Roll libxml to bdec2183f34b37ee89ae1d330c6ad2bb4d76605f

third_party/libxml/src/xmlstring.c

 /*
  * string.c : an XML string utilities module
  *
  * This module provides various utility functions for manipulating
  * the xmlChar* type. All functions named xmlStr* have been moved here
  * from the parser.c file (their original home).
  *
  * See Copyright for the status of this software.
  *
  * UTF8 string routines from:
@@ skipping 439 matching lines @@
     xmlChar *ret;
 
     if ((add == NULL) || (len == 0))
         return(cur);
     if (len < 0)
         return(NULL);
     if (cur == NULL)
         return(xmlStrndup(add, len));
 
     size = xmlStrlen(cur);
+    if (size < 0)
+        return(NULL);
     ret = (xmlChar *) xmlRealloc(cur, (size + len + 1) * sizeof(xmlChar));
     if (ret == NULL) {
         xmlErrMemory(NULL, NULL);
         return(cur);
     }
     memcpy(&ret[size], add, len * sizeof(xmlChar));
     ret[size + len] = 0;
     return(ret);
 }
 
 /**
  * xmlStrncatNew:
  * @str1:  first xmlChar string
  * @str2:  second xmlChar string
  * @len:  the len of @str2 or < 0
  *
  * same as xmlStrncat, but creates a new string.  The original
  * two strings are not freed. If @len is < 0 then the length
  * will be calculated automatically.
  *
  * Returns a new xmlChar * or NULL
  */
 xmlChar *
 xmlStrncatNew(const xmlChar *str1, const xmlChar *str2, int len) {
     int size;
     xmlChar *ret;
 
-    if (len < 0)
+    if (len < 0) {
         len = xmlStrlen(str2);
+        if (len < 0)
+            return(NULL);
+    }
     if ((str2 == NULL) || (len == 0))
         return(xmlStrdup(str1));
     if (str1 == NULL)
         return(xmlStrndup(str2, len));
 
     size = xmlStrlen(str1);
+    if (size < 0)
+        return(NULL);
     ret = (xmlChar *) xmlMalloc((size + len + 1) * sizeof(xmlChar));
     if (ret == NULL) {
         xmlErrMemory(NULL, NULL);
         return(xmlStrndup(str1, size));
     }
     memcpy(ret, str1, size * sizeof(xmlChar));
     memcpy(&ret[size], str2, len * sizeof(xmlChar));
     ret[size + len] = 0;
     return(ret);
 }
@@ skipping 26 matching lines @@
  * @buf:   the result buffer.
  * @len:   the result buffer length.
  * @msg:   the message with printf formatting.
  * @...:   extra parameters for the message.
  *
  * Formats @msg and places result into @buf.
  *
  * Returns the number of characters written to @buf or -1 if an error occurs.
  */
 int XMLCDECL
-xmlStrPrintf(xmlChar *buf, int len, const xmlChar *msg, ...) {
+xmlStrPrintf(xmlChar *buf, int len, const char *msg, ...) {
     va_list args;
     int ret;
 
     if((buf == NULL) || (msg == NULL)) {
         return(-1);
     }
 
     va_start(args, msg);
     ret = vsnprintf((char *) buf, len, (const char *) msg, args);
     va_end(args);
     buf[len - 1] = 0; /* be safe ! */
 
     return(ret);
 }
 
 /**
  * xmlStrVPrintf:
  * @buf:   the result buffer.
  * @len:   the result buffer length.
  * @msg:   the message with printf formatting.
  * @ap:    extra parameters for the message.
  *
  * Formats @msg and places result into @buf.
  *
  * Returns the number of characters written to @buf or -1 if an error occurs.
  */
 int
-xmlStrVPrintf(xmlChar *buf, int len, const xmlChar *msg, va_list ap) {
+xmlStrVPrintf(xmlChar *buf, int len, const char *msg, va_list ap) {
     int ret;
 
     if((buf == NULL) || (msg == NULL)) {
         return(-1);
     }
 
     ret = vsnprintf((char *) buf, len, (const char *) msg, ap);
     buf[len - 1] = 0; /* be safe ! */
 
     return(ret);
@@ skipping 397 matching lines @@
             /* then skip over remaining bytes for this char */
             while ( (ch <<= 1) & 0x80 )
                 if ( (*utf++ & 0xc0) != 0x80 )
                     return(NULL);
         }
     }
 
     return(xmlUTF8Strndup(utf, len));
 }
 
+/**
+ * xmlEscapeFormatString:
+ * @msg:  a pointer to the string in which to escape '%' characters.
+ * Must be a heap-allocated buffer created by libxml2 that may be
+ * returned, or that may be freed and replaced.
+ *
+ * Replaces the string pointed to by 'msg' with an escaped string.
+ * Returns the same string with all '%' characters escaped.
+ */
+xmlChar *
+xmlEscapeFormatString(xmlChar **msg)
+{
+    xmlChar *msgPtr = NULL;
+    xmlChar *result = NULL;
+    xmlChar *resultPtr = NULL;
+    size_t count = 0;
+    size_t msgLen = 0;
+    size_t resultLen = 0;
+
+    if (!msg || !*msg)
+        return(NULL);
+
+    for (msgPtr = *msg; *msgPtr != '\0'; ++msgPtr) {
+        ++msgLen;
+        if (*msgPtr == '%')
+            ++count;
+    }
+
+    if (count == 0)
+        return(*msg);
+
+    resultLen = msgLen + count + 1;
+    result = (xmlChar *) xmlMallocAtomic(resultLen * sizeof(xmlChar));
+    if (result == NULL) {
+        /* Clear *msg to prevent format string vulnerabilities in
+           out-of-memory situations. */
+        xmlFree(*msg);
+        *msg = NULL;
+        xmlErrMemory(NULL, NULL);
+        return(NULL);
+    }
+
+    for (msgPtr = *msg, resultPtr = result; *msgPtr != '\0'; ++msgPtr, ++resultPtr) {
+        *resultPtr = *msgPtr;
+        if (*msgPtr == '%')
+            *(++resultPtr) = '%';
+    }
+    result[resultLen - 1] = '\0';
+
+    xmlFree(*msg);
+    *msg = result;
+
+    return *msg;
+}
+
 #define bottom_xmlstring
 #include "elfgcchack.h"