Coverage Report

Created: 2026-08-31 06:27

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/libyaml/src/reader.c
Line
Count
Source
1
2
#include "yaml_private.h"
3
4
/*
5
 * Declarations.
6
 */
7
8
static int
9
yaml_parser_set_reader_error(yaml_parser_t *parser, const char *problem,
10
        size_t offset, int value);
11
12
static int
13
yaml_parser_update_raw_buffer(yaml_parser_t *parser);
14
15
static int
16
yaml_parser_determine_encoding(yaml_parser_t *parser);
17
18
YAML_DECLARE(int)
19
yaml_parser_update_buffer(yaml_parser_t *parser, size_t length);
20
21
/*
22
 * Set the reader error and return 0.
23
 */
24
25
static int
26
yaml_parser_set_reader_error(yaml_parser_t *parser, const char *problem,
27
        size_t offset, int value)
28
280
{
29
280
    parser->error = YAML_READER_ERROR;
30
280
    parser->problem = problem;
31
280
    parser->problem_offset = offset;
32
280
    parser->problem_value = value;
33
34
280
    return 0;
35
280
}
36
37
/*
38
 * Byte order marks.
39
 */
40
41
7.23k
#define BOM_UTF8    "\xef\xbb\xbf"
42
7.82k
#define BOM_UTF16LE "\xff\xfe"
43
7.69k
#define BOM_UTF16BE "\xfe\xff"
44
45
/*
46
 * Determine the input stream encoding by checking the BOM symbol. If no BOM is
47
 * found, the UTF-8 encoding is assumed. Return 1 on success, 0 on failure.
48
 */
49
50
static int
51
yaml_parser_determine_encoding(yaml_parser_t *parser)
52
7.91k
{
53
    /* Ensure that we had enough bytes in the raw buffer. */
54
55
16.2k
    while (!parser->eof
56
15.8k
            && parser->raw_buffer.last - parser->raw_buffer.pointer < 3) {
57
8.35k
        if (!yaml_parser_update_raw_buffer(parser)) {
58
0
            return 0;
59
0
        }
60
8.35k
    }
61
62
    /* Determine the encoding. */
63
64
7.91k
    if (parser->raw_buffer.last - parser->raw_buffer.pointer >= 2
65
7.82k
            && !memcmp(parser->raw_buffer.pointer, BOM_UTF16LE, 2)) {
66
135
        parser->encoding = YAML_UTF16LE_ENCODING;
67
135
        parser->raw_buffer.pointer += 2;
68
135
        parser->offset += 2;
69
135
    }
70
7.77k
    else if (parser->raw_buffer.last - parser->raw_buffer.pointer >= 2
71
7.69k
            && !memcmp(parser->raw_buffer.pointer, BOM_UTF16BE, 2)) {
72
105
        parser->encoding = YAML_UTF16BE_ENCODING;
73
105
        parser->raw_buffer.pointer += 2;
74
105
        parser->offset += 2;
75
105
    }
76
7.67k
    else if (parser->raw_buffer.last - parser->raw_buffer.pointer >= 3
77
7.23k
            && !memcmp(parser->raw_buffer.pointer, BOM_UTF8, 3)) {
78
14
        parser->encoding = YAML_UTF8_ENCODING;
79
14
        parser->raw_buffer.pointer += 3;
80
14
        parser->offset += 3;
81
14
    }
82
7.65k
    else {
83
7.65k
        parser->encoding = YAML_UTF8_ENCODING;
84
7.65k
    }
85
86
7.91k
    return 1;
87
7.91k
}
88
89
/*
90
 * Update the raw buffer.
91
 */
92
93
static int
94
yaml_parser_update_raw_buffer(yaml_parser_t *parser)
95
21.6k
{
96
21.6k
    size_t size_read = 0;
97
98
    /* Return if the raw buffer is full. */
99
100
21.6k
    if (parser->raw_buffer.start == parser->raw_buffer.pointer
101
8.35k
            && parser->raw_buffer.last == parser->raw_buffer.end)
102
0
        return 1;
103
104
    /* Return on EOF. */
105
106
21.6k
    if (parser->eof) return 1;
107
108
    /* Move the remaining bytes in the raw buffer to the beginning. */
109
110
21.5k
    if (parser->raw_buffer.start < parser->raw_buffer.pointer
111
13.2k
            && parser->raw_buffer.pointer < parser->raw_buffer.last) {
112
408
        memmove(parser->raw_buffer.start, parser->raw_buffer.pointer,
113
408
                parser->raw_buffer.last - parser->raw_buffer.pointer);
114
408
    }
115
21.5k
    parser->raw_buffer.last -=
116
21.5k
        parser->raw_buffer.pointer - parser->raw_buffer.start;
117
21.5k
    parser->raw_buffer.pointer = parser->raw_buffer.start;
118
119
    /* Call the read handler to fill the buffer. */
120
121
21.5k
    if (!parser->read_handler(parser->read_handler_data, parser->raw_buffer.last,
122
21.5k
                parser->raw_buffer.end - parser->raw_buffer.last, &size_read)) {
123
0
        return yaml_parser_set_reader_error(parser, "input error",
124
0
                parser->offset, -1);
125
0
    }
126
21.5k
    parser->raw_buffer.last += size_read;
127
21.5k
    if (!size_read) {
128
7.41k
        parser->eof = 1;
129
7.41k
    }
130
131
21.5k
    return 1;
132
21.5k
}
133
134
/*
135
 * Ensure that the buffer contains at least `length` characters.
136
 * Return 1 on success, 0 on failure.
137
 *
138
 * The length is supposed to be significantly less that the buffer size.
139
 */
140
141
YAML_DECLARE(int)
142
yaml_parser_update_buffer(yaml_parser_t *parser, size_t length)
143
32.3k
{
144
32.3k
    int first = 1;
145
146
32.3k
    assert(parser->read_handler);   /* Read handler must be set. */
147
148
    /* If the EOF flag is set and the raw buffer is empty, do nothing. */
149
150
32.3k
    if (parser->eof && parser->raw_buffer.pointer == parser->raw_buffer.last)
151
11.2k
        return 1;
152
153
    /* Return if the buffer contains enough characters. */
154
155
21.1k
    if (parser->unread >= length)
156
0
        return 1;
157
158
    /* Determine the input encoding if it is not known yet. */
159
160
21.1k
    if (!parser->encoding) {
161
7.91k
        if (!yaml_parser_determine_encoding(parser))
162
0
            return 0;
163
7.91k
    }
164
165
    /* Move the unread characters to the beginning of the buffer. */
166
167
21.1k
    if (parser->buffer.start < parser->buffer.pointer
168
12.4k
            && parser->buffer.pointer < parser->buffer.last) {
169
6.05k
        size_t size = parser->buffer.last - parser->buffer.pointer;
170
6.05k
        memmove(parser->buffer.start, parser->buffer.pointer, size);
171
6.05k
        parser->buffer.pointer = parser->buffer.start;
172
6.05k
        parser->buffer.last = parser->buffer.start + size;
173
6.05k
    }
174
15.0k
    else if (parser->buffer.pointer == parser->buffer.last) {
175
14.2k
        parser->buffer.pointer = parser->buffer.start;
176
14.2k
        parser->buffer.last = parser->buffer.start;
177
14.2k
    }
178
179
    /* Fill the buffer until it has enough characters. */
180
181
35.1k
    while (parser->unread < length)
182
21.5k
    {
183
        /* Fill the raw buffer if necessary. */
184
185
21.5k
        if (!first || parser->raw_buffer.pointer == parser->raw_buffer.last) {
186
13.2k
            if (!yaml_parser_update_raw_buffer(parser)) return 0;
187
13.2k
        }
188
21.5k
        first = 0;
189
190
        /* Decode the raw buffer. */
191
192
101M
        while (parser->raw_buffer.pointer != parser->raw_buffer.last)
193
101M
        {
194
101M
            unsigned int value = 0, value2 = 0;
195
101M
            int incomplete = 0;
196
101M
            unsigned char octet;
197
101M
            unsigned int width = 0;
198
101M
            int low, high;
199
101M
            size_t k;
200
101M
            size_t raw_unread = parser->raw_buffer.last - parser->raw_buffer.pointer;
201
202
            /* Decode the next character. */
203
204
101M
            switch (parser->encoding)
205
101M
            {
206
99.8M
                case YAML_UTF8_ENCODING:
207
208
                    /*
209
                     * Decode a UTF-8 character.  Check RFC 3629
210
                     * (http://www.ietf.org/rfc/rfc3629.txt) for more details.
211
                     *
212
                     * The following table (taken from the RFC) is used for
213
                     * decoding.
214
                     *
215
                     *    Char. number range |        UTF-8 octet sequence
216
                     *      (hexadecimal)    |              (binary)
217
                     *   --------------------+------------------------------------
218
                     *   0000 0000-0000 007F | 0xxxxxxx
219
                     *   0000 0080-0000 07FF | 110xxxxx 10xxxxxx
220
                     *   0000 0800-0000 FFFF | 1110xxxx 10xxxxxx 10xxxxxx
221
                     *   0001 0000-0010 FFFF | 11110xxx 10xxxxxx 10xxxxxx 10xxxxxx
222
                     *
223
                     * Additionally, the characters in the range 0xD800-0xDFFF
224
                     * are prohibited as they are reserved for use with UTF-16
225
                     * surrogate pairs.
226
                     */
227
228
                    /* Determine the length of the UTF-8 sequence. */
229
230
99.8M
                    octet = parser->raw_buffer.pointer[0];
231
99.8M
                    width = (octet & 0x80) == 0x00 ? 1 :
232
99.8M
                            (octet & 0xE0) == 0xC0 ? 2 :
233
1.68M
                            (octet & 0xF0) == 0xE0 ? 3 :
234
1.67M
                            (octet & 0xF8) == 0xF0 ? 4 : 0;
235
236
                    /* Check if the leading octet is valid. */
237
238
99.8M
                    if (!width)
239
38
                        return yaml_parser_set_reader_error(parser,
240
38
                                "invalid leading UTF-8 octet",
241
38
                                parser->offset, octet);
242
243
                    /* Check if the raw buffer contains an incomplete character. */
244
245
99.8M
                    if (width > raw_unread) {
246
823
                        if (parser->eof) {
247
87
                            return yaml_parser_set_reader_error(parser,
248
87
                                    "incomplete UTF-8 octet sequence",
249
87
                                    parser->offset, -1);
250
87
                        }
251
736
                        incomplete = 1;
252
736
                        break;
253
823
                    }
254
255
                    /* Decode the leading octet. */
256
257
99.8M
                    value = (octet & 0x80) == 0x00 ? octet & 0x7F :
258
99.8M
                            (octet & 0xE0) == 0xC0 ? octet & 0x1F :
259
1.68M
                            (octet & 0xF0) == 0xE0 ? octet & 0x0F :
260
1.67M
                            (octet & 0xF8) == 0xF0 ? octet & 0x07 : 0;
261
262
                    /* Check and decode the trailing octets. */
263
264
103M
                    for (k = 1; k < width; k ++)
265
3.35M
                    {
266
3.35M
                        octet = parser->raw_buffer.pointer[k];
267
268
                        /* Check if the octet is valid. */
269
270
3.35M
                        if ((octet & 0xC0) != 0x80)
271
18
                            return yaml_parser_set_reader_error(parser,
272
18
                                    "invalid trailing UTF-8 octet",
273
18
                                    parser->offset+k, octet);
274
275
                        /* Decode the octet. */
276
277
3.35M
                        value = (value << 6) + (octet & 0x3F);
278
3.35M
                    }
279
280
                    /* Check the length of the sequence against the value. */
281
282
99.8M
                    if (!((width == 1) ||
283
1.68M
                            (width == 2 && value >= 0x80) ||
284
1.67M
                            (width == 3 && value >= 0x800) ||
285
2.15k
                            (width == 4 && value >= 0x10000)))
286
37
                        return yaml_parser_set_reader_error(parser,
287
37
                                "invalid length of a UTF-8 sequence",
288
37
                                parser->offset, -1);
289
290
                    /* Check the range of the value. */
291
292
99.8M
                    if ((value >= 0xD800 && value <= 0xDFFF) || value > 0x10FFFF)
293
18
                        return yaml_parser_set_reader_error(parser,
294
18
                                "invalid Unicode character",
295
18
                                parser->offset, value);
296
297
99.8M
                    break;
298
299
99.8M
                case YAML_UTF16LE_ENCODING:
300
2.13M
                case YAML_UTF16BE_ENCODING:
301
302
2.13M
                    low = (parser->encoding == YAML_UTF16LE_ENCODING ? 0 : 1);
303
2.13M
                    high = (parser->encoding == YAML_UTF16LE_ENCODING ? 1 : 0);
304
305
                    /*
306
                     * The UTF-16 encoding is not as simple as one might
307
                     * naively think.  Check RFC 2781
308
                     * (http://www.ietf.org/rfc/rfc2781.txt).
309
                     *
310
                     * Normally, two subsequent bytes describe a Unicode
311
                     * character.  However a special technique (called a
312
                     * surrogate pair) is used for specifying character
313
                     * values larger than 0xFFFF.
314
                     *
315
                     * A surrogate pair consists of two pseudo-characters:
316
                     *      high surrogate area (0xD800-0xDBFF)
317
                     *      low surrogate area (0xDC00-0xDFFF)
318
                     *
319
                     * The following formulas are used for decoding
320
                     * and encoding characters using surrogate pairs:
321
                     *
322
                     *  U  = U' + 0x10000   (0x01 00 00 <= U <= 0x10 FF FF)
323
                     *  U' = yyyyyyyyyyxxxxxxxxxx   (0 <= U' <= 0x0F FF FF)
324
                     *  W1 = 110110yyyyyyyyyy
325
                     *  W2 = 110111xxxxxxxxxx
326
                     *
327
                     * where U is the character value, W1 is the high surrogate
328
                     * area, W2 is the low surrogate area.
329
                     */
330
331
                    /* Check for incomplete UTF-16 character. */
332
333
2.13M
                    if (raw_unread < 2) {
334
64
                        if (parser->eof) {
335
22
                            return yaml_parser_set_reader_error(parser,
336
22
                                    "incomplete UTF-16 character",
337
22
                                    parser->offset, -1);
338
22
                        }
339
42
                        incomplete = 1;
340
42
                        break;
341
64
                    }
342
343
                    /* Get the character. */
344
345
2.13M
                    value = parser->raw_buffer.pointer[low]
346
2.13M
                        + (parser->raw_buffer.pointer[high] << 8);
347
348
                    /* Check for unexpected low surrogate area. */
349
350
2.13M
                    if ((value & 0xFC00) == 0xDC00)
351
2
                        return yaml_parser_set_reader_error(parser,
352
2
                                "unexpected low surrogate area",
353
2
                                parser->offset, value);
354
355
                    /* Check for a high surrogate area. */
356
357
2.13M
                    if ((value & 0xFC00) == 0xD800) {
358
359
33.3k
                        width = 4;
360
361
                        /* Check for incomplete surrogate pair. */
362
363
33.3k
                        if (raw_unread < 4) {
364
46
                            if (parser->eof) {
365
6
                                return yaml_parser_set_reader_error(parser,
366
6
                                        "incomplete UTF-16 surrogate pair",
367
6
                                        parser->offset, -1);
368
6
                            }
369
40
                            incomplete = 1;
370
40
                            break;
371
46
                        }
372
373
                        /* Get the next character. */
374
375
33.2k
                        value2 = parser->raw_buffer.pointer[low+2]
376
33.2k
                            + (parser->raw_buffer.pointer[high+2] << 8);
377
378
                        /* Check for a low surrogate area. */
379
380
33.2k
                        if ((value2 & 0xFC00) != 0xDC00)
381
12
                            return yaml_parser_set_reader_error(parser,
382
12
                                    "expected low surrogate area",
383
12
                                    parser->offset+2, value2);
384
385
                        /* Generate the value of the surrogate pair. */
386
387
33.2k
                        value = 0x10000 + ((value & 0x3FF) << 10) + (value2 & 0x3FF);
388
33.2k
                    }
389
390
2.10M
                    else {
391
2.10M
                        width = 2;
392
2.10M
                    }
393
394
2.13M
                    break;
395
396
2.13M
                default:
397
0
                    assert(1);      /* Impossible. */
398
101M
            }
399
400
            /* Check if the raw buffer contains enough bytes to form a character. */
401
402
101M
            if (incomplete) break;
403
404
            /*
405
             * Check if the character is in the allowed range:
406
             *      #x9 | #xA | #xD | [#x20-#x7E]               (8 bit)
407
             *      | #x85 | [#xA0-#xD7FF] | [#xE000-#xFFFD]    (16 bit)
408
             *      | [#x10000-#x10FFFF]                        (32 bit)
409
             */
410
411
101M
            if (! (value == 0x09 || value == 0x0A || value == 0x0D
412
91.7M
                        || (value >= 0x20 && value <= 0x7E)
413
3.81M
                        || (value == 0x85) || (value >= 0xA0 && value <= 0xD7FF)
414
311k
                        || (value >= 0xE000 && value <= 0xFFFD)
415
35.4k
                        || (value >= 0x10000 && value <= 0x10FFFF)))
416
40
                return yaml_parser_set_reader_error(parser,
417
40
                        "control characters are not allowed",
418
40
                        parser->offset, value);
419
420
            /* Move the raw pointers. */
421
422
101M
            parser->raw_buffer.pointer += width;
423
101M
            parser->offset += width;
424
425
            /* Finally put the character into the buffer. */
426
427
            /* 0000 0000-0000 007F -> 0xxxxxxx */
428
101M
            if (value <= 0x7F) {
429
98.1M
                *(parser->buffer.last++) = value;
430
98.1M
            }
431
            /* 0000 0080-0000 07FF -> 110xxxxx 10xxxxxx */
432
3.81M
            else if (value <= 0x7FF) {
433
17.1k
                *(parser->buffer.last++) = 0xC0 + (value >> 6);
434
17.1k
                *(parser->buffer.last++) = 0x80 + (value & 0x3F);
435
17.1k
            }
436
            /* 0000 0800-0000 FFFF -> 1110xxxx 10xxxxxx 10xxxxxx */
437
3.79M
            else if (value <= 0xFFFF) {
438
3.76M
                *(parser->buffer.last++) = 0xE0 + (value >> 12);
439
3.76M
                *(parser->buffer.last++) = 0x80 + ((value >> 6) & 0x3F);
440
3.76M
                *(parser->buffer.last++) = 0x80 + (value & 0x3F);
441
3.76M
            }
442
            /* 0001 0000-0010 FFFF -> 11110xxx 10xxxxxx 10xxxxxx 10xxxxxx */
443
35.3k
            else {
444
35.3k
                *(parser->buffer.last++) = 0xF0 + (value >> 18);
445
35.3k
                *(parser->buffer.last++) = 0x80 + ((value >> 12) & 0x3F);
446
35.3k
                *(parser->buffer.last++) = 0x80 + ((value >> 6) & 0x3F);
447
35.3k
                *(parser->buffer.last++) = 0x80 + (value & 0x3F);
448
35.3k
            }
449
450
101M
            parser->unread ++;
451
101M
        }
452
453
        /* On EOF, put NUL into the buffer and return. */
454
455
21.2k
        if (parser->eof) {
456
7.23k
            *(parser->buffer.last++) = '\0';
457
7.23k
            parser->unread ++;
458
7.23k
            return 1;
459
7.23k
        }
460
461
21.2k
    }
462
463
13.6k
    if (parser->offset >= MAX_FILE_SIZE) {
464
0
        return yaml_parser_set_reader_error(parser, "input is too long",
465
0
            parser->offset, -1);
466
0
    }
467
468
13.6k
    return 1;
469
13.6k
}