[musl] [PATCH] mntent: deal with escaped whitespace in mtab and fstab

[Matthias Goergens <matthias.goergens@gmail.com>]

From glibc's documentation:

> Since fields in the mtab and fstab files are separated by whitespace,
> octal  escapes  are  used  to  represent  the characters space (\040),
> tab (\011), newline (\012), and backslash (\\) in those files when they
> occur  in  one  of  the  four strings  in  a  mntent  structure.  The
> routines addmntent() and getmntent() will convert from string
> representation to escaped representation and back.  When converting
> from  escaped  representation,  the sequence \134 is also converted to a
> backslash.

This fixes the issue reported in https://www.openwall.com/lists/musl/2021/12/14/1

Please pardon the previous broken patch that I tried to send directly
via gmail.

This is my first time contributing to musl.  Please point out any ways
to improve.  I probably got a few things wrong?

Thanks!
---
 src/misc/mntent.c | 71 ++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 64 insertions(+), 7 deletions(-)

diff --git a/src/misc/mntent.c b/src/misc/mntent.c
index d404fbe3..527acc01 100644
--- a/src/misc/mntent.c
+++ b/src/misc/mntent.c
@@ -20,6 +20,34 @@ int endmntent(FILE *f)
 	return 1;
 }
 
+static inline int decode1(char** in_buf, char** out_buf,  const char* from, const char to) {
+	if(strncmp(from, *in_buf, strlen(from)) == 0) {
+		*(*out_buf)++ = to;
+		*in_buf += strlen(from);
+		return 1;
+	}
+	return 0;
+}
+
+static inline char* decode(char* buf) {
+	char* read_cursor = buf;
+	char* write_cursor = buf;
+	while(read_cursor && *read_cursor) {
+			// space
+			decode1(&read_cursor, &write_cursor, "\\040", '\040')
+			// tab
+			|| decode1(&read_cursor, &write_cursor, "\\011", '\011')
+			// newline
+			|| decode1(&read_cursor, &write_cursor, "\\012", '\012')
+			// backslash
+			|| decode1(&read_cursor, &write_cursor, "\\134", '\134')
+			|| decode1(&read_cursor, &write_cursor, "\\\\", '\\')
+			// default: copy char as is.
+			|| (*write_cursor++ = *read_cursor++);
+	}
+	return buf;
+}
+
 struct mntent *getmntent_r(FILE *f, struct mntent *mnt, char *linebuf, int buflen)
 {
 	int n[8], use_internal = (linebuf == SENTINEL);
@@ -55,10 +83,10 @@ struct mntent *getmntent_r(FILE *f, struct mntent *mnt, char *linebuf, int bufle
 	linebuf[n[5]] = 0;
 	linebuf[n[7]] = 0;
 
-	mnt->mnt_fsname = linebuf+n[0];
-	mnt->mnt_dir = linebuf+n[2];
-	mnt->mnt_type = linebuf+n[4];
-	mnt->mnt_opts = linebuf+n[6];
+	mnt->mnt_fsname = decode(linebuf+n[0]);
+	mnt->mnt_dir = decode(linebuf+n[2]);
+	mnt->mnt_type = decode(linebuf+n[4]);
+	mnt->mnt_opts = decode(linebuf+n[6]);
 
 	return mnt;
 }
@@ -69,12 +97,41 @@ struct mntent *getmntent(FILE *f)
 	return getmntent_r(f, &mnt, SENTINEL, 0);
 }
 
+static inline int write_string(FILE *f, const char* str)
+{
+	char c;
+	int error_occured = 0;
+	while(str && !error_occured && (c = *str++) != 0) {
+		if(c == '\040') // space
+			error_occured = fprintf(f, "%s", "\\040") < 0;
+		else if (c == '\011') // tab
+			error_occured = fprintf(f, "%s", "\\011") < 0;
+		else if (c == '\012') // newline
+			error_occured = fprintf(f, "%s", "\\012") < 0;
+		else if (c == '\\')
+			error_occured = fprintf(f, "%s", "\\\\") < 0;
+		else
+			error_occured = fprintf(f, "%c", c) < 0;
+	}
+	return error_occured;
+}
+
 int addmntent(FILE *f, const struct mntent *mnt)
 {
 	if (fseek(f, 0, SEEK_END)) return 1;
-	return fprintf(f, "%s\t%s\t%s\t%s\t%d\t%d\n",
-		mnt->mnt_fsname, mnt->mnt_dir, mnt->mnt_type, mnt->mnt_opts,
-		mnt->mnt_freq, mnt->mnt_passno) < 0;
+	flockfile(f);
+	int result =
+		write_string(f, mnt->mnt_fsname)
+		|| (fprintf(f, "\t") < 0)
+		|| write_string(f, mnt->mnt_dir)
+		|| (fprintf(f, "\t") < 0)
+		|| write_string(f, mnt->mnt_type)
+		|| (fprintf(f, "\t") < 0)
+		|| write_string(f, mnt->mnt_opts)
+		|| (fprintf(f, "\t%d\t%d\n",
+			mnt->mnt_freq, mnt->mnt_passno) < 0);
+	funlockfile(f);
+	return result;
 }
 
 char *hasmntopt(const struct mntent *mnt, const char *opt)
-- 
2.40.0