From fd4c65ede93d8f71892072c573835b7f74b4e53b Mon Sep 17 00:00:00 2001 From: Phillip Susi Date: Tue, 26 Feb 2002 05:59:00 +0000 Subject: [PATCH] Fixed _vsnprintf() to actually use the buffer size limit to prevent buffer overflows Sorry, but I had to re indent and tabify this code, I could not read it because it was all screwed up before. svn path=/trunk/; revision=2652 --- reactos/ntoskrnl/rtl/sprintf.c | 791 +++++++++++++++++++-------------- 1 file changed, 448 insertions(+), 343 deletions(-) diff --git a/reactos/ntoskrnl/rtl/sprintf.c b/reactos/ntoskrnl/rtl/sprintf.c index 27e03d9c676..20c033630b3 100644 --- a/reactos/ntoskrnl/rtl/sprintf.c +++ b/reactos/ntoskrnl/rtl/sprintf.c @@ -1,4 +1,4 @@ -/* $Id: sprintf.c,v 1.6 2002/02/18 18:39:31 hbirr Exp $ +/* $Id: sprintf.c,v 1.7 2002/02/26 05:59:00 phreak Exp $ * * COPYRIGHT: See COPYING in the top level directory * PROJECT: ReactOS kernel @@ -8,7 +8,7 @@ * Eric Kohl * * TODO: - * - Implement maximum length (cnt) in _vsnprintf(). + * - Implement maximum length (cnt) in _vsnprintf(). */ /* @@ -32,13 +32,13 @@ #include -#define ZEROPAD 1 /* pad with zero */ -#define SIGN 2 /* unsigned/signed long */ -#define PLUS 4 /* show plus */ -#define SPACE 8 /* space if plus */ -#define LEFT 16 /* left justified */ -#define SPECIAL 32 /* 0x */ -#define LARGE 64 /* use 'ABCDEF' instead of 'abcdef' */ +#define ZEROPAD 1 /* pad with zero */ +#define SIGN 2 /* unsigned/signed long */ +#define PLUS 4 /* show plus */ +#define SPACE 8 /* space if plus */ +#define LEFT 16 /* left justified */ +#define SPECIAL 32 /* 0x */ +#define LARGE 64 /* use 'ABCDEF' instead of 'abcdef' */ #define do_div(n,base) ({ \ @@ -50,384 +50,489 @@ __res; }) static int skip_atoi(const char **s) { - int i=0; + int i=0; - while (isdigit(**s)) - i = i*10 + *((*s)++) - '0'; - return i; + while (isdigit(**s)) + i = i*10 + *((*s)++) - '0'; + return i; } static char * number (char * str, long long num, int base, int size, int precision, int type) { - char c,sign,tmp[66]; - const char *digits="0123456789abcdefghijklmnopqrstuvwxyz"; - int i; + char c,sign,tmp[66]; + const char *digits="0123456789abcdefghijklmnopqrstuvwxyz"; + int i; - if (type & LARGE) - digits = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"; - if (type & LEFT) - type &= ~ZEROPAD; - if (base < 2 || base > 36) - return 0; + if (type & LARGE) + digits = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"; + if (type & LEFT) + type &= ~ZEROPAD; + if (base < 2 || base > 36) + return 0; - c = (type & ZEROPAD) ? '0' : ' '; - sign = 0; + c = (type & ZEROPAD) ? '0' : ' '; + sign = 0; - if (type & SIGN) { - if (num < 0) { - sign = '-'; - num = -num; - size--; - } else if (type & PLUS) { - sign = '+'; - size--; - } else if (type & SPACE) { - sign = ' '; - size--; - } - } + if (type & SIGN) { + if (num < 0) { + sign = '-'; + num = -num; + size--; + } else if (type & PLUS) { + sign = '+'; + size--; + } else if (type & SPACE) { + sign = ' '; + size--; + } + } - if (type & SPECIAL) { - if (base == 16) - size -= 2; - else if (base == 8) - size--; - } + if (type & SPECIAL) { + if (base == 16) + size -= 2; + else if (base == 8) + size--; + } - i = 0; - if (num == 0) - tmp[i++]='0'; - else while (num != 0) - tmp[i++] = digits[do_div(num,base)]; - if (i > precision) - precision = i; - size -= precision; - if (!(type&(ZEROPAD+LEFT))) - while(size-->0) - *str++ = ' '; - if (sign) - *str++ = sign; - if (type & SPECIAL) { - if (base==8) { - *str++ = '0'; - } else if (base==16) { - *str++ = '0'; - *str++ = digits[33]; - } - } - if (!(type & LEFT)) - while (size-- > 0) - *str++ = c; - while (i < precision--) - *str++ = '0'; - while (i-- > 0) - *str++ = tmp[i]; - while (size-- > 0) - *str++ = ' '; - return str; + i = 0; + if (num == 0) + tmp[i++]='0'; + else while (num != 0) + tmp[i++] = digits[do_div(num,base)]; + if (i > precision) + precision = i; + size -= precision; + if (!(type&(ZEROPAD+LEFT))) + while(size-->0) + *str++ = ' '; + if (sign) + *str++ = sign; + if (type & SPECIAL) { + if (base==8) { + *str++ = '0'; + } else if (base==16) { + *str++ = '0'; + *str++ = digits[33]; + } + } + if (!(type & LEFT)) + while (size-- > 0) + *str++ = c; + while (i < precision--) + *str++ = '0'; + while (i-- > 0) + *str++ = tmp[i]; + while (size-- > 0) + *str++ = ' '; + return str; } int _vsnprintf(char *buf, size_t cnt, const char *fmt, va_list args) { - int len; - unsigned long long num; - int i, base; - char * str; - const char *s; - const wchar_t *sw; + int len; + unsigned long long num; + int i, base; + char * str; + const char *s; + const wchar_t *sw; - int flags; /* flags to number() */ + int flags; /* flags to number() */ - int field_width; /* width of output field */ - int precision; /* min. # of digits for integers; max - number of chars for from string */ - int qualifier; /* 'h', 'l', 'L', 'I' or 'w' for integer fields */ + int field_width; /* width of output field */ + int precision; /* min. # of digits for integers; max + number of chars for from string */ + int qualifier; /* 'h', 'l', 'L', 'I' or 'w' for integer fields */ - for (str=buf ; *fmt ; ++fmt) { - if (*fmt != '%') { - *str++ = *fmt; - continue; - } + for (str=buf ; *fmt ; ++fmt) { + if (*fmt != '%') { + *str++ = *fmt; + if( --cnt == 0 ) + goto out; + continue; + } - /* process flags */ - flags = 0; - repeat: - ++fmt; /* this also skips first '%' */ - switch (*fmt) { - case '-': flags |= LEFT; goto repeat; - case '+': flags |= PLUS; goto repeat; - case ' ': flags |= SPACE; goto repeat; - case '#': flags |= SPECIAL; goto repeat; - case '0': flags |= ZEROPAD; goto repeat; - } + /* process flags */ + flags = 0; + repeat: + ++fmt; /* this also skips first '%' */ + switch (*fmt) { + case '-': flags |= LEFT; goto repeat; + case '+': flags |= PLUS; goto repeat; + case ' ': flags |= SPACE; goto repeat; + case '#': flags |= SPECIAL; goto repeat; + case '0': flags |= ZEROPAD; goto repeat; + } - /* get field width */ - field_width = -1; - if (isdigit(*fmt)) - field_width = skip_atoi(&fmt); - else if (*fmt == '*') { - ++fmt; - /* it's the next argument */ - field_width = va_arg(args, int); - if (field_width < 0) { - field_width = -field_width; - flags |= LEFT; - } - } + /* get field width */ + field_width = -1; + if (isdigit(*fmt)) + field_width = skip_atoi(&fmt); + else if (*fmt == '*') { + ++fmt; + /* it's the next argument */ + field_width = va_arg(args, int); + if (field_width < 0) { + field_width = -field_width; + flags |= LEFT; + } + } - /* get the precision */ - precision = -1; - if (*fmt == '.') { - ++fmt; - if (isdigit(*fmt)) - precision = skip_atoi(&fmt); - else if (*fmt == '*') { - ++fmt; - /* it's the next argument */ - precision = va_arg(args, int); - } - if (precision < 0) - precision = 0; - } + /* get the precision */ + precision = -1; + if (*fmt == '.') { + ++fmt; + if (isdigit(*fmt)) + precision = skip_atoi(&fmt); + else if (*fmt == '*') { + ++fmt; + /* it's the next argument */ + precision = va_arg(args, int); + } + if (precision < 0) + precision = 0; + } - /* get the conversion qualifier */ - qualifier = -1; - if (*fmt == 'h' || *fmt == 'l' || *fmt == 'L' || *fmt == 'w') { - qualifier = *fmt; - ++fmt; - } else if (*fmt == 'I' && *(fmt+1) == '6' && *(fmt+2) == '4') { - qualifier = *fmt; - fmt += 3; - } + /* get the conversion qualifier */ + qualifier = -1; + if (*fmt == 'h' || *fmt == 'l' || *fmt == 'L' || *fmt == 'w') { + qualifier = *fmt; + ++fmt; + } else if (*fmt == 'I' && *(fmt+1) == '6' && *(fmt+2) == '4') { + qualifier = *fmt; + fmt += 3; + } - /* default base */ - base = 10; + /* default base */ + base = 10; - switch (*fmt) { - case 'c': /* finished */ - if (!(flags & LEFT)) - while (--field_width > 0) - *str++ = ' '; - if (qualifier == 'l' || qualifier == 'w') - *str++ - = (unsigned char)(wchar_t) va_arg(args, int); - else - *str++ = (unsigned char) va_arg(args, int); - while (--field_width > 0) - *str++ = ' '; - continue; - - case 'C': /* finished */ - if (!(flags & LEFT)) - while (--field_width > 0) - *str++ = ' '; - if (qualifier == 'h') - *str++ = (unsigned char) va_arg(args, int); - else - *str++ - = (unsigned char)(wchar_t) va_arg(args, int); - while (--field_width > 0) - *str++ = ' '; - continue; - - case 's': /* finished */ - if (qualifier == 'l' || qualifier == 'w') { - /* print unicode string */ - sw = va_arg(args, wchar_t *); - if (sw == NULL) - sw = L""; - - for (len = 0; (unsigned int)len < (unsigned int)precision && sw[len]; len++); - - if (!(flags & LEFT)) - while (len < field_width--) - *str++ = ' '; - for (i = 0; i < len; ++i) - *str++ = (unsigned char)(*sw++); - while (len < field_width--) - *str++ = ' '; - } else { - /* print ascii string */ - s = va_arg(args, char *); - if (s == NULL) - s = ""; - - for (len = 0; (unsigned int)len < (unsigned int)precision && s[len]; len++); - - if (!(flags & LEFT)) - while (len < field_width--) - *str++ = ' '; - for (i = 0; i < len; ++i) - *str++ = *s++; - while (len < field_width--) - *str++ = ' '; - } - continue; - - case 'S': - if (qualifier == 'h') { - /* print ascii string */ - s = va_arg(args, char *); - if (s == NULL) - s = ""; - - for (len = 0; (unsigned int)len < (unsigned int)precision && s[len]; len++); - - if (!(flags & LEFT)) - while (len < field_width--) - *str++ = ' '; - for (i = 0; i < len; ++i) - *str++ = *s++; - while (len < field_width--) - *str++ = ' '; - } else { - /* print unicode string */ - sw = va_arg(args, wchar_t *); - if (sw == NULL) - sw = L""; - - for (len = 0; (unsigned int)len < (unsigned int)precision && sw[len]; len++); - - if (!(flags & LEFT)) - while (len < field_width--) - *str++ = ' '; - for (i = 0; i < len; ++i) - *str++ = (unsigned char)(*sw++); - while (len < field_width--) - *str++ = ' '; - } - continue; - - case 'Z': - if (qualifier == 'w') { - /* print counted unicode string */ - PUNICODE_STRING pus = va_arg(args, PUNICODE_STRING); - if ((pus == NULL) || (pus->Buffer == NULL)) { - s = ""; - while ((*s) != 0) - *str++ = *s++; - } else { - for (i = 0; pus->Buffer[i] && i < pus->Length / sizeof(WCHAR); i++) - *str++ = (unsigned char)(pus->Buffer[i]); - } - } else { - /* print counted ascii string */ - PANSI_STRING pus = va_arg(args, PANSI_STRING); - if ((pus == NULL) || (pus->Buffer == NULL)) { - s = ""; - while ((*s) != 0) - *str++ = *s++; - } else { - for (i = 0; pus->Buffer[i] && i < pus->Length; i++) - *str++ = pus->Buffer[i]; - } - } - continue; - - case 'p': - if (field_width == -1) { - field_width = 2 * sizeof(void *); - flags |= ZEROPAD; - } - str = number(str, - (unsigned long) va_arg(args, void *), 16, - field_width, precision, flags); - continue; - - case 'n': - if (qualifier == 'l') { - long * ip = va_arg(args, long *); - *ip = (str - buf); - } else { - int * ip = va_arg(args, int *); - *ip = (str - buf); - } - continue; - - /* integer number formats - set up the flags and "break" */ - case 'o': - base = 8; - break; - - case 'b': - base = 2; - break; - - case 'X': - flags |= LARGE; - case 'x': - base = 16; - break; - - case 'd': - case 'i': - flags |= SIGN; - case 'u': - break; - - default: - if (*fmt != '%') - *str++ = '%'; - if (*fmt) - *str++ = *fmt; - else - --fmt; - continue; - } - - if (qualifier == 'I') - num = va_arg(args, unsigned long long); - else if (qualifier == 'l') - num = va_arg(args, unsigned long); - else if (qualifier == 'h') { - if (flags & SIGN) - num = va_arg(args, int); - else - num = va_arg(args, unsigned int); - } - else { - if (flags & SIGN) - num = va_arg(args, int); - else - num = va_arg(args, unsigned int); - } - str = number(str, num, base, field_width, precision, flags); + switch (*fmt) { + case 'c': /* finished */ + if (!(flags & LEFT)) + while (--field_width > 0) + { + *str++ = ' '; + if( --cnt == 0 ) + goto out; + } + if (qualifier == 'l' || qualifier == 'w') + { + *str++ = (unsigned char)(wchar_t) va_arg(args, int); + if( --cnt == 0 ) + goto out; } - *str = '\0'; - return str-buf; + else + { + *str++ = (unsigned char) va_arg(args, int); + if( --cnt == 0 ) + goto out; + } + while (--field_width > 0) + { + *str++ = ' '; + if( --cnt == 0 ) + goto out; + } + continue; + + case 'C': /* finished */ + if (!(flags & LEFT)) + while (--field_width > 0) + { + *str++ = ' '; + if( --cnt == 0 ) + goto out; + } + if (qualifier == 'h') + { + *str++ = (unsigned char) va_arg(args, int); + if( --cnt == 0 ) + goto out; + } + else + { + *str++ = (unsigned char)(wchar_t) va_arg(args, int); + if( --cnt == 0 ) + goto out; + } + while (--field_width > 0) + { + *str++ = ' '; + if( --cnt == 0 ) + goto out; + } + continue; + + case 's': /* finished */ + if (qualifier == 'l' || qualifier == 'w') { + /* print unicode string */ + sw = va_arg(args, wchar_t *); + if (sw == NULL) + sw = L""; + + for (len = 0; (unsigned int)len < (unsigned int)precision && sw[len]; len++); + + if (!(flags & LEFT)) + while (len < field_width--) + { + *str++ = ' '; + if( --cnt == 0 ) + goto out; + } + for (i = 0; i < len; ++i) + { + *str++ = (unsigned char)(*sw++); + if( --cnt == 0 ) + goto out; + } + while (len < field_width--) + { + *str++ = ' '; + if( --cnt == 0 ) + goto out; + } + } else { + /* print ascii string */ + s = va_arg(args, char *); + if (s == NULL) + s = ""; + + for (len = 0; (unsigned int)len < (unsigned int)precision && s[len]; len++); + + if (!(flags & LEFT)) + while (len < field_width--) + { + *str++ = ' '; + if( --cnt == 0 ) + goto out; + } + for (i = 0; i < len; ++i) + { + *str++ = *s++; + if( --cnt == 0 ) + goto out; + } + while (len < field_width--) + { + *str++ = ' '; + if( --cnt == 0 ) + goto out; + } + } + continue; + + case 'S': + if (qualifier == 'h') { + /* print ascii string */ + s = va_arg(args, char *); + if (s == NULL) + s = ""; + + for (len = 0; (unsigned int)len < (unsigned int)precision && s[len]; len++); + + if (!(flags & LEFT)) + while (len < field_width--) + { + *str++ = ' '; + if( --cnt == 0 ) + goto out; + } + for (i = 0; i < len; ++i) + { + *str++ = *s++; + if( --cnt == 0 ) + goto out; + } + while (len < field_width--) + { + *str++ = ' '; + if( --cnt == 0 ) + goto out; + } + } else { + /* print unicode string */ + sw = va_arg(args, wchar_t *); + if (sw == NULL) + sw = L""; + + for (len = 0; (unsigned int)len < (unsigned int)precision && sw[len]; len++); + + if (!(flags & LEFT)) + while (len < field_width--) + { + *str++ = ' '; + if( --cnt == 0 ) + goto out; + } + for (i = 0; i < len; ++i) + { + *str++ = (unsigned char)(*sw++); + if( --cnt == 0 ) + goto out; + } + while (len < field_width--) + { + *str++ = ' '; + if( --cnt == 0 ) + goto out; + } + } + continue; + + case 'Z': + if (qualifier == 'w') { + /* print counted unicode string */ + PUNICODE_STRING pus = va_arg(args, PUNICODE_STRING); + if ((pus == NULL) || (pus->Buffer == NULL)) { + s = ""; + while ((*s) != 0) + { + *str++ = *s++; + if( --cnt == 0 ) + goto out; + } + } else { + for (i = 0; pus->Buffer[i] && i < pus->Length / sizeof(WCHAR); i++) + { + *str++ = (unsigned char)(pus->Buffer[i]); + if( --cnt == 0 ) + goto out; + } + } + } else { + /* print counted ascii string */ + PANSI_STRING pus = va_arg(args, PANSI_STRING); + if ((pus == NULL) || (pus->Buffer == NULL)) { + s = ""; + while ((*s) != 0) + { + *str++ = *s++; + if( --cnt == 0 ) + goto out; + } + } else { + for (i = 0; pus->Buffer[i] && i < pus->Length; i++) + { + *str++ = pus->Buffer[i]; + if( --cnt == 0 ) + goto out; + } + } + } + continue; + + case 'p': + if (field_width == -1) { + field_width = 2 * sizeof(void *); + flags |= ZEROPAD; + } + str = number(str, + (unsigned long) va_arg(args, void *), 16, + field_width, precision, flags); + continue; + + case 'n': + if (qualifier == 'l') { + long * ip = va_arg(args, long *); + *ip = (str - buf); + } else { + int * ip = va_arg(args, int *); + *ip = (str - buf); + } + continue; + + /* integer number formats - set up the flags and "break" */ + case 'o': + base = 8; + break; + + case 'b': + base = 2; + break; + + case 'X': + flags |= LARGE; + case 'x': + base = 16; + break; + + case 'd': + case 'i': + flags |= SIGN; + case 'u': + break; + + default: + if (*fmt != '%') + { + *str++ = '%'; + if( --cnt == 0 ) + goto out; + } + if (*fmt) + { + *str++ = *fmt; + if( --cnt == 0 ) + goto out; + } + else + --fmt; + continue; + } + + if (qualifier == 'I') + num = va_arg(args, unsigned long long); + else if (qualifier == 'l') + num = va_arg(args, unsigned long); + else if (qualifier == 'h') { + if (flags & SIGN) + num = va_arg(args, int); + else + num = va_arg(args, unsigned int); + } + else { + if (flags & SIGN) + num = va_arg(args, int); + else + num = va_arg(args, unsigned int); + } + str = number(str, num, base, field_width, precision, flags); + } + out: + *str = '\0'; + return str-buf; } int sprintf(char * buf, const char *fmt, ...) { - va_list args; - int i; + va_list args; + int i; - va_start(args, fmt); - i=_vsnprintf(buf,INT_MAX,fmt,args); - va_end(args); - return i; + va_start(args, fmt); + i=_vsnprintf(buf,INT_MAX,fmt,args); + va_end(args); + return i; } int _snprintf(char * buf, size_t cnt, const char *fmt, ...) { - va_list args; - int i; + va_list args; + int i; - va_start(args, fmt); - i=_vsnprintf(buf,cnt,fmt,args); - va_end(args); - return i; + va_start(args, fmt); + i=_vsnprintf(buf,cnt,fmt,args); + va_end(args); + return i; } int vsprintf(char *buf, const char *fmt, va_list args) { - return _vsnprintf(buf,INT_MAX,fmt,args); + return _vsnprintf(buf,INT_MAX,fmt,args); } /* EOF */