CVE-2015-5330: next_codepoint_handle_ext: don't short-circuit UTF16 low bytes
[samba.git] / lib / util / charset / weird.c
1 /* 
2    Unix SMB/CIFS implementation.
3    Samba module with developer tools
4    Copyright (C) Andrew Tridgell 2001
5    Copyright (C) Jelmer Vernooij 2002
6    
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License as published by
9    the Free Software Foundation; either version 3 of the License, or
10    (at your option) any later version.
11    
12    This program is distributed in the hope that it will be useful,
13    but WITHOUT ANY WARRANTY; without even the implied warranty of
14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15    GNU General Public License for more details.
16    
17    You should have received a copy of the GNU General Public License
18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "charset_proto.h"
23
24 #ifdef DEVELOPER
25
26 static struct {
27         char from;
28         const char *to;
29         int len;
30 } weird_table[] = {
31         {'q', "^q^", 3},
32         {'Q', "^Q^", 3},
33         {0, NULL}
34 };
35
36 size_t weird_pull(void *cd, const char **inbuf, size_t *inbytesleft,
37                   char **outbuf, size_t *outbytesleft)
38 {
39         while (*inbytesleft >= 1 && *outbytesleft >= 2) {
40                 int i;
41                 int done = 0;
42                 for (i=0;weird_table[i].from;i++) {
43                         if (strncmp((*inbuf), 
44                                     weird_table[i].to, 
45                                     weird_table[i].len) == 0) {
46                                 if (*inbytesleft < weird_table[i].len) {
47                                         DEBUG(0,("ERROR: truncated weird string\n"));
48                                         /* smb_panic("weird_pull"); */
49
50                                 } else {
51                                         (*outbuf)[0] = weird_table[i].from;
52                                         (*outbuf)[1] = 0;
53                                         (*inbytesleft)  -= weird_table[i].len;
54                                         (*outbytesleft) -= 2;
55                                         (*inbuf)  += weird_table[i].len;
56                                         (*outbuf) += 2;
57                                         done = 1;
58                                         break;
59                                 }
60                         }
61                 }
62                 if (done) continue;
63                 (*outbuf)[0] = (*inbuf)[0];
64                 (*outbuf)[1] = 0;
65                 (*inbytesleft)  -= 1;
66                 (*outbytesleft) -= 2;
67                 (*inbuf)  += 1;
68                 (*outbuf) += 2;
69         }
70
71         if (*inbytesleft > 0) {
72                 errno = E2BIG;
73                 return -1;
74         }
75         
76         return 0;
77 }
78
79 size_t weird_push(void *cd, const char **inbuf, size_t *inbytesleft,
80                   char **outbuf, size_t *outbytesleft)
81 {
82         int ir_count=0;
83
84         while (*inbytesleft >= 2 && *outbytesleft >= 1) {
85                 int i;
86                 int done=0;
87                 for (i=0;weird_table[i].from;i++) {
88                         if ((*inbuf)[0] == weird_table[i].from &&
89                             (*inbuf)[1] == 0) {
90                                 if (*outbytesleft < weird_table[i].len) {
91                                         DEBUG(0,("No room for weird character\n"));
92                                         /* smb_panic("weird_push"); */
93                                 } else {
94                                         memcpy(*outbuf, weird_table[i].to, 
95                                                weird_table[i].len);
96                                         (*inbytesleft)  -= 2;
97                                         (*outbytesleft) -= weird_table[i].len;
98                                         (*inbuf)  += 2;
99                                         (*outbuf) += weird_table[i].len;
100                                         done = 1;
101                                         break;
102                                 }
103                         }
104                 }
105                 if (done) continue;
106
107                 (*outbuf)[0] = (*inbuf)[0];
108                 if ((*inbuf)[1]) ir_count++;
109                 (*inbytesleft)  -= 2;
110                 (*outbytesleft) -= 1;
111                 (*inbuf)  += 2;
112                 (*outbuf) += 1;
113         }
114
115         if (*inbytesleft == 1) {
116                 errno = EINVAL;
117                 return -1;
118         }
119
120         if (*inbytesleft > 1) {
121                 errno = E2BIG;
122                 return -1;
123         }
124         
125         return ir_count;
126 }
127
128 #else
129 void charset_weird_dummy(void);
130 void charset_weird_dummy(void)
131 {
132         return;
133 }
134
135 #endif