1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2022 */
6 /* Copyright (c) University of Cambridge 1995 - 2018 */
7 /* See the file NOTICE for conditions of use and distribution. */
8 /* SPDX-License-Identifier: GPL-2.0-or-later */
10 /* Miscellaneous string-handling functions. Some are not required for
11 utilities and tests, and are cut out by the COMPILE_UTILITY macro. */
18 #ifndef COMPILE_UTILITY
19 /*************************************************
20 * Test for IP address *
21 *************************************************/
23 /* This used just to be a regular expression, but with IPv6 things are a bit
24 more complicated. If the address contains a colon, it is assumed to be a v6
25 address (assuming HAVE_IPV6 is set). If a mask is permitted and one is present,
26 and maskptr is not NULL, its offset is placed there.
30 maskptr NULL if no mask is permitted to follow
31 otherwise, points to an int where the offset of '/' is placed
32 if there is no / followed by trailing digits, *maskptr is set 0
34 Returns: 0 if the string is not a textual representation of an IP address
35 4 if it is an IPv4 address
36 6 if it is an IPv6 address
40 string_is_ip_address(const uschar *s, int *maskptr)
44 /* If an optional mask is permitted, check for it. If found, pass back the
49 const uschar *ss = s + Ustrlen(s);
51 if (s != ss && isdigit(*(--ss)))
53 while (ss > s && isdigit(ss[-1])) ss--;
54 if (ss > s && *(--ss) == '/') *maskptr = ss - s;
58 /* A colon anywhere in the string => IPv6 address */
60 if (Ustrchr(s, ':') != NULL)
62 BOOL had_double_colon = FALSE;
67 /* An IPv6 address must start with hex digit or double colon. A single
70 if (*s == ':' && *(++s) != ':') return 0;
72 /* Now read up to 8 components consisting of up to 4 hex digits each. There
73 may be one and only one appearance of double colon, which implies any number
74 of binary zero bits. The number of preceding components is held in count. */
76 for (int count = 0; count < 8; count++)
78 /* If the end of the string is reached before reading 8 components, the
79 address is valid provided a double colon has been read. This also applies
80 if we hit the / that introduces a mask or the % that introduces the
81 interface specifier (scope id) of a link-local address. */
83 if (*s == 0 || *s == '%' || *s == '/') return had_double_colon ? yield : 0;
85 /* If a component starts with an additional colon, we have hit a double
86 colon. This is permitted to appear once only, and counts as at least
87 one component. The final component may be of this form. */
91 if (had_double_colon) return 0;
92 had_double_colon = TRUE;
97 /* If the remainder of the string contains a dot but no colons, we
98 can expect a trailing IPv4 address. This is valid if either there has
99 been no double-colon and this is the 7th component (with the IPv4 address
100 being the 7th & 8th components), OR if there has been a double-colon
101 and fewer than 6 components. */
103 if (Ustrchr(s, ':') == NULL && Ustrchr(s, '.') != NULL)
105 if ((!had_double_colon && count != 6) ||
106 (had_double_colon && count > 6)) return 0;
112 /* Check for at least one and not more than 4 hex digits for this
115 if (!isxdigit(*s++)) return 0;
116 if (isxdigit(*s) && isxdigit(*(++s)) && isxdigit(*(++s))) s++;
118 /* If the component is terminated by colon and there is more to
119 follow, skip over the colon. If there is no more to follow the address is
122 if (*s == ':' && *(++s) == 0) return 0;
125 /* If about to handle a trailing IPv4 address, drop through. Otherwise
126 all is well if we are at the end of the string or at the mask or at a percent
127 sign, which introduces the interface specifier (scope id) of a link local
131 return (*s == 0 || *s == '%' ||
132 (*s == '/' && maskptr != NULL && *maskptr != 0))? yield : 0;
135 /* Test for IPv4 address, which may be the tail-end of an IPv6 address. */
137 for (int i = 0; i < 4; i++)
142 if (i != 0 && *s++ != '.') return 0;
143 n = strtol(CCS s, CSS &end, 10);
144 if (n > 255 || n < 0 || end <= s || end > s+3) return 0;
148 return !*s || (*s == '/' && maskptr && *maskptr != 0) ? yield : 0;
150 #endif /* COMPILE_UTILITY */
153 /*************************************************
154 * Format message size *
155 *************************************************/
157 /* Convert a message size in bytes to printing form, rounding
158 according to the magnitude of the number. A value of zero causes
159 a string of spaces to be returned.
162 size the message size in bytes
163 buffer where to put the answer
165 Returns: pointer to the buffer
166 a string of exactly 5 characters is normally returned
170 string_format_size(int size, uschar *buffer)
172 if (size == 0) Ustrcpy(buffer, US" ");
173 else if (size < 1024) sprintf(CS buffer, "%5d", size);
174 else if (size < 10*1024)
175 sprintf(CS buffer, "%4.1fK", (double)size / 1024.0);
176 else if (size < 1024*1024)
177 sprintf(CS buffer, "%4dK", (size + 512)/1024);
178 else if (size < 10*1024*1024)
179 sprintf(CS buffer, "%4.1fM", (double)size / (1024.0 * 1024.0));
181 sprintf(CS buffer, "%4dM", (size + 512 * 1024)/(1024*1024));
187 #ifndef COMPILE_UTILITY
188 /*************************************************
189 * Convert a number to base 62 format *
190 *************************************************/
192 /* Convert a long integer into an ASCII base 62 string. For Cygwin the value of
193 BASE_62 is actually 36. Always return exactly 6 characters plus a NUL, in a
194 static area. This is enough for a 32b input, for 62 (for 64b we would want 11+nul);
195 but with 36 we lose half the input range of a 32b input.
197 Argument: a long integer
198 Returns: pointer to base 62 string
202 string_base62_32(unsigned long int value)
204 static uschar yield[7];
205 uschar * p = yield + sizeof(yield) - 1;
209 *--p = base62_chars[value % BASE_62];
216 string_base62_64(unsigned long int value)
218 static uschar yield[12];
219 uschar * p = yield + sizeof(yield) - 1;
224 *--p = base62_chars[value % BASE_62];
231 #endif /* COMPILE_UTILITY */
235 /*************************************************
236 * Interpret escape sequence *
237 *************************************************/
239 /* This function is called from several places where escape sequences are to be
240 interpreted in strings.
243 pp points a pointer to the initiating "\" in the string;
244 the pointer gets updated to point to the final character
245 If the backslash is the last character in the string, it
247 Returns: the value of the character escape
251 string_interpret_escape(const uschar **pp)
253 #ifdef COMPILE_UTILITY
254 const uschar *hex_digits= CUS"0123456789abcdef";
257 const uschar *p = *pp;
259 if (ch == '\0') return **pp;
260 if (isdigit(ch) && ch != '8' && ch != '9')
263 if (isdigit(p[1]) && p[1] != '8' && p[1] != '9')
265 ch = ch * 8 + *(++p) - '0';
266 if (isdigit(p[1]) && p[1] != '8' && p[1] != '9')
267 ch = ch * 8 + *(++p) - '0';
272 case 'b': ch = '\b'; break;
273 case 'f': ch = '\f'; break;
274 case 'n': ch = '\n'; break;
275 case 'r': ch = '\r'; break;
276 case 't': ch = '\t'; break;
277 case 'v': ch = '\v'; break;
283 Ustrchr(hex_digits, tolower(*(++p))) - hex_digits;
284 if (isxdigit(p[1])) ch = ch * 16 +
285 Ustrchr(hex_digits, tolower(*(++p))) - hex_digits;
295 #ifndef COMPILE_UTILITY
296 /*************************************************
297 * Ensure string is printable *
298 *************************************************/
300 /* This function is called for critical strings. It checks for any
301 non-printing characters, and if any are found, it makes a new copy
302 of the string with suitable escape sequences. It is most often called by the
303 macro string_printing(), which sets flags to 0.
307 flags Bit 0: convert tabs. Bit 1: convert spaces.
309 Returns: string with non-printers encoded as printing sequences
313 string_printing2(const uschar *s, int flags)
315 int nonprintcount = 0;
324 || flags & SP_TAB && c == '\t'
325 || flags & SP_SPACE && c == ' '
330 if (nonprintcount == 0) return s;
332 /* Get a new block of store guaranteed big enough to hold the
335 tt = ss = store_get(length + nonprintcount * 3 + 1, s);
337 /* Copy everything, escaping non printers. */
343 && (!(flags & SP_TAB) || c != '\t')
344 && (!(flags & SP_SPACE) || c != ' ')
352 case '\n': *tt++ = 'n'; break;
353 case '\r': *tt++ = 'r'; break;
354 case '\b': *tt++ = 'b'; break;
355 case '\v': *tt++ = 'v'; break;
356 case '\f': *tt++ = 'f'; break;
357 case '\t': *tt++ = 't'; break;
358 default: sprintf(CS tt, "%03o", *t); tt += 3; break;
366 #endif /* COMPILE_UTILITY */
368 /*************************************************
369 * Undo printing escapes in string *
370 *************************************************/
372 /* This function is the reverse of string_printing2. It searches for
373 backslash characters and if any are found, it makes a new copy of the
374 string with escape sequences parsed. Otherwise it returns the original
380 Returns: string with printing escapes parsed back
384 string_unprinting(uschar *s)
386 uschar *p, *q, *r, *ss;
389 p = Ustrchr(s, '\\');
392 len = Ustrlen(s) + 1;
393 ss = store_get(len, s);
407 *q++ = string_interpret_escape((const uschar **)&p);
412 r = Ustrchr(p, '\\');
438 #if (defined(HAVE_LOCAL_SCAN) || defined(EXPAND_DLFUNC)) \
439 && !defined(MACRO_PREDEF) && !defined(COMPILE_UTILITY)
440 /*************************************************
441 * Copy and save string *
442 *************************************************/
445 Argument: string to copy
446 Returns: copy of string in new store with the same taint status
450 string_copy_function(const uschar * s)
452 return string_copy_taint(s, s);
455 /* As above, but explicitly specifying the result taint status
459 string_copy_taint_function(const uschar * s, const void * proto_mem)
461 return string_copy_taint(s, proto_mem);
466 /*************************************************
467 * Copy and save string, given length *
468 *************************************************/
470 /* It is assumed the data contains no zeros. A zero is added
475 n number of characters
477 Returns: copy of string in new store
481 string_copyn_function(const uschar * s, int n)
483 return string_copyn(s, n);
488 /*************************************************
489 * Copy and save string in malloc'd store *
490 *************************************************/
492 /* This function assumes that memcpy() is faster than strcpy().
494 Argument: string to copy
495 Returns: copy of string in new store
499 string_copy_malloc(const uschar * s)
501 int len = Ustrlen(s) + 1;
502 uschar * ss = store_malloc(len);
509 /*************************************************
510 * Copy string if long, inserting newlines *
511 *************************************************/
513 /* If the given string is longer than 75 characters, it is copied, and within
514 the copy, certain space characters are converted into newlines.
516 Argument: pointer to the string
517 Returns: pointer to the possibly altered string
521 string_split_message(uschar * msg)
525 if (!msg || Ustrlen(msg) <= 75) return msg;
526 s = ss = msg = string_copy(msg);
531 while (i < 75 && *ss && *ss != '\n') ss++, i++;
543 if (t[-1] == ':') { tt = t; break; }
548 if (!tt) /* Can't split behind - try ahead */
553 if (*t == ' ' || *t == '\n')
559 if (!tt) break; /* Can't find anywhere to split */
570 /*************************************************
571 * Copy returned DNS domain name, de-escaping *
572 *************************************************/
574 /* If a domain name contains top-bit characters, some resolvers return
575 the fully qualified name with those characters turned into escapes. The
576 convention is a backslash followed by _decimal_ digits. We convert these
577 back into the original binary values. This will be relevant when
578 allow_utf8_domains is set true and UTF-8 characters are used in domain
579 names. Backslash can also be used to escape other characters, though we
580 shouldn't come across them in domain names.
582 Argument: the domain name string
583 Returns: copy of string in new store, de-escaped
587 string_copy_dnsdomain(uschar * s)
590 uschar * ss = yield = store_get(Ustrlen(s) + 1, GET_TAINTED); /* always treat as tainted */
596 else if (isdigit(s[1]))
598 *ss++ = (s[1] - '0')*100 + (s[2] - '0')*10 + s[3] - '0';
610 #ifndef COMPILE_UTILITY
611 /*************************************************
612 * Copy space-terminated or quoted string *
613 *************************************************/
615 /* This function copies from a string until its end, or until whitespace is
616 encountered, unless the string begins with a double quote, in which case the
617 terminating quote is sought, and escaping within the string is done. The length
618 of a de-quoted string can be no longer than the original, since escaping always
619 turns n characters into 1 character.
621 Argument: pointer to the pointer to the first character, which gets updated
622 Returns: the new string
626 string_dequote(const uschar ** sptr)
628 const uschar * s = * sptr;
631 /* First find the end of the string */
634 while (*s && !isspace(*s)) s++;
638 while (*s && *s != '\"')
640 if (*s == '\\') (void)string_interpret_escape(&s);
646 /* Get enough store to copy into */
648 t = yield = store_get(s - *sptr + 1, *sptr);
654 while (*s && !isspace(*s)) *t++ = *s++;
658 while (*s && *s != '\"')
660 *t++ = *s == '\\' ? string_interpret_escape(&s) : *s;
666 /* Update the pointer and return the terminated copy */
672 #endif /* COMPILE_UTILITY */
676 /*************************************************
677 * Format a string and save it *
678 *************************************************/
680 /* The formatting is done by string_vformat, which checks the length of
681 everything. Taint is taken from the worst of the arguments.
684 format a printf() format - deliberately char * rather than uschar *
685 because it will most usually be a literal string
686 func caller, for debug
687 line caller, for debug
688 ... arguments for format
690 Returns: pointer to fresh piece of store containing sprintf'ed string
694 string_sprintf_trc(const char * format, const uschar * func, unsigned line, ...)
696 #ifdef COMPILE_UTILITY
697 uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
698 gstring gs = { .size = STRING_SPRINTF_BUFFER_SIZE, .ptr = 0, .s = buffer };
703 unsigned flags = SVFMT_REBUFFER|SVFMT_EXTEND;
708 g = string_vformat_trc(g, func, line, STRING_SPRINTF_BUFFER_SIZE,
713 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
714 "string_sprintf expansion was longer than %d; format string was (%s)\n"
715 " called from %s %d\n",
716 STRING_SPRINTF_BUFFER_SIZE, format, func, line);
718 #ifdef COMPILE_UTILITY
719 return string_copyn(g->s, g->ptr);
721 gstring_release_unused(g);
722 return string_from_gstring(g);
728 /*************************************************
729 * Case-independent strncmp() function *
730 *************************************************/
736 n number of characters to compare
738 Returns: < 0, = 0, or > 0, according to the comparison
742 strncmpic(const uschar * s, const uschar * t, int n)
746 int c = tolower(*s++) - tolower(*t++);
753 /*************************************************
754 * Case-independent strcmp() function *
755 *************************************************/
762 Returns: < 0, = 0, or > 0, according to the comparison
766 strcmpic(const uschar * s, const uschar * t)
770 int c = tolower(*s++) - tolower(*t++);
771 if (c != 0) return c;
777 /*************************************************
778 * Case-independent strstr() function *
779 *************************************************/
781 /* The third argument specifies whether whitespace is required
782 to follow the matched string.
786 t substring to search for
787 space_follows if TRUE, match only if whitespace follows
789 Returns: pointer to substring in string, or NULL if not found
793 strstric_c(const uschar * s, const uschar * t, BOOL space_follows)
795 const uschar * p = t;
796 const uschar * yield = NULL;
797 int cl = tolower(*p);
798 int cu = toupper(*p);
802 if (*s == cl || *s == cu)
804 if (!yield) yield = s;
807 if (!space_follows || s[1] == ' ' || s[1] == '\n' ) return yield;
828 strstric(uschar * s, uschar * t, BOOL space_follows)
830 return US strstric_c(s, t, space_follows);
834 #ifdef COMPILE_UTILITY
835 /* Dummy version for this function; it should never be called */
837 gstring_grow(gstring * g, int count)
845 #ifndef COMPILE_UTILITY
846 /*************************************************
847 * Get next string from separated list *
848 *************************************************/
850 /* Leading and trailing space is removed from each item. The separator in the
851 list is controlled by the int pointed to by the separator argument as follows:
853 If the value is > 0 it is used as the separator. This is typically used for
854 sublists such as slash-separated options. The value is always a printing
857 (If the value is actually > UCHAR_MAX there is only one item in the list.
858 This is used for some cases when called via functions that sometimes
859 plough through lists, and sometimes are given single items.)
861 If the value is <= 0, the string is inspected for a leading <x, where x is an
862 ispunct() or an iscntrl() character. If found, x is used as the separator. If
865 (a) if separator == 0, ':' is used
866 (b) if separator <0, -separator is used
868 In all cases the value of the separator that is used is written back to the
869 int so that it is used on subsequent calls as we progress through the list.
871 A literal ispunct() separator can be represented in an item by doubling, but
872 there is no way to include an iscntrl() separator as part of the data.
875 listptr points to a pointer to the current start of the list; the
876 pointer gets updated to point after the end of the next item
877 separator a pointer to the separator character in an int (see above)
878 buffer where to put a copy of the next string in the list; or
879 NULL if the next string is returned in new memory
880 Note that if the list is tainted then a provided buffer must be
881 also (else we trap, with a message referencing the callsite).
882 If we do the allocation, taint is handled there.
883 buflen when buffer is not NULL, the size of buffer; otherwise ignored
885 func caller, for debug
886 line caller, for debug
888 Returns: pointer to buffer, containing the next substring,
889 or NULL if no more substrings
893 string_nextinlist_trc(const uschar ** listptr, int * separator, uschar * buffer,
894 int buflen, const uschar * func, int line)
896 int sep = *separator;
897 const uschar * s = *listptr;
902 /* This allows for a fixed specified separator to be an iscntrl() character,
903 but at the time of implementation, this is never the case. However, it's best
904 to be conservative. */
906 while (isspace(*s) && *s != sep) s++;
908 /* A change of separator is permitted, so look for a leading '<' followed by an
909 allowed character. */
913 if (*s == '<' && (ispunct(s[1]) || iscntrl(s[1])))
917 while (isspace(*s) && *s != sep) s++;
920 sep = sep ? -sep : ':';
924 /* An empty string has no list elements */
926 if (!*s) return NULL;
928 /* Note whether whether or not the separator is an iscntrl() character. */
930 sep_is_special = iscntrl(sep);
932 /* Handle the case when a buffer is provided. */
933 /*XXX need to also deal with qouted-requirements mismatch */
938 if (is_tainted(s) && !is_tainted(buffer))
939 die_tainted(US"string_nextinlist", func, line);
942 if (*s == sep && (*(++s) != sep || sep_is_special)) break;
943 if (p < buflen - 1) buffer[p++] = *s;
945 while (p > 0 && isspace(buffer[p-1])) p--;
949 /* Handle the case when a buffer is not provided. */
955 /* We know that *s != 0 at this point. However, it might be pointing to a
956 separator, which could indicate an empty string, or (if an ispunct()
957 character) could be doubled to indicate a separator character as data at the
958 start of a string. Avoid getting working memory for an empty item. */
961 if (*++s != sep || sep_is_special)
964 return string_copy(US"");
967 /* Not an empty string; the first character is guaranteed to be a data
973 for (ss = s + 1; *ss && *ss != sep; ) ss++;
974 g = string_catn(g, s, ss-s);
976 if (!*s || *++s != sep || sep_is_special) break;
979 /* Trim trailing spaces from the returned string */
981 /* while (g->ptr > 0 && isspace(g->s[g->ptr-1])) g->ptr--; */
982 while ( g->ptr > 0 && isspace(g->s[g->ptr-1])
983 && (g->ptr == 1 || g->s[g->ptr-2] != '\\') )
985 buffer = string_from_gstring(g);
986 gstring_release_unused_trc(g, CCS func, line);
989 /* Update the current pointer and return the new string */
996 static const uschar *
997 Ustrnchr(const uschar * s, int c, unsigned * len)
1002 if (!*s) return NULL;
1015 /************************************************
1016 * Add element to separated list *
1017 ************************************************/
1018 /* This function is used to build a list, returning an allocated null-terminated
1019 growable string. The given element has any embedded separator characters
1022 Despite having the same growable-string interface as string_cat() the list is
1023 always returned null-terminated.
1026 list expanding-string for the list that is being built, or NULL
1027 if this is a new list that has no contents yet
1028 sep list separator character
1029 ele new element to be appended to the list
1031 Returns: pointer to the start of the list, changed if copied for expansion.
1035 string_append_listele(gstring * list, uschar sep, const uschar * ele)
1039 if (list && list->ptr)
1040 list = string_catn(list, &sep, 1);
1042 while((sp = Ustrchr(ele, sep)))
1044 list = string_catn(list, ele, sp-ele+1);
1045 list = string_catn(list, &sep, 1);
1048 list = string_cat(list, ele);
1049 (void) string_from_gstring(list);
1055 string_append_listele_n(gstring * list, uschar sep, const uschar * ele,
1060 if (list && list->ptr)
1061 list = string_catn(list, &sep, 1);
1063 while((sp = Ustrnchr(ele, sep, &len)))
1065 list = string_catn(list, ele, sp-ele+1);
1066 list = string_catn(list, &sep, 1);
1070 list = string_catn(list, ele, len);
1071 (void) string_from_gstring(list);
1077 /* A slightly-bogus listmaker utility; the separator is a string so
1078 can be multiple chars - there is no checking for the element content
1079 containing any of the separator. */
1082 string_append2_listele_n(gstring * list, const uschar * sepstr,
1083 const uschar * ele, unsigned len)
1085 if (list && list->ptr)
1086 list = string_cat(list, sepstr);
1088 list = string_catn(list, ele, len);
1089 (void) string_from_gstring(list);
1095 /************************************************/
1096 /* Add more space to a growable-string. The caller should check
1097 first if growth is required. The gstring struct is modified on
1098 return; specifically, the string-base-pointer may have been changed.
1101 g the growable-string
1102 count amount needed for g->ptr to increase by
1106 gstring_grow(gstring * g, int count)
1109 int oldsize = g->size;
1111 /* Mostly, string_cat() is used to build small strings of a few hundred
1112 characters at most. There are times, however, when the strings are very much
1113 longer (for example, a lookup that returns a vast number of alias addresses).
1114 To try to keep things reasonable, we use increments whose size depends on the
1115 existing length of the string. */
1117 unsigned inc = oldsize < 4096 ? 127 : 1023;
1119 if (g->ptr < 0 || g->ptr > g->size || g->size >= INT_MAX/2)
1120 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
1121 "internal error in gstring_grow (ptr %d size %d)", g->ptr, g->size);
1123 if (count <= 0) return;
1125 if (count >= INT_MAX/2 - g->ptr)
1126 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
1127 "internal error in gstring_grow (ptr %d count %d)", g->ptr, count);
1129 g->size = (p + count + inc + 1) & ~inc; /* one for a NUL */
1131 /* Try to extend an existing allocation. If the result of calling
1132 store_extend() is false, either there isn't room in the current memory block,
1133 or this string is not the top item on the dynamic store stack. We then have
1134 to get a new chunk of store and copy the old string. When building large
1135 strings, it is helpful to call store_release() on the old string, to release
1136 memory blocks that have become empty. (The block will be freed if the string
1137 is at its start.) However, we can do this only if we know that the old string
1138 was the last item on the dynamic memory stack. This is the case if it matches
1141 if (!store_extend(g->s, oldsize, g->size))
1142 g->s = store_newblock(g->s, g->size, p);
1147 /*************************************************
1148 * Add chars to string *
1149 *************************************************/
1150 /* This function is used when building up strings of unknown length. Room is
1151 always left for a terminating zero to be added to the string that is being
1152 built. This function does not require the string that is being added to be NUL
1153 terminated, because the number of characters to add is given explicitly. It is
1154 sometimes called to extract parts of other strings.
1157 g growable-string that is being built, or NULL if not assigned yet
1158 s points to characters to add
1159 count count of characters to add; must not exceed the length of s, if s
1162 Returns: growable string, changed if copied for expansion.
1163 Note that a NUL is not added, though space is left for one. This is
1164 because string_cat() is often called multiple times to build up a
1165 string - there's no point adding the NUL till the end.
1166 NULL is a possible return.
1169 /* coverity[+alloc] */
1172 string_catn(gstring * g, const uschar * s, int count)
1177 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
1178 "internal error in string_catn (count %d)", count);
1179 if (count == 0) return g;
1181 /*debug_printf("string_catn '%.*s'\n", count, s);*/
1184 unsigned inc = count < 4096 ? 127 : 1023;
1185 unsigned size = ((count + inc) & ~inc) + 1; /* round up requested count */
1186 g = string_get_tainted(size, s);
1188 else if (!g->s) /* should not happen */
1190 g->s = string_copyn(s, count);
1192 g->size = count; /*XXX suboptimal*/
1195 else if (is_incompatible(g->s, s))
1197 /* debug_printf("rebuf A\n"); */
1198 gstring_rebuffer(g, s);
1201 if (g->ptr < 0 || g->ptr > g->size)
1202 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
1203 "internal error in string_catn (ptr %d size %d)", g->ptr, g->size);
1206 if (count >= g->size - p)
1207 gstring_grow(g, count);
1209 /* Because we always specify the exact number of characters to copy, we can
1210 use memcpy(), which is likely to be more efficient than strncopy() because the
1211 latter has to check for zero bytes. */
1213 memcpy(g->s + p, s, count);
1220 string_cat(gstring * g, const uschar * s)
1222 return string_catn(g, s, Ustrlen(s));
1227 /*************************************************
1228 * Append strings to another string *
1229 *************************************************/
1231 /* This function can be used to build a string from many other strings.
1232 It calls string_cat() to do the dirty work.
1235 g growable-string that is being built, or NULL if not yet assigned
1236 count the number of strings to append
1237 ... "count" uschar* arguments, which must be valid zero-terminated
1240 Returns: growable string, changed if copied for expansion.
1241 The string is not zero-terminated - see string_cat() above.
1244 __inline__ gstring *
1245 string_append(gstring * g, int count, ...)
1249 va_start(ap, count);
1252 uschar * t = va_arg(ap, uschar *);
1253 g = string_cat(g, t);
1263 /*************************************************
1264 * Format a string with length checks *
1265 *************************************************/
1267 /* This function is used to format a string with checking of the length of the
1268 output for all conversions. It protects Exim from absent-mindedness when
1269 calling functions like debug_printf and string_sprintf, and elsewhere. There
1270 are two different entry points to what is actually the same function, depending
1271 on whether the variable length list of data arguments are given explicitly or
1274 The formats are the usual printf() ones, with some omissions (never used) and
1275 three additions for strings: %S forces lower case, %T forces upper case, and
1276 %#s or %#S prints nothing for a NULL string. Without the # "NULL" is printed
1277 (useful in debugging). There is also the addition of %D and %M, which insert
1278 the date in the form used for datestamped log files.
1281 buffer a buffer in which to put the formatted string
1282 buflen the length of the buffer
1283 format the format string - deliberately char * and not uschar *
1284 ... or ap variable list of supplementary arguments
1286 Returns: TRUE if the result fitted in the buffer
1290 string_format_trc(uschar * buffer, int buflen,
1291 const uschar * func, unsigned line, const char * format, ...)
1293 gstring g = { .size = buflen, .ptr = 0, .s = buffer }, * gp;
1295 va_start(ap, format);
1296 gp = string_vformat_trc(&g, func, line, STRING_SPRINTF_BUFFER_SIZE,
1306 /* Build or append to a growing-string, sprintf-style.
1310 func called-from function name, for debug
1311 line called-from file line number, for debug
1312 limit maximum string size
1314 format printf-like format string
1315 ap variable-args pointer
1318 SVFMT_EXTEND buffer can be created or exteded as needed
1319 SVFMT_REBUFFER buffer can be recopied to tainted mem as needed
1320 SVFMT_TAINT_NOCHK do not check inputs for taint
1322 If the "extend" flag is true, the string passed in can be NULL,
1323 empty, or non-empty. Growing is subject to an overall limit given
1324 by the limit argument.
1326 If the "extend" flag is false, the string passed in may not be NULL,
1327 will not be grown, and is usable in the original place after return.
1328 The return value can be NULL to signify overflow.
1330 Returns the possibly-new (if copy for growth or taint-handling was needed)
1331 string, not nul-terminated.
1335 string_vformat_trc(gstring * g, const uschar * func, unsigned line,
1336 unsigned size_limit, unsigned flags, const char * format, va_list ap)
1338 enum ltypes { L_NORMAL=1, L_SHORT=2, L_LONG=3, L_LONGLONG=4, L_LONGDOUBLE=5, L_SIZE=6 };
1340 int width, precision, off, lim, need;
1341 const char * fp = format; /* Deliberately not unsigned */
1343 string_datestamp_offset = -1; /* Datestamp not inserted */
1344 string_datestamp_length = 0; /* Datestamp not inserted */
1345 string_datestamp_type = 0; /* Datestamp not inserted */
1347 #ifdef COMPILE_UTILITY
1348 assert(!(flags & SVFMT_EXTEND));
1352 /* Ensure we have a string, to save on checking later */
1353 if (!g) g = string_get(16);
1355 if (!(flags & SVFMT_TAINT_NOCHK) && is_incompatible(g->s, format))
1357 #ifndef MACRO_PREDEF
1358 if (!(flags & SVFMT_REBUFFER))
1359 die_tainted(US"string_vformat", func, line);
1361 /* debug_printf("rebuf B\n"); */
1362 gstring_rebuffer(g, format);
1364 #endif /*!COMPILE_UTILITY*/
1366 lim = g->size - 1; /* leave one for a nul */
1367 off = g->ptr; /* remember initial offset in gstring */
1369 /* Scan the format and handle the insertions */
1373 int length = L_NORMAL;
1376 const char *null = "NULL"; /* ) These variables */
1377 const char *item_start, *s; /* ) are deliberately */
1378 char newformat[16]; /* ) not unsigned */
1379 char * gp = CS g->s + g->ptr; /* ) */
1381 /* Non-% characters just get copied verbatim */
1385 /* Avoid string_copyn() due to COMPILE_UTILITY */
1386 if ((need = g->ptr + 1) > lim)
1388 if (!(flags & SVFMT_EXTEND) || need > size_limit) return NULL;
1392 g->s[g->ptr++] = (uschar) *fp++;
1396 /* Deal with % characters. Pick off the width and precision, for checking
1397 strings, skipping over the flag and modifier characters. */
1400 width = precision = -1;
1402 if (strchr("-+ #0", *(++fp)) != NULL)
1404 if (*fp == '#') null = "";
1408 if (isdigit((uschar)*fp))
1410 width = *fp++ - '0';
1411 while (isdigit((uschar)*fp)) width = width * 10 + *fp++ - '0';
1413 else if (*fp == '*')
1415 width = va_arg(ap, int);
1422 precision = va_arg(ap, int);
1426 for (precision = 0; isdigit((uschar)*fp); fp++)
1427 precision = precision*10 + *fp - '0';
1429 /* Skip over 'h', 'L', 'l', 'll' and 'z', remembering the item length */
1432 { fp++; length = L_SHORT; }
1433 else if (*fp == 'L')
1434 { fp++; length = L_LONGDOUBLE; }
1435 else if (*fp == 'l')
1437 { fp += 2; length = L_LONGLONG; }
1439 { fp++; length = L_LONG; }
1440 else if (*fp == 'z')
1441 { fp++; length = L_SIZE; }
1443 /* Handle each specific format type. */
1448 nptr = va_arg(ap, int *);
1449 *nptr = g->ptr - off;
1457 width = length > L_LONG ? 24 : 12;
1458 if ((need = g->ptr + width) > lim)
1460 if (!(flags & SVFMT_EXTEND) || need >= size_limit) return NULL;
1461 gstring_grow(g, width);
1463 gp = CS g->s + g->ptr;
1465 strncpy(newformat, item_start, fp - item_start);
1466 newformat[fp - item_start] = 0;
1468 /* Short int is promoted to int when passing through ..., so we must use
1469 int for va_arg(). */
1475 g->ptr += sprintf(gp, newformat, va_arg(ap, int)); break;
1477 g->ptr += sprintf(gp, newformat, va_arg(ap, long int)); break;
1479 g->ptr += sprintf(gp, newformat, va_arg(ap, LONGLONG_T)); break;
1481 g->ptr += sprintf(gp, newformat, va_arg(ap, size_t)); break;
1488 if ((need = g->ptr + 24) > lim)
1490 if (!(flags & SVFMT_EXTEND || need >= size_limit)) return NULL;
1491 gstring_grow(g, 24);
1493 gp = CS g->s + g->ptr;
1495 /* sprintf() saying "(nil)" for a null pointer seems unreliable.
1496 Handle it explicitly. */
1497 if ((ptr = va_arg(ap, void *)))
1499 strncpy(newformat, item_start, fp - item_start);
1500 newformat[fp - item_start] = 0;
1501 g->ptr += sprintf(gp, newformat, ptr);
1504 g->ptr += sprintf(gp, "(nil)");
1508 /* %f format is inherently insecure if the numbers that it may be
1509 handed are unknown (e.g. 1e300). However, in Exim, %f is used for
1510 printing load averages, and these are actually stored as integers
1511 (load average * 1000) so the size of the numbers is constrained.
1512 It is also used for formatting sending rates, where the simplicity
1513 of the format prevents overflow. */
1520 if (precision < 0) precision = 6;
1521 if ((need = g->ptr + precision + 8) > lim)
1523 if (!(flags & SVFMT_EXTEND || need >= size_limit)) return NULL;
1524 gstring_grow(g, precision+8);
1526 gp = CS g->s + g->ptr;
1528 strncpy(newformat, item_start, fp - item_start);
1529 newformat[fp-item_start] = 0;
1530 if (length == L_LONGDOUBLE)
1531 g->ptr += sprintf(gp, newformat, va_arg(ap, long double));
1533 g->ptr += sprintf(gp, newformat, va_arg(ap, double));
1539 if ((need = g->ptr + 1) > lim)
1541 if (!(flags & SVFMT_EXTEND || need >= size_limit)) return NULL;
1545 g->s[g->ptr++] = (uschar) '%';
1549 if ((need = g->ptr + 1) > lim)
1551 if (!(flags & SVFMT_EXTEND || need >= size_limit)) return NULL;
1555 g->s[g->ptr++] = (uschar) va_arg(ap, int);
1558 case 'D': /* Insert daily datestamp for log file names */
1559 s = CS tod_stamp(tod_log_datestamp_daily);
1560 string_datestamp_offset = g->ptr; /* Passed back via global */
1561 string_datestamp_length = Ustrlen(s); /* Passed back via global */
1562 string_datestamp_type = tod_log_datestamp_daily;
1563 slen = string_datestamp_length;
1566 case 'M': /* Insert monthly datestamp for log file names */
1567 s = CS tod_stamp(tod_log_datestamp_monthly);
1568 string_datestamp_offset = g->ptr; /* Passed back via global */
1569 string_datestamp_length = Ustrlen(s); /* Passed back via global */
1570 string_datestamp_type = tod_log_datestamp_monthly;
1571 slen = string_datestamp_length;
1575 case 'S': /* Forces *lower* case */
1576 case 'T': /* Forces *upper* case */
1577 s = va_arg(ap, char *);
1582 if (!(flags & SVFMT_TAINT_NOCHK) && is_incompatible(g->s, s))
1583 if (flags & SVFMT_REBUFFER)
1585 /* debug_printf("%s %d: untainted workarea, tainted %%s :- rebuffer\n", __FUNCTION__, __LINE__); */
1586 gstring_rebuffer(g, s);
1587 gp = CS g->s + g->ptr;
1589 #ifndef MACRO_PREDEF
1591 die_tainted(US"string_vformat", func, line);
1594 INSERT_STRING: /* Come to from %D or %M above */
1597 BOOL truncated = FALSE;
1599 /* If the width is specified, check that there is a precision
1600 set; if not, set it to the width to prevent overruns of long
1605 if (precision < 0) precision = width;
1608 /* If a width is not specified and the precision is specified, set
1609 the width to the precision, or the string length if shorted. */
1611 else if (precision >= 0)
1612 width = precision < slen ? precision : slen;
1614 /* If neither are specified, set them both to the string length. */
1617 width = precision = slen;
1619 if ((need = g->ptr + width) >= size_limit || !(flags & SVFMT_EXTEND))
1621 if (g->ptr == lim) return NULL;
1625 width = precision = lim - g->ptr - 1;
1626 if (width < 0) width = 0;
1627 if (precision < 0) precision = 0;
1630 else if (need > lim)
1632 gstring_grow(g, width);
1634 gp = CS g->s + g->ptr;
1637 g->ptr += sprintf(gp, "%*.*s", width, precision, s);
1639 while (*gp) { *gp = tolower(*gp); gp++; }
1640 else if (fp[-1] == 'T')
1641 while (*gp) { *gp = toupper(*gp); gp++; }
1643 if (truncated) return NULL;
1647 /* Some things are never used in Exim; also catches junk. */
1650 strncpy(newformat, item_start, fp - item_start);
1651 newformat[fp-item_start] = 0;
1652 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "string_format: unsupported type "
1653 "in \"%s\" in \"%s\"", newformat, format);
1658 if (g->ptr > g->size)
1659 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
1660 "string_format internal error: caller %s %d", func, line);
1666 #ifndef COMPILE_UTILITY
1667 /*************************************************
1668 * Generate an "open failed" message *
1669 *************************************************/
1671 /* This function creates a message after failure to open a file. It includes a
1672 string supplied as data, adds the strerror() text, and if the failure was
1673 "Permission denied", reads and includes the euid and egid.
1676 format a text format string - deliberately not uschar *
1677 func caller, for debug
1678 line caller, for debug
1679 ... arguments for the format string
1681 Returns: a message, in dynamic store
1685 string_open_failed_trc(const uschar * func, unsigned line,
1686 const char * format, ...)
1689 gstring * g = string_get(1024);
1691 g = string_catn(g, US"failed to open ", 15);
1693 /* Use the checked formatting routine to ensure that the buffer
1694 does not overflow. It should not, since this is called only for internally
1695 specified messages. If it does, the message just gets truncated, and there
1696 doesn't seem much we can do about that. */
1698 va_start(ap, format);
1699 (void) string_vformat_trc(g, func, line, STRING_SPRINTF_BUFFER_SIZE,
1700 SVFMT_REBUFFER, format, ap);
1703 g = string_catn(g, US": ", 2);
1704 g = string_cat(g, US strerror(errno));
1706 if (errno == EACCES)
1708 int save_errno = errno;
1709 g = string_fmt_append(g, " (euid=%ld egid=%ld)",
1710 (long int)geteuid(), (long int)getegid());
1713 gstring_release_unused(g);
1714 return string_from_gstring(g);
1721 /* qsort(3), currently used to sort the environment variables
1722 for -bP environment output, needs a function to compare two pointers to string
1723 pointers. Here it is. */
1726 string_compare_by_pointer(const void *a, const void *b)
1728 return Ustrcmp(* CUSS a, * CUSS b);
1730 #endif /* COMPILE_UTILITY */
1735 /*************************************************
1736 **************************************************
1737 * Stand-alone test program *
1738 **************************************************
1739 *************************************************/
1746 printf("Testing is_ip_address\n");
1749 while (fgets(CS buffer, sizeof(buffer), stdin) != NULL)
1752 buffer[Ustrlen(buffer) - 1] = 0;
1753 printf("%d\n", string_is_ip_address(buffer, NULL));
1754 printf("%d %d %s\n", string_is_ip_address(buffer, &offset), offset, buffer);
1757 printf("Testing string_nextinlist\n");
1759 while (fgets(CS buffer, sizeof(buffer), stdin) != NULL)
1761 uschar *list = buffer;
1769 sep1 = sep2 = list[1];
1776 uschar *item1 = string_nextinlist(&lp1, &sep1, item, sizeof(item));
1777 uschar *item2 = string_nextinlist(&lp2, &sep2, NULL, 0);
1779 if (item1 == NULL && item2 == NULL) break;
1780 if (item == NULL || item2 == NULL || Ustrcmp(item1, item2) != 0)
1782 printf("***ERROR\nitem1=\"%s\"\nitem2=\"%s\"\n",
1783 (item1 == NULL)? "NULL" : CS item1,
1784 (item2 == NULL)? "NULL" : CS item2);
1787 else printf(" \"%s\"\n", CS item1);
1791 /* This is a horrible lash-up, but it serves its purpose. */
1793 printf("Testing string_format\n");
1795 while (fgets(CS buffer, sizeof(buffer), stdin) != NULL)
1798 long long llargs[3];
1804 BOOL countset = FASE;
1808 buffer[Ustrlen(buffer) - 1] = 0;
1810 s = Ustrchr(buffer, ',');
1811 if (s == NULL) s = buffer + Ustrlen(buffer);
1813 Ustrncpy(format, buffer, s - buffer);
1814 format[s-buffer] = 0;
1821 s = Ustrchr(ss, ',');
1822 if (s == NULL) s = ss + Ustrlen(ss);
1826 Ustrncpy(outbuf, ss, s-ss);
1827 if (Ustrchr(outbuf, '.') != NULL)
1830 dargs[n++] = Ustrtod(outbuf, NULL);
1832 else if (Ustrstr(outbuf, "ll") != NULL)
1835 llargs[n++] = strtoull(CS outbuf, NULL, 10);
1839 args[n++] = (void *)Uatoi(outbuf);
1843 else if (Ustrcmp(ss, "*") == 0)
1845 args[n++] = (void *)(&count);
1851 uschar *sss = malloc(s - ss + 1);
1852 Ustrncpy(sss, ss, s-ss);
1859 if (!dflag && !llflag)
1860 printf("%s\n", string_format(outbuf, sizeof(outbuf), CS format,
1861 args[0], args[1], args[2])? "True" : "False");
1864 printf("%s\n", string_format(outbuf, sizeof(outbuf), CS format,
1865 dargs[0], dargs[1], dargs[2])? "True" : "False");
1867 else printf("%s\n", string_format(outbuf, sizeof(outbuf), CS format,
1868 llargs[0], llargs[1], llargs[2])? "True" : "False");
1870 printf("%s\n", CS outbuf);
1871 if (countset) printf("count=%d\n", count);
1878 /* End of string.c */