@matheusbsbs / matheus-bagliano / commits / 522cc87fdc

utf8: fix truncated string lengths in `utf8_strnwidth()`

The `utf8_strnwidth()` function accepts an optional string length as input parameter. This parameter can either be set to `-1`, in which case we call `strlen()` on the input. Or it can be set to a positive integer that indicates a precomputed length, which callers typically compute by calling `strlen()` at some point themselves. The input parameter is an `int` though, whereas `strlen()` returns a `size_t`. This can lead to implementation-defined behaviour though when the `size_t` cannot be represented by the `int`. In the general case though this leads to wrap-around and thus to negative string sizes, which is sure enough to not lead to well-defined behaviour. Fix this by accepting a `size_t` instead of an `int` as string length. While this takes away the ability of callers to simply pass in `-1` as string length, it really is trivial enough to convert them to instead pass in `strlen()` instead. Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Patrick Steinhardt committed Dec 1, 2022 at 15:46 UTC 522cc87fdc25449222a5894a428eebf4b8d5eaa9

4 files changed +7 -9

column.c

+1 -1

@@ -23,7 +23,7 @@ struct column_data {

23 /* return length of 's' in letters, ANSI escapes stripped */

24 static int item_length(const char *s)

25 {

26 - return utf8_strnwidth(s, -1, 1);

26 + return utf8_strnwidth(s, strlen(s), 1);

27 }

29 /*

pretty.c

+2 -2

@@ -1483,7 +1483,7 @@ static size_t format_and_pad_commit(struct strbuf *sb, /* in UTF-8 */

1483 int occupied;

1484 if (!start)

1485 start = sb->buf;

1486 - occupied = utf8_strnwidth(start, -1, 1);

1486 + occupied = utf8_strnwidth(start, strlen(start), 1);

1487 occupied += c->pretty_ctx->graph_width;

1488 padding = (-padding) - occupied;

1489 }

@@ -1501,7 +1501,7 @@ static size_t format_and_pad_commit(struct strbuf *sb, /* in UTF-8 */

1501 placeholder++;

1502 total_consumed++;

1503 }

1504 - len = utf8_strnwidth(local_sb.buf, -1, 1);

1504 + len = utf8_strnwidth(local_sb.buf, local_sb.len, 1);

1505

1506 if (c->flush_type == flush_left_and_steal) {

1507 const char *ch = sb->buf + sb->len - 1;

utf8.c

+3 -5

@@ -206,13 +206,11 @@ int utf8_width(const char **start, size_t *remainder_p)

206 * string, assuming that the string is utf8. Returns strlen() instead

207 * if the string does not look like a valid utf8 string.

208 */

209 -int utf8_strnwidth(const char *string, int len, int skip_ansi)

209 +int utf8_strnwidth(const char *string, size_t len, int skip_ansi)

210 {

211 int width = 0;

212 const char *orig = string;

213

214 - if (len == -1)

215 - len = strlen(string);

214 while (string && string < orig + len) {

215 int skip;

216 while (skip_ansi &&

@@ -225,7 +223,7 @@ int utf8_strnwidth(const char *string, int len, int skip_ansi)

223

224 int utf8_strwidth(const char *string)

225 {

228 - return utf8_strnwidth(string, -1, 0);

226 + return utf8_strnwidth(string, strlen(string), 0);

227 }

228

229 int is_utf8(const char *text)

@@ -791,7 +789,7 @@ int skip_utf8_bom(char **text, size_t len)

789 void strbuf_utf8_align(struct strbuf *buf, align_type position, unsigned int width,

790 const char *s)

791 {

794 - int slen = strlen(s);

792 + size_t slen = strlen(s);

793 int display_len = utf8_strnwidth(s, slen, 0);

794 int utf8_compensation = slen - display_len;

795

utf8.h

+1 -1

@@ -7,7 +7,7 @@ typedef unsigned int ucs_char_t; /* assuming 32bit int */

8 size_t display_mode_esc_sequence_len(const char *s);

9 int utf8_width(const char **start, size_t *remainder_p);

10 -int utf8_strnwidth(const char *string, int len, int skip_ansi);

10 +int utf8_strnwidth(const char *string, size_t len, int skip_ansi);

11 int utf8_strwidth(const char *string);

12 int is_utf8(const char *text);

13 int is_encoding_utf8(const char *name);