author | Mark Lodato <lodatom@gmail.com> | 2010-08-28 01:02:27 (UTC) |
---|---|---|
committer | Lars Hjemli <hjemli@gmail.com> | 2010-08-29 15:27:40 (UTC) |
commit | 48434780ca62fde84337ea1e797f642de5ca50d5 (patch) (unidiff) | |
tree | ad6a67137124a5ae70de10dd29e84bd6bf21c6ea | |
parent | c94414a4c8cd099f5737e8b4066693d07ce78f61 (diff) | |
download | cgit-48434780ca62fde84337ea1e797f642de5ca50d5.zip cgit-48434780ca62fde84337ea1e797f642de5ca50d5.tar.gz cgit-48434780ca62fde84337ea1e797f642de5ca50d5.tar.bz2 |
html: fix strcpy bug in convert_query_hexchar
The source and destination strings in strcpy() may not overlap.
Instead, use memmove(), which allows overlap. This fixes test t0104,
where 'url=foo%2bbar/tree' was being parsed improperly.
Signed-off-by: Mark Lodato <lodatom@gmail.com>
-rw-r--r-- | html.c | 9 |
1 files changed, 5 insertions, 4 deletions
@@ -51,241 +51,242 @@ void htmlf(const char *format, ...) | |||
51 | va_list args; | 51 | va_list args; |
52 | 52 | ||
53 | va_start(args, format); | 53 | va_start(args, format); |
54 | vsnprintf(buf, sizeof(buf), format, args); | 54 | vsnprintf(buf, sizeof(buf), format, args); |
55 | va_end(args); | 55 | va_end(args); |
56 | html(buf); | 56 | html(buf); |
57 | } | 57 | } |
58 | 58 | ||
59 | void html_status(int code, const char *msg, int more_headers) | 59 | void html_status(int code, const char *msg, int more_headers) |
60 | { | 60 | { |
61 | htmlf("Status: %d %s\n", code, msg); | 61 | htmlf("Status: %d %s\n", code, msg); |
62 | if (!more_headers) | 62 | if (!more_headers) |
63 | html("\n"); | 63 | html("\n"); |
64 | } | 64 | } |
65 | 65 | ||
66 | void html_txt(char *txt) | 66 | void html_txt(char *txt) |
67 | { | 67 | { |
68 | char *t = txt; | 68 | char *t = txt; |
69 | while(t && *t){ | 69 | while(t && *t){ |
70 | int c = *t; | 70 | int c = *t; |
71 | if (c=='<' || c=='>' || c=='&') { | 71 | if (c=='<' || c=='>' || c=='&') { |
72 | write(htmlfd, txt, t - txt); | 72 | write(htmlfd, txt, t - txt); |
73 | if (c=='>') | 73 | if (c=='>') |
74 | html(">"); | 74 | html(">"); |
75 | else if (c=='<') | 75 | else if (c=='<') |
76 | html("<"); | 76 | html("<"); |
77 | else if (c=='&') | 77 | else if (c=='&') |
78 | html("&"); | 78 | html("&"); |
79 | txt = t+1; | 79 | txt = t+1; |
80 | } | 80 | } |
81 | t++; | 81 | t++; |
82 | } | 82 | } |
83 | if (t!=txt) | 83 | if (t!=txt) |
84 | html(txt); | 84 | html(txt); |
85 | } | 85 | } |
86 | 86 | ||
87 | void html_ntxt(int len, char *txt) | 87 | void html_ntxt(int len, char *txt) |
88 | { | 88 | { |
89 | char *t = txt; | 89 | char *t = txt; |
90 | while(t && *t && len--){ | 90 | while(t && *t && len--){ |
91 | int c = *t; | 91 | int c = *t; |
92 | if (c=='<' || c=='>' || c=='&') { | 92 | if (c=='<' || c=='>' || c=='&') { |
93 | write(htmlfd, txt, t - txt); | 93 | write(htmlfd, txt, t - txt); |
94 | if (c=='>') | 94 | if (c=='>') |
95 | html(">"); | 95 | html(">"); |
96 | else if (c=='<') | 96 | else if (c=='<') |
97 | html("<"); | 97 | html("<"); |
98 | else if (c=='&') | 98 | else if (c=='&') |
99 | html("&"); | 99 | html("&"); |
100 | txt = t+1; | 100 | txt = t+1; |
101 | } | 101 | } |
102 | t++; | 102 | t++; |
103 | } | 103 | } |
104 | if (t!=txt) | 104 | if (t!=txt) |
105 | write(htmlfd, txt, t - txt); | 105 | write(htmlfd, txt, t - txt); |
106 | if (len<0) | 106 | if (len<0) |
107 | html("..."); | 107 | html("..."); |
108 | } | 108 | } |
109 | 109 | ||
110 | void html_attr(char *txt) | 110 | void html_attr(char *txt) |
111 | { | 111 | { |
112 | char *t = txt; | 112 | char *t = txt; |
113 | while(t && *t){ | 113 | while(t && *t){ |
114 | int c = *t; | 114 | int c = *t; |
115 | if (c=='<' || c=='>' || c=='\'' || c=='\"') { | 115 | if (c=='<' || c=='>' || c=='\'' || c=='\"') { |
116 | write(htmlfd, txt, t - txt); | 116 | write(htmlfd, txt, t - txt); |
117 | if (c=='>') | 117 | if (c=='>') |
118 | html(">"); | 118 | html(">"); |
119 | else if (c=='<') | 119 | else if (c=='<') |
120 | html("<"); | 120 | html("<"); |
121 | else if (c=='\'') | 121 | else if (c=='\'') |
122 | html("'"); | 122 | html("'"); |
123 | else if (c=='"') | 123 | else if (c=='"') |
124 | html("""); | 124 | html("""); |
125 | txt = t+1; | 125 | txt = t+1; |
126 | } | 126 | } |
127 | t++; | 127 | t++; |
128 | } | 128 | } |
129 | if (t!=txt) | 129 | if (t!=txt) |
130 | html(txt); | 130 | html(txt); |
131 | } | 131 | } |
132 | 132 | ||
133 | void html_url_path(char *txt) | 133 | void html_url_path(char *txt) |
134 | { | 134 | { |
135 | char *t = txt; | 135 | char *t = txt; |
136 | while(t && *t){ | 136 | while(t && *t){ |
137 | int c = *t; | 137 | int c = *t; |
138 | if (c=='"' || c=='#' || c=='\'' || c=='?') { | 138 | if (c=='"' || c=='#' || c=='\'' || c=='?') { |
139 | write(htmlfd, txt, t - txt); | 139 | write(htmlfd, txt, t - txt); |
140 | write(htmlfd, fmt("%%%2x", c), 3); | 140 | write(htmlfd, fmt("%%%2x", c), 3); |
141 | txt = t+1; | 141 | txt = t+1; |
142 | } | 142 | } |
143 | t++; | 143 | t++; |
144 | } | 144 | } |
145 | if (t!=txt) | 145 | if (t!=txt) |
146 | html(txt); | 146 | html(txt); |
147 | } | 147 | } |
148 | 148 | ||
149 | void html_url_arg(char *txt) | 149 | void html_url_arg(char *txt) |
150 | { | 150 | { |
151 | char *t = txt; | 151 | char *t = txt; |
152 | while(t && *t){ | 152 | while(t && *t){ |
153 | int c = *t; | 153 | int c = *t; |
154 | if (c=='"' || c=='#' || c=='%' || c=='&' || c=='\'' || c=='+' || c=='?') { | 154 | if (c=='"' || c=='#' || c=='%' || c=='&' || c=='\'' || c=='+' || c=='?') { |
155 | write(htmlfd, txt, t - txt); | 155 | write(htmlfd, txt, t - txt); |
156 | write(htmlfd, fmt("%%%2x", c), 3); | 156 | write(htmlfd, fmt("%%%2x", c), 3); |
157 | txt = t+1; | 157 | txt = t+1; |
158 | } | 158 | } |
159 | t++; | 159 | t++; |
160 | } | 160 | } |
161 | if (t!=txt) | 161 | if (t!=txt) |
162 | html(txt); | 162 | html(txt); |
163 | } | 163 | } |
164 | 164 | ||
165 | void html_hidden(char *name, char *value) | 165 | void html_hidden(char *name, char *value) |
166 | { | 166 | { |
167 | html("<input type='hidden' name='"); | 167 | html("<input type='hidden' name='"); |
168 | html_attr(name); | 168 | html_attr(name); |
169 | html("' value='"); | 169 | html("' value='"); |
170 | html_attr(value); | 170 | html_attr(value); |
171 | html("'/>"); | 171 | html("'/>"); |
172 | } | 172 | } |
173 | 173 | ||
174 | void html_option(char *value, char *text, char *selected_value) | 174 | void html_option(char *value, char *text, char *selected_value) |
175 | { | 175 | { |
176 | html("<option value='"); | 176 | html("<option value='"); |
177 | html_attr(value); | 177 | html_attr(value); |
178 | html("'"); | 178 | html("'"); |
179 | if (selected_value && !strcmp(selected_value, value)) | 179 | if (selected_value && !strcmp(selected_value, value)) |
180 | html(" selected='selected'"); | 180 | html(" selected='selected'"); |
181 | html(">"); | 181 | html(">"); |
182 | html_txt(text); | 182 | html_txt(text); |
183 | html("</option>\n"); | 183 | html("</option>\n"); |
184 | } | 184 | } |
185 | 185 | ||
186 | void html_link_open(char *url, char *title, char *class) | 186 | void html_link_open(char *url, char *title, char *class) |
187 | { | 187 | { |
188 | html("<a href='"); | 188 | html("<a href='"); |
189 | html_attr(url); | 189 | html_attr(url); |
190 | if (title) { | 190 | if (title) { |
191 | html("' title='"); | 191 | html("' title='"); |
192 | html_attr(title); | 192 | html_attr(title); |
193 | } | 193 | } |
194 | if (class) { | 194 | if (class) { |
195 | html("' class='"); | 195 | html("' class='"); |
196 | html_attr(class); | 196 | html_attr(class); |
197 | } | 197 | } |
198 | html("'>"); | 198 | html("'>"); |
199 | } | 199 | } |
200 | 200 | ||
201 | void html_link_close(void) | 201 | void html_link_close(void) |
202 | { | 202 | { |
203 | html("</a>"); | 203 | html("</a>"); |
204 | } | 204 | } |
205 | 205 | ||
206 | void html_fileperm(unsigned short mode) | 206 | void html_fileperm(unsigned short mode) |
207 | { | 207 | { |
208 | htmlf("%c%c%c", (mode & 4 ? 'r' : '-'), | 208 | htmlf("%c%c%c", (mode & 4 ? 'r' : '-'), |
209 | (mode & 2 ? 'w' : '-'), (mode & 1 ? 'x' : '-')); | 209 | (mode & 2 ? 'w' : '-'), (mode & 1 ? 'x' : '-')); |
210 | } | 210 | } |
211 | 211 | ||
212 | int html_include(const char *filename) | 212 | int html_include(const char *filename) |
213 | { | 213 | { |
214 | FILE *f; | 214 | FILE *f; |
215 | char buf[4096]; | 215 | char buf[4096]; |
216 | size_t len; | 216 | size_t len; |
217 | 217 | ||
218 | if (!(f = fopen(filename, "r"))) { | 218 | if (!(f = fopen(filename, "r"))) { |
219 | fprintf(stderr, "[cgit] Failed to include file %s: %s (%d).\n", | 219 | fprintf(stderr, "[cgit] Failed to include file %s: %s (%d).\n", |
220 | filename, strerror(errno), errno); | 220 | filename, strerror(errno), errno); |
221 | return -1; | 221 | return -1; |
222 | } | 222 | } |
223 | while((len = fread(buf, 1, 4096, f)) > 0) | 223 | while((len = fread(buf, 1, 4096, f)) > 0) |
224 | write(htmlfd, buf, len); | 224 | write(htmlfd, buf, len); |
225 | fclose(f); | 225 | fclose(f); |
226 | return 0; | 226 | return 0; |
227 | } | 227 | } |
228 | 228 | ||
229 | int hextoint(char c) | 229 | int hextoint(char c) |
230 | { | 230 | { |
231 | if (c >= 'a' && c <= 'f') | 231 | if (c >= 'a' && c <= 'f') |
232 | return 10 + c - 'a'; | 232 | return 10 + c - 'a'; |
233 | else if (c >= 'A' && c <= 'F') | 233 | else if (c >= 'A' && c <= 'F') |
234 | return 10 + c - 'A'; | 234 | return 10 + c - 'A'; |
235 | else if (c >= '0' && c <= '9') | 235 | else if (c >= '0' && c <= '9') |
236 | return c - '0'; | 236 | return c - '0'; |
237 | else | 237 | else |
238 | return -1; | 238 | return -1; |
239 | } | 239 | } |
240 | 240 | ||
241 | char *convert_query_hexchar(char *txt) | 241 | char *convert_query_hexchar(char *txt) |
242 | { | 242 | { |
243 | int d1, d2; | 243 | int d1, d2, n; |
244 | if (strlen(txt) < 3) { | 244 | n = strlen(txt); |
245 | if (n < 3) { | ||
245 | *txt = '\0'; | 246 | *txt = '\0'; |
246 | return txt-1; | 247 | return txt-1; |
247 | } | 248 | } |
248 | d1 = hextoint(*(txt+1)); | 249 | d1 = hextoint(*(txt+1)); |
249 | d2 = hextoint(*(txt+2)); | 250 | d2 = hextoint(*(txt+2)); |
250 | if (d1<0 || d2<0) { | 251 | if (d1<0 || d2<0) { |
251 | strcpy(txt, txt+3); | 252 | memmove(txt, txt+3, n-3); |
252 | return txt-1; | 253 | return txt-1; |
253 | } else { | 254 | } else { |
254 | *txt = d1 * 16 + d2; | 255 | *txt = d1 * 16 + d2; |
255 | strcpy(txt+1, txt+3); | 256 | memmove(txt+1, txt+3, n-2); |
256 | return txt; | 257 | return txt; |
257 | } | 258 | } |
258 | } | 259 | } |
259 | 260 | ||
260 | int http_parse_querystring(char *txt, void (*fn)(const char *name, const char *value)) | 261 | int http_parse_querystring(char *txt, void (*fn)(const char *name, const char *value)) |
261 | { | 262 | { |
262 | char *t, *value = NULL, c; | 263 | char *t, *value = NULL, c; |
263 | 264 | ||
264 | if (!txt) | 265 | if (!txt) |
265 | return 0; | 266 | return 0; |
266 | 267 | ||
267 | t = txt = strdup(txt); | 268 | t = txt = strdup(txt); |
268 | if (t == NULL) { | 269 | if (t == NULL) { |
269 | printf("Out of memory\n"); | 270 | printf("Out of memory\n"); |
270 | exit(1); | 271 | exit(1); |
271 | } | 272 | } |
272 | while((c=*t) != '\0') { | 273 | while((c=*t) != '\0') { |
273 | if (c=='=') { | 274 | if (c=='=') { |
274 | *t = '\0'; | 275 | *t = '\0'; |
275 | value = t+1; | 276 | value = t+1; |
276 | } else if (c=='+') { | 277 | } else if (c=='+') { |
277 | *t = ' '; | 278 | *t = ' '; |
278 | } else if (c=='%') { | 279 | } else if (c=='%') { |
279 | t = convert_query_hexchar(t); | 280 | t = convert_query_hexchar(t); |
280 | } else if (c=='&') { | 281 | } else if (c=='&') { |
281 | *t = '\0'; | 282 | *t = '\0'; |
282 | (*fn)(txt, value); | 283 | (*fn)(txt, value); |
283 | txt = t+1; | 284 | txt = t+1; |
284 | value = NULL; | 285 | value = NULL; |
285 | } | 286 | } |
286 | t++; | 287 | t++; |
287 | } | 288 | } |
288 | if (t!=txt) | 289 | if (t!=txt) |
289 | (*fn)(txt, value); | 290 | (*fn)(txt, value); |
290 | return 0; | 291 | return 0; |
291 | } | 292 | } |