Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 17 additions & 7 deletions centrallix-lib/src/cxsec.c
Original file line number Diff line number Diff line change
Expand Up @@ -116,50 +116,60 @@ cxsecUpdateDS(unsigned long* start, unsigned long* end, char* file, int line)
int
cxsecVerifySymbol(const char* sym)
{
const char* original_symbol = sym;

/** First char must be alpha or underscore, and must exist (len >= 1).
** We don't use isalpha() et al here because symbols need to conform to
** the normal 'C' locale ascii charset!!! To do otherwise can cause
** significant security risks in the event of a locale mismatch!!
**/
if (*sym != '_' && (*sym < 'A' || *sym > 'Z') && (*sym < 'a' || *sym > 'z'))
return -1;
goto err;

/** Next chars may be 1) end of string, 2) digits, 3) alpha, or 4) underscore **/
sym++;
while(*sym)
{
if (*sym != '_' && (*sym < 'A' || *sym > 'Z') && (*sym < 'a' || *sym > 'z') && (*sym < '0' || *sym > '9'))
return -1;
goto err;
sym++;
}

return 0;
return 0;

err:
fprintf(stderr, "WARNING: '%s' is not a valid symbol!\n", original_symbol);
return -1;
}

int
cxsecVerifySymbol_n(const char* sym, size_t n)
{
const char* original_symbol = sym;
const size_t original_n = n;

/** First char must be alpha or underscore, and must exist (len >= 1).
** We don't use isalpha() et al here because symbols need to conform to
** the normal 'C' locale ascii charset!!! To do otherwise can cause
** significant security risks in the event of a locale mismatch!!
**/
if (n <= 0 || (*sym != '_' && (*sym < 'A' || *sym > 'Z') && (*sym < 'a' || *sym > 'z')))
return -1;
goto err;
n--;

/** Next chars may be 1) end of string, 2) digits, 3) alpha, or 4) underscore **/
sym++;
while(n)
{
if (*sym != '_' && (*sym < 'A' || *sym > 'Z') && (*sym < 'a' || *sym > 'z') && (*sym < '0' || *sym > '9'))
return -1;
goto err;
sym++;
n--;
}

return 0;
}
return 0;

err:
fprintf(stderr, "WARNING: '%.*s' is not a valid symbol!\n", (int)original_n, original_symbol);
return -1;
}