lib-charset: Added CHARSET_MAX_PENDING_BUF_SIZE macro and asserts for it.

diff --git a/src/lib-charset/charset-iconv.c b/src/lib-charset/charset-iconv.c
index 8564aa166a6f2cd6d383f5d4f011388c4dc37b48..b93f3654c6e108f725f4f683e591eaa731c04214 100644 (file)
--- a/src/lib-charset/charset-iconv.c
+++ b/src/lib-charset/charset-iconv.c
@@ -129,6 +129,7 @@ charset_to_utf8(struct charset_translation *t,
        if (prev_invalid_pos != (size_t)-1)
                result = CHARSET_RET_INVALID_INPUT;
 
+       i_assert(*src_size - pos <= CHARSET_MAX_PENDING_BUF_SIZE);
        *src_size = pos;
        return result;
 }

diff --git a/src/lib-charset/charset-utf8.c b/src/lib-charset/charset-utf8.c
index 11b7262173664db270d9f32a5155ad54a0b7bbe2..522de58be8e705cd7892cacdff565726a43b707b 100644 (file)
--- a/src/lib-charset/charset-utf8.c
+++ b/src/lib-charset/charset-utf8.c
@@ -94,6 +94,7 @@ charset_utf8_to_utf8(normalizer_func_t *normalizer,
 
        uni_utf8_partial_strlen_n(src, *src_size, &pos);
        if (pos < *src_size) {
+               i_assert(*src_size - pos <= CHARSET_MAX_PENDING_BUF_SIZE);
                *src_size = pos;
                res = CHARSET_RET_INCOMPLETE_INPUT;
        }

diff --git a/src/lib-charset/charset-utf8.h b/src/lib-charset/charset-utf8.h
index 249ef72f7c22944799f35d43d8ed21fe720044ab..c17ab3053f1a70d0ab6259a5d65eed654ccd2973 100644 (file)
--- a/src/lib-charset/charset-utf8.h
+++ b/src/lib-charset/charset-utf8.h
@@ -3,6 +3,11 @@
 
 #include "unichar.h"
 
+/* Max number of bytes that iconv can require for a single character.
+   UTF-8 takes max 6 bytes per character. Not sure about others, but I'd think
+   10 is more than enough for everyone.. */
+#define CHARSET_MAX_PENDING_BUF_SIZE 10
+
 struct charset_translation;
 
 enum charset_result {
@@ -25,7 +30,12 @@ void charset_to_utf8_reset(struct charset_translation *t);
 bool charset_is_utf8(const char *charset) ATTR_PURE;
 
 /* Translate src to UTF-8. src_size is updated to contain the number of
-   characters actually translated from src. */
+   characters actually translated from src. The src_size should never shrink
+   more than CHARSET_MAX_PENDING_BUF_SIZE bytes.
+
+   If src contains invalid input, UNICODE_REPLACEMENT_CHAR is placed in such
+   positions and the invalid input is skipped over. Return value is also
+   CHARSET_RET_INCOMPLETE_INPUT in that case. */
 enum charset_result
 charset_to_utf8(struct charset_translation *t,
                const unsigned char *src, size_t *src_size, buffer_t *dest);