Protect against malicious manual pages containing .ll requests with

[mandoc.git] / tag.c

diff --git a/tag.c b/tag.c
index 4167336fcdc7ddb5b9c7e90e526fd93eb39f54a8..c0832c4f74b7b011805c4ae2050bc6e9d090210d 100644 (file)
--- a/tag.c
+++ b/tag.c
@@ -1,6 +1,6 @@
-/*      $Id: tag.c,v 1.7 2015/08/29 15:28:13 schwarze Exp $    */
+/*     $Id: tag.c,v 1.19 2018/02/23 16:47:10 schwarze Exp $ */

 /*
 /*

- * Copyright (c) 2015 Ingo Schwarze <schwarze@openbsd.org>
+ * Copyright (c) 2015, 2016 Ingo Schwarze <schwarze@openbsd.org>

  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above


@@ -26,25 +26,19 @@
 #include <string.h>
 #include <unistd.h>
 
 #include <string.h>
 #include <unistd.h>
 

-#if HAVE_OHASH
-#include <ohash.h>
-#else
-#include "compat_ohash.h"
-#endif
-

 #include "mandoc_aux.h"
 #include "mandoc_aux.h"

+#include "mandoc_ohash.h"

 #include "tag.h"
 
 struct tag_entry {
 #include "tag.h"
 
 struct tag_entry {

-       size_t   line;
+       size_t  *lines;
+       size_t   maxlines;
+       size_t   nlines;

        int      prio;
        char     s[];
 };
 
        int      prio;
        char     s[];
 };
 

-static void     tag_signal(int);
-static void    *tag_alloc(size_t, void *);
-static void     tag_free(void *, void *);
-static void    *tag_calloc(size_t, size_t, void *);
+static void     tag_signal(int) __attribute__((__noreturn__));

 
 static struct ohash     tag_data;
 static struct tag_files         tag_files;
 
 static struct ohash     tag_data;
 static struct tag_files         tag_files;


@@ -58,11 +52,30 @@ static struct tag_files      tag_files;
 struct tag_files *
 tag_init(void)
 {
 struct tag_files *
 tag_init(void)
 {

-       struct ohash_info        tag_info;
+       struct sigaction         sa;

        int                      ofd;
 
        ofd = -1;
        tag_files.tfd = -1;
        int                      ofd;
 
        ofd = -1;
        tag_files.tfd = -1;

+       tag_files.tcpgid = -1;
+
+       /* Clean up when dying from a signal. */
+
+       memset(&sa, 0, sizeof(sa));
+       sigfillset(&sa.sa_mask);
+       sa.sa_handler = tag_signal;
+       sigaction(SIGHUP, &sa, NULL);
+       sigaction(SIGINT, &sa, NULL);
+       sigaction(SIGTERM, &sa, NULL);
+
+       /*
+        * POSIX requires that a process calling tcsetpgrp(3)
+        * from the background gets a SIGTTOU signal.
+        * In that case, do not stop.
+        */
+
+       sa.sa_handler = SIG_IGN;
+       sigaction(SIGTTOU, &sa, NULL);

 
        /* Save the original standard output for use by the pager. */
 
 
        /* Save the original standard output for use by the pager. */
 


@@ -75,9 +88,6 @@ tag_init(void)
            sizeof(tag_files.ofn));
        (void)strlcpy(tag_files.tfn, "/tmp/man.XXXXXXXXXX",
            sizeof(tag_files.tfn));
            sizeof(tag_files.ofn));
        (void)strlcpy(tag_files.tfn, "/tmp/man.XXXXXXXXXX",
            sizeof(tag_files.tfn));

-       signal(SIGHUP, tag_signal);
-       signal(SIGINT, tag_signal);
-       signal(SIGTERM, tag_signal);

        if ((ofd = mkstemp(tag_files.ofn)) == -1)
                goto fail;
        if ((tag_files.tfd = mkstemp(tag_files.tfn)) == -1)
        if ((ofd = mkstemp(tag_files.ofn)) == -1)
                goto fail;
        if ((tag_files.tfd = mkstemp(tag_files.tfn)) == -1)


@@ -91,13 +101,8 @@ tag_init(void)
         * where various marked-up terms are documented.
         */
 
         * where various marked-up terms are documented.
         */
 

-       tag_info.alloc = tag_alloc;
-       tag_info.calloc = tag_calloc;
-       tag_info.free = tag_free;
-       tag_info.key_offset = offsetof(struct tag_entry, s);
-       tag_info.data = NULL;
-       ohash_init(&tag_data, 4, &tag_info);
-       return(&tag_files);
+       mandoc_ohash_init(&tag_data, 4, offsetof(struct tag_entry, s));
+       return &tag_files;

 
 fail:
        tag_unlink();
 
 fail:
        tag_unlink();


@@ -111,7 +116,7 @@ fail:
        *tag_files.tfn = '\0';
        tag_files.ofd = -1;
        tag_files.tfd = -1;
        *tag_files.tfn = '\0';
        tag_files.ofd = -1;
        tag_files.tfd = -1;

-       return(NULL);
+       return NULL;

 }
 
 /*
 }
 
 /*


@@ -125,18 +130,58 @@ tag_put(const char *s, int prio, size_t line)
        size_t                   len;
        unsigned int             slot;
 
        size_t                   len;
        unsigned int             slot;
 

+       /* Sanity checks. */
+

        if (tag_files.tfd <= 0)
                return;
        if (tag_files.tfd <= 0)
                return;

+       if (s[0] == '\\' && (s[1] == '&' || s[1] == 'e'))
+               s += 2;
+       if (*s == '\0' || strchr(s, ' ') != NULL)
+               return;
+

        slot = ohash_qlookup(&tag_data, s);
        entry = ohash_find(&tag_data, slot);
        slot = ohash_qlookup(&tag_data, s);
        entry = ohash_find(&tag_data, slot);

+

        if (entry == NULL) {
        if (entry == NULL) {

+
+               /* Build a new entry. */
+

                len = strlen(s) + 1;
                entry = mandoc_malloc(sizeof(*entry) + len);
                memcpy(entry->s, s, len);
                len = strlen(s) + 1;
                entry = mandoc_malloc(sizeof(*entry) + len);
                memcpy(entry->s, s, len);

+               entry->lines = NULL;
+               entry->maxlines = entry->nlines = 0;

                ohash_insert(&tag_data, slot, entry);
                ohash_insert(&tag_data, slot, entry);

-       } else if (entry->prio <= prio)
-               return;
-       entry->line = line;
+
+       } else {
+
+               /* Handle priority 0 entries. */
+
+               if (prio == 0) {
+                       if (entry->prio == 0)
+                               entry->prio = -1;
+                       return;
+               }
+
+               /* A better entry is already present, ignore the new one. */
+
+               if (entry->prio > 0 && entry->prio < prio)
+                       return;
+
+               /* The existing entry is worse, clear it. */
+
+               if (entry->prio < 1 || entry->prio > prio)
+                       entry->nlines = 0;
+       }
+
+       /* Remember the new line. */
+
+       if (entry->maxlines == entry->nlines) {
+               entry->maxlines += 4;
+               entry->lines = mandoc_reallocarray(entry->lines,
+                   entry->maxlines, sizeof(*entry->lines));
+       }
+       entry->lines[entry->nlines++] = line;

        entry->prio = prio;
 }
 
        entry->prio = prio;
 }
 


@@ -149,6 +194,7 @@ tag_write(void)
 {
        FILE                    *stream;
        struct tag_entry        *entry;
 {
        FILE                    *stream;
        struct tag_entry        *entry;

+       size_t                   i;

        unsigned int             slot;
 
        if (tag_files.tfd <= 0)
        unsigned int             slot;
 
        if (tag_files.tfd <= 0)


@@ -156,21 +202,34 @@ tag_write(void)
        stream = fdopen(tag_files.tfd, "w");
        entry = ohash_first(&tag_data, &slot);
        while (entry != NULL) {
        stream = fdopen(tag_files.tfd, "w");
        entry = ohash_first(&tag_data, &slot);
        while (entry != NULL) {

-               if (stream != NULL)
-                       fprintf(stream, "%s %s %zu\n",
-                           entry->s, tag_files.ofn, entry->line);
+               if (stream != NULL && entry->prio >= 0)
+                       for (i = 0; i < entry->nlines; i++)
+                               fprintf(stream, "%s %s %zu\n",
+                                   entry->s, tag_files.ofn, entry->lines[i]);
+               free(entry->lines);

                free(entry);
                entry = ohash_next(&tag_data, &slot);
        }
        ohash_delete(&tag_data);
        if (stream != NULL)
                fclose(stream);
                free(entry);
                entry = ohash_next(&tag_data, &slot);
        }
        ohash_delete(&tag_data);
        if (stream != NULL)
                fclose(stream);

+       else
+               close(tag_files.tfd);
+       tag_files.tfd = -1;

 }
 
 void
 tag_unlink(void)
 {
 }
 
 void
 tag_unlink(void)
 {

-
+       pid_t    tc_pgid;
+
+       if (tag_files.tcpgid != -1) {
+               tc_pgid = tcgetpgrp(tag_files.ofd);
+               if (tc_pgid == tag_files.pager_pid ||
+                   tc_pgid == getpgid(0) ||
+                   getpgid(tc_pgid) == -1)
+                       (void)tcsetpgrp(tag_files.ofd, tag_files.tcpgid);
+       }

        if (*tag_files.ofn != '\0')
                unlink(tag_files.ofn);
        if (*tag_files.tfn != '\0')
        if (*tag_files.ofn != '\0')
                unlink(tag_files.ofn);
        if (*tag_files.tfn != '\0')


@@ -180,34 +239,14 @@ tag_unlink(void)
 static void
 tag_signal(int signum)
 {
 static void
 tag_signal(int signum)
 {

+       struct sigaction         sa;

 
        tag_unlink();
 
        tag_unlink();

-       signal(signum, SIG_DFL);
+       memset(&sa, 0, sizeof(sa));
+       sigemptyset(&sa.sa_mask);
+       sa.sa_handler = SIG_DFL;
+       sigaction(signum, &sa, NULL);

        kill(getpid(), signum);
        /* NOTREACHED */
        _exit(1);
 }
        kill(getpid(), signum);
        /* NOTREACHED */
        _exit(1);
 }

-
-/*
- * Memory management callback functions for ohash.
- */
-static void *
-tag_alloc(size_t sz, void *arg)
-{
-
-       return(mandoc_malloc(sz));
-}
-
-static void *
-tag_calloc(size_t nmemb, size_t sz, void *arg)
-{
-
-       return(mandoc_calloc(nmemb, sz));
-}
-
-static void
-tag_free(void *p, void *arg)
-{
-
-       free(p);
-}