1 /*
2 * "streamable kanji code filter and converter"
3 * Copyright (c) 1998-2002 HappySize, Inc. All rights reserved.
4 *
5 * LICENSE NOTICES
6 *
7 * This file is part of "streamable kanji code filter and converter",
8 * which is distributed under the terms of GNU Lesser General Public
9 * License (version 2) as published by the Free Software Foundation.
10 *
11 * This software is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with "streamable kanji code filter and converter";
18 * if not, write to the Free Software Foundation, Inc., 59 Temple Place,
19 * Suite 330, Boston, MA 02111-1307 USA
20 *
21 * The author of this file:
22 *
23 */
24 /*
25 * The source code included in this file was separated from mbfilter.c
26 * by moriyoshi koizumi <moriyoshi@php.net> on 4 dec 2002.
27 *
28 */
29
30 /* Modified UTF-7 used for 'international mailbox names' in the IMAP protocol
31 * Also known as mUTF-7
32 * Defined in RFC 3501 5.1.3 (https://tools.ietf.org/html/rfc3501)
33 *
34 * Quoting from the RFC:
35 *
36 ***********************************************************************
37 * In modified UTF-7, printable US-ASCII characters, except for "&",
38 * represent themselves; that is, characters with octet values 0x20-0x25
39 * and 0x27-0x7e. The character "&" (0x26) is represented by the
40 * two-octet sequence "&-".
41 *
42 * All other characters (octet values 0x00-0x1f and 0x7f-0xff) are
43 * represented in modified BASE64, with a further modification from
44 * UTF-7 that "," is used instead of "/". Modified BASE64 MUST NOT be
45 * used to represent any printing US-ASCII character which can represent
46 * itself.
47 *
48 * "&" is used to shift to modified BASE64 and "-" to shift back to
49 * US-ASCII. There is no implicit shift from BASE64 to US-ASCII, and
50 * null shifts ("-&" while in BASE64; note that "&-" while in US-ASCII
51 * means "&") are not permitted. However, all names start in US-ASCII,
52 * and MUST end in US-ASCII; that is, a name that ends with a non-ASCII
53 * ISO-10646 character MUST end with a "-").
54 ***********************************************************************
55 *
56 * The purpose of all this is: 1) to keep all parts of IMAP messages 7-bit clean,
57 * 2) to avoid giving special treatment to +, /, \, and ~, since these are
58 * commonly used in mailbox names, and 3) to ensure there is only one
59 * representation of any mailbox name (vanilla UTF-7 does allow multiple
60 * representations of the same string, by Base64-encoding characters which
61 * could have been included as ASCII literals.)
62 *
63 * RFC 2152 also applies, since it defines vanilla UTF-7 (minus IMAP modifications)
64 * The following paragraph is notable:
65 *
66 ***********************************************************************
67 * Unicode is encoded using Modified Base64 by first converting Unicode
68 * 16-bit quantities to an octet stream (with the most significant octet first).
69 * Surrogate pairs (UTF-16) are converted by treating each half of the pair as
70 * a separate 16 bit quantity (i.e., no special treatment). Text with an odd
71 * number of octets is ill-formed. ISO 10646 characters outside the range
72 * addressable via surrogate pairs cannot be encoded.
73 ***********************************************************************
74 *
75 * So after reversing the modified Base64 encoding on an encoded section,
76 * the contents are interpreted as UTF-16BE. */
77
78 #include "mbfilter.h"
79 #include "mbfilter_utf7imap.h"
80 #include "utf7_helper.h"
81
82 static int mbfl_filt_conv_wchar_utf7imap_flush(mbfl_convert_filter *filter);
83 static int mbfl_filt_conv_utf7imap_wchar_flush(mbfl_convert_filter *filter);
84 static size_t mb_utf7imap_to_wchar(unsigned char **in, size_t *in_len, uint32_t *buf, size_t bufsize, unsigned int *state);
85 static void mb_wchar_to_utf7imap(uint32_t *in, size_t len, mb_convert_buf *buf, bool end);
86 static bool mb_check_utf7imap(unsigned char *in, size_t in_len);
87
88 static const char *mbfl_encoding_utf7imap_aliases[] = {"mUTF-7", NULL};
89
90 const mbfl_encoding mbfl_encoding_utf7imap = {
91 mbfl_no_encoding_utf7imap,
92 "UTF7-IMAP",
93 NULL,
94 mbfl_encoding_utf7imap_aliases,
95 NULL,
96 0,
97 &vtbl_utf7imap_wchar,
98 &vtbl_wchar_utf7imap,
99 mb_utf7imap_to_wchar,
100 mb_wchar_to_utf7imap,
101 mb_check_utf7imap,
102 NULL,
103 };
104
105 const struct mbfl_convert_vtbl vtbl_utf7imap_wchar = {
106 mbfl_no_encoding_utf7imap,
107 mbfl_no_encoding_wchar,
108 mbfl_filt_conv_common_ctor,
109 NULL,
110 mbfl_filt_conv_utf7imap_wchar,
111 mbfl_filt_conv_utf7imap_wchar_flush,
112 NULL,
113 };
114
115 const struct mbfl_convert_vtbl vtbl_wchar_utf7imap = {
116 mbfl_no_encoding_wchar,
117 mbfl_no_encoding_utf7imap,
118 mbfl_filt_conv_common_ctor,
119 NULL,
120 mbfl_filt_conv_wchar_utf7imap,
121 mbfl_filt_conv_wchar_utf7imap_flush,
122 NULL,
123 };
124
125 #define CK(statement) do { if ((statement) < 0) return (-1); } while (0)
126
mbfl_filt_conv_utf7imap_wchar(int c,mbfl_convert_filter * filter)127 int mbfl_filt_conv_utf7imap_wchar(int c, mbfl_convert_filter *filter)
128 {
129 int s, n = -1;
130
131 if (filter->status != 0) { /* Modified Base64 */
132 if (c >= 'A' && c <= 'Z') {
133 n = c - 65;
134 } else if (c >= 'a' && c <= 'z') {
135 n = c - 71;
136 } else if (c >= '0' && c <= '9') {
137 n = c + 4;
138 } else if (c == '+') {
139 n = 62;
140 } else if (c == ',') {
141 n = 63;
142 }
143
144 if (n < 0 || n > 63) {
145 if (c == '-') {
146 if (filter->status == 1) { /* "&-" -> "&" */
147 filter->cache = filter->status = 0;
148 CK((*filter->output_function)('&', filter->data));
149 } else if (filter->cache) {
150 /* Base64-encoded section ended abruptly, with partially encoded characters,
151 * or it could be that it ended on the first half of a surrogate pair */
152 filter->cache = filter->status = 0;
153 CK((*filter->output_function)(MBFL_BAD_INPUT, filter->data));
154 } else {
155 /* Base64-encoded section properly terminated by - */
156 filter->cache = filter->status = 0;
157 }
158 } else { /* illegal character */
159 filter->cache = filter->status = 0;
160 CK((*filter->output_function)(MBFL_BAD_INPUT, filter->data));
161 }
162 return 0;
163 }
164 }
165
166 switch (filter->status) {
167 /* directly encoded characters */
168 case 0:
169 if (c == '&') { /* shift character */
170 filter->status++;
171 } else if (c >= 0x20 && c <= 0x7E) { /* ASCII */
172 CK((*filter->output_function)(c, filter->data));
173 } else { /* illegal character */
174 CK((*filter->output_function)(MBFL_BAD_INPUT, filter->data));
175 }
176 break;
177
178 /* decode Modified Base64 */
179 case 1:
180 case 2:
181 filter->cache |= n << 10;
182 filter->status = 3;
183 break;
184 case 3:
185 filter->cache |= n << 4;
186 filter->status = 4;
187 break;
188 case 4:
189 s = ((n >> 2) & 0xf) | (filter->cache & 0xffff);
190 n = (n & 0x3) << 14;
191 filter->status = 5;
192 if (s >= 0xd800 && s < 0xdc00) {
193 /* 1st part of surrogate pair */
194 s = (((s & 0x3ff) << 16) + 0x400000) | n;
195 filter->cache = s;
196 } else if (s >= 0xdc00 && s < 0xe000) {
197 /* 2nd part of surrogate pair */
198 if (filter->cache & 0xfff0000) {
199 s &= 0x3ff;
200 s |= (filter->cache & 0xfff0000) >> 6;
201 filter->cache = n;
202 CK((*filter->output_function)(s, filter->data));
203 } else { /* illegal character */
204 CK((*filter->output_function)(MBFL_BAD_INPUT, filter->data));
205 }
206 } else {
207 filter->cache = n;
208 /* Characters which can be expressed as literal, ASCII characters
209 * should not be Base64-encoded */
210 if (s < 0x20 || s > 0x7E || s == '&') {
211 CK((*filter->output_function)(s, filter->data));
212 } else {
213 CK((*filter->output_function)(MBFL_BAD_INPUT, filter->data));
214 }
215 }
216 break;
217
218 case 5:
219 filter->cache |= n << 8;
220 filter->status = 6;
221 break;
222 case 6:
223 filter->cache |= n << 2;
224 filter->status = 7;
225 break;
226 case 7:
227 s = ((n >> 4) & 0x3) | (filter->cache & 0xffff);
228 n = (n & 0xf) << 12;
229 filter->status = 8;
230 if (s >= 0xd800 && s < 0xdc00) {
231 s = (((s & 0x3ff) << 16) + 0x400000) | n;
232 filter->cache = s;
233 } else if (s >= 0xdc00 && s < 0xe000) {
234 if (filter->cache & 0xfff0000) {
235 s &= 0x3ff;
236 s |= (filter->cache & 0xfff0000) >> 6;
237 filter->cache = n;
238 CK((*filter->output_function)(s, filter->data));
239 } else { /* illegal character */
240 CK((*filter->output_function)(MBFL_BAD_INPUT, filter->data));
241 }
242 } else {
243 filter->cache = n;
244 /* Characters which can be expressed as literal, ASCII characters
245 * should not be Base64-encoded */
246 if (s < 0x20 || s > 0x7E || s == '&') {
247 CK((*filter->output_function)(s, filter->data));
248 } else {
249 CK((*filter->output_function)(MBFL_BAD_INPUT, filter->data));
250 }
251 }
252 break;
253
254 case 8:
255 filter->cache |= n << 6;
256 filter->status = 9;
257 break;
258 case 9:
259 s = n | (filter->cache & 0xffff);
260 filter->status = 2;
261 if (s >= 0xd800 && s < 0xdc00) {
262 s = (((s & 0x3ff) << 16) + 0x400000);
263 filter->cache = s;
264 } else if (s >= 0xdc00 && s < 0xe000) {
265 if (filter->cache & 0xfff0000) {
266 s &= 0x3ff;
267 s |= (filter->cache & 0xfff0000) >> 6;
268 filter->cache = 0;
269 CK((*filter->output_function)(s, filter->data));
270 } else { /* illegal character */
271 CK((*filter->output_function)(MBFL_BAD_INPUT, filter->data));
272 }
273 } else {
274 filter->cache = 0;
275 /* Characters which can be expressed as literal, ASCII characters
276 * should not be Base64-encoded */
277 if (s < 0x20 || s > 0x7E || s == '&') {
278 CK((*filter->output_function)(s, filter->data));
279 } else {
280 CK((*filter->output_function)(MBFL_BAD_INPUT, filter->data));
281 }
282 }
283 break;
284
285 EMPTY_SWITCH_DEFAULT_CASE();
286 }
287
288 return 0;
289 }
290
mbfl_filt_conv_utf7imap_wchar_flush(mbfl_convert_filter * filter)291 static int mbfl_filt_conv_utf7imap_wchar_flush(mbfl_convert_filter *filter)
292 {
293 if (filter->status) {
294 /* It is illegal for a UTF-7 IMAP string to end in a Base-64 encoded
295 * section. It should always change back to ASCII before the end. */
296 (*filter->output_function)(MBFL_BAD_INPUT, filter->data);
297 filter->status = 0;
298 }
299
300 if (filter->flush_function) {
301 (*filter->flush_function)(filter->data);
302 }
303
304 return 0;
305 }
306
307 static const unsigned char mbfl_utf7imap_base64_table[] =
308 {
309 /* 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', */
310 0x41,0x42,0x43,0x44,0x45,0x46,0x47,0x48,0x49,0x4a,0x4b,0x4c,0x4d,
311 /* 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', */
312 0x4e,0x4f,0x50,0x51,0x52,0x53,0x54,0x55,0x56,0x57,0x58,0x59,0x5a,
313 /* 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', */
314 0x61,0x62,0x63,0x64,0x65,0x66,0x67,0x68,0x69,0x6a,0x6b,0x6c,0x6d,
315 /* 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', */
316 0x6e,0x6f,0x70,0x71,0x72,0x73,0x74,0x75,0x76,0x77,0x78,0x79,0x7a,
317 /* '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '+', ',', '\0' */
318 0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x2b,0x2c,0x00
319 };
320
mbfl_filt_conv_wchar_utf7imap(int c,mbfl_convert_filter * filter)321 int mbfl_filt_conv_wchar_utf7imap(int c, mbfl_convert_filter *filter)
322 {
323 int n = 0, s;
324
325 if (c == '&') {
326 n = 1;
327 } else if ((c >= 0x20 && c <= 0x7e) || c == 0) {
328 n = 2;
329 } else if (c >= 0 && c < MBFL_WCSPLANE_UCS2MAX) {
330 ;
331 } else if (c >= MBFL_WCSPLANE_SUPMIN && c < MBFL_WCSPLANE_SUPMAX) {
332 s = ((c >> 10) - 0x40) | 0xd800;
333 CK((*filter->filter_function)(s, filter));
334 s = (c & 0x3ff) | 0xdc00;
335 CK((*filter->filter_function)(s, filter));
336 return 0;
337 } else {
338 CK(mbfl_filt_conv_illegal_output(c, filter));
339 return 0;
340 }
341
342 switch (filter->status) {
343 case 0:
344 if (n != 0) { /* directly encode characters */
345 CK((*filter->output_function)(c, filter->data));
346 if (n == 1) {
347 CK((*filter->output_function)(0x2d, filter->data)); /* '-' */
348 }
349 } else { /* Modified Base64 */
350 CK((*filter->output_function)(0x26, filter->data)); /* '&' */
351 filter->status = 1;
352 filter->cache = c;
353 }
354 break;
355
356 /* encode Modified Base64 */
357 case 1:
358 s = filter->cache;
359 CK((*filter->output_function)(mbfl_utf7imap_base64_table[(s >> 10) & 0x3f], filter->data));
360 CK((*filter->output_function)(mbfl_utf7imap_base64_table[(s >> 4) & 0x3f], filter->data));
361 if (n != 0) {
362 CK((*filter->output_function)(mbfl_utf7imap_base64_table[(s << 2) & 0x3c], filter->data));
363 CK((*filter->output_function)('-', filter->data));
364 CK((*filter->output_function)(c, filter->data));
365 if (n == 1) {
366 CK((*filter->output_function)('-', filter->data));
367 }
368 filter->status = 0;
369 } else {
370 filter->status = 2;
371 filter->cache = ((s & 0xf) << 16) | c;
372 }
373 break;
374
375 case 2:
376 s = filter->cache;
377 CK((*filter->output_function)(mbfl_utf7imap_base64_table[(s >> 14) & 0x3f], filter->data));
378 CK((*filter->output_function)(mbfl_utf7imap_base64_table[(s >> 8) & 0x3f], filter->data));
379 CK((*filter->output_function)(mbfl_utf7imap_base64_table[(s >> 2) & 0x3f], filter->data));
380 if (n != 0) {
381 CK((*filter->output_function)(mbfl_utf7imap_base64_table[(s << 4) & 0x30], filter->data));
382 CK((*filter->output_function)('-', filter->data));
383 CK((*filter->output_function)(c, filter->data));
384 if (n == 1) {
385 CK((*filter->output_function)('-', filter->data));
386 }
387 filter->status = 0;
388 } else {
389 filter->status = 3;
390 filter->cache = ((s & 0x3) << 16) | c;
391 }
392 break;
393
394 case 3:
395 s = filter->cache;
396 CK((*filter->output_function)(mbfl_utf7imap_base64_table[(s >> 12) & 0x3f], filter->data));
397 CK((*filter->output_function)(mbfl_utf7imap_base64_table[(s >> 6) & 0x3f], filter->data));
398 CK((*filter->output_function)(mbfl_utf7imap_base64_table[s & 0x3f], filter->data));
399 if (n != 0) {
400 CK((*filter->output_function)('-', filter->data));
401 CK((*filter->output_function)(c, filter->data));
402 if (n == 1) {
403 CK((*filter->output_function)('-', filter->data));
404 }
405 filter->status = 0;
406 } else {
407 filter->status = 1;
408 filter->cache = c;
409 }
410 break;
411
412 EMPTY_SWITCH_DEFAULT_CASE();
413 }
414
415 return 0;
416 }
417
mbfl_filt_conv_wchar_utf7imap_flush(mbfl_convert_filter * filter)418 static int mbfl_filt_conv_wchar_utf7imap_flush(mbfl_convert_filter *filter)
419 {
420 int status = filter->status, cache = filter->cache;
421 filter->status = filter->cache = 0;
422
423 /* flush fragments */
424 switch (status) {
425 case 1:
426 CK((*filter->output_function)(mbfl_utf7imap_base64_table[(cache >> 10) & 0x3f], filter->data));
427 CK((*filter->output_function)(mbfl_utf7imap_base64_table[(cache >> 4) & 0x3f], filter->data));
428 CK((*filter->output_function)(mbfl_utf7imap_base64_table[(cache << 2) & 0x3c], filter->data));
429 CK((*filter->output_function)('-', filter->data));
430 break;
431
432 case 2:
433 CK((*filter->output_function)(mbfl_utf7imap_base64_table[(cache >> 14) & 0x3f], filter->data));
434 CK((*filter->output_function)(mbfl_utf7imap_base64_table[(cache >> 8) & 0x3f], filter->data));
435 CK((*filter->output_function)(mbfl_utf7imap_base64_table[(cache >> 2) & 0x3f], filter->data));
436 CK((*filter->output_function)(mbfl_utf7imap_base64_table[(cache << 4) & 0x30], filter->data));
437 CK((*filter->output_function)('-', filter->data));
438 break;
439
440 case 3:
441 CK((*filter->output_function)(mbfl_utf7imap_base64_table[(cache >> 12) & 0x3f], filter->data));
442 CK((*filter->output_function)(mbfl_utf7imap_base64_table[(cache >> 6) & 0x3f], filter->data));
443 CK((*filter->output_function)(mbfl_utf7imap_base64_table[cache & 0x3f], filter->data));
444 CK((*filter->output_function)('-', filter->data));
445 break;
446 }
447
448 return 0;
449 }
450
is_base64_end(unsigned char c)451 static inline bool is_base64_end(unsigned char c)
452 {
453 return c >= DASH;
454 }
455
decode_base64(unsigned char c)456 static unsigned char decode_base64(unsigned char c)
457 {
458 if (c >= 'A' && c <= 'Z') {
459 return c - 65;
460 } else if (c >= 'a' && c <= 'z') {
461 return c - 71;
462 } else if (c >= '0' && c <= '9') {
463 return c + 4;
464 } else if (c == '+') {
465 return 62;
466 } else if (c == ',') {
467 return 63;
468 } else if (c == '-') {
469 return DASH;
470 }
471 return ILLEGAL;
472 }
473
handle_utf16_cp(uint16_t cp,uint32_t * out,uint16_t * surrogate1)474 static uint32_t* handle_utf16_cp(uint16_t cp, uint32_t *out, uint16_t *surrogate1)
475 {
476 retry:
477 if (*surrogate1) {
478 if (cp >= 0xDC00 && cp <= 0xDFFF) {
479 *out++ = ((*surrogate1 & 0x3FF) << 10) + (cp & 0x3FF) + 0x10000;
480 *surrogate1 = 0;
481 } else {
482 *out++ = MBFL_BAD_INPUT;
483 *surrogate1 = 0;
484 goto retry;
485 }
486 } else if (cp >= 0xD800 && cp <= 0xDBFF) {
487 *surrogate1 = cp;
488 } else if (cp >= 0xDC00 && cp <= 0xDFFF) {
489 /* 2nd part of surrogate pair came unexpectedly */
490 *out++ = MBFL_BAD_INPUT;
491 } else if (cp >= 0x20 && cp <= 0x7E && cp != '&') {
492 *out++ = MBFL_BAD_INPUT;
493 } else {
494 *out++ = cp;
495 }
496 return out;
497 }
498
handle_base64_end(unsigned char n,uint32_t * out,bool * base64,bool abrupt,uint16_t * surrogate1)499 static uint32_t* handle_base64_end(unsigned char n, uint32_t *out, bool *base64, bool abrupt, uint16_t *surrogate1)
500 {
501 if (abrupt || n == ILLEGAL || *surrogate1) {
502 *out++ = MBFL_BAD_INPUT;
503 *surrogate1 = 0;
504 }
505
506 *base64 = false;
507 return out;
508 }
509
mb_utf7imap_to_wchar(unsigned char ** in,size_t * in_len,uint32_t * buf,size_t bufsize,unsigned int * state)510 static size_t mb_utf7imap_to_wchar(unsigned char **in, size_t *in_len, uint32_t *buf, size_t bufsize, unsigned int *state)
511 {
512 ZEND_ASSERT(bufsize >= 5); /* This function will infinite-loop if called with a tiny output buffer */
513
514 /* Why does this require a minimum output buffer size of 5?
515 * See comment in mb_utf7_to_wchar; the worst case for this function is similar,
516 * though not exactly the same. */
517
518 unsigned char *p = *in, *e = p + *in_len;
519 /* Always leave one empty space in output buffer in case the string ends while
520 * in Base64 mode and we need to emit an error marker */
521 uint32_t *out = buf, *limit = buf + bufsize - 1;
522
523 bool base64 = *state & 1;
524 uint16_t surrogate1 = (*state >> 1); /* First half of a surrogate pair */
525
526 while (p < e && out < limit) {
527 if (base64) {
528 /* Base64 section */
529 if ((limit - out) < 4) {
530 break;
531 }
532
533 unsigned char n1 = decode_base64(*p++);
534 if (is_base64_end(n1)) {
535 out = handle_base64_end(n1, out, &base64, false, &surrogate1);
536 continue;
537 } else if (p == e) {
538 out = handle_base64_end(n1, out, &base64, true, &surrogate1);
539 continue;
540 }
541 unsigned char n2 = decode_base64(*p++);
542 if (is_base64_end(n2) || p == e) {
543 out = handle_base64_end(n2, out, &base64, true, &surrogate1);
544 continue;
545 }
546 unsigned char n3 = decode_base64(*p++);
547 if (is_base64_end(n3)) {
548 out = handle_base64_end(n3, out, &base64, true, &surrogate1);
549 continue;
550 }
551 out = handle_utf16_cp((n1 << 10) | (n2 << 4) | ((n3 & 0x3C) >> 2), out, &surrogate1);
552 if (p == e) {
553 /* It is an error if trailing padding bits are not zeroes or if we were
554 * expecting the 2nd part of a surrogate pair when Base64 section ends */
555 if ((n3 & 0x3) || surrogate1)
556 *out++ = MBFL_BAD_INPUT;
557 break;
558 }
559
560 unsigned char n4 = decode_base64(*p++);
561 if (is_base64_end(n4)) {
562 out = handle_base64_end(n4, out, &base64, n3 & 0x3, &surrogate1);
563 continue;
564 } else if (p == e) {
565 out = handle_base64_end(n4, out, &base64, true, &surrogate1);
566 continue;
567 }
568 unsigned char n5 = decode_base64(*p++);
569 if (is_base64_end(n5) || p == e) {
570 out = handle_base64_end(n5, out, &base64, true, &surrogate1);
571 continue;
572 }
573 unsigned char n6 = decode_base64(*p++);
574 if (is_base64_end(n6)) {
575 out = handle_base64_end(n6, out, &base64, true, &surrogate1);
576 continue;
577 }
578 out = handle_utf16_cp((n3 << 14) | (n4 << 8) | (n5 << 2) | ((n6 & 0x30) >> 4), out, &surrogate1);
579 if (p == e) {
580 if ((n6 & 0xF) || surrogate1)
581 *out++ = MBFL_BAD_INPUT;
582 break;
583 }
584
585 unsigned char n7 = decode_base64(*p++);
586 if (is_base64_end(n7)) {
587 out = handle_base64_end(n7, out, &base64, n6 & 0xF, &surrogate1);
588 continue;
589 } else if (p == e) {
590 out = handle_base64_end(n7, out, &base64, true, &surrogate1);
591 continue;
592 }
593 unsigned char n8 = decode_base64(*p++);
594 if (is_base64_end(n8)) {
595 out = handle_base64_end(n8, out, &base64, true, &surrogate1);
596 continue;
597 }
598 out = handle_utf16_cp((n6 << 12) | (n7 << 6) | n8, out, &surrogate1);
599 } else {
600 unsigned char c = *p++;
601
602 if (c == '&') {
603 if (p < e && *p == '-') {
604 *out++ = '&';
605 p++;
606 } else {
607 base64 = true;
608 }
609 } else if (c >= 0x20 && c <= 0x7E) {
610 *out++ = c;
611 } else {
612 *out++ = MBFL_BAD_INPUT;
613 }
614 }
615 }
616
617 if (p == e && base64) {
618 /* UTF7-IMAP doesn't allow strings to end in Base64 mode
619 * One space in output buffer was reserved just for this */
620 ZEND_ASSERT(out < limit);
621 *out++ = MBFL_BAD_INPUT;
622 }
623
624 *state = (surrogate1 << 1) | base64;
625 *in_len = e - p;
626 *in = p;
627 return out - buf;
628 }
629
630 #define SAVE_CONVERSION_STATE() buf->state = (cache << 4) | (nbits << 1) | base64
631 #define RESTORE_CONVERSION_STATE() base64 = (buf->state & 1); nbits = (buf->state >> 1) & 0x7; cache = (buf->state >> 4)
632
633 static const unsigned char mbfl_base64_table[] = {
634 /* 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', */
635 0x41,0x42,0x43,0x44,0x45,0x46,0x47,0x48,0x49,0x4a,0x4b,0x4c,0x4d,
636 /* 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', */
637 0x4e,0x4f,0x50,0x51,0x52,0x53,0x54,0x55,0x56,0x57,0x58,0x59,0x5a,
638 /* 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', */
639 0x61,0x62,0x63,0x64,0x65,0x66,0x67,0x68,0x69,0x6a,0x6b,0x6c,0x6d,
640 /* 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', */
641 0x6e,0x6f,0x70,0x71,0x72,0x73,0x74,0x75,0x76,0x77,0x78,0x79,0x7a,
642 /* '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '+', ',', '\0' */
643 0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x2b,0x2c,0x00
644 };
645
mb_wchar_to_utf7imap(uint32_t * in,size_t len,mb_convert_buf * buf,bool end)646 static void mb_wchar_to_utf7imap(uint32_t *in, size_t len, mb_convert_buf *buf, bool end)
647 {
648 unsigned char *out, *limit;
649 MB_CONVERT_BUF_LOAD(buf, out, limit);
650 MB_CONVERT_BUF_ENSURE(buf, out, limit, len);
651
652 bool base64;
653 unsigned char nbits, cache; /* `nbits` is the number of cached bits; either 0, 2, or 4 */
654 RESTORE_CONVERSION_STATE();
655
656 while (len--) {
657 uint32_t w = *in++;
658 if (base64) {
659 if (w >= 0x20 && w <= 0x7E) {
660 /* End of Base64 section. Drain buffered bits (if any), close Base64 section
661 * Leave enough space in the output buffer such that even if the remainder of
662 * the input string is ASCII, we can output the whole thing without having to
663 * check for output buffer space again */
664 base64 = false;
665 in--; len++; /* Unconsume codepoint; it will be handled by 'ASCII section' code below */
666 MB_CONVERT_BUF_ENSURE(buf, out, limit, len + 2);
667 if (nbits) {
668 out = mb_convert_buf_add(out, mbfl_base64_table[(cache << (6 - nbits)) & 0x3F]);
669 }
670 nbits = cache = 0;
671 out = mb_convert_buf_add(out, '-');
672 } else if (w >= MBFL_WCSPLANE_UTF32MAX) {
673 /* Make recursive call to add an error marker character */
674 SAVE_CONVERSION_STATE();
675 MB_CONVERT_ERROR(buf, out, limit, w, mb_wchar_to_utf7imap);
676 MB_CONVERT_BUF_ENSURE(buf, out, limit, len);
677 RESTORE_CONVERSION_STATE();
678 } else {
679 /* Encode codepoint, preceded by any cached bits, as Base64
680 * Make enough space in the output buffer to hold both any bytes that
681 * we emit right here, plus any finishing byte which might need to
682 * be emitted if the input string ends abruptly */
683 uint64_t bits;
684 if (w >= MBFL_WCSPLANE_SUPMIN) {
685 /* Must use surrogate pair */
686 MB_CONVERT_BUF_ENSURE(buf, out, limit, 7);
687 w -= 0x10000;
688 bits = ((uint64_t)cache << 32) | 0xD800DC00L | ((w & 0xFFC00) << 6) | (w & 0x3FF);
689 nbits += 32;
690 } else {
691 MB_CONVERT_BUF_ENSURE(buf, out, limit, 4);
692 bits = (cache << 16) | w;
693 nbits += 16;
694 }
695
696 while (nbits >= 6) {
697 out = mb_convert_buf_add(out, mbfl_base64_table[(bits >> (nbits - 6)) & 0x3F]);
698 nbits -= 6;
699 }
700 cache = bits;
701 }
702 } else {
703 /* ASCII section */
704 if (w == '&') {
705 MB_CONVERT_BUF_ENSURE(buf, out, limit, len + 2);
706 out = mb_convert_buf_add2(out, '&', '-');
707 } else if (w >= 0x20 && w <= 0x7E) {
708 out = mb_convert_buf_add(out, w);
709 } else if (w >= MBFL_WCSPLANE_UTF32MAX) {
710 buf->state = 0;
711 MB_CONVERT_ERROR(buf, out, limit, w, mb_wchar_to_utf7imap);
712 MB_CONVERT_BUF_ENSURE(buf, out, limit, len);
713 RESTORE_CONVERSION_STATE();
714 } else {
715 out = mb_convert_buf_add(out, '&');
716 base64 = true;
717 in--; len++; /* Unconsume codepoint; it will be handled by Base64 code above */
718 }
719 }
720 }
721
722 if (end) {
723 if (nbits) {
724 out = mb_convert_buf_add(out, mbfl_base64_table[(cache << (6 - nbits)) & 0x3F]);
725 }
726 if (base64) {
727 MB_CONVERT_BUF_ENSURE(buf, out, limit, 1);
728 out = mb_convert_buf_add(out, '-');
729 }
730 } else {
731 SAVE_CONVERSION_STATE();
732 }
733
734 MB_CONVERT_BUF_STORE(buf, out, limit);
735 }
736
is_utf16_cp_valid(uint16_t cp,bool is_surrogate)737 static bool is_utf16_cp_valid(uint16_t cp, bool is_surrogate)
738 {
739 if (is_surrogate) {
740 return cp >= 0xDC00 && cp <= 0xDFFF;
741 } else if (cp >= 0xDC00 && cp <= 0xDFFF) {
742 /* 2nd part of surrogate pair came unexpectedly */
743 return false;
744 } else if (cp >= 0x20 && cp <= 0x7E && cp != '&') {
745 return false;
746 }
747 return true;
748 }
749
mb_check_utf7imap(unsigned char * in,size_t in_len)750 static bool mb_check_utf7imap(unsigned char *in, size_t in_len)
751 {
752 unsigned char *p = in, *e = p + in_len;
753 bool base64 = false;
754 bool is_surrogate = false;
755
756 while (p < e) {
757 if (base64) {
758 /* Base64 section */
759 unsigned char n1 = decode_base64(*p++);
760 if (is_base64_end(n1)) {
761 if (!is_base64_end_valid(n1, false, is_surrogate)) {
762 return false;
763 }
764 base64 = false;
765 continue;
766 } else if (p == e) {
767 return false;
768 }
769 unsigned char n2 = decode_base64(*p++);
770 if (is_base64_end(n2) || p == e) {
771 return false;
772 }
773 unsigned char n3 = decode_base64(*p++);
774 if (is_base64_end(n3)) {
775 return false;
776 }
777 uint16_t cp1 = (n1 << 10) | (n2 << 4) | ((n3 & 0x3C) >> 2);
778 if (!is_utf16_cp_valid(cp1, is_surrogate)) {
779 return false;
780 }
781 is_surrogate = has_surrogate(cp1, is_surrogate);
782 if (p == e) {
783 return false;
784 }
785
786 unsigned char n4 = decode_base64(*p++);
787 if (is_base64_end(n4)) {
788 if (!is_base64_end_valid(n4, n3 & 0x3, is_surrogate)) {
789 return false;
790 }
791 base64 = false;
792 continue;
793 } else if (p == e) {
794 return false;
795 }
796 unsigned char n5 = decode_base64(*p++);
797 if (is_base64_end(n5) || p == e) {
798 return false;
799 }
800 unsigned char n6 = decode_base64(*p++);
801 if (is_base64_end(n6)) {
802 return false;
803 }
804 uint16_t cp2 = (n3 << 14) | (n4 << 8) | (n5 << 2) | ((n6 & 0x30) >> 4);
805 if (!is_utf16_cp_valid(cp2, is_surrogate)) {
806 return false;
807 }
808 is_surrogate = has_surrogate(cp2, is_surrogate);
809 if (p == e) {
810 return false;
811 }
812
813 unsigned char n7 = decode_base64(*p++);
814 if (is_base64_end(n7)) {
815 if (!is_base64_end_valid(n7, n6 & 0xF, is_surrogate)) {
816 return false;
817 }
818 base64 = false;
819 continue;
820 } else if (p == e) {
821 return false;
822 }
823 unsigned char n8 = decode_base64(*p++);
824 if (is_base64_end(n8)) {
825 return false;
826 }
827 uint16_t cp3 = (n6 << 12) | (n7 << 6) | n8;
828 if (!is_utf16_cp_valid(cp3, is_surrogate)) {
829 return false;
830 }
831 is_surrogate = has_surrogate(cp3, is_surrogate);
832 } else {
833 /* ASCII text section */
834 unsigned char c = *p++;
835
836 if (c == '&') {
837 if (p == e) {
838 return false;
839 }
840 unsigned char n = decode_base64(*p);
841 if (n == DASH) {
842 p++;
843 } else if (n == ILLEGAL) {
844 return false;
845 } else {
846 base64 = true;
847 }
848 } else if (c >= 0x20 && c <= 0x7E) {
849 continue;
850 } else {
851 return false;
852 }
853 }
854 }
855 return !base64;
856 }
857
