summaryrefslogtreecommitdiffabout
authorMark Lodato <lodatom@gmail.com>2010-08-28 01:02:27 (UTC)
committer Lars Hjemli <hjemli@gmail.com>2010-08-29 15:27:40 (UTC)
commit48434780ca62fde84337ea1e797f642de5ca50d5 (patch) (unidiff)
treead6a67137124a5ae70de10dd29e84bd6bf21c6ea
parentc94414a4c8cd099f5737e8b4066693d07ce78f61 (diff)
downloadcgit-48434780ca62fde84337ea1e797f642de5ca50d5.zip
cgit-48434780ca62fde84337ea1e797f642de5ca50d5.tar.gz
cgit-48434780ca62fde84337ea1e797f642de5ca50d5.tar.bz2
html: fix strcpy bug in convert_query_hexchar
The source and destination strings in strcpy() may not overlap. Instead, use memmove(), which allows overlap. This fixes test t0104, where 'url=foo%2bbar/tree' was being parsed improperly. Signed-off-by: Mark Lodato <lodatom@gmail.com>
Diffstat (more/less context) (ignore whitespace changes)
-rw-r--r--html.c9
1 files changed, 5 insertions, 4 deletions
diff --git a/html.c b/html.c
index 66ba65d..d86b2c1 100644
--- a/html.c
+++ b/html.c
@@ -51,241 +51,242 @@ void htmlf(const char *format, ...)
51 va_list args; 51 va_list args;
52 52
53 va_start(args, format); 53 va_start(args, format);
54 vsnprintf(buf, sizeof(buf), format, args); 54 vsnprintf(buf, sizeof(buf), format, args);
55 va_end(args); 55 va_end(args);
56 html(buf); 56 html(buf);
57} 57}
58 58
59void html_status(int code, const char *msg, int more_headers) 59void html_status(int code, const char *msg, int more_headers)
60{ 60{
61 htmlf("Status: %d %s\n", code, msg); 61 htmlf("Status: %d %s\n", code, msg);
62 if (!more_headers) 62 if (!more_headers)
63 html("\n"); 63 html("\n");
64} 64}
65 65
66void html_txt(char *txt) 66void html_txt(char *txt)
67{ 67{
68 char *t = txt; 68 char *t = txt;
69 while(t && *t){ 69 while(t && *t){
70 int c = *t; 70 int c = *t;
71 if (c=='<' || c=='>' || c=='&') { 71 if (c=='<' || c=='>' || c=='&') {
72 write(htmlfd, txt, t - txt); 72 write(htmlfd, txt, t - txt);
73 if (c=='>') 73 if (c=='>')
74 html("&gt;"); 74 html("&gt;");
75 else if (c=='<') 75 else if (c=='<')
76 html("&lt;"); 76 html("&lt;");
77 else if (c=='&') 77 else if (c=='&')
78 html("&amp;"); 78 html("&amp;");
79 txt = t+1; 79 txt = t+1;
80 } 80 }
81 t++; 81 t++;
82 } 82 }
83 if (t!=txt) 83 if (t!=txt)
84 html(txt); 84 html(txt);
85} 85}
86 86
87void html_ntxt(int len, char *txt) 87void html_ntxt(int len, char *txt)
88{ 88{
89 char *t = txt; 89 char *t = txt;
90 while(t && *t && len--){ 90 while(t && *t && len--){
91 int c = *t; 91 int c = *t;
92 if (c=='<' || c=='>' || c=='&') { 92 if (c=='<' || c=='>' || c=='&') {
93 write(htmlfd, txt, t - txt); 93 write(htmlfd, txt, t - txt);
94 if (c=='>') 94 if (c=='>')
95 html("&gt;"); 95 html("&gt;");
96 else if (c=='<') 96 else if (c=='<')
97 html("&lt;"); 97 html("&lt;");
98 else if (c=='&') 98 else if (c=='&')
99 html("&amp;"); 99 html("&amp;");
100 txt = t+1; 100 txt = t+1;
101 } 101 }
102 t++; 102 t++;
103 } 103 }
104 if (t!=txt) 104 if (t!=txt)
105 write(htmlfd, txt, t - txt); 105 write(htmlfd, txt, t - txt);
106 if (len<0) 106 if (len<0)
107 html("..."); 107 html("...");
108} 108}
109 109
110void html_attr(char *txt) 110void html_attr(char *txt)
111{ 111{
112 char *t = txt; 112 char *t = txt;
113 while(t && *t){ 113 while(t && *t){
114 int c = *t; 114 int c = *t;
115 if (c=='<' || c=='>' || c=='\'' || c=='\"') { 115 if (c=='<' || c=='>' || c=='\'' || c=='\"') {
116 write(htmlfd, txt, t - txt); 116 write(htmlfd, txt, t - txt);
117 if (c=='>') 117 if (c=='>')
118 html("&gt;"); 118 html("&gt;");
119 else if (c=='<') 119 else if (c=='<')
120 html("&lt;"); 120 html("&lt;");
121 else if (c=='\'') 121 else if (c=='\'')
122 html("&#x27;"); 122 html("&#x27;");
123 else if (c=='"') 123 else if (c=='"')
124 html("&quot;"); 124 html("&quot;");
125 txt = t+1; 125 txt = t+1;
126 } 126 }
127 t++; 127 t++;
128 } 128 }
129 if (t!=txt) 129 if (t!=txt)
130 html(txt); 130 html(txt);
131} 131}
132 132
133void html_url_path(char *txt) 133void html_url_path(char *txt)
134{ 134{
135 char *t = txt; 135 char *t = txt;
136 while(t && *t){ 136 while(t && *t){
137 int c = *t; 137 int c = *t;
138 if (c=='"' || c=='#' || c=='\'' || c=='?') { 138 if (c=='"' || c=='#' || c=='\'' || c=='?') {
139 write(htmlfd, txt, t - txt); 139 write(htmlfd, txt, t - txt);
140 write(htmlfd, fmt("%%%2x", c), 3); 140 write(htmlfd, fmt("%%%2x", c), 3);
141 txt = t+1; 141 txt = t+1;
142 } 142 }
143 t++; 143 t++;
144 } 144 }
145 if (t!=txt) 145 if (t!=txt)
146 html(txt); 146 html(txt);
147} 147}
148 148
149void html_url_arg(char *txt) 149void html_url_arg(char *txt)
150{ 150{
151 char *t = txt; 151 char *t = txt;
152 while(t && *t){ 152 while(t && *t){
153 int c = *t; 153 int c = *t;
154 if (c=='"' || c=='#' || c=='%' || c=='&' || c=='\'' || c=='+' || c=='?') { 154 if (c=='"' || c=='#' || c=='%' || c=='&' || c=='\'' || c=='+' || c=='?') {
155 write(htmlfd, txt, t - txt); 155 write(htmlfd, txt, t - txt);
156 write(htmlfd, fmt("%%%2x", c), 3); 156 write(htmlfd, fmt("%%%2x", c), 3);
157 txt = t+1; 157 txt = t+1;
158 } 158 }
159 t++; 159 t++;
160 } 160 }
161 if (t!=txt) 161 if (t!=txt)
162 html(txt); 162 html(txt);
163} 163}
164 164
165void html_hidden(char *name, char *value) 165void html_hidden(char *name, char *value)
166{ 166{
167 html("<input type='hidden' name='"); 167 html("<input type='hidden' name='");
168 html_attr(name); 168 html_attr(name);
169 html("' value='"); 169 html("' value='");
170 html_attr(value); 170 html_attr(value);
171 html("'/>"); 171 html("'/>");
172} 172}
173 173
174void html_option(char *value, char *text, char *selected_value) 174void html_option(char *value, char *text, char *selected_value)
175{ 175{
176 html("<option value='"); 176 html("<option value='");
177 html_attr(value); 177 html_attr(value);
178 html("'"); 178 html("'");
179 if (selected_value && !strcmp(selected_value, value)) 179 if (selected_value && !strcmp(selected_value, value))
180 html(" selected='selected'"); 180 html(" selected='selected'");
181 html(">"); 181 html(">");
182 html_txt(text); 182 html_txt(text);
183 html("</option>\n"); 183 html("</option>\n");
184} 184}
185 185
186void html_link_open(char *url, char *title, char *class) 186void html_link_open(char *url, char *title, char *class)
187{ 187{
188 html("<a href='"); 188 html("<a href='");
189 html_attr(url); 189 html_attr(url);
190 if (title) { 190 if (title) {
191 html("' title='"); 191 html("' title='");
192 html_attr(title); 192 html_attr(title);
193 } 193 }
194 if (class) { 194 if (class) {
195 html("' class='"); 195 html("' class='");
196 html_attr(class); 196 html_attr(class);
197 } 197 }
198 html("'>"); 198 html("'>");
199} 199}
200 200
201void html_link_close(void) 201void html_link_close(void)
202{ 202{
203 html("</a>"); 203 html("</a>");
204} 204}
205 205
206void html_fileperm(unsigned short mode) 206void html_fileperm(unsigned short mode)
207{ 207{
208 htmlf("%c%c%c", (mode & 4 ? 'r' : '-'), 208 htmlf("%c%c%c", (mode & 4 ? 'r' : '-'),
209 (mode & 2 ? 'w' : '-'), (mode & 1 ? 'x' : '-')); 209 (mode & 2 ? 'w' : '-'), (mode & 1 ? 'x' : '-'));
210} 210}
211 211
212int html_include(const char *filename) 212int html_include(const char *filename)
213{ 213{
214 FILE *f; 214 FILE *f;
215 char buf[4096]; 215 char buf[4096];
216 size_t len; 216 size_t len;
217 217
218 if (!(f = fopen(filename, "r"))) { 218 if (!(f = fopen(filename, "r"))) {
219 fprintf(stderr, "[cgit] Failed to include file %s: %s (%d).\n", 219 fprintf(stderr, "[cgit] Failed to include file %s: %s (%d).\n",
220 filename, strerror(errno), errno); 220 filename, strerror(errno), errno);
221 return -1; 221 return -1;
222 } 222 }
223 while((len = fread(buf, 1, 4096, f)) > 0) 223 while((len = fread(buf, 1, 4096, f)) > 0)
224 write(htmlfd, buf, len); 224 write(htmlfd, buf, len);
225 fclose(f); 225 fclose(f);
226 return 0; 226 return 0;
227} 227}
228 228
229int hextoint(char c) 229int hextoint(char c)
230{ 230{
231 if (c >= 'a' && c <= 'f') 231 if (c >= 'a' && c <= 'f')
232 return 10 + c - 'a'; 232 return 10 + c - 'a';
233 else if (c >= 'A' && c <= 'F') 233 else if (c >= 'A' && c <= 'F')
234 return 10 + c - 'A'; 234 return 10 + c - 'A';
235 else if (c >= '0' && c <= '9') 235 else if (c >= '0' && c <= '9')
236 return c - '0'; 236 return c - '0';
237 else 237 else
238 return -1; 238 return -1;
239} 239}
240 240
241char *convert_query_hexchar(char *txt) 241char *convert_query_hexchar(char *txt)
242{ 242{
243 int d1, d2; 243 int d1, d2, n;
244 if (strlen(txt) < 3) { 244 n = strlen(txt);
245 if (n < 3) {
245 *txt = '\0'; 246 *txt = '\0';
246 return txt-1; 247 return txt-1;
247 } 248 }
248 d1 = hextoint(*(txt+1)); 249 d1 = hextoint(*(txt+1));
249 d2 = hextoint(*(txt+2)); 250 d2 = hextoint(*(txt+2));
250 if (d1<0 || d2<0) { 251 if (d1<0 || d2<0) {
251 strcpy(txt, txt+3); 252 memmove(txt, txt+3, n-3);
252 return txt-1; 253 return txt-1;
253 } else { 254 } else {
254 *txt = d1 * 16 + d2; 255 *txt = d1 * 16 + d2;
255 strcpy(txt+1, txt+3); 256 memmove(txt+1, txt+3, n-2);
256 return txt; 257 return txt;
257 } 258 }
258} 259}
259 260
260int http_parse_querystring(char *txt, void (*fn)(const char *name, const char *value)) 261int http_parse_querystring(char *txt, void (*fn)(const char *name, const char *value))
261{ 262{
262 char *t, *value = NULL, c; 263 char *t, *value = NULL, c;
263 264
264 if (!txt) 265 if (!txt)
265 return 0; 266 return 0;
266 267
267 t = txt = strdup(txt); 268 t = txt = strdup(txt);
268 if (t == NULL) { 269 if (t == NULL) {
269 printf("Out of memory\n"); 270 printf("Out of memory\n");
270 exit(1); 271 exit(1);
271 } 272 }
272 while((c=*t) != '\0') { 273 while((c=*t) != '\0') {
273 if (c=='=') { 274 if (c=='=') {
274 *t = '\0'; 275 *t = '\0';
275 value = t+1; 276 value = t+1;
276 } else if (c=='+') { 277 } else if (c=='+') {
277 *t = ' '; 278 *t = ' ';
278 } else if (c=='%') { 279 } else if (c=='%') {
279 t = convert_query_hexchar(t); 280 t = convert_query_hexchar(t);
280 } else if (c=='&') { 281 } else if (c=='&') {
281 *t = '\0'; 282 *t = '\0';
282 (*fn)(txt, value); 283 (*fn)(txt, value);
283 txt = t+1; 284 txt = t+1;
284 value = NULL; 285 value = NULL;
285 } 286 }
286 t++; 287 t++;
287 } 288 }
288 if (t!=txt) 289 if (t!=txt)
289 (*fn)(txt, value); 290 (*fn)(txt, value);
290 return 0; 291 return 0;
291} 292}