avoid null pointer dereference on %*p fields in scanf
[musl] / src / stdio / vfscanf.c
1 #include <stdio.h>
2 #include <stdlib.h>
3 #include <stdarg.h>
4 #include <ctype.h>
5 #include <wchar.h>
6 #include <wctype.h>
7 #include <limits.h>
8 #include <string.h>
9 #include <errno.h>
10 #include <math.h>
11 #include <float.h>
12
13 #include "stdio_impl.h"
14 #include "shgetc.h"
15 #include "intscan.h"
16 #include "floatscan.h"
17
18 #define SIZE_hh -2
19 #define SIZE_h  -1
20 #define SIZE_def 0
21 #define SIZE_l   1
22 #define SIZE_L   2
23 #define SIZE_ll  3
24
25 static void store_int(void *dest, int size, unsigned long long i)
26 {
27         if (!dest) return;
28         switch (size) {
29         case SIZE_hh:
30                 *(char *)dest = i;
31                 break;
32         case SIZE_h:
33                 *(short *)dest = i;
34                 break;
35         case SIZE_def:
36                 *(int *)dest = i;
37                 break;
38         case SIZE_l:
39                 *(long *)dest = i;
40                 break;
41         case SIZE_ll:
42                 *(long long *)dest = i;
43                 break;
44         }
45 }
46
47 static void *arg_n(va_list ap, unsigned int n)
48 {
49         void *p;
50         unsigned int i;
51         va_list ap2;
52         va_copy(ap2, ap);
53         for (i=n; i>1; i--) va_arg(ap2, void *);
54         p = va_arg(ap2, void *);
55         va_end(ap2);
56         return p;
57 }
58
59 static int readwc(int c, wchar_t **wcs, mbstate_t *st)
60 {
61         char ch = c;
62         wchar_t wc;
63         switch (mbrtowc(&wc, &ch, 1, st)) {
64         case -1:
65                 return -1;
66         case -2:
67                 break;
68         default:
69                 if (*wcs) *(*wcs)++ = wc;
70         }
71         return 0;
72 }
73
74 int vfscanf(FILE *f, const char *fmt, va_list ap)
75 {
76         int width;
77         int size;
78         int alloc;
79         int base;
80         const unsigned char *p;
81         int c, t;
82         char *s;
83         wchar_t *wcs;
84         mbstate_t st;
85         void *dest=NULL;
86         int invert;
87         int matches=0;
88         unsigned long long x;
89         long double y;
90         off_t pos = 0;
91
92         FLOCK(f);
93
94         for (p=(const unsigned char *)fmt; *p; p++) {
95
96                 if (isspace(*p)) {
97                         while (isspace(p[1])) p++;
98                         shlim(f, 0);
99                         while (isspace(shgetc(f)));
100                         shunget(f);
101                         pos += shcnt(f);
102                         continue;
103                 }
104                 if (*p != '%' || p[1] == '%') {
105                         p += *p=='%';
106                         c = shgetc(f);
107                         if (c!=*p) {
108                                 shunget(f);
109                                 if (c<0) goto input_fail;
110                                 goto match_fail;
111                         }
112                         pos++;
113                         continue;
114                 }
115
116                 p++;
117                 if (*p=='*') {
118                         dest = 0; p++;
119                 } else if (isdigit(*p) && p[1]=='$') {
120                         dest = arg_n(ap, *p-'0'); p+=2;
121                 } else {
122                         dest = va_arg(ap, void *);
123                 }
124
125                 for (width=0; isdigit(*p); p++) {
126                         width = 10*width + *p - '0';
127                 }
128
129                 if (*p=='m') {
130                         alloc = 1;
131                         p++;
132                 } else {
133                         alloc = 0;
134                 }
135
136                 size = SIZE_def;
137                 switch (*p++) {
138                 case 'h':
139                         if (*p == 'h') p++, size = SIZE_hh;
140                         else size = SIZE_h;
141                         break;
142                 case 'l':
143                         if (*p == 'l') p++, size = SIZE_ll;
144                         else size = SIZE_l;
145                         break;
146                 case 'j':
147                         size = SIZE_ll;
148                         break;
149                 case 'z':
150                 case 't':
151                         size = SIZE_l;
152                         break;
153                 case 'L':
154                         size = SIZE_L;
155                         break;
156                 case 'd': case 'i': case 'o': case 'u': case 'x':
157                 case 'a': case 'e': case 'f': case 'g':
158                 case 'A': case 'E': case 'F': case 'G': case 'X':
159                 case 's': case 'c': case '[':
160                 case 'S': case 'C':
161                 case 'p': case 'n':
162                         p--;
163                         break;
164                 default:
165                         goto fmt_fail;
166                 }
167
168                 t = *p;
169
170                 switch (t) {
171                 case 'C':
172                 case 'c':
173                         if (width < 1) width = 1;
174                 case 's':
175                         if (size == SIZE_l) t &= ~0x20;
176                 case 'd': case 'i': case 'o': case 'u': case 'x':
177                 case 'a': case 'e': case 'f': case 'g':
178                 case 'A': case 'E': case 'F': case 'G': case 'X':
179                 case '[': case 'S':
180                 case 'p': case 'n':
181                         if (width < 1) width = 0;
182                         break;
183                 default:
184                         goto fmt_fail;
185                 }
186
187                 shlim(f, width);
188
189                 if (t != 'n') {
190                         if (shgetc(f) < 0) goto input_fail;
191                         shunget(f);
192                 }
193
194                 switch (t) {
195                 case 'n':
196                         store_int(dest, size, pos);
197                         /* do not increment match count, etc! */
198                         continue;
199                 case 'C':
200                         wcs = dest;
201                         st = (mbstate_t){ 0 };
202                         while ((c=shgetc(f)) >= 0) {
203                                 if (readwc(c, &wcs, &st) < 0)
204                                         goto input_fail;
205                         }
206                         if (!mbsinit(&st)) goto input_fail;
207                         if (shcnt(f) != width) goto match_fail;
208                         break;
209                 case 'c':
210                         if (dest) {
211                                 s = dest;
212                                 while ((c=shgetc(f)) >= 0) *s++ = c;
213                         } else {
214                                 while (shgetc(f)>=0);
215                         }
216                         if (shcnt(f) < width) goto match_fail;
217                         break;
218                 case '[':
219                         s = dest;
220                         wcs = dest;
221
222                         if (*++p == '^') p++, invert = 1;
223                         else invert = 0;
224
225                         unsigned char scanset[257];
226                         memset(scanset, invert, sizeof scanset);
227
228                         scanset[0] = 0;
229                         if (*p == '-') p++, scanset[1+'-'] = 1-invert;
230                         if (*p == ']') p++, scanset[1+']'] = 1-invert;
231                         for (; *p && *p != ']'; p++) {
232                                 if (*p=='-' && p[1] != ']')
233                                         for (c=p++[-1]; c<*p; c++)
234                                                 scanset[1+c] = 1-invert;
235                                 scanset[1+*p] = 1-invert;
236                         }
237                         if (!*p) goto fmt_fail;
238
239                         if (size == SIZE_l) {
240                                 st = (mbstate_t){0};
241                                 while (scanset[(c=shgetc(f))+1]) {
242                                         if (readwc(c, &wcs, &st) < 0)
243                                                 goto input_fail;
244                                 }
245                                 if (!mbsinit(&st)) goto input_fail;
246                                 s = 0;
247                         } else if (s) {
248                                 while (scanset[(c=shgetc(f))+1])
249                                         *s++ = c;
250                                 wcs = 0;
251                         } else {
252                                 while (scanset[(c=shgetc(f))+1]);
253                         }
254                         shunget(f);
255                         if (!shcnt(f)) goto match_fail;
256                         if (s) *s = 0;
257                         if (wcs) *wcs = 0;
258                         break;
259                 default:
260                         shlim(f, 0);
261                         while (isspace(shgetc(f)));
262                         shunget(f);
263                         pos += shcnt(f);
264                         shlim(f, width);
265                         if (shgetc(f) < 0) goto input_fail;
266                         shunget(f);
267                 }
268
269                 switch (t) {
270                 case 'p':
271                 case 'X':
272                 case 'x':
273                         base = 16;
274                         goto int_common;
275                 case 'o':
276                         base = 8;
277                         goto int_common;
278                 case 'd':
279                 case 'u':
280                         base = 10;
281                         goto int_common;
282                 case 'i':
283                         base = 0;
284                 int_common:
285                         x = __intscan(f, base, 0, ULLONG_MAX);
286                         if (!shcnt(f)) goto match_fail;
287                         if (t=='p' && dest) *(void **)dest = (void *)(uintptr_t)x;
288                         else store_int(dest, size, x);
289                         break;
290                 case 'a': case 'A':
291                 case 'e': case 'E':
292                 case 'f': case 'F':
293                 case 'g': case 'G':
294                         y = __floatscan(f, -1, size, 0);
295                         if (!shcnt(f)) goto match_fail;
296                         if (dest) switch (size) {
297                         case SIZE_def:
298                                 *(float *)dest = y;
299                                 break;
300                         case SIZE_l:
301                                 *(double *)dest = y;
302                                 break;
303                         case SIZE_L:
304                                 *(long double *)dest = y;
305                                 break;
306                         }
307                         break;
308                 case 'S':
309                         wcs = dest;
310                         st = (mbstate_t){ 0 };
311                         while (!isspace(c=shgetc(f)) && c!=EOF) {
312                                 if (readwc(c, &wcs, &st) < 0)
313                                         goto input_fail;
314                         }
315                         if (!mbsinit(&st)) goto input_fail;
316                         if (dest) *wcs++ = 0;
317                         break;
318                 case 's':
319                         if (dest) {
320                                 s = dest;
321                                 while (!isspace(c=shgetc(f)) && c!=EOF)
322                                         *s++ = c;
323                                 *s = 0;
324                         } else {
325                                 while (!isspace(c=shgetc(f)) && c!=EOF);
326                         }
327                         shunget(f);
328                         break;
329                 }
330
331                 pos += shcnt(f);
332                 if (dest) matches++;
333         }
334         if (0) {
335 fmt_fail:
336 input_fail:
337                 if (!matches) matches--;
338         }
339 match_fail:
340         FUNLOCK(f);
341         return matches;
342 }