scsi: pvscsi: check command descriptor ring buffer size (CVE-2016-4952)
[qemu.git] / util / readline.c
1 /*
2 * QEMU readline utility
3 *
4 * Copyright (c) 2003-2004 Fabrice Bellard
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
12 *
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
23 */
24
25 #include "qemu/osdep.h"
26 #include "qemu-common.h"
27 #include "qemu/readline.h"
28 #include "qemu/cutils.h"
29
30 #define IS_NORM 0
31 #define IS_ESC 1
32 #define IS_CSI 2
33 #define IS_SS3 3
34
35 void readline_show_prompt(ReadLineState *rs)
36 {
37 rs->printf_func(rs->opaque, "%s", rs->prompt);
38 rs->flush_func(rs->opaque);
39 rs->last_cmd_buf_index = 0;
40 rs->last_cmd_buf_size = 0;
41 rs->esc_state = IS_NORM;
42 }
43
44 /* update the displayed command line */
45 static void readline_update(ReadLineState *rs)
46 {
47 int i, delta, len;
48
49 if (rs->cmd_buf_size != rs->last_cmd_buf_size ||
50 memcmp(rs->cmd_buf, rs->last_cmd_buf, rs->cmd_buf_size) != 0) {
51 for(i = 0; i < rs->last_cmd_buf_index; i++) {
52 rs->printf_func(rs->opaque, "\033[D");
53 }
54 rs->cmd_buf[rs->cmd_buf_size] = '\0';
55 if (rs->read_password) {
56 len = strlen(rs->cmd_buf);
57 for(i = 0; i < len; i++)
58 rs->printf_func(rs->opaque, "*");
59 } else {
60 rs->printf_func(rs->opaque, "%s", rs->cmd_buf);
61 }
62 rs->printf_func(rs->opaque, "\033[K");
63 memcpy(rs->last_cmd_buf, rs->cmd_buf, rs->cmd_buf_size);
64 rs->last_cmd_buf_size = rs->cmd_buf_size;
65 rs->last_cmd_buf_index = rs->cmd_buf_size;
66 }
67 if (rs->cmd_buf_index != rs->last_cmd_buf_index) {
68 delta = rs->cmd_buf_index - rs->last_cmd_buf_index;
69 if (delta > 0) {
70 for(i = 0;i < delta; i++) {
71 rs->printf_func(rs->opaque, "\033[C");
72 }
73 } else {
74 delta = -delta;
75 for(i = 0;i < delta; i++) {
76 rs->printf_func(rs->opaque, "\033[D");
77 }
78 }
79 rs->last_cmd_buf_index = rs->cmd_buf_index;
80 }
81 rs->flush_func(rs->opaque);
82 }
83
84 static void readline_insert_char(ReadLineState *rs, int ch)
85 {
86 if (rs->cmd_buf_index < READLINE_CMD_BUF_SIZE) {
87 memmove(rs->cmd_buf + rs->cmd_buf_index + 1,
88 rs->cmd_buf + rs->cmd_buf_index,
89 rs->cmd_buf_size - rs->cmd_buf_index);
90 rs->cmd_buf[rs->cmd_buf_index] = ch;
91 rs->cmd_buf_size++;
92 rs->cmd_buf_index++;
93 }
94 }
95
96 static void readline_backward_char(ReadLineState *rs)
97 {
98 if (rs->cmd_buf_index > 0) {
99 rs->cmd_buf_index--;
100 }
101 }
102
103 static void readline_forward_char(ReadLineState *rs)
104 {
105 if (rs->cmd_buf_index < rs->cmd_buf_size) {
106 rs->cmd_buf_index++;
107 }
108 }
109
110 static void readline_delete_char(ReadLineState *rs)
111 {
112 if (rs->cmd_buf_index < rs->cmd_buf_size) {
113 memmove(rs->cmd_buf + rs->cmd_buf_index,
114 rs->cmd_buf + rs->cmd_buf_index + 1,
115 rs->cmd_buf_size - rs->cmd_buf_index - 1);
116 rs->cmd_buf_size--;
117 }
118 }
119
120 static void readline_backspace(ReadLineState *rs)
121 {
122 if (rs->cmd_buf_index > 0) {
123 readline_backward_char(rs);
124 readline_delete_char(rs);
125 }
126 }
127
128 static void readline_backword(ReadLineState *rs)
129 {
130 int start;
131
132 if (rs->cmd_buf_index == 0 || rs->cmd_buf_index > rs->cmd_buf_size) {
133 return;
134 }
135
136 start = rs->cmd_buf_index - 1;
137
138 /* find first word (backwards) */
139 while (start > 0) {
140 if (!qemu_isspace(rs->cmd_buf[start])) {
141 break;
142 }
143
144 --start;
145 }
146
147 /* find first space (backwards) */
148 while (start > 0) {
149 if (qemu_isspace(rs->cmd_buf[start])) {
150 ++start;
151 break;
152 }
153
154 --start;
155 }
156
157 /* remove word */
158 if (start < rs->cmd_buf_index) {
159 memmove(rs->cmd_buf + start,
160 rs->cmd_buf + rs->cmd_buf_index,
161 rs->cmd_buf_size - rs->cmd_buf_index);
162 rs->cmd_buf_size -= rs->cmd_buf_index - start;
163 rs->cmd_buf_index = start;
164 }
165 }
166
167 static void readline_bol(ReadLineState *rs)
168 {
169 rs->cmd_buf_index = 0;
170 }
171
172 static void readline_eol(ReadLineState *rs)
173 {
174 rs->cmd_buf_index = rs->cmd_buf_size;
175 }
176
177 static void readline_up_char(ReadLineState *rs)
178 {
179 int idx;
180
181 if (rs->hist_entry == 0)
182 return;
183 if (rs->hist_entry == -1) {
184 /* Find latest entry */
185 for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
186 if (rs->history[idx] == NULL)
187 break;
188 }
189 rs->hist_entry = idx;
190 }
191 rs->hist_entry--;
192 if (rs->hist_entry >= 0) {
193 pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
194 rs->history[rs->hist_entry]);
195 rs->cmd_buf_index = rs->cmd_buf_size = strlen(rs->cmd_buf);
196 }
197 }
198
199 static void readline_down_char(ReadLineState *rs)
200 {
201 if (rs->hist_entry == -1)
202 return;
203 if (rs->hist_entry < READLINE_MAX_CMDS - 1 &&
204 rs->history[++rs->hist_entry] != NULL) {
205 pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
206 rs->history[rs->hist_entry]);
207 } else {
208 rs->cmd_buf[0] = 0;
209 rs->hist_entry = -1;
210 }
211 rs->cmd_buf_index = rs->cmd_buf_size = strlen(rs->cmd_buf);
212 }
213
214 static void readline_hist_add(ReadLineState *rs, const char *cmdline)
215 {
216 char *hist_entry, *new_entry;
217 int idx;
218
219 if (cmdline[0] == '\0')
220 return;
221 new_entry = NULL;
222 if (rs->hist_entry != -1) {
223 /* We were editing an existing history entry: replace it */
224 hist_entry = rs->history[rs->hist_entry];
225 idx = rs->hist_entry;
226 if (strcmp(hist_entry, cmdline) == 0) {
227 goto same_entry;
228 }
229 }
230 /* Search cmdline in history buffers */
231 for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
232 hist_entry = rs->history[idx];
233 if (hist_entry == NULL)
234 break;
235 if (strcmp(hist_entry, cmdline) == 0) {
236 same_entry:
237 new_entry = hist_entry;
238 /* Put this entry at the end of history */
239 memmove(&rs->history[idx], &rs->history[idx + 1],
240 (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
241 rs->history[READLINE_MAX_CMDS - 1] = NULL;
242 for (; idx < READLINE_MAX_CMDS; idx++) {
243 if (rs->history[idx] == NULL)
244 break;
245 }
246 break;
247 }
248 }
249 if (idx == READLINE_MAX_CMDS) {
250 /* Need to get one free slot */
251 g_free(rs->history[0]);
252 memmove(rs->history, &rs->history[1],
253 (READLINE_MAX_CMDS - 1) * sizeof(char *));
254 rs->history[READLINE_MAX_CMDS - 1] = NULL;
255 idx = READLINE_MAX_CMDS - 1;
256 }
257 if (new_entry == NULL)
258 new_entry = g_strdup(cmdline);
259 rs->history[idx] = new_entry;
260 rs->hist_entry = -1;
261 }
262
263 /* completion support */
264
265 void readline_add_completion(ReadLineState *rs, const char *str)
266 {
267 if (rs->nb_completions < READLINE_MAX_COMPLETIONS) {
268 int i;
269 for (i = 0; i < rs->nb_completions; i++) {
270 if (!strcmp(rs->completions[i], str)) {
271 return;
272 }
273 }
274 rs->completions[rs->nb_completions++] = g_strdup(str);
275 }
276 }
277
278 void readline_set_completion_index(ReadLineState *rs, int index)
279 {
280 rs->completion_index = index;
281 }
282
283 static int completion_comp(const void *a, const void *b)
284 {
285 return strcmp(*(const char **) a, *(const char **) b);
286 }
287
288 static void readline_completion(ReadLineState *rs)
289 {
290 int len, i, j, max_width, nb_cols, max_prefix;
291 char *cmdline;
292
293 rs->nb_completions = 0;
294
295 cmdline = g_strndup(rs->cmd_buf, rs->cmd_buf_index);
296 rs->completion_finder(rs->opaque, cmdline);
297 g_free(cmdline);
298
299 /* no completion found */
300 if (rs->nb_completions <= 0)
301 return;
302 if (rs->nb_completions == 1) {
303 len = strlen(rs->completions[0]);
304 for(i = rs->completion_index; i < len; i++) {
305 readline_insert_char(rs, rs->completions[0][i]);
306 }
307 /* extra space for next argument. XXX: make it more generic */
308 if (len > 0 && rs->completions[0][len - 1] != '/')
309 readline_insert_char(rs, ' ');
310 } else {
311 qsort(rs->completions, rs->nb_completions, sizeof(char *),
312 completion_comp);
313 rs->printf_func(rs->opaque, "\n");
314 max_width = 0;
315 max_prefix = 0;
316 for(i = 0; i < rs->nb_completions; i++) {
317 len = strlen(rs->completions[i]);
318 if (i==0) {
319 max_prefix = len;
320 } else {
321 if (len < max_prefix)
322 max_prefix = len;
323 for(j=0; j<max_prefix; j++) {
324 if (rs->completions[i][j] != rs->completions[0][j])
325 max_prefix = j;
326 }
327 }
328 if (len > max_width)
329 max_width = len;
330 }
331 if (max_prefix > 0)
332 for(i = rs->completion_index; i < max_prefix; i++) {
333 readline_insert_char(rs, rs->completions[0][i]);
334 }
335 max_width += 2;
336 if (max_width < 10)
337 max_width = 10;
338 else if (max_width > 80)
339 max_width = 80;
340 nb_cols = 80 / max_width;
341 j = 0;
342 for(i = 0; i < rs->nb_completions; i++) {
343 rs->printf_func(rs->opaque, "%-*s", max_width, rs->completions[i]);
344 if (++j == nb_cols || i == (rs->nb_completions - 1)) {
345 rs->printf_func(rs->opaque, "\n");
346 j = 0;
347 }
348 }
349 readline_show_prompt(rs);
350 }
351 for (i = 0; i < rs->nb_completions; i++) {
352 g_free(rs->completions[i]);
353 }
354 }
355
356 static void readline_clear_screen(ReadLineState *rs)
357 {
358 rs->printf_func(rs->opaque, "\033[2J\033[1;1H");
359 readline_show_prompt(rs);
360 }
361
362 /* return true if command handled */
363 void readline_handle_byte(ReadLineState *rs, int ch)
364 {
365 switch(rs->esc_state) {
366 case IS_NORM:
367 switch(ch) {
368 case 1:
369 readline_bol(rs);
370 break;
371 case 4:
372 readline_delete_char(rs);
373 break;
374 case 5:
375 readline_eol(rs);
376 break;
377 case 9:
378 readline_completion(rs);
379 break;
380 case 12:
381 readline_clear_screen(rs);
382 break;
383 case 10:
384 case 13:
385 rs->cmd_buf[rs->cmd_buf_size] = '\0';
386 if (!rs->read_password)
387 readline_hist_add(rs, rs->cmd_buf);
388 rs->printf_func(rs->opaque, "\n");
389 rs->cmd_buf_index = 0;
390 rs->cmd_buf_size = 0;
391 rs->last_cmd_buf_index = 0;
392 rs->last_cmd_buf_size = 0;
393 rs->readline_func(rs->opaque, rs->cmd_buf, rs->readline_opaque);
394 break;
395 case 23:
396 /* ^W */
397 readline_backword(rs);
398 break;
399 case 27:
400 rs->esc_state = IS_ESC;
401 break;
402 case 127:
403 case 8:
404 readline_backspace(rs);
405 break;
406 case 155:
407 rs->esc_state = IS_CSI;
408 break;
409 default:
410 if (ch >= 32) {
411 readline_insert_char(rs, ch);
412 }
413 break;
414 }
415 break;
416 case IS_ESC:
417 if (ch == '[') {
418 rs->esc_state = IS_CSI;
419 rs->esc_param = 0;
420 } else if (ch == 'O') {
421 rs->esc_state = IS_SS3;
422 rs->esc_param = 0;
423 } else {
424 rs->esc_state = IS_NORM;
425 }
426 break;
427 case IS_CSI:
428 switch(ch) {
429 case 'A':
430 case 'F':
431 readline_up_char(rs);
432 break;
433 case 'B':
434 case 'E':
435 readline_down_char(rs);
436 break;
437 case 'D':
438 readline_backward_char(rs);
439 break;
440 case 'C':
441 readline_forward_char(rs);
442 break;
443 case '0' ... '9':
444 rs->esc_param = rs->esc_param * 10 + (ch - '0');
445 goto the_end;
446 case '~':
447 switch(rs->esc_param) {
448 case 1:
449 readline_bol(rs);
450 break;
451 case 3:
452 readline_delete_char(rs);
453 break;
454 case 4:
455 readline_eol(rs);
456 break;
457 }
458 break;
459 default:
460 break;
461 }
462 rs->esc_state = IS_NORM;
463 the_end:
464 break;
465 case IS_SS3:
466 switch(ch) {
467 case 'F':
468 readline_eol(rs);
469 break;
470 case 'H':
471 readline_bol(rs);
472 break;
473 }
474 rs->esc_state = IS_NORM;
475 break;
476 }
477 readline_update(rs);
478 }
479
480 void readline_start(ReadLineState *rs, const char *prompt, int read_password,
481 ReadLineFunc *readline_func, void *opaque)
482 {
483 pstrcpy(rs->prompt, sizeof(rs->prompt), prompt);
484 rs->readline_func = readline_func;
485 rs->readline_opaque = opaque;
486 rs->read_password = read_password;
487 readline_restart(rs);
488 }
489
490 void readline_restart(ReadLineState *rs)
491 {
492 rs->cmd_buf_index = 0;
493 rs->cmd_buf_size = 0;
494 }
495
496 const char *readline_get_history(ReadLineState *rs, unsigned int index)
497 {
498 if (index >= READLINE_MAX_CMDS)
499 return NULL;
500 return rs->history[index];
501 }
502
503 ReadLineState *readline_init(ReadLinePrintfFunc *printf_func,
504 ReadLineFlushFunc *flush_func,
505 void *opaque,
506 ReadLineCompletionFunc *completion_finder)
507 {
508 ReadLineState *rs = g_malloc0(sizeof(*rs));
509
510 rs->hist_entry = -1;
511 rs->opaque = opaque;
512 rs->printf_func = printf_func;
513 rs->flush_func = flush_func;
514 rs->completion_finder = completion_finder;
515
516 return rs;
517 }