core: fix buffer overflow in function utf8_next_char and return NULL for empty string

Now the function utf8_next_char with an empty string returns NULL instead of
the next char, which is most of the time after an allocated buffer.

And the function utf8_char_size with an empty string now returns 0 instead of
1.

This indirectly fixes a buffer overflow in function eval_string_range_chars
when the input string is empty (for example when doing `/eval -n ${chars:}`).

CHANGELOG.md

@@ -10,6 +10,7 @@ SPDX-License-Identifier: GPL-3.0-or-later
 
 ### Changed
 
+- **breaking:** core: fix buffer overflow in function utf8_next_char and return NULL for empty string
 - **breaking:** core: fix integer overflow and return "unsigned long" in function util_version_number
 - core: write configuration files on disk only if there are changes ([#2250](https://github.com/weechat/weechat/issues/2250))
 

src/core/core-string.c

@@ -254,6 +254,8 @@ string_reverse (const char *string)
     while (ptr_string && ptr_string[0])
     {
         char_size = utf8_char_size (ptr_string);
+        if (char_size < 1)
+            break;
 
         ptr_result -= char_size;
         memcpy (ptr_result, ptr_string, char_size);
@@ -313,6 +315,8 @@ string_reverse_screen (const char *string)
         if (ptr_string[0])
         {
             char_size = utf8_char_size (ptr_string);
+            if (char_size < 1)
+                break;
 
             ptr_result -= char_size;
             memcpy (ptr_result, ptr_string, char_size);
@@ -934,7 +938,7 @@ string_strcasestr (const char *string, const char *search)
     if (!string || !search || (length_search == 0))
         return NULL;
 
-    while (string[0])
+    while (string && string[0])
     {
         if (string_strncasecmp (string, search, length_search) == 0)
             return (char *)string;
@@ -4139,6 +4143,8 @@ string_input_for_buffer (const char *string)
         return string;
 
     next_char = utf8_next_char (string);
+    if (!next_char)
+        return NULL;
 
     /* next char is a space, then it's not a command */
     if (next_char[0] == ' ')
@@ -4226,8 +4232,12 @@ string_levenshtein (const char *string1, const char *string2,
                 last_diag + ((char1 == char2) ? 0 : 1));
             last_diag = old_diag;
             ptr_str1 = utf8_next_char (ptr_str1);
+            if (!ptr_str1)
+                break;
         }
         ptr_str2 = utf8_next_char (ptr_str2);
+        if (!ptr_str2)
+            break;
     }
 
     return column[length1];

src/core/core-utf8.c

@@ -242,7 +242,7 @@ utf8_prev_char (const char *string_start, const char *string)
 const char *
 utf8_next_char (const char *string)
 {
-    if (!string)
+    if (!string || !string[0])
         return NULL;
 
     /* UTF-8, 2 bytes: 110vvvvv 10vvvvvv */
@@ -311,7 +311,7 @@ utf8_end_of_line (const char *string)
     if (!string)
         return NULL;
 
-    while (string[0] && (string[0] != '\n'))
+    while (string && string[0] && (string[0] != '\n'))
     {
         string = utf8_next_char (string);
     }
@@ -451,10 +451,16 @@ utf8_int_string (unsigned int unicode_value, char *string)
 int
 utf8_char_size (const char *string)
 {
-    if (!string)
+    const char *ptr_next;
+
+    if (!string || !string[0])
         return 0;
 
-    return utf8_next_char (string) - string;
+    ptr_next = utf8_next_char (string);
+    if (!ptr_next)
+        return 0;
+
+    return ptr_next - string;
 }
 
 /*

src/core/hook/hook-command-run.c

@@ -115,7 +115,7 @@ hook_command_run_exec (struct t_gui_buffer *buffer, const char *command)
     if (command[0] != '/')
     {
         ptr_string = utf8_next_char (command);
-        if (string_asprintf (&command2, "/%s", ptr_string) < 0)
+        if (string_asprintf (&command2, "/%s", (ptr_string) ? ptr_string : "") < 0)
             return WEECHAT_RC_ERROR;
     }
     else

src/gui/gui-completion.c

@@ -323,9 +323,11 @@ gui_completion_nick_has_ignored_chars (const char *string)
     int char_size;
     char utf_char[16];
 
-    while (string[0])
+    while (string && string[0])
     {
         char_size = utf8_char_size (string);
+        if (char_size < 1)
+            break;
         memcpy (utf_char, string, char_size);
         utf_char[char_size] = '\0';
 
@@ -352,9 +354,11 @@ gui_completion_nick_strdup_ignore_chars (const char *string)
 
     result = malloc (strlen (string) + 1);
     pos = result;
-    while (string[0])
+    while (string && string[0])
     {
         char_size = utf8_char_size (string);
+        if (char_size < 1)
+            break;
         memcpy (utf_char, string, char_size);
         utf_char[char_size] = '\0';
 
@@ -915,13 +919,16 @@ gui_completion_find_context (struct t_gui_completion *completion,
     if (string_is_command_char (ptr_data))
     {
         ptr_data = utf8_next_char (ptr_data);
-        if (ptr_data < data + pos)
+        if (ptr_data)
         {
-            if (string_is_command_char (ptr_data))
-                ptr_data = utf8_next_char (ptr_data);
+            if (ptr_data < data + pos)
+            {
+                if (string_is_command_char (ptr_data))
+                    ptr_data = utf8_next_char (ptr_data);
+            }
+            if (!string_is_command_char (ptr_data))
+                ptr_command = ptr_data;
         }
-        if (!string_is_command_char (ptr_data))
-            ptr_command = ptr_data;
     }
 
     /*

src/gui/gui-key.c

@@ -1328,7 +1328,7 @@ gui_key_chunk_seems_valid (const char *chunk)
     if (!found)
         chunk = utf8_next_char (chunk);
 
-    if (chunk[0])
+    if (chunk && chunk[0])
         return 0;
 
     return 1;

src/plugins/alias/alias.c

@@ -420,6 +420,7 @@ void
 alias_hook_command (struct t_alias *alias)
 {
     char *str_priority_name, *str_completion;
+    const char *ptr_command;
 
     if (alias->hook)
     {
@@ -442,11 +443,10 @@ alias_hook_command (struct t_alias *alias)
     str_completion = NULL;
     if (!alias->completion)
     {
-        weechat_asprintf (
-            &str_completion,
-            "%%%%%s",
-            (weechat_string_is_command_char (alias->command)) ?
-            weechat_utf8_next_char (alias->command) : alias->command);
+        ptr_command = (weechat_string_is_command_char (alias->command)) ?
+            weechat_utf8_next_char (alias->command) : alias->command;
+        weechat_asprintf (&str_completion, "%%%%%s",
+                          (ptr_command) ? ptr_command : "");
     }
 
     alias->hook = weechat_hook_command (
@@ -681,11 +681,20 @@ alias_new (const char *name, const char *command, const char *completion)
     if (!command || !command[0])
         return NULL;
 
-    while (weechat_string_is_command_char (name))
+    while (name && weechat_string_is_command_char (name))
     {
         name = weechat_utf8_next_char (name);
     }
 
+    if (!name || !name[0])
+    {
+        weechat_printf (NULL,
+                        _("%s%s: invalid alias name: \"%s\""),
+                        weechat_prefix ("error"), ALIAS_PLUGIN_NAME,
+                        "");
+        return NULL;
+    }
+
     ptr_alias = alias_search (name);
     alias_free (ptr_alias);
 

src/plugins/irc/irc-message.c

@@ -1079,12 +1079,12 @@ irc_message_split_string (struct t_irc_message_split_context *context,
         pos = arguments;
         pos_max = pos + max_length;
         pos_last_delim = NULL;
-        while (pos[0])
+        while (pos && pos[0])
         {
             if (pos[0] == delimiter)
                 pos_last_delim = pos;
             pos_next = weechat_utf8_next_char (pos);
-            if (pos_next > pos_max)
+            if (!pos_next || (pos_next > pos_max))
                 break;
             pos = pos_next;
         }

src/plugins/spell/spell.c

@@ -834,7 +834,7 @@ spell_modifier_cb (const void *pointer, void *data,
     }
 
     current_pos = 0;
-    while (ptr_string[0])
+    while (ptr_string && ptr_string[0])
     {
         ptr_string_orig = NULL;
 
@@ -885,7 +885,7 @@ spell_modifier_cb (const void *pointer, void *data,
                 word_end_pos_valid = word_end_pos;
             }
             ptr_end = (char *)weechat_utf8_next_char (ptr_end);
-            if (!ptr_end[0])
+            if (!ptr_end || !ptr_end[0])
                 break;
             code_point = weechat_utf8_char_int (ptr_end);
         }
@@ -906,7 +906,7 @@ spell_modifier_cb (const void *pointer, void *data,
                 while (!iswspace (code_point))
                 {
                     ptr_end = (char *)weechat_utf8_next_char (ptr_end);
-                    if (!ptr_end[0])
+                    if (!ptr_end || !ptr_end[0])
                         break;
                     code_point = weechat_utf8_char_int (ptr_end);
                 }

src/plugins/trigger/trigger.c

@@ -700,11 +700,11 @@ trigger_regex_split (const char *str_regex,
 
         /* search the delimiter (which can be more than one char) */
         pos = weechat_utf8_next_char (ptr_regex);
-        while (pos[0] && (weechat_string_charcmp (ptr_regex, pos) == 0))
+        while (pos && pos[0] && (weechat_string_charcmp (ptr_regex, pos) == 0))
         {
             pos = weechat_utf8_next_char (pos);
         }
-        if (!pos[0])
+        if (!pos || !pos[0])
             goto format_error;
         delimiter = weechat_strndup (ptr_regex, pos - ptr_regex);
         if (!delimiter)

tests/unit/core/test-core-utf8.cpp

@@ -351,7 +351,7 @@ TEST(CoreUtf8, Move)
     STRCMP_EQUAL(NULL, utf8_prev_char (NULL, NULL));
     STRCMP_EQUAL(NULL, utf8_next_char (NULL));
     STRCMP_EQUAL(NULL, utf8_prev_char (empty_string, empty_string));
-    STRCMP_EQUAL(empty_string + 1, utf8_next_char (empty_string));
+    STRCMP_EQUAL(NULL, utf8_next_char (empty_string));
     STRCMP_EQUAL(NULL, utf8_prev_char (noel_valid + 1, noel_valid));
     ptr = utf8_next_char (noel_valid);
     STRCMP_EQUAL("oël", ptr);
@@ -512,7 +512,7 @@ TEST(CoreUtf8, Size)
 {
     /* char size (in bytes) */
     LONGS_EQUAL(0, utf8_char_size (NULL));
-    LONGS_EQUAL(1, utf8_char_size (""));
+    LONGS_EQUAL(0, utf8_char_size (""));
     LONGS_EQUAL(1, utf8_char_size ("A"));
     LONGS_EQUAL(2, utf8_char_size ("ë"));
     LONGS_EQUAL(3, utf8_char_size ("€"));