]> git.ipfire.org Git - thirdparty/glibc.git/blame - iconvdata/ibm937.c
CVE-2014-6040: Crashes on invalid input in IBM gconv modules [BZ #17325]
[thirdparty/glibc.git] / iconvdata / ibm937.c
CommitLineData
29132b91 1/* Conversion from and to IBM937.
d4697bc9 2 Copyright (C) 2000-2014 Free Software Foundation, Inc.
dbd10df7
UD
3 This file is part of the GNU C Library.
4 Contributed by Masahide Washizawa <washi@yamato.ibm.co.jp>, 2000.
5
6 The GNU C Library is free software; you can redistribute it and/or
41bdb6e2
AJ
7 modify it under the terms of the GNU Lesser General Public
8 License as published by the Free Software Foundation; either
9 version 2.1 of the License, or (at your option) any later version.
dbd10df7
UD
10
11 The GNU C Library is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
41bdb6e2 14 Lesser General Public License for more details.
dbd10df7 15
41bdb6e2 16 You should have received a copy of the GNU Lesser General Public
59ba27a6
PE
17 License along with the GNU C Library; if not, see
18 <http://www.gnu.org/licenses/>. */
dbd10df7
UD
19
20#include <dlfcn.h>
21#include <stdint.h>
22#include <wchar.h>
23#include <byteswap.h>
24#include "ibm937.h"
25
26/* The shift sequences for this charset (it does not use ESC). */
27#define SI 0x0F /* Shift In, host code to turn DBCS off. */
28#define SO 0x0E /* Shift Out, host code to turn DBCS on. */
29
30/* Definitions used in the body of the `gconv' function. */
31#define CHARSET_NAME "IBM937//"
32#define FROM_LOOP from_ibm937
33#define TO_LOOP to_ibm937
13e402e7 34#define ONE_DIRECTION 0
faaa6f62
UD
35#define FROM_LOOP_MIN_NEEDED_FROM 1
36#define FROM_LOOP_MAX_NEEDED_FROM 2
37#define FROM_LOOP_MIN_NEEDED_TO 4
38#define FROM_LOOP_MAX_NEEDED_TO 4
39#define TO_LOOP_MIN_NEEDED_FROM 4
40#define TO_LOOP_MAX_NEEDED_FROM 4
41#define TO_LOOP_MIN_NEEDED_TO 1
42#define TO_LOOP_MAX_NEEDED_TO 3
f1813b56
UD
43#define PREPARE_LOOP \
44 int save_curcs; \
45 int *curcsp = &data->__statep->__count;
46#define EXTRA_LOOP_ARGS , curcsp
dbd10df7
UD
47
48/* Definitions of initialization and destructor function. */
49#define DEFINE_INIT 1
50#define DEFINE_FINI 1
51
f1813b56
UD
52
53/* Since this is a stateful encoding we have to provide code which resets
54 the output state to the initial state. This has to be done during the
55 flushing. */
56#define EMIT_SHIFT_TO_INIT \
57 if ((data->__statep->__count & ~7) != sb) \
58 { \
59 if (FROM_DIRECTION) \
60 data->__statep->__count &= 7; \
61 else \
62 { \
f1813b56
UD
63 /* We are not in the initial state. To switch back we have \
64 to emit `SI'. */ \
a1ffb40e 65 if (__glibc_unlikely (outbuf >= outend)) \
f1813b56
UD
66 /* We don't have enough room in the output buffer. */ \
67 status = __GCONV_FULL_OUTPUT; \
68 else \
69 { \
70 /* Write out the shift sequence. */ \
71 *outbuf++ = SI; \
f1813b56
UD
72 data->__statep->__count &= 7; \
73 } \
74 } \
75 }
76
77
78/* Since we might have to reset input pointer we must be able to save
79 and retore the state. */
80#define SAVE_RESET_STATE(Save) \
81 if (Save) \
82 save_curcs = *curcsp; \
83 else \
84 *curcsp = save_curcs
85
dbd10df7
UD
86
87/* Current codeset type. */
88enum
89{
f1813b56
UD
90 sb = 0,
91 db = 64
dbd10df7
UD
92};
93
94/* First, define the conversion function from IBM-937 to UCS4. */
faaa6f62
UD
95#define MIN_NEEDED_INPUT FROM_LOOP_MIN_NEEDED_FROM
96#define MAX_NEEDED_INPUT FROM_LOOP_MAX_NEEDED_FROM
97#define MIN_NEEDED_OUTPUT FROM_LOOP_MIN_NEEDED_TO
98#define MAX_NEEDED_OUTPUT FROM_LOOP_MAX_NEEDED_TO
dbd10df7
UD
99#define LOOPFCT FROM_LOOP
100#define BODY \
101 { \
102 uint32_t ch = *inptr; \
29132b91 103 uint32_t res; \
dbd10df7
UD
104 \
105 if (__builtin_expect (ch, 0) == SO) \
106 { \
dbd10df7
UD
107 /* Shift OUT, change to DBCS converter. */ \
108 if (curcs == db) \
109 { \
110 result = __GCONV_ILLEGAL_INPUT; \
111 break; \
112 } \
113 curcs = db; \
114 ++inptr; \
f1813b56 115 continue; \
dbd10df7
UD
116 } \
117 else if (__builtin_expect (ch, 0) == SI) \
118 { \
dbd10df7
UD
119 /* Shift IN, change to SBCS converter. */ \
120 if (curcs == sb) \
121 { \
122 result = __GCONV_ILLEGAL_INPUT; \
123 break; \
124 } \
125 curcs = sb; \
126 ++inptr; \
f1813b56 127 continue; \
dbd10df7
UD
128 } \
129 \
f1813b56 130 if (curcs == sb) \
dbd10df7 131 { \
29132b91
UD
132 /* Use the IBM937 table for single byte. */ \
133 res = __ibm937sb_to_ucs4[ch]; \
134 if (__builtin_expect (res, L'\1') == L'\0' && ch != '\0') \
dbd10df7
UD
135 { \
136 /* This is an illegal character. */ \
e438a468 137 STANDARD_FROM_LOOP_ERR_HANDLER (1); \
dbd10df7
UD
138 } \
139 else \
140 { \
29132b91 141 put32 (outptr, res); \
dbd10df7 142 outptr += 4; \
dbd10df7 143 } \
f1813b56 144 ++inptr; \
dbd10df7 145 } \
f1813b56 146 else \
dbd10df7 147 { \
29132b91 148 const struct gap *rp2 = __ibm937db_to_ucs4_idx; \
f1813b56
UD
149 \
150 assert (curcs == db); \
151 \
29132b91 152 /* Use the IBM937 table for double byte. */ \
a1ffb40e 153 if (__glibc_unlikely (inptr + 1 >= inend)) \
29132b91
UD
154 { \
155 /* The second character is not available. \
156 Store the intermediate result. */ \
157 result = __GCONV_INCOMPLETE_INPUT; \
158 break; \
159 } \
160 \
161 ch = (ch * 0x100) + inptr[1]; \
162 while (ch > rp2->end) \
163 ++rp2; \
164 \
41488498 165 if (__builtin_expect (rp2->start == 0xffff, 0) \
29132b91
UD
166 || __builtin_expect (ch < rp2->start, 0) \
167 || (res = __ibm937db_to_ucs4[ch + rp2->idx], \
168 __builtin_expect (res, L'\1') == L'\0' && ch != '\0')) \
dbd10df7
UD
169 { \
170 /* This is an illegal character. */ \
e438a468 171 STANDARD_FROM_LOOP_ERR_HANDLER (2); \
dbd10df7
UD
172 } \
173 else \
174 { \
29132b91 175 put32 (outptr, res); \
dbd10df7 176 outptr += 4; \
dbd10df7 177 } \
f1813b56 178 inptr += 2; \
dbd10df7
UD
179 } \
180 }
181#define LOOP_NEED_FLAGS
f1813b56
UD
182#define EXTRA_LOOP_DECLS , int *curcsp
183#define INIT_PARAMS int curcs = *curcsp & ~7
184#define UPDATE_PARAMS *curcsp = curcs
dbd10df7
UD
185#include <iconv/loop.c>
186
187/* Next, define the other direction. */
faaa6f62
UD
188#define MIN_NEEDED_INPUT TO_LOOP_MIN_NEEDED_FROM
189#define MAX_NEEDED_INPUT TO_LOOP_MAX_NEEDED_FROM
190#define MIN_NEEDED_OUTPUT TO_LOOP_MIN_NEEDED_TO
191#define MAX_NEEDED_OUTPUT TO_LOOP_MAX_NEEDED_TO
dbd10df7
UD
192#define LOOPFCT TO_LOOP
193#define BODY \
194 { \
195 uint32_t ch = get32 (inptr); \
29132b91
UD
196 const struct gap *rp1 = __ucs4_to_ibm937sb_idx; \
197 const struct gap *rp2 = __ucs4_to_ibm937db_idx; \
dbd10df7
UD
198 const char *cp; \
199 \
a1ffb40e 200 if (__glibc_unlikely (ch >= 0xffff)) \
dbd10df7 201 { \
29132b91
UD
202 UNICODE_TAG_HANDLER (ch, 4); \
203 \
e438a468 204 STANDARD_TO_LOOP_ERR_HANDLER (4); \
29132b91 205 } \
601d2942 206 \
29132b91
UD
207 while (ch > rp1->end) \
208 ++rp1; \
209 \
210 /* Use the UCS4 table for single byte. */ \
211 if (__builtin_expect (ch < rp1->start, 0) \
212 || (cp = __ucs4_to_ibm937sb[ch + rp1->idx], \
213 __builtin_expect (cp[0], L'\1') == L'\0' && ch != '\0')) \
214 { \
215 /* Use the UCS4 table for double byte. */ \
216 while (ch > rp2->end) \
217 ++rp2; \
218 \
219 if (__builtin_expect (ch < rp2->start, 0) \
220 || (cp = __ucs4_to_ibm937db[ch + rp2->idx], \
221 __builtin_expect (cp[0], L'\1')==L'\0' && ch != '\0')) \
222 { \
dbd10df7 223 /* This is an illegal character. */ \
e438a468 224 STANDARD_TO_LOOP_ERR_HANDLER (4); \
dbd10df7
UD
225 } \
226 else \
227 { \
f1813b56 228 if (curcs == sb) \
dbd10df7 229 { \
a1ffb40e 230 if (__glibc_unlikely (outptr + 1 > outend)) \
29132b91
UD
231 { \
232 result = __GCONV_FULL_OUTPUT; \
233 break; \
234 } \
dbd10df7 235 *outptr++ = SO; \
dbd10df7
UD
236 curcs = db; \
237 } \
29132b91 238 \
a1ffb40e 239 if (__glibc_unlikely (outptr + 2 > outend)) \
531950ce
UD
240 { \
241 result = __GCONV_FULL_OUTPUT; \
242 break; \
243 } \
dbd10df7
UD
244 *outptr++ = cp[0]; \
245 *outptr++ = cp[1]; \
246 } \
247 } \
248 else \
249 { \
250 if (curcs == db) \
251 { \
a1ffb40e 252 if (__glibc_unlikely (outptr + 1 > outend)) \
dbd10df7
UD
253 { \
254 result = __GCONV_FULL_OUTPUT; \
255 break; \
256 } \
29132b91
UD
257 *outptr++ = SI; \
258 } \
259 \
a1ffb40e 260 if (__glibc_unlikely (outptr + 1 > outend)) \
29132b91
UD
261 { \
262 result = __GCONV_FULL_OUTPUT; \
263 break; \
dbd10df7 264 } \
dbd10df7 265 *outptr++ = cp[0]; \
29132b91 266 curcs = sb; \
dbd10df7
UD
267 } \
268 \
269 /* Now that we wrote the output increment the input pointer. */ \
270 inptr += 4; \
271 }
272#define LOOP_NEED_FLAGS
f1813b56
UD
273#define EXTRA_LOOP_DECLS , int *curcsp
274#define INIT_PARAMS int curcs = *curcsp & ~7
4b1b449d 275#define REINIT_PARAMS curcs = *curcsp & ~7
f1813b56 276#define UPDATE_PARAMS *curcsp = curcs
dbd10df7
UD
277#include <iconv/loop.c>
278
279/* Now define the toplevel functions. */
280#include <iconv/skeleton.c>