Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix valid_format() to be more careful about allowing only valid printf

Browse Source 
formats.

Also, accept %a and %A, which are new since this logic was last updated,
and also allow %F even though it's not functionally different from %f.
Document these additions and bump date of man page.

Fixes PR 43355.
This commit is contained in:
dholland 2010-05-27 08:30:35 +00:00
parent 5373bec4d9
commit 76c7c8ecbf
2 changed files with 50 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
usr.bin/seq/seq.1
View File

@ -1,4 +1,4 @@
.\" $NetBSD: seq.1,v 1.6 2008/11/26 15:03:47 ginsbach Exp $
.\" $NetBSD: seq.1,v 1.7 2010/05/27 08:30:35 dholland Exp $
.\"
.\" Copyright (c) 2005 The NetBSD Foundation, Inc.
.\" All rights reserved.
@ -28,7 +28,7 @@
.\" POSSIBILITY OF SUCH DAMAGE.
.\"
.\"
.Dd January 17, 2005
.Dd May 27, 2010
.Dt SEQ 1
.Os
.Sh NAME
@ -78,8 +78,11 @@ style
.Ar format
to print each number.
Only the
.Cm A ,
.Cm a ,
.Cm E ,
.Cm e ,
.Cm F ,
.Cm f ,
.Cm G ,
.Cm g ,

73
usr.bin/seq/seq.c
View File

@ -31,7 +31,7 @@
#ifndef lint
__COPYRIGHT("@(#) Copyright (c) 2005\
The NetBSD Foundation, Inc. All rights reserved.");
__RCSID("$NetBSD: seq.c,v 1.5 2008/07/21 14:19:26 lukem Exp $");
__RCSID("$NetBSD: seq.c,v 1.6 2010/05/27 08:30:35 dholland Exp $");
#endif /* not lint */
#include <ctype.h>
@ -228,39 +228,56 @@ numeric(const char *s)
int
valid_format(const char *fmt)
{
int conversions = 0;
unsigned conversions = 0;
while (*fmt != '\0') {
/* scan for conversions */
if (*fmt != '\0' && *fmt != '%') {
do {
fmt++;
} while (*fmt != '\0' && *fmt != '%');
if (*fmt != '%') {
fmt++;
continue;
}
/* scan a conversion */
if (*fmt != '\0') {
do {
fmt++;
/* allow %% but not things like %10% */
if (*fmt == '%') {
fmt++;
continue;
}
/* flags */
while (*fmt != '\0' && strchr("#0- +'", *fmt)) {
fmt++;
}
/* field width */
while (*fmt != '\0' && strchr("0123456789", *fmt)) {
fmt++;
}
/* precision */
if (*fmt == '.') {
fmt++;
while (*fmt != '\0' && strchr("0123456789", *fmt)) {
fmt++;
}
}
/* ok %% */
if (*fmt == '%') {
fmt++;
break;
}
/* valid conversions */
if (strchr("eEfgG", *fmt) &&
conversions++ < 1) {
fmt++;
break;
}
/* flags, width and precsision */
if (isdigit((unsigned char)*fmt) ||
strchr("+- 0#.", *fmt))
continue;
/* oops! bad conversion format! */
return (0);
} while (*fmt != '\0');
/* conversion */
switch (*fmt) {
case 'A':
case 'a':
case 'E':
case 'e':
case 'F':
case 'f':
case 'G':
case 'g':
/* floating point formats are accepted */
conversions++;
break;
default:
/* anything else is not */
return 0;
}
}