OLD | NEW |
| (Empty) |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef BASE_STRINGS_SAFE_SPRINTF_H_ | |
6 #define BASE_STRINGS_SAFE_SPRINTF_H_ | |
7 | |
8 #include <stddef.h> | |
9 #include <stdint.h> | |
10 #include <stdlib.h> | |
11 | |
12 #if defined(__unix__) | |
13 // For ssize_t | |
14 #include <unistd.h> | |
15 #endif | |
16 | |
17 #include "base/base_export.h" | |
18 #include "base/basictypes.h" | |
19 | |
20 namespace base { | |
21 namespace strings { | |
22 | |
23 #if defined(_MSC_VER) | |
24 // Define ssize_t inside of our namespace. | |
25 #if defined(_WIN64) | |
26 typedef __int64 ssize_t; | |
27 #else | |
28 typedef long ssize_t; | |
29 #endif | |
30 #endif | |
31 | |
32 // SafeSPrintf() is a type-safe and completely self-contained version of | |
33 // snprintf(). | |
34 // | |
35 // SafeSNPrintf() is an alternative function signature that can be used when | |
36 // not dealing with fixed-sized buffers. When possible, SafeSPrintf() should | |
37 // always be used instead of SafeSNPrintf() | |
38 // | |
39 // These functions allow for formatting complicated messages from contexts that | |
40 // require strict async-signal-safety. In fact, it is safe to call them from | |
41 // any low-level execution context, as they are guaranteed to make no library | |
42 // or system calls. It deliberately never touches "errno", either. | |
43 // | |
44 // The only exception to this rule is that in debug builds the code calls | |
45 // RAW_CHECK() to help diagnose problems when the format string does not | |
46 // match the rest of the arguments. In release builds, no CHECK()s are used, | |
47 // and SafeSPrintf() instead returns an output string that expands only | |
48 // those arguments that match their format characters. Mismatched arguments | |
49 // are ignored. | |
50 // | |
51 // The code currently only supports a subset of format characters: | |
52 // %c, %o, %d, %x, %X, %p, and %s. | |
53 // | |
54 // SafeSPrintf() aims to be as liberal as reasonably possible. Integer-like | |
55 // values of arbitrary width can be passed to all of the format characters | |
56 // that expect integers. Thus, it is explicitly legal to pass an "int" to | |
57 // "%c", and output will automatically look at the LSB only. It is also | |
58 // explicitly legal to pass either signed or unsigned values, and the format | |
59 // characters will automatically interpret the arguments accordingly. | |
60 // | |
61 // It is still not legal to mix-and-match integer-like values with pointer | |
62 // values. For instance, you cannot pass a pointer to %x, nor can you pass an | |
63 // integer to %p. | |
64 // | |
65 // The one exception is "0" zero being accepted by "%p". This works-around | |
66 // the problem of C++ defining NULL as an integer-like value. | |
67 // | |
68 // All format characters take an optional width parameter. This must be a | |
69 // positive integer. For %d, %o, %x, %X and %p, if the width starts with | |
70 // a leading '0', padding is done with '0' instead of ' ' characters. | |
71 // | |
72 // There are a few features of snprintf()-style format strings, that | |
73 // SafeSPrintf() does not support at this time. | |
74 // | |
75 // If an actual user showed up, there is no particularly strong reason they | |
76 // couldn't be added. But that assumes that the trade-offs between complexity | |
77 // and utility are favorable. | |
78 // | |
79 // For example, adding support for negative padding widths, and for %n are all | |
80 // likely to be viewed positively. They are all clearly useful, low-risk, easy | |
81 // to test, don't jeopardize the async-signal-safety of the code, and overall | |
82 // have little impact on other parts of SafeSPrintf() function. | |
83 // | |
84 // On the other hands, adding support for alternate forms, positional | |
85 // arguments, grouping, wide characters, localization or floating point numbers | |
86 // are all unlikely to ever be added. | |
87 // | |
88 // SafeSPrintf() and SafeSNPrintf() mimic the behavior of snprintf() and they | |
89 // return the number of bytes needed to store the untruncated output. This | |
90 // does *not* include the terminating NUL byte. | |
91 // | |
92 // They return -1, iff a fatal error happened. This typically can only happen, | |
93 // if the buffer size is a) negative, or b) zero (i.e. not even the NUL byte | |
94 // can be written). The return value can never be larger than SSIZE_MAX-1. | |
95 // This ensures that the caller can always add one to the signed return code | |
96 // in order to determine the amount of storage that needs to be allocated. | |
97 // | |
98 // While the code supports type checking and while it is generally very careful | |
99 // to avoid printing incorrect values, it tends to be conservative in printing | |
100 // as much as possible, even when given incorrect parameters. Typically, in | |
101 // case of an error, the format string will not be expanded. (i.e. something | |
102 // like SafeSPrintf(buf, "%p %d", 1, 2) results in "%p 2"). See above for | |
103 // the use of RAW_CHECK() in debug builds, though. | |
104 // | |
105 // The pre-C++11 version cannot handle more than ten arguments. | |
106 // | |
107 // Basic example: | |
108 // char buf[20]; | |
109 // base::strings::SafeSPrintf(buf, "The answer: %2d", 42); | |
110 // | |
111 // Example with dynamically sized buffer (async-signal-safe). This code won't | |
112 // work on Visual studio, as it requires dynamically allocating arrays on the | |
113 // stack. Consider picking a smaller value for |kMaxSize| if stack size is | |
114 // limited and known. On the other hand, if the parameters to SafeSNPrintf() | |
115 // are trusted and not controllable by the user, you can consider eliminating | |
116 // the check for |kMaxSize| altogether. The current value of SSIZE_MAX is | |
117 // essentially a no-op that just illustrates how to implement an upper bound: | |
118 // const size_t kInitialSize = 128; | |
119 // const size_t kMaxSize = std::numeric_limits<ssize_t>::max(); | |
120 // size_t size = kInitialSize; | |
121 // for (;;) { | |
122 // char buf[size]; | |
123 // size = SafeSNPrintf(buf, size, "Error message \"%s\"\n", err) + 1; | |
124 // if (sizeof(buf) < kMaxSize && size > kMaxSize) { | |
125 // size = kMaxSize; | |
126 // continue; | |
127 // } else if (size > sizeof(buf)) | |
128 // continue; | |
129 // write(2, buf, size-1); | |
130 // break; | |
131 // } | |
132 | |
133 namespace internal { | |
134 // Helpers that use C++ overloading, templates, and specializations to deduce | |
135 // and record type information from function arguments. This allows us to | |
136 // later write a type-safe version of snprintf(). | |
137 | |
138 struct Arg { | |
139 enum Type { INT, UINT, STRING, POINTER }; | |
140 | |
141 // Any integer-like value. | |
142 Arg(signed char c) : i(c), width(sizeof(char)), type(INT) { } | |
143 Arg(unsigned char c) : i(c), width(sizeof(char)), type(UINT) { } | |
144 Arg(signed short j) : i(j), width(sizeof(short)), type(INT) { } | |
145 Arg(unsigned short j) : i(j), width(sizeof(short)), type(UINT) { } | |
146 Arg(signed int j) : i(j), width(sizeof(int)), type(INT) { } | |
147 Arg(unsigned int j) : i(j), width(sizeof(int)), type(UINT) { } | |
148 Arg(signed long j) : i(j), width(sizeof(long)), type(INT) { } | |
149 Arg(unsigned long j) : i(j), width(sizeof(long)), type(UINT) { } | |
150 Arg(signed long long j) : i(j), width(sizeof(long long)), type(INT) { } | |
151 Arg(unsigned long long j) : i(j), width(sizeof(long long)), type(UINT) { } | |
152 | |
153 // A C-style text string. | |
154 Arg(const char* s) : str(s), type(STRING) { } | |
155 Arg(char* s) : str(s), type(STRING) { } | |
156 | |
157 // Any pointer value that can be cast to a "void*". | |
158 template<class T> Arg(T* p) : ptr((void*)p), type(POINTER) { } | |
159 | |
160 union { | |
161 // An integer-like value. | |
162 struct { | |
163 int64_t i; | |
164 unsigned char width; | |
165 }; | |
166 | |
167 // A C-style text string. | |
168 const char* str; | |
169 | |
170 // A pointer to an arbitrary object. | |
171 const void* ptr; | |
172 }; | |
173 const enum Type type; | |
174 }; | |
175 | |
176 // This is the internal function that performs the actual formatting of | |
177 // an snprintf()-style format string. | |
178 BASE_EXPORT ssize_t SafeSNPrintf(char* buf, size_t sz, const char* fmt, | |
179 const Arg* args, size_t max_args); | |
180 | |
181 #if !defined(NDEBUG) | |
182 // In debug builds, allow unit tests to artificially lower the kSSizeMax | |
183 // constant that is used as a hard upper-bound for all buffers. In normal | |
184 // use, this constant should always be std::numeric_limits<ssize_t>::max(). | |
185 BASE_EXPORT void SetSafeSPrintfSSizeMaxForTest(size_t max); | |
186 BASE_EXPORT size_t GetSafeSPrintfSSizeMaxForTest(); | |
187 #endif | |
188 | |
189 } // namespace internal | |
190 | |
191 #if __cplusplus >= 201103 // C++11 | |
192 | |
193 template<typename... Args> | |
194 ssize_t SafeSNPrintf(char* buf, size_t N, const char* fmt, Args... args) { | |
195 // Use Arg() object to record type information and then copy arguments to an | |
196 // array to make it easier to iterate over them. | |
197 const internal::Arg arg_array[] = { args... }; | |
198 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
199 } | |
200 | |
201 template<size_t N, typename... Args> | |
202 ssize_t SafeSPrintf(char (&buf)[N], const char* fmt, Args... args) { | |
203 // Use Arg() object to record type information and then copy arguments to an | |
204 // array to make it easier to iterate over them. | |
205 const internal::Arg arg_array[] = { args... }; | |
206 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
207 } | |
208 | |
209 #else // Pre-C++11 | |
210 | |
211 // TODO(markus): C++11 has a much more concise and readable solution for | |
212 // expressing what we are doing here. Delete the fall-back code for older | |
213 // compilers as soon as we have fully switched to C++11. | |
214 | |
215 template<class T0, class T1, class T2, class T3, class T4, | |
216 class T5, class T6, class T7, class T8, class T9> | |
217 ssize_t SafeSNPrintf(char* buf, size_t N, const char* fmt, | |
218 T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4, | |
219 T5 arg5, T6 arg6, T7 arg7, T8 arg8, T9 arg9) { | |
220 // Use Arg() object to record type information and then copy arguments to an | |
221 // array to make it easier to iterate over them. | |
222 const internal::Arg arg_array[] = { | |
223 arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8, arg9 | |
224 }; | |
225 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
226 } | |
227 | |
228 template<size_t N, | |
229 class T0, class T1, class T2, class T3, class T4, | |
230 class T5, class T6, class T7, class T8, class T9> | |
231 ssize_t SafeSPrintf(char (&buf)[N], const char* fmt, | |
232 T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4, | |
233 T5 arg5, T6 arg6, T7 arg7, T8 arg8, T9 arg9) { | |
234 // Use Arg() object to record type information and then copy arguments to an | |
235 // array to make it easier to iterate over them. | |
236 const internal::Arg arg_array[] = { | |
237 arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8, arg9 | |
238 }; | |
239 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
240 } | |
241 | |
242 template<class T0, class T1, class T2, class T3, class T4, | |
243 class T5, class T6, class T7, class T8> | |
244 ssize_t SafeSNPrintf(char* buf, size_t N, const char* fmt, | |
245 T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4, | |
246 T5 arg5, T6 arg6, T7 arg7, T8 arg8) { | |
247 // Use Arg() object to record type information and then copy arguments to an | |
248 // array to make it easier to iterate over them. | |
249 const internal::Arg arg_array[] = { | |
250 arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8 | |
251 }; | |
252 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
253 } | |
254 | |
255 template<size_t N, | |
256 class T0, class T1, class T2, class T3, class T4, class T5, | |
257 class T6, class T7, class T8> | |
258 ssize_t SafeSPrintf(char (&buf)[N], const char* fmt, | |
259 T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4, | |
260 T5 arg5, T6 arg6, T7 arg7, T8 arg8) { | |
261 // Use Arg() object to record type information and then copy arguments to an | |
262 // array to make it easier to iterate over them. | |
263 const internal::Arg arg_array[] = { | |
264 arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8 | |
265 }; | |
266 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
267 } | |
268 | |
269 template<class T0, class T1, class T2, class T3, class T4, class T5, | |
270 class T6, class T7> | |
271 ssize_t SafeSNPrintf(char* buf, size_t N, const char* fmt, | |
272 T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4, | |
273 T5 arg5, T6 arg6, T7 arg7) { | |
274 // Use Arg() object to record type information and then copy arguments to an | |
275 // array to make it easier to iterate over them. | |
276 const internal::Arg arg_array[] = { | |
277 arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7 | |
278 }; | |
279 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
280 } | |
281 | |
282 template<size_t N, | |
283 class T0, class T1, class T2, class T3, class T4, class T5, | |
284 class T6, class T7> | |
285 ssize_t SafeSPrintf(char (&buf)[N], const char* fmt, | |
286 T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4, | |
287 T5 arg5, T6 arg6, T7 arg7) { | |
288 // Use Arg() object to record type information and then copy arguments to an | |
289 // array to make it easier to iterate over them. | |
290 const internal::Arg arg_array[] = { | |
291 arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7 | |
292 }; | |
293 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
294 } | |
295 | |
296 template<class T0, class T1, class T2, class T3, class T4, class T5, | |
297 class T6> | |
298 ssize_t SafeSNPrintf(char* buf, size_t N, const char* fmt, | |
299 T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4, | |
300 T5 arg5, T6 arg6) { | |
301 // Use Arg() object to record type information and then copy arguments to an | |
302 // array to make it easier to iterate over them. | |
303 const internal::Arg arg_array[] = { | |
304 arg0, arg1, arg2, arg3, arg4, arg5, arg6 | |
305 }; | |
306 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
307 } | |
308 | |
309 template<size_t N, | |
310 class T0, class T1, class T2, class T3, class T4, class T5, | |
311 class T6> | |
312 ssize_t SafeSPrintf(char (&buf)[N], const char* fmt, | |
313 T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4, T5 arg5, | |
314 T6 arg6) { | |
315 // Use Arg() object to record type information and then copy arguments to an | |
316 // array to make it easier to iterate over them. | |
317 const internal::Arg arg_array[] = { | |
318 arg0, arg1, arg2, arg3, arg4, arg5, arg6 | |
319 }; | |
320 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
321 } | |
322 | |
323 template<class T0, class T1, class T2, class T3, class T4, class T5> | |
324 ssize_t SafeSNPrintf(char* buf, size_t N, const char* fmt, | |
325 T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4, T5 arg5) { | |
326 // Use Arg() object to record type information and then copy arguments to an | |
327 // array to make it easier to iterate over them. | |
328 const internal::Arg arg_array[] = { arg0, arg1, arg2, arg3, arg4, arg5 }; | |
329 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
330 } | |
331 | |
332 template<size_t N, | |
333 class T0, class T1, class T2, class T3, class T4, class T5> | |
334 ssize_t SafeSPrintf(char (&buf)[N], const char* fmt, | |
335 T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4, T5 arg5) { | |
336 // Use Arg() object to record type information and then copy arguments to an | |
337 // array to make it easier to iterate over them. | |
338 const internal::Arg arg_array[] = { arg0, arg1, arg2, arg3, arg4, arg5 }; | |
339 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
340 } | |
341 | |
342 template<class T0, class T1, class T2, class T3, class T4> | |
343 ssize_t SafeSNPrintf(char* buf, size_t N, const char* fmt, | |
344 T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4) { | |
345 // Use Arg() object to record type information and then copy arguments to an | |
346 // array to make it easier to iterate over them. | |
347 const internal::Arg arg_array[] = { arg0, arg1, arg2, arg3, arg4 }; | |
348 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
349 } | |
350 | |
351 template<size_t N, class T0, class T1, class T2, class T3, class T4> | |
352 ssize_t SafeSPrintf(char (&buf)[N], const char* fmt, T0 arg0, T1 arg1, | |
353 T2 arg2, T3 arg3, T4 arg4) { | |
354 // Use Arg() object to record type information and then copy arguments to an | |
355 // array to make it easier to iterate over them. | |
356 const internal::Arg arg_array[] = { arg0, arg1, arg2, arg3, arg4 }; | |
357 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
358 } | |
359 | |
360 template<class T0, class T1, class T2, class T3> | |
361 ssize_t SafeSNPrintf(char* buf, size_t N, const char* fmt, | |
362 T0 arg0, T1 arg1, T2 arg2, T3 arg3) { | |
363 // Use Arg() object to record type information and then copy arguments to an | |
364 // array to make it easier to iterate over them. | |
365 const internal::Arg arg_array[] = { arg0, arg1, arg2, arg3 }; | |
366 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
367 } | |
368 | |
369 template<size_t N, class T0, class T1, class T2, class T3> | |
370 ssize_t SafeSPrintf(char (&buf)[N], const char* fmt, | |
371 T0 arg0, T1 arg1, T2 arg2, T3 arg3) { | |
372 // Use Arg() object to record type information and then copy arguments to an | |
373 // array to make it easier to iterate over them. | |
374 const internal::Arg arg_array[] = { arg0, arg1, arg2, arg3 }; | |
375 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
376 } | |
377 | |
378 template<class T0, class T1, class T2> | |
379 ssize_t SafeSNPrintf(char* buf, size_t N, const char* fmt, | |
380 T0 arg0, T1 arg1, T2 arg2) { | |
381 // Use Arg() object to record type information and then copy arguments to an | |
382 // array to make it easier to iterate over them. | |
383 const internal::Arg arg_array[] = { arg0, arg1, arg2 }; | |
384 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
385 } | |
386 | |
387 template<size_t N, class T0, class T1, class T2> | |
388 ssize_t SafeSPrintf(char (&buf)[N], const char* fmt, T0 arg0, T1 arg1, | |
389 T2 arg2) { | |
390 // Use Arg() object to record type information and then copy arguments to an | |
391 // array to make it easier to iterate over them. | |
392 const internal::Arg arg_array[] = { arg0, arg1, arg2 }; | |
393 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
394 } | |
395 | |
396 template<class T0, class T1> | |
397 ssize_t SafeSNPrintf(char* buf, size_t N, const char* fmt, T0 arg0, T1 arg1) { | |
398 // Use Arg() object to record type information and then copy arguments to an | |
399 // array to make it easier to iterate over them. | |
400 const internal::Arg arg_array[] = { arg0, arg1 }; | |
401 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
402 } | |
403 | |
404 template<size_t N, class T0, class T1> | |
405 ssize_t SafeSPrintf(char (&buf)[N], const char* fmt, T0 arg0, T1 arg1) { | |
406 // Use Arg() object to record type information and then copy arguments to an | |
407 // array to make it easier to iterate over them. | |
408 const internal::Arg arg_array[] = { arg0, arg1 }; | |
409 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
410 } | |
411 | |
412 template<class T0> | |
413 ssize_t SafeSNPrintf(char* buf, size_t N, const char* fmt, T0 arg0) { | |
414 // Use Arg() object to record type information and then copy arguments to an | |
415 // array to make it easier to iterate over them. | |
416 const internal::Arg arg_array[] = { arg0 }; | |
417 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
418 } | |
419 | |
420 template<size_t N, class T0> | |
421 ssize_t SafeSPrintf(char (&buf)[N], const char* fmt, T0 arg0) { | |
422 // Use Arg() object to record type information and then copy arguments to an | |
423 // array to make it easier to iterate over them. | |
424 const internal::Arg arg_array[] = { arg0 }; | |
425 return internal::SafeSNPrintf(buf, N, fmt, arg_array, arraysize(arg_array)); | |
426 } | |
427 #endif | |
428 | |
429 // Fast-path when we don't actually need to substitute any arguments. | |
430 BASE_EXPORT ssize_t SafeSNPrintf(char* buf, size_t N, const char* fmt); | |
431 template<size_t N> | |
432 inline ssize_t SafeSPrintf(char (&buf)[N], const char* fmt) { | |
433 return SafeSNPrintf(buf, N, fmt); | |
434 } | |
435 | |
436 } // namespace strings | |
437 } // namespace base | |
438 | |
439 #endif // BASE_STRINGS_SAFE_SPRINTF_H_ | |
OLD | NEW |