summaryrefslogtreecommitdiffabout
authorMark Lodato <lodatom@gmail.com>2010-08-28 01:02:27 (UTC)
committer Lars Hjemli <hjemli@gmail.com>2010-08-29 15:27:40 (UTC)
commit48434780ca62fde84337ea1e797f642de5ca50d5 (patch) (unidiff)
treead6a67137124a5ae70de10dd29e84bd6bf21c6ea
parentc94414a4c8cd099f5737e8b4066693d07ce78f61 (diff)
downloadcgit-48434780ca62fde84337ea1e797f642de5ca50d5.zip
cgit-48434780ca62fde84337ea1e797f642de5ca50d5.tar.gz
cgit-48434780ca62fde84337ea1e797f642de5ca50d5.tar.bz2
html: fix strcpy bug in convert_query_hexchar
The source and destination strings in strcpy() may not overlap. Instead, use memmove(), which allows overlap. This fixes test t0104, where 'url=foo%2bbar/tree' was being parsed improperly. Signed-off-by: Mark Lodato <lodatom@gmail.com>
Diffstat (more/less context) (ignore whitespace changes)
-rw-r--r--html.c9
1 files changed, 5 insertions, 4 deletions
diff --git a/html.c b/html.c
index 66ba65d..d86b2c1 100644
--- a/html.c
+++ b/html.c
@@ -195,97 +195,98 @@ void html_link_open(char *url, char *title, char *class)
195 html("' class='"); 195 html("' class='");
196 html_attr(class); 196 html_attr(class);
197 } 197 }
198 html("'>"); 198 html("'>");
199} 199}
200 200
201void html_link_close(void) 201void html_link_close(void)
202{ 202{
203 html("</a>"); 203 html("</a>");
204} 204}
205 205
206void html_fileperm(unsigned short mode) 206void html_fileperm(unsigned short mode)
207{ 207{
208 htmlf("%c%c%c", (mode & 4 ? 'r' : '-'), 208 htmlf("%c%c%c", (mode & 4 ? 'r' : '-'),
209 (mode & 2 ? 'w' : '-'), (mode & 1 ? 'x' : '-')); 209 (mode & 2 ? 'w' : '-'), (mode & 1 ? 'x' : '-'));
210} 210}
211 211
212int html_include(const char *filename) 212int html_include(const char *filename)
213{ 213{
214 FILE *f; 214 FILE *f;
215 char buf[4096]; 215 char buf[4096];
216 size_t len; 216 size_t len;
217 217
218 if (!(f = fopen(filename, "r"))) { 218 if (!(f = fopen(filename, "r"))) {
219 fprintf(stderr, "[cgit] Failed to include file %s: %s (%d).\n", 219 fprintf(stderr, "[cgit] Failed to include file %s: %s (%d).\n",
220 filename, strerror(errno), errno); 220 filename, strerror(errno), errno);
221 return -1; 221 return -1;
222 } 222 }
223 while((len = fread(buf, 1, 4096, f)) > 0) 223 while((len = fread(buf, 1, 4096, f)) > 0)
224 write(htmlfd, buf, len); 224 write(htmlfd, buf, len);
225 fclose(f); 225 fclose(f);
226 return 0; 226 return 0;
227} 227}
228 228
229int hextoint(char c) 229int hextoint(char c)
230{ 230{
231 if (c >= 'a' && c <= 'f') 231 if (c >= 'a' && c <= 'f')
232 return 10 + c - 'a'; 232 return 10 + c - 'a';
233 else if (c >= 'A' && c <= 'F') 233 else if (c >= 'A' && c <= 'F')
234 return 10 + c - 'A'; 234 return 10 + c - 'A';
235 else if (c >= '0' && c <= '9') 235 else if (c >= '0' && c <= '9')
236 return c - '0'; 236 return c - '0';
237 else 237 else
238 return -1; 238 return -1;
239} 239}
240 240
241char *convert_query_hexchar(char *txt) 241char *convert_query_hexchar(char *txt)
242{ 242{
243 int d1, d2; 243 int d1, d2, n;
244 if (strlen(txt) < 3) { 244 n = strlen(txt);
245 if (n < 3) {
245 *txt = '\0'; 246 *txt = '\0';
246 return txt-1; 247 return txt-1;
247 } 248 }
248 d1 = hextoint(*(txt+1)); 249 d1 = hextoint(*(txt+1));
249 d2 = hextoint(*(txt+2)); 250 d2 = hextoint(*(txt+2));
250 if (d1<0 || d2<0) { 251 if (d1<0 || d2<0) {
251 strcpy(txt, txt+3); 252 memmove(txt, txt+3, n-3);
252 return txt-1; 253 return txt-1;
253 } else { 254 } else {
254 *txt = d1 * 16 + d2; 255 *txt = d1 * 16 + d2;
255 strcpy(txt+1, txt+3); 256 memmove(txt+1, txt+3, n-2);
256 return txt; 257 return txt;
257 } 258 }
258} 259}
259 260
260int http_parse_querystring(char *txt, void (*fn)(const char *name, const char *value)) 261int http_parse_querystring(char *txt, void (*fn)(const char *name, const char *value))
261{ 262{
262 char *t, *value = NULL, c; 263 char *t, *value = NULL, c;
263 264
264 if (!txt) 265 if (!txt)
265 return 0; 266 return 0;
266 267
267 t = txt = strdup(txt); 268 t = txt = strdup(txt);
268 if (t == NULL) { 269 if (t == NULL) {
269 printf("Out of memory\n"); 270 printf("Out of memory\n");
270 exit(1); 271 exit(1);
271 } 272 }
272 while((c=*t) != '\0') { 273 while((c=*t) != '\0') {
273 if (c=='=') { 274 if (c=='=') {
274 *t = '\0'; 275 *t = '\0';
275 value = t+1; 276 value = t+1;
276 } else if (c=='+') { 277 } else if (c=='+') {
277 *t = ' '; 278 *t = ' ';
278 } else if (c=='%') { 279 } else if (c=='%') {
279 t = convert_query_hexchar(t); 280 t = convert_query_hexchar(t);
280 } else if (c=='&') { 281 } else if (c=='&') {
281 *t = '\0'; 282 *t = '\0';
282 (*fn)(txt, value); 283 (*fn)(txt, value);
283 txt = t+1; 284 txt = t+1;
284 value = NULL; 285 value = NULL;
285 } 286 }
286 t++; 287 t++;
287 } 288 }
288 if (t!=txt) 289 if (t!=txt)
289 (*fn)(txt, value); 290 (*fn)(txt, value);
290 return 0; 291 return 0;
291} 292}