]> git.sur5r.net Git - openldap/blobdiff - libraries/librewrite/rule.c
Fix UTF8StringNormalize overrun on zero-length string
[openldap] / libraries / librewrite / rule.c
index 11f489bda348aef5641b856927fbe5ff1a10d520..6f80f161e41c3d6a4659dbd037bd93cdf5c8ed2c 100644 (file)
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2000-2003 The OpenLDAP Foundation.
+ * Copyright 2000-2011 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -72,8 +72,8 @@ destroy_action(
 {
        struct rewrite_action   *action;
 
-       assert( paction );
-       assert( *paction );
+       assert( paction != NULL );
+       assert( *paction != NULL );
 
        action = *paction;
 
@@ -99,11 +99,20 @@ destroy_action(
        return 0;
 }
 
+static void
+destroy_actions(
+       struct rewrite_action *paction
+)
+{
+       struct rewrite_action *next;
+
+       for (; paction; paction = next) {
+               next = paction->la_next;
+               destroy_action( &paction );
+       }
+}
+
 /*
- * In case of error it returns NULL and does not free all the memory
- * it allocated; as this is a once only phase, and an error at this stage
- * would require the server to stop, there is no need to be paranoid
- * about memory allocation
  */
 int
 rewrite_rule_compile(
@@ -116,6 +125,7 @@ rewrite_rule_compile(
 {
        int flags = REWRITE_REGEX_EXTENDED | REWRITE_REGEX_ICASE;
        int mode = REWRITE_RECURSE;
+       int max_passes;
 
        struct rewrite_rule *rule = NULL;
        struct rewrite_subst *subst = NULL;
@@ -127,11 +137,12 @@ rewrite_rule_compile(
        assert( context != NULL );
        assert( pattern != NULL );
        assert( result != NULL );
-
        /*
         * A null flagstring should be allowed
         */
 
+       max_passes = info->li_max_passes_per_rule;
+
        /*
         * Take care of substitution string
         */
@@ -185,12 +196,9 @@ rewrite_rule_compile(
                         */
                        action = calloc( sizeof( struct rewrite_action ), 1 );
                        if ( action == NULL ) {
-                               /* cleanup ... */
-                               return REWRITE_ERR;
+                               goto fail;
                        }
-                       
-                       //mode &= ~REWRITE_RECURSE;
-                       //mode |= REWRITE_EXEC_ONCE;
+
                        action->la_type = REWRITE_ACTION_STOP;
                        break;
                        
@@ -200,8 +208,7 @@ rewrite_rule_compile(
                         */
                        action = calloc( sizeof( struct rewrite_action ), 1 );
                        if ( action == NULL ) {
-                               /* cleanup ... */
-                               return REWRITE_ERR;
+                               goto fail;
                        }
                        
                        mode &= ~REWRITE_RECURSE;
@@ -223,26 +230,24 @@ rewrite_rule_compile(
                        int *d;
                        
                        if ( p[ 1 ] != '{' ) {
-                               /* XXX Need to free stuff */
-                               return REWRITE_ERR;
+                               goto fail;
                        }
 
                        d = malloc( sizeof( int ) );
                        if ( d == NULL ) {
-                               /* XXX Need to free stuff */
-                               return REWRITE_ERR;
+                               goto fail;
                        }
 
                        d[ 0 ] = strtol( &p[ 2 ], &next, 0 );
-                       if ( next == NULL || next == &p[ 2 ] || next[0] != '}' ) {
-                               /* XXX Need to free stuff */
-                               return REWRITE_ERR;
+                       if ( next == &p[ 2 ] || next[0] != '}' ) {
+                               free( d );
+                               goto fail;
                        }
 
                        action = calloc( sizeof( struct rewrite_action ), 1 );
                        if ( action == NULL ) {
-                               /* cleanup ... */       
-                               return REWRITE_ERR;
+                               free( d );
+                               goto fail;
                        }
                        switch ( p[ 0 ] ) {
                        case REWRITE_FLAG_GOTO:
@@ -264,14 +269,38 @@ rewrite_rule_compile(
                        break;
                }
 
+               case REWRITE_FLAG_MAX_PASSES: {                 /* 'U' */
+                       /*
+                        * Set the number of max passes per rule
+                        */
+                       char *next = NULL;
+                       
+                       if ( p[ 1 ] != '{' ) {
+                               goto fail;
+                       }
+
+                       max_passes = strtol( &p[ 2 ], &next, 0 );
+                       if ( next == &p[ 2 ] || next[0] != '}' ) {
+                               goto fail;
+                       }
+
+                       if ( max_passes < 1 ) {
+                               /* FIXME: nonsense ... */
+                               max_passes = 1;
+                       }
+
+                       p = next;       /* p is incremented by the for ... */
+               
+                       break;
+               }
+
                case REWRITE_FLAG_IGNORE_ERR:               /* 'I' */
                        /*
                         * Ignore errors!
                         */
                        action = calloc( sizeof( struct rewrite_action ), 1 );
                        if ( action == NULL ) {
-                               /* cleanup ... */
-                               return REWRITE_ERR;
+                               goto fail;
                        }
                        
                        action->la_type = REWRITE_ACTION_IGNORE_ERR;
@@ -301,23 +330,14 @@ rewrite_rule_compile(
         */
        rule = calloc( sizeof( struct rewrite_rule ), 1 );
        if ( rule == NULL ) {
-               /* charray_free( res ); */
-               /*
-                * XXX need to free the value subst stuff!
-                */
-               return REWRITE_ERR;
+               goto fail;
        }
        
        /*
         * REGEX compilation (luckily I don't need to take care of this ...)
         */
        if ( regcomp( &rule->lr_regex, ( char * )pattern, flags ) != 0 ) {
-               /* charray_free( res ); */
-               /*
-                *XXX need to free the value subst stuff!
-                */
-               free( rule );
-               return REWRITE_ERR;
+               goto fail;
        }
        
        /*
@@ -326,6 +346,12 @@ rewrite_rule_compile(
        rule->lr_pattern = strdup( pattern );
        rule->lr_subststring = strdup( result );
        rule->lr_flagstring = strdup( flagstring );
+       if ( rule->lr_pattern == NULL
+               || rule->lr_subststring == NULL
+               || rule->lr_flagstring == NULL )
+       {
+               goto fail;
+       }
        
        /*
         * Load compiled data into rule
@@ -337,6 +363,7 @@ rewrite_rule_compile(
         */
        rule->lr_flags = flags;         /* don't really need any longer ... */
        rule->lr_mode = mode;
+       rule->lr_max_passes = max_passes;
        rule->lr_action = first_action;
        
        /*
@@ -345,6 +372,17 @@ rewrite_rule_compile(
        append_rule( context, rule );
 
        return REWRITE_SUCCESS;
+
+fail:
+       if ( rule ) {
+               if ( rule->lr_pattern ) free( rule->lr_pattern );
+               if ( rule->lr_subststring ) free( rule->lr_subststring );
+               if ( rule->lr_flagstring ) free( rule->lr_flagstring );
+               free( rule );
+       }
+       destroy_actions( first_action );
+       free( subst );
+       return REWRITE_ERR;
 }
 
 /*
@@ -387,14 +425,15 @@ rewrite_rule_apply(
 recurse:;
 
        Debug( LDAP_DEBUG_TRACE, "==> rewrite_rule_apply"
-                       " rule='%s' string='%s'\n", 
-                       rule->lr_pattern, string, 0 );
+                       " rule='%s' string='%s' [%d pass(es)]\n", 
+                       rule->lr_pattern, string, strcnt + 1 );
        
        op->lo_num_passes++;
-       if ( regexec( &rule->lr_regex, string, nmatch, match, 0 ) != 0 ) {
-               if ( *result == NULL && strcnt > 0 ) {
+
+       rc = regexec( &rule->lr_regex, string, nmatch, match, 0 );
+       if ( rc != 0 ) {
+               if ( *result == NULL && string != arg ) {
                        free( string );
-                       string = NULL;
                }
 
                /*
@@ -408,7 +447,7 @@ recurse:;
 
        *result = val.bv_val;
        val.bv_val = NULL;
-       if ( strcnt > 0 ) {
+       if ( string != arg ) {
                free( string );
                string = NULL;
        }
@@ -418,9 +457,9 @@ recurse:;
        }
 
        if ( ( rule->lr_mode & REWRITE_RECURSE ) == REWRITE_RECURSE 
-                       && op->lo_num_passes <= info->li_max_passes ) {
+                       && op->lo_num_passes < info->li_max_passes
+                       && ++strcnt < rule->lr_max_passes ) {
                string = *result;
-               strcnt++;
 
                goto recurse;
        }
@@ -434,10 +473,9 @@ rewrite_rule_destroy(
                )
 {
        struct rewrite_rule *rule;
-       struct rewrite_action *action;
 
-       assert( prule );
-       assert( *prule );
+       assert( prule != NULL );
+       assert( *prule != NULL );
 
        rule = *prule;
 
@@ -462,12 +500,7 @@ rewrite_rule_destroy(
 
        regfree( &rule->lr_regex );
 
-       for ( action = rule->lr_action; action; ) {
-               struct rewrite_action *curraction = action;
-
-               action = action->la_next;
-               destroy_action( &curraction );
-       }
+       destroy_actions( rule->lr_action );
 
        free( rule );
        *prule = NULL;