c
+++ b/delta.c
@@ -471,8 +471,19 @@ int uci_save(struct uci_context *ctx, struct uci_package *p)
 
                if (h->cmd == UCI_CMD_REMOVE && !h->value)
                        fprintf(f, "\n");
-               else
-                       fprintf(f, "=%s\n", h->value);
+               else {
+                       int i;
+
+                       fprintf(f, "='");
+                       for (i = 0; h->value[i]; i++) {
+                               unsigned char c = h->value[i];
+                               if (c != '\'')
+                                       fputc(c, f);
+                               else
+                                       fprintf(f, "'\\''");
+                       }
+                       fprintf(f, "'\n");
+               }
                uci_free_delta(h);
        }
 

diff --git a/file.c b/file.c
index a5e242f4908409bd9dfe9c9bbec67deb56bb9ce3..8d4408d43e4b78bd6c3af86d98e5ef5df4c8f231 100644 (file)
--- a/file.c
+++ b/file.c
@@ -48,11 +48,16 @@ __private void uci_getln(struct uci_context *ctx, int offset)
                pctx->buf = uci_malloc(ctx, LINEBUF);
                pctx->bufsz = LINEBUF;
        }
+       /* `offset' may off by one */
+       if (offset >= pctx->bufsz) {
+               pctx->bufsz *= 2;
+               pctx->buf = uci_realloc(ctx, pctx->buf, pctx->bufsz);
+       }
 
        ofs = offset;
        do {
                p = &pctx->buf[ofs];
-               p[ofs] = 0;
+               p[0] = 0;
 
                p = fgets(p, pctx->bufsz - ofs, pctx->file);
                if (!p || !*p)
@@ -61,36 +66,36 @@ __private void uci_getln(struct uci_context *ctx, int offset)
                ofs += strlen(p);
                if (pctx->buf[ofs - 1] == '\n') {
                        pctx->line++;
-                       if (ofs >= 2 && pctx->buf[ofs - 2] == '\r')
-                               pctx->buf[ofs - 2] = 0;
-                       else
-                               pctx->buf[ofs - 1] = 0;
                        return;
                }
 
                if (pctx->bufsz > LINEBUF_MAX/2)
-                       uci_parse_error(ctx, p, "line too long");
+                       uci_parse_error(ctx, "line too long");
 
                pctx->bufsz *= 2;
                pctx->buf = uci_realloc(ctx, pctx->buf, pctx->bufsz);
        } while (1);
 }
 
-
 /*
  * parse a character escaped by '\'
  * returns true if the escaped character is to be parsed
  * returns false if the escaped character is to be ignored
  */
-static inline bool parse_backslash(struct uci_context *ctx, char **str)
+static bool parse_backslash(struct uci_context *ctx)
 {
+       struct uci_parse_context *pctx = ctx->pctx;
+
        /* skip backslash */
-       *str += 1;
+       pctx->pos += 1;
 
        /* undecoded backslash at the end of line, fetch the next line */
-       if (!**str) {
-               *str += 1;
-               uci_getln(ctx, *str - ctx->pctx->buf);
+       if (!pctx_cur_char(pctx)
+                   || pctx_cur_char(pctx) == '\n'
+                   || (pctx_cur_char(pctx) == '\r' &&
+                       pctx_char(pctx, pctx_pos(pctx) + 1) == '\n' &&
+                       !pctx_char(pctx, pctx_pos(pctx) + 2))) {
+               uci_getln(ctx, pctx->pos);
                return false;
        }
 
@@ -102,91 +107,106 @@ static inline bool parse_backslash(struct uci_context *ctx, char **str)
  * move the string pointer forward until a non-whitespace character or
  * EOL is reached
  */
-static void skip_whitespace(struct uci_context *ctx, char **str)
+static void skip_whitespace(struct uci_context *ctx)
 {
-restart:
-       while (**str && isspace(**str))
-               *str += 1;
+       struct uci_parse_context *pctx = ctx->pctx;
 
-       if (**str == '\\') {
-               if (!parse_backslash(ctx, str))
-                       goto restart;
-       }
+       while (pctx_cur_char(pctx) && isspace(pctx_cur_char(pctx)))
+               pctx->pos += 1;
 }
 
-static inline void addc(char **dest, char **src)
+static inline void addc(struct uci_context *ctx, int *pos_dest, int *pos_src)
 {
-       **dest = **src;
-       *dest += 1;
-       *src += 1;
+       struct uci_parse_context *pctx = ctx->pctx;
+
+       pctx_char(pctx, *pos_dest) = pctx_char(pctx, *pos_src);
+       *pos_dest += 1;
+       *pos_src += 1;
 }
 
 /*
  * parse a double quoted string argument from the command line
  */
-static void parse_double_quote(struct uci_context *ctx, char **str, char **target)
+static void parse_double_quote(struct uci_context *ctx, int *target)
 {
+       struct uci_parse_context *pctx = ctx->pctx;
        char c;
 
        /* skip quote character */
-       *str += 1;
+       pctx->pos += 1;
 
-       while ((c = **str)) {
+       while (1) {
+               c = pctx_cur_char(pctx);
                switch(c) {
                case '"':
-                       **target = 0;
-                       *str += 1;
+                       pctx->pos += 1;
                        return;
+               case 0:
+                       /* Multi-line str value */
+                       uci_getln(ctx, pctx->pos);
+                       if (!pctx_cur_char(pctx)) {
+                               uci_parse_error(ctx, "EOF with unterminated \"");
+                       }
+                       break;
                case '\\':
-                       if (!parse_backslash(ctx, str))
+                       if (!parse_backslash(ctx))
                                continue;
                        /* fall through */
                default:
-                       addc(target, str);
+                       addc(ctx, target, &pctx->pos);
                        break;
                }
        }
-       uci_parse_error(ctx, *str, "unterminated \"");
+       uci_parse_error(ctx, "unterminated \"");
 }
 
 /*
  * parse a single quoted string argument from the command line
  */
-static void parse_single_quote(struct uci_context *ctx, char **str, char **target)
+static void parse_single_quote(struct uci_context *ctx, int *target)
 {
+       struct uci_parse_context *pctx = ctx->pctx;
        char c;
        /* skip quote character */
-       *str += 1;
+       pctx->pos += 1;
 
-       while ((c = **str)) {
+       while (1) {
+               c = pctx_cur_char(pctx);
                switch(c) {
                case '\'':
-                       **target = 0;
-                       *str += 1;
+                       pctx->pos += 1;
                        return;
+               case 0:
+                       /* Multi-line str value */
+                       uci_getln(ctx, pctx->pos);
+                       if (!pctx_cur_char(pctx)) {
+                               uci_parse_error(ctx, "EOF with unterminated \"");
+                       }
+                       break;
                default:
-                       addc(target, str);
+                       addc(ctx, target, &pctx->pos);
                }
        }
-       uci_parse_error(ctx, *str, "unterminated '");
+       uci_parse_error(ctx, "unterminated '");
 }
 
 /*
  * parse a string from the command line and detect the quoting style
  */
-static void parse_str(struct uci_context *ctx, char **str, char **target)
+static void parse_str(struct uci_context *ctx, int *target)
 {
+       struct uci_parse_context *pctx = ctx->pctx;
        bool next = true;
        do {
-               switch(**str) {
+               switch(pctx_cur_char(pctx)) {
                case '\'':
-                       parse_single_quote(ctx, str, target);
+                       parse_single_quote(ctx, target);
                        break;
                case '"':
-                       parse_double_quote(ctx, str, target);
+                       parse_double_quote(ctx, target);
                        break;
                case '#':
-                       **str = 0;
+                       pctx_cur_char(pctx) = 0;
                        /* fall through */
                case 0:
                        goto done;
@@ -194,14 +214,14 @@ static void parse_str(struct uci_context *ctx, char **str, char **target)
                        next = false;
                        goto done;
                case '\\':
-                       if (!parse_backslash(ctx, str))
+                       if (!parse_backslash(ctx))
                                continue;
                        /* fall through */
                default:
-                       addc(target, str);
+                       addc(ctx, target, &pctx->pos);
                        break;
                }
-       } while (**str && !isspace(**str));
+       } while (pctx_cur_char(pctx) && !isspace(pctx_cur_char(pctx)));
 done:
 
        /*
@@ -209,40 +229,40 @@ done:
         * character, skip to the next one, because the whitespace will
         * be overwritten by a null byte here
         */
-       if (**str && next)
-               *str += 1;
+       if (pctx_cur_char(pctx) && next)
+               pctx->pos += 1;
 
        /* terminate the parsed string */
-       **target = 0;
+       pctx_char(pctx, *target) = 0;
 }
 
 /*
  * extract the next argument from the command line
  */
-static char *next_arg(struct uci_context *ctx, char **str, bool required, bool name)
+static char *next_arg(struct uci_context *ctx, bool required, bool name)
 {
-       char *val;
-       char *ptr;
-
-       val = ptr = *str;
-       skip_whitespace(ctx, str);
-       if(*str[0] == ';') {
-               *str[0] = 0;
-               *str += 1;
+       struct uci_parse_context *pctx = ctx->pctx;
+       int val, ptr;
+
+       skip_whitespace(ctx);
+       val = ptr = pctx_pos(pctx);
+       if(pctx_cur_char(pctx) == ';') {
+               pctx_cur_char(pctx) = 0;
+               pctx->pos += 1;
        } else {
-               parse_str(ctx, str, &ptr);
+               parse_str(ctx, &ptr);
        }
-       if (!*val) {
+       if (!pctx_char(pctx, val)) {
                if (required)
-                       uci_parse_error(ctx, *str, "insufficient arguments");
+                       uci_parse_error(ctx, "insufficient arguments");
                goto done;
        }
 
-       if (name && !uci_validate_name(val))
-               uci_parse_error(ctx, val, "invalid character in field");
+       if (name && !uci_validate_name(pctx_str(pctx, val)))
+               uci_parse_error(ctx, "invalid character in name field");
 
 done:
-       return val;
+       return pctx_str(pctx, val);
 }
 
 int uci_parse_argument(struct uci_context *ctx, FILE *stream, char **str, char **result)
@@ -262,9 +282,11 @@ int uci_parse_argument(struct uci_context *ctx, FILE *stream, char **str, char *
        if (!*str) {
                uci_getln(ctx, 0);
                *str = ctx->pctx->buf;
+       } else {
+               UCI_ASSERT(ctx, ctx->pctx->pos == *str - ctx->pctx->buf);
        }
 
-       *result = next_arg(ctx, str, false, false);
+       *result = next_arg(ctx, false, false);
 
        return 0;
 }
@@ -310,14 +332,14 @@ fill_package:
  * verify that the end of the line or command is reached.
  * throw an error if extra arguments are given on the command line
  */
-static void assert_eol(struct uci_context *ctx, char **str)
+static void assert_eol(struct uci_context *ctx)
 {
        char *tmp;
 
-       skip_whitespace(ctx, str);
-       tmp = next_arg(ctx, str, false, false);
+       skip_whitespace(ctx);
+       tmp = next_arg(ctx, false, false);
        if (*tmp && (ctx->flags & UCI_FLAG_STRICT))
-               uci_parse_error(ctx, *str, "too many arguments");
+               uci_parse_error(ctx, "too many arguments");
 }
 
 /*
@@ -358,15 +380,16 @@ static void uci_switch_config(struct uci_context *ctx)
 /*
  * parse the 'package' uci command (next config package)
  */
-static void uci_parse_package(struct uci_context *ctx, char **str, bool single)
+static void uci_parse_package(struct uci_context *ctx, bool single)
 {
+       struct uci_parse_context *pctx = ctx->pctx;
        char *name = NULL;
 
        /* command string null-terminated by strtok */
-       *str += strlen(*str) + 1;
+       pctx->pos += strlen(pctx_cur_str(pctx)) + 1;
 
-       name = next_arg(ctx, str, true, true);
-       assert_eol(ctx, str);
+       name = next_arg(ctx, true, true);
+       assert_eol(ctx);
        if (single)
                return;
 
@@ -377,7 +400,7 @@ static void uci_parse_package(struct uci_context *ctx, char **str, bool single)
 /*
  * parse the 'config' uci command (open a section)
  */
-static void uci_parse_config(struct uci_context *ctx, char **str)
+static void uci_parse_config(struct uci_context *ctx)
 {
        struct uci_parse_context *pctx = ctx->pctx;
        struct uci_element *e;
@@ -388,19 +411,19 @@ static void uci_parse_config(struct uci_context *ctx, char **str)
        uci_fixup_section(ctx, ctx->pctx->section);
        if (!ctx->pctx->package) {
                if (!ctx->pctx->name)
-                       uci_parse_error(ctx, *str, "attempting to import a file without a package name");
+                       uci_parse_error(ctx, "attempting to import a file without a package name");
 
                uci_switch_config(ctx);
        }
 
        /* command string null-terminated by strtok */
-       *str += strlen(*str) + 1;
+       pctx->pos += strlen(pctx_cur_str(pctx)) + 1;
 
-       type = next_arg(ctx, str, true, false);
+       type = next_arg(ctx, true, false);
        if (!uci_validate_type(type))
-               uci_parse_error(ctx, type, "invalid character in field");
-       name = next_arg(ctx, str, false, true);
-       assert_eol(ctx, str);
+               uci_parse_error(ctx, "invalid character in type field");
+       name = next_arg(ctx, false, true);
+       assert_eol(ctx);
 
        if (!name || !name[0]) {
                ctx->internal = !pctx->merge;
@@ -422,7 +445,7 @@ static void uci_parse_config(struct uci_context *ctx, char **str)
 /*
  * parse the 'option' uci command (open a value)
  */
-static void uci_parse_option(struct uci_context *ctx, char **str, bool list)
+static void uci_parse_option(struct uci_context *ctx, bool list)
 {
        struct uci_parse_context *pctx = ctx->pctx;
        struct uci_element *e;
@@ -431,14 +454,14 @@ static void uci_parse_option(struct uci_context *ctx, char **str, bool list)
        char *value = NULL;
 
        if (!pctx->section)
-               uci_parse_error(ctx, *str, "option/list command found before the first section");
+               uci_parse_error(ctx, "option/list command found before the first section");
 
        /* command string null-terminated by strtok */
-       *str += strlen(*str) + 1;
+       pctx->pos += strlen(pctx_cur_str(pctx)) + 1;
 
-       name = next_arg(ctx, str, true, true);
-       value = next_arg(ctx, str, false, false);
-       assert_eol(ctx, str);
+       name = next_arg(ctx, true, true);
+       value = next_arg(ctx, false, false);
+       assert_eol(ctx);
 
        uci_fill_ptr(ctx, &ptr, &pctx->section->e);
        e = uci_lookup_list(&pctx->section->options, name);
@@ -460,12 +483,12 @@ static void uci_parse_option(struct uci_context *ctx, char **str, bool list)
 static void uci_parse_line(struct uci_context *ctx, bool single)
 {
        struct uci_parse_context *pctx = ctx->pctx;
-       char *word, *brk;
+       char *word;
 
-       word = pctx->buf;
+       /* Skip whitespace characters at the start of line */
+       skip_whitespace(ctx);
        do {
-               brk = NULL;
-               word = strtok_r(word, " \t", &brk);
+               word = strtok(pctx_cur_str(pctx), " \t");
                if (!word)
                        return;
 
@@ -475,25 +498,25 @@ static void uci_parse_line(struct uci_context *ctx, bool single)
                                return;
                        case 'p':
                                if ((word[1] == 0) || !strcmp(word + 1, "ackage"))
-                                       uci_parse_package(ctx, &word, single);
+                                       uci_parse_package(ctx, single);
                                else
                                        goto invalid;
                                break;
                        case 'c':
                                if ((word[1] == 0) || !strcmp(word + 1, "onfig"))
-                                       uci_parse_config(ctx, &word);
+                                       uci_parse_config(ctx);
                                else
                                        goto invalid;
                                break;
                        case 'o':
                                if ((word[1] == 0) || !strcmp(word + 1, "ption"))
-                                       uci_parse_option(ctx, &word, false);
+                                       uci_parse_option(ctx, false);
                                else
                                        goto invalid;
                                break;
                        case 'l':
                                if ((word[1] == 0) || !strcmp(word + 1, "ist"))
-                                       uci_parse_option(ctx, &word, true);
+                                       uci_parse_option(ctx, true);
                                else
                                        goto invalid;
                                break;
@@ -502,7 +525,7 @@ static void uci_parse_line(struct uci_context *ctx, bool single)
                }
                continue;
 invalid:
-               uci_parse_error(ctx, word, "invalid command");
+               uci_parse_error(ctx, "invalid command");
        } while (1);
 }
 
@@ -639,6 +662,7 @@ int uci_import(struct uci_context *ctx, FILE *stream, const char *name, struct u
        }
 
        while (!feof(pctx->file)) {
+               pctx->pos = 0;
                uci_getln(ctx, 0);
                UCI_TRAP_SAVE(ctx, error);
                if (pctx->buf[0])

diff --git a/uci_internal.h b/uci_internal.h
index b4e62ffb973714588cfcbbd00c40353873fcf299..89863f1fec7bc3645ca8a6c688737d7e74cbdc6f 100644 (file)
--- a/uci_internal.h
+++ b/uci_internal.h
@@ -33,7 +33,13 @@ struct uci_parse_context
        const char *name;
        char *buf;
        int bufsz;
+       int pos;
 };
+#define pctx_pos(pctx)         ((pctx)->pos)
+#define pctx_str(pctx, i)      (&(pctx)->buf[(i)])
+#define pctx_cur_str(pctx)     pctx_str(pctx, pctx_pos(pctx))
+#define pctx_char(pctx, i)     ((pctx)->buf[(i)])
+#define pctx_cur_char(pctx)    pctx_char(pctx, pctx_pos(pctx))
 
 extern const char *uci_confdir;
 extern const char *uci_savedir;
@@ -50,7 +56,7 @@ __private FILE *uci_open_stream(struct uci_context *ctx, const char *filename, c
 __private void uci_close_stream(FILE *stream);
 __private void uci_getln(struct uci_context *ctx, int offset);
 
-__private void uci_parse_error(struct uci_context *ctx, char *pos, char *reason);
+__private void uci_parse_error(struct uci_context *ctx, char *reason);
 __private void uci_alloc_parse_context(struct uci_context *ctx);
 
 __private void uci_cleanup(struct uci_context *ctx);

diff --git a/util.c b/util.c
index ce7d849855fe39b5b3b1caf3a683fac4b05e3a7f..09f18171cede5399a020610050b9f202dd476ee7 100644 (file)
--- a/util.c
+++ b/util.c
@@ -89,9 +89,12 @@ bool uci_validate_text(const char *str)
 {
        while (*str) {
                unsigned char c = *str;
-               if ((c == '\r') || (c == '\n') ||
-                       ((c < 32) && (c != '\t')))
+               if (((c < 32) &&
+                    (c != '\t') &&
+                    (c != '\n') &&
+                    (c != '\r'))) {
                        return false;
+               }
                str++;
        }
        return true;
@@ -161,12 +164,12 @@ error:
 }
 
 
-__private void uci_parse_error(struct uci_context *ctx, char *pos, char *reason)
+__private void uci_parse_error(struct uci_context *ctx, char *reason)
 {
        struct uci_parse_context *pctx = ctx->pctx;
 
        pctx->reason = reason;
-       pctx->byte = pos - pctx->buf;
+       pctx->byte = pctx_pos(pctx);
        UCI_THROW(ctx, UCI_ERR_PARSE);
 }