patch 9.1.0006: is*() and to*() function may be unsafe
Problem: is*() and to*() function may be unsafe
Solution: Add SAFE_* macros and start using those instead
(Keith Thompson)
Use SAFE_() macros for is*() and to*() functions
The standard is*() and to*() functions declared in <ctype.h> have
undefined behavior for negative arguments other than EOF. If plain char
is signed, passing an unchecked value from argv for from user input
to one of these functions has undefined behavior.
Solution: Add SAFE_*() macros that cast the argument to unsigned char.
Most implementations behave sanely for negative arguments, and most
character values in practice are non-negative, but it's still best
to avoid undefined behavior.
The change from #13347 has been omitted, as this has already been
separately fixed in commit ac709e2fc0db6d31abb7da96f743c40956b60c3a
(v9.0.2054)
fixes: #13332
closes: #13347
Signed-off-by: Keith Thompson <Keith.S.Thompson@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/macros.h b/src/macros.h
index cc2d11f..190778e 100644
--- a/src/macros.h
+++ b/src/macros.h
@@ -50,6 +50,28 @@
*/
#define BUFEMPTY() (curbuf->b_ml.ml_line_count == 1 && *ml_get((linenr_T)1) == NUL)
+// The is*() and to*() functions declared in <ctype.h> have
+// undefined behavior for values other than EOF outside the range of
+// unsigned char. If plain char is signed, a call with a negative
+// value has undefined behavior. These macros cast the argument to
+// unsigned char. (Most implementations behave more or less sanely
+// with negative values, and most character values in practice are
+// positive, but we want to avoid undefined behavior anyway.)
+#define SAFE_isalnum(c) (isalnum ((unsigned char)(c)))
+#define SAFE_isalpha(c) (isalpha ((unsigned char)(c)))
+#define SAFE_isblank(c) (isblank ((unsigned char)(c)))
+#define SAFE_iscntrl(c) (iscntrl ((unsigned char)(c)))
+#define SAFE_isdigit(c) (isdigit ((unsigned char)(c)))
+#define SAFE_isgraph(c) (isgraph ((unsigned char)(c)))
+#define SAFE_islower(c) (islower ((unsigned char)(c)))
+#define SAFE_isprint(c) (isprint ((unsigned char)(c)))
+#define SAFE_ispunct(c) (ispunct ((unsigned char)(c)))
+#define SAFE_isspace(c) (isspace ((unsigned char)(c)))
+#define SAFE_isupper(c) (isupper ((unsigned char)(c)))
+#define SAFE_isxdigit(c) (isxdigit((unsigned char)(c)))
+#define SAFE_tolower(c) (tolower ((unsigned char)(c)))
+#define SAFE_toupper(c) (toupper ((unsigned char)(c)))
+
/*
* toupper() and tolower() that use the current locale.
* On some systems toupper()/tolower() only work on lower/uppercase
@@ -64,11 +86,11 @@
# define TOLOWER_LOC(c) tolower_tab[(c) & 255]
#else
# ifdef BROKEN_TOUPPER
-# define TOUPPER_LOC(c) (islower(c) ? toupper(c) : (c))
-# define TOLOWER_LOC(c) (isupper(c) ? tolower(c) : (c))
+# define TOUPPER_LOC(c) (SAFE_islower(c) ? SAFE_toupper(c) : (c))
+# define TOLOWER_LOC(c) (SAFE_isupper(c) ? SAFE_tolower(c) : (c))
# else
-# define TOUPPER_LOC toupper
-# define TOLOWER_LOC tolower
+# define TOUPPER_LOC SAFE_toupper
+# define TOLOWER_LOC SAFE_tolower
# endif
#endif