vbatts/grub
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity
grub/include/grub/misc.h
Peter Jones d5a32255de misc: Make grub_strtol() "end" pointers have safer const qualifiers 
Currently the string functions grub_strtol(), grub_strtoul(), and
grub_strtoull() don't declare the "end" pointer in such a way as to
require the pointer itself or the character array to be immutable to the
implementation, nor does the C standard do so in its similar functions,
though it does require us not to change any of it.

The typical declarations of these functions follow this pattern:

long
strtol(const char * restrict nptr, char ** restrict endptr, int base);

Much of the reason for this is historic, and a discussion of that
follows below, after the explanation of this change.  (GRUB currently
does not include the "restrict" qualifiers, and we name the arguments a
bit differently.)

The implementation is semantically required to treat the character array
as immutable, but such accidental modifications aren't stopped by the
compiler, and the semantics for both the callers and the implementation
of these functions are sometimes also helped by adding that requirement.

This patch changes these declarations to follow this pattern instead:

long
strtol(const char * restrict nptr,
       const char ** const restrict endptr,
       int base);

This means that if any modification to these functions accidentally
introduces either an errant modification to the underlying character
array, or an accidental assignment to endptr rather than *endptr, the
compiler should generate an error.  (The two uses of "restrict" in this
case basically mean strtol() isn't allowed to modify the character array
by going through *endptr, and endptr isn't allowed to point inside the
array.)

It also means the typical use case changes to:

  char *s = ...;
  const char *end;
  long l;

  l = strtol(s, &end, 10);

Or even:

  const char *p = str;
  while (p && *p) {
	  long l = strtol(p, &p, 10);
	  ...
  }

This fixes 26 places where we discard our attempts at treating the data
safely by doing:

  const char *p = str;
  long l;

  l = strtol(p, (char **)&ptr, 10);

It also adds 5 places where we do:

  char *p = str;
  while (p && *p) {
	  long l = strtol(p, (const char ** const)&p, 10);
	  ...
	  /* more calls that need p not to be pointer-to-const */
  }

While moderately distasteful, this is a better problem to have.

With one minor exception, I have tested that all of this compiles
without relevant warnings or errors, and that /much/ of it behaves
correctly, with gcc 9 using 'gcc -W -Wall -Wextra'.  The one exception
is the changes in grub-core/osdep/aros/hostdisk.c , which I have no idea
how to build.

Because the C standard defined type-qualifiers in a way that can be
confusing, in the past there's been a slow but fairly regular stream of
churn within our patches, which add and remove the const qualifier in many
of the users of these functions.  This change should help avoid that in
the future, and in order to help ensure this, I've added an explanation
in misc.h so that when someone does get a compiler warning about a type
error, they have the fix at hand.

The reason we don't have "const" in these calls in the standard is
purely anachronistic: C78 (de facto) did not have type qualifiers in the
syntax, and the "const" type qualifier was added for C89 (I think; it
may have been later).  strtol() appears to date from 4.3BSD in 1986,
which means it could not be added to those functions in the standard
without breaking compatibility, which is usually avoided.

The syntax chosen for type qualifiers is what has led to the churn
regarding usage of const, and is especially confusing on string
functions due to the lack of a string type.  Quoting from C99, the
syntax is:

 declarator:
  pointer[opt] direct-declarator
 direct-declarator:
  identifier
  ( declarator )
  direct-declarator [ type-qualifier-list[opt] assignment-expression[opt] ]
  ...
  direct-declarator [ type-qualifier-list[opt] * ]
  ...
 pointer:
  * type-qualifier-list[opt]
  * type-qualifier-list[opt] pointer
 type-qualifier-list:
  type-qualifier
  type-qualifier-list type-qualifier
 ...
 type-qualifier:
  const
  restrict
  volatile

So the examples go like:

const char foo;			// immutable object
const char *foo;		// mutable pointer to object
char * const foo;		// immutable pointer to mutable object
const char * const foo;		// immutable pointer to immutable object
const char const * const foo; 	// XXX extra const keyword in the middle
const char * const * const foo; // immutable pointer to immutable
				//   pointer to immutable object
const char ** const foo;	// immutable pointer to mutable pointer
				//   to immutable object

Making const left-associative for * and right-associative for everything
else may not have been the best choice ever, but here we are, and the
inevitable result is people using trying to use const (as they should!),
putting it at the wrong place, fighting with the compiler for a bit, and
then either removing it or typecasting something in a bad way.  I won't
go into describing restrict, but its syntax has exactly the same issue
as with const.

Anyway, the last example above actually represents the *behavior* that's
required of strtol()-like functions, so that's our choice for the "end"
pointer.

Signed-off-by: Peter Jones <pjones@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
2020-02-28 12:41:29 +01:00

484 lines
12 KiB
C
Raw Blame History

/* misc.h - prototypes for misc functions */
/*
* GRUB -- GRand Unified Bootloader
* Copyright (C) 2002,2003,2005,2006,2007,2008,2009,2010 Free Software Foundation, Inc.
*
* GRUB is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* GRUB is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with GRUB. If not, see <http://www.gnu.org/licenses/>.
*/
#ifndef GRUB_MISC_HEADER
#define GRUB_MISC_HEADER 1
#include <stdarg.h>
#include <grub/types.h>
#include <grub/symbol.h>
#include <grub/err.h>
#include <grub/i18n.h>
#include <grub/compiler.h>
#define ALIGN_UP(addr, align) \
((addr + (typeof (addr)) align - 1) & ~((typeof (addr)) align - 1))
#define ALIGN_UP_OVERHEAD(addr, align) ((-(addr)) & ((typeof (addr)) (align) - 1))
#define ALIGN_DOWN(addr, align) \
((addr) & ~((typeof (addr)) align - 1))
#define ARRAY_SIZE(array) (sizeof (array) / sizeof (array[0]))
#define COMPILE_TIME_ASSERT(cond) switch (0) { case 1: case !(cond): ; }
#define grub_dprintf(condition, ...) grub_real_dprintf(GRUB_FILE, __LINE__, condition, __VA_ARGS__)
void *EXPORT_FUNC(grub_memmove) (void *dest, const void *src, grub_size_t n);
char *EXPORT_FUNC(grub_strcpy) (char *dest, const char *src);
static inline char *
grub_strncpy (char *dest, const char *src, int c)
{
char *p = dest;
while ((*p++ = *src++) != '\0' && --c)
;
return dest;
}
static inline char *
grub_stpcpy (char *dest, const char *src)
{
char *d = dest;
const char *s = src;
do
*d++ = *s;
while (*s++ != '\0');
return d - 1;
}
/* XXX: If grub_memmove is too slow, we must implement grub_memcpy. */
static inline void *
grub_memcpy (void *dest, const void *src, grub_size_t n)
{
return grub_memmove (dest, src, n);
}
#if defined(__x86_64__) && !defined (GRUB_UTIL)
#if defined (__MINGW32__) || defined (__CYGWIN__) || defined (__MINGW64__)
#define GRUB_ASM_ATTR __attribute__ ((sysv_abi))
#else
#define GRUB_ASM_ATTR
#endif
#endif
int EXPORT_FUNC(grub_memcmp) (const void *s1, const void *s2, grub_size_t n);
int EXPORT_FUNC(grub_strcmp) (const char *s1, const char *s2);
int EXPORT_FUNC(grub_strncmp) (const char *s1, const char *s2, grub_size_t n);
char *EXPORT_FUNC(grub_strchr) (const char *s, int c);
char *EXPORT_FUNC(grub_strrchr) (const char *s, int c);
int EXPORT_FUNC(grub_strword) (const char *s, const char *w);
/* Copied from gnulib.
Written by Bruno Haible <bruno@clisp.org>, 2005. */
static inline char *
grub_strstr (const char *haystack, const char *needle)
{
/* Be careful not to look at the entire extent of haystack or needle
until needed. This is useful because of these two cases:
- haystack may be very long, and a match of needle found early,
- needle may be very long, and not even a short initial segment of
needle may be found in haystack. */
if (*needle != '\0')
{
/* Speed up the following searches of needle by caching its first
character. */
char b = *needle++;
for (;; haystack++)
{
if (*haystack == '\0')
/* No match. */
return 0;
if (*haystack == b)
/* The first character matches. */
{
const char *rhaystack = haystack + 1;
const char *rneedle = needle;
for (;; rhaystack++, rneedle++)
{
if (*rneedle == '\0')
/* Found a match. */
return (char *) haystack;
if (*rhaystack == '\0')
/* No match. */
return 0;
if (*rhaystack != *rneedle)
/* Nothing in this round. */
break;
}
}
}
}
else
return (char *) haystack;
}
int EXPORT_FUNC(grub_isspace) (int c);
static inline int
grub_isprint (int c)
{
return (c >= ' ' && c <= '~');
}
static inline int
grub_iscntrl (int c)
{
return (c >= 0x00 && c <= 0x1F) || c == 0x7F;
}
static inline int
grub_isalpha (int c)
{
return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z');
}
static inline int
grub_islower (int c)
{
return (c >= 'a' && c <= 'z');
}
static inline int
grub_isupper (int c)
{
return (c >= 'A' && c <= 'Z');
}
static inline int
grub_isgraph (int c)
{
return (c >= '!' && c <= '~');
}
static inline int
grub_isdigit (int c)
{
return (c >= '0' && c <= '9');
}
static inline int
grub_isxdigit (int c)
{
return (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F');
}
static inline int
grub_isalnum (int c)
{
return grub_isalpha (c) || grub_isdigit (c);
}
static inline int
grub_tolower (int c)
{
if (c >= 'A' && c <= 'Z')
return c - 'A' + 'a';
return c;
}
static inline int
grub_toupper (int c)
{
if (c >= 'a' && c <= 'z')
return c - 'a' + 'A';
return c;
}
static inline int
grub_strcasecmp (const char *s1, const char *s2)
{
while (*s1 && *s2)
{
if (grub_tolower ((grub_uint8_t) *s1)
!= grub_tolower ((grub_uint8_t) *s2))
break;
s1++;
s2++;
}
return (int) grub_tolower ((grub_uint8_t) *s1)
- (int) grub_tolower ((grub_uint8_t) *s2);
}
static inline int
grub_strncasecmp (const char *s1, const char *s2, grub_size_t n)
{
if (n == 0)
return 0;
while (*s1 && *s2 && --n)
{
if (grub_tolower (*s1) != grub_tolower (*s2))
break;
s1++;
s2++;
}
return (int) grub_tolower ((grub_uint8_t) *s1)
- (int) grub_tolower ((grub_uint8_t) *s2);
}
/*
* Note that these differ from the C standard's definitions of strtol,
* strtoul(), and strtoull() by the addition of two const qualifiers on the end
* pointer, which make the declaration match the *semantic* requirements of
* their behavior. This means that instead of:
*
* char *s = "1234 abcd";
* char *end;
* unsigned long l;
*
* l = grub_strtoul(s, &end, 10);
*
* We must one of:
*
* const char *end;
* ... or ...
* l = grub_strtoul(s, (const char ** const)&end, 10);
*/
unsigned long EXPORT_FUNC(grub_strtoul) (const char * restrict str, const char ** const restrict end, int base);
unsigned long long EXPORT_FUNC(grub_strtoull) (const char * restrict str, const char ** const restrict end, int base);
static inline long
grub_strtol (const char * restrict str, const char ** const restrict end, int base)
{
int negative = 0;
unsigned long long magnitude;
while (*str && grub_isspace (*str))
str++;
if (*str == '-')
{
negative = 1;
str++;
}
magnitude = grub_strtoull (str, end, base);
if (negative)
{
if (magnitude > (unsigned long) GRUB_LONG_MAX + 1)
{
grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
return GRUB_LONG_MIN;
}
return -((long) magnitude);
}
else
{
if (magnitude > GRUB_LONG_MAX)
{
grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
return GRUB_LONG_MAX;
}
return (long) magnitude;
}
}
char *EXPORT_FUNC(grub_strdup) (const char *s) WARN_UNUSED_RESULT;
char *EXPORT_FUNC(grub_strndup) (const char *s, grub_size_t n) WARN_UNUSED_RESULT;
void *EXPORT_FUNC(grub_memset) (void *s, int c, grub_size_t n);
grub_size_t EXPORT_FUNC(grub_strlen) (const char *s) WARN_UNUSED_RESULT;
int EXPORT_FUNC(grub_printf) (const char *fmt, ...) __attribute__ ((format (GNU_PRINTF, 1, 2)));
int EXPORT_FUNC(grub_printf_) (const char *fmt, ...) __attribute__ ((format (GNU_PRINTF, 1, 2)));
/* Replace all `ch' characters of `input' with `with' and copy the
result into `output'; return EOS address of `output'. */
static inline char *
grub_strchrsub (char *output, const char *input, char ch, const char *with)
{
while (*input)
{
if (*input == ch)
{
grub_strcpy (output, with);
output += grub_strlen (with);
input++;
continue;
}
*output++ = *input++;
}
*output = '\0';
return output;
}
extern void (*EXPORT_VAR (grub_xputs)) (const char *str);
static inline int
grub_puts (const char *s)
{
const char nl[2] = "\n";
grub_xputs (s);
grub_xputs (nl);
return 1; /* Cannot fail. */
}
int EXPORT_FUNC(grub_puts_) (const char *s);
void EXPORT_FUNC(grub_real_dprintf) (const char *file,
const int line,
const char *condition,
const char *fmt, ...) __attribute__ ((format (GNU_PRINTF, 4, 5)));
int EXPORT_FUNC(grub_vprintf) (const char *fmt, va_list args);
int EXPORT_FUNC(grub_snprintf) (char *str, grub_size_t n, const char *fmt, ...)
__attribute__ ((format (GNU_PRINTF, 3, 4)));
int EXPORT_FUNC(grub_vsnprintf) (char *str, grub_size_t n, const char *fmt,
va_list args);
char *EXPORT_FUNC(grub_xasprintf) (const char *fmt, ...)
__attribute__ ((format (GNU_PRINTF, 1, 2))) WARN_UNUSED_RESULT;
char *EXPORT_FUNC(grub_xvasprintf) (const char *fmt, va_list args) WARN_UNUSED_RESULT;
void EXPORT_FUNC(grub_exit) (void) __attribute__ ((noreturn));
grub_uint64_t EXPORT_FUNC(grub_divmod64) (grub_uint64_t n,
grub_uint64_t d,
grub_uint64_t *r);
/* Must match softdiv group in gentpl.py. */
#if !defined(GRUB_MACHINE_EMU) && (defined(__arm__) || defined(__ia64__) || \
(defined(__riscv) && (__riscv_xlen == 32)))
#define GRUB_DIVISION_IN_SOFTWARE 1
#else
#define GRUB_DIVISION_IN_SOFTWARE 0
#endif
/* Some division functions need to be in kernel if compiler generates calls
to them. Otherwise we still need them for consistent tests but they go
into a separate module. */
#if GRUB_DIVISION_IN_SOFTWARE
#define EXPORT_FUNC_IF_SOFTDIV EXPORT_FUNC
#else
#define EXPORT_FUNC_IF_SOFTDIV(x) x
#endif
grub_int64_t
EXPORT_FUNC_IF_SOFTDIV(grub_divmod64s) (grub_int64_t n,
grub_int64_t d,
grub_int64_t *r);
grub_uint32_t
EXPORT_FUNC_IF_SOFTDIV (grub_divmod32) (grub_uint32_t n,
grub_uint32_t d,
grub_uint32_t *r);
grub_int32_t
EXPORT_FUNC_IF_SOFTDIV (grub_divmod32s) (grub_int32_t n,
grub_int32_t d,
grub_int32_t *r);
/* Inline functions. */
static inline char *
grub_memchr (const void *p, int c, grub_size_t len)
{
const char *s = (const char *) p;
const char *e = s + len;
for (; s < e; s++)
if (*s == c)
return (char *) s;
return 0;
}
static inline unsigned int
grub_abs (int x)
{
if (x < 0)
return (unsigned int) (-x);
else
return (unsigned int) x;
}
/* Reboot the machine. */
#if defined (GRUB_MACHINE_EMU) || defined (GRUB_MACHINE_QEMU_MIPS) || \
defined (GRUB_MACHINE_EFI)
void EXPORT_FUNC(grub_reboot) (void) __attribute__ ((noreturn));
#else
void grub_reboot (void) __attribute__ ((noreturn));
#endif
#if defined (__clang__) && !defined (GRUB_UTIL)
void __attribute__ ((noreturn)) EXPORT_FUNC (abort) (void);
#endif
#ifdef GRUB_MACHINE_PCBIOS
/* Halt the system, using APM if possible. If NO_APM is true, don't
* use APM even if it is available. */
void grub_halt (int no_apm) __attribute__ ((noreturn));
#elif defined (__mips__) && !defined (GRUB_MACHINE_EMU)
void EXPORT_FUNC (grub_halt) (void) __attribute__ ((noreturn));
#else
void grub_halt (void) __attribute__ ((noreturn));
#endif
#ifdef GRUB_MACHINE_EMU
/* Flag to check if module loading is available. */
extern const int EXPORT_VAR(grub_no_modules);
#else
#define grub_no_modules 0
#endif
static inline void
grub_error_save (struct grub_error_saved *save)
{
grub_memcpy (save->errmsg, grub_errmsg, sizeof (save->errmsg));
save->grub_errno = grub_errno;
grub_errno = GRUB_ERR_NONE;
}
static inline void
grub_error_load (const struct grub_error_saved *save)
{
grub_memcpy (grub_errmsg, save->errmsg, sizeof (grub_errmsg));
grub_errno = save->grub_errno;
}
#if BOOT_TIME_STATS
struct grub_boot_time
{
struct grub_boot_time *next;
grub_uint64_t tp;
const char *file;
int line;
char *msg;
};
extern struct grub_boot_time *EXPORT_VAR(grub_boot_time_head);
void EXPORT_FUNC(grub_real_boot_time) (const char *file,
const int line,
const char *fmt, ...) __attribute__ ((format (GNU_PRINTF, 3, 4)));
#define grub_boot_time(...) grub_real_boot_time(GRUB_FILE, __LINE__, __VA_ARGS__)
#else
#define grub_boot_time(...)
#endif
#define grub_max(a, b) (((a) > (b)) ? (a) : (b))
#define grub_min(a, b) (((a) < (b)) ? (a) : (b))
#endif /* ! GRUB_MISC_HEADER */
Reference in a new issue View git blame Copy permalink