Re: [PATCH] \N'nnn' protection.

[Ingo Schwarze <schwarze@usta.de>]

Hi Kristaps,

Kristaps Dzonsons wrote on Sun, May 01, 2011 at 12:37:27AM +0200:

> Enclosed is a patch to limit possible \N'nnn' escapes.  \N
> transforms the number 'nnn' into its character representation and is
> marked as "for backwards compatibility" in mandoc_char(7).
> 
> I can only find manuals using this for the double-quote \N'34', so
> this seems safe, but maybe one of you knows of crazy \N usage that
> would inspire me to re-think.

None known, and little wonder, as it would be a bad idea because it's
inherently non-portable even among systems supporting \N.

> However, throwing, e.g., the \b
> character in there will cause at least -Tps and -Tpdf to puke.
> 
> Thoughts?

Maybe isprint(3)?

Yours,
  Ingo

> Index: chars.c
> ===================================================================
> RCS file: /usr/vhosts/mdocml.bsd.lv/cvs/mdocml/chars.c,v
> retrieving revision 1.39
> diff -u -r1.39 chars.c
> --- chars.c	30 Apr 2011 22:24:31 -0000	1.39
> +++ chars.c	30 Apr 2011 22:31:11 -0000
> @@ -20,6 +20,7 @@
>  #endif
>  
>  #include <assert.h>
> +#include <ctype.h>
>  #include <stdio.h>
>  #include <stdlib.h>
>  #include <string.h>
> @@ -148,12 +149,10 @@
>  		return('\0');
>  
>  	i = atoi(p);
> -	/* 
> -	 * FIXME:
> -	 * This is wrong.  Anything could be written here!
> -	 * This should be carefully screened for possible characters.
> -	 */
> -	return(i <= 0 || i > 255 ? '\0' : (char)i);
> +	if (isalnum(i) || ispunct(i) || ' ' == (char)i)
> +		return(i);
> +
> +	return('\0');
>  }
>  
>  

--
 To unsubscribe send an email to tech+unsubscribe@mdocml.bsd.lv