xml_decode.c

Go to the documentation of this file.

#include <stddef.h>
#include <stdint.h>
#include <string.h>
 
#include "ra8_attributes.h"
#include "xml.h"
#include "xml_internal.h"

typedef struct {
  size_t  position;    
  size_t  end;         
  uint8_t pending[4];  
  uint8_t pending_at;  
  uint8_t pending_len; 
} priv_decode_cursor_t;

RA8_INTERNAL static bool internal_xml_char(uint32_t cp)
{
  return (cp == k_priv_xml_tab) || (cp == k_priv_xml_line_feed) ||
         (cp == k_priv_xml_carriage_return) ||
         ((cp >= k_priv_xml_printable_min) && (cp <= k_priv_xml_bmp_first_max)) ||
         ((cp >= k_priv_xml_bmp_second_min) && (cp <= k_priv_xml_bmp_second_max)) ||
         ((cp >= k_priv_xml_supplementary_min) && (cp <= k_priv_xml_scalar_max));
}

RA8_INTERNAL static ra8_err_t
internal_utf8_lead(uint8_t lead, uint32_t* out_cp, size_t* out_used, uint32_t* out_minimum)
{
  uint32_t cp      = lead;
  size_t   used    = 1U;
  uint32_t minimum = 0U;
  if ((lead >= k_priv_utf8_two_lead_min) && (lead <= k_priv_utf8_two_lead_max)) {
    cp      = (uint32_t)(lead & k_priv_utf8_two_payload_mask);
    used    = 2U;
    minimum = k_priv_utf8_continuation_tag;
  } else if ((lead >= k_priv_utf8_three_lead_min) && (lead <= k_priv_utf8_three_lead_max)) {
    cp      = (uint32_t)(lead & k_priv_utf8_three_payload_mask);
    used    = 3U;
    minimum = k_priv_utf8_three_scalar_min;
  } else if ((lead >= k_priv_utf8_four_lead_min) && (lead <= k_priv_utf8_four_lead_max)) {
    cp      = (uint32_t)(lead & k_priv_utf8_four_payload_mask);
    used    = 4U;
    minimum = k_priv_xml_supplementary_min;
  } else if (lead >= k_priv_utf8_continuation_tag) {
    return k_ra8_err_validation_failed;
  } else {
    /* ASCII lead: the seeded cp/used/minimum above already describe it. */
  }
  *out_cp      = cp;
  *out_used    = used;
  *out_minimum = minimum;
  return k_ra8_ok;
}

RA8_INTERNAL static ra8_err_t internal_utf8_next(const uint8_t* source,
                                                 size_t         end,
                                                 size_t         position,
                                                 uint32_t*      out_cp,
                                                 size_t*        out_used)
{
  if (position >= end) {
    return k_ra8_err_validation_failed;
  }
  uint32_t        cp       = 0U;
  size_t          used     = 0U;
  uint32_t        minimum  = 0U;
  const ra8_err_t lead_err = internal_utf8_lead(source[position], &cp, &used, &minimum);
  if (lead_err != k_ra8_ok) {
    return lead_err;
  }
  if ((position + used) > end) {
    return k_ra8_err_validation_failed;
  }
  for (size_t i = 1U; i < used; ++i) {
    const uint8_t byte = source[position + i];
    if ((byte & k_priv_utf8_continuation_mask) != k_priv_utf8_continuation_tag) {
      return k_ra8_err_validation_failed;
    }
    cp = (cp << 6U) | (uint32_t)(byte & k_priv_utf8_scalar_mask);
  }
  if ((cp < minimum) || !internal_xml_char(cp)) {
    return k_ra8_err_validation_failed;
  }
  *out_cp   = cp;
  *out_used = used;
  return k_ra8_ok;
}
 
bool priv_xml_span_valid(size_t source_len, xml_span_t span)
{
  return ((size_t)span.offset <= source_len) &&
         ((size_t)span.length <= (source_len - (size_t)span.offset));
}

RA8_INTERNAL static size_t internal_utf8(uint32_t cp, uint8_t out[4])
{
  if (cp < k_priv_utf8_continuation_tag) {
    out[0] = (uint8_t)cp;
    return 1U;
  }
  if (cp < k_priv_utf8_three_scalar_min) {
    out[0] = (uint8_t)(k_priv_utf8_two_lead_tag | (cp >> 6U));
    out[1] = (uint8_t)(k_priv_utf8_continuation_tag | (cp & k_priv_utf8_scalar_mask));
    return 2U;
  }
  if (cp < k_priv_xml_supplementary_min) {
    out[0] = (uint8_t)(k_priv_utf8_three_lead_tag | (cp >> k_priv_utf8_shift_second));
    out[1] = (uint8_t)(k_priv_utf8_continuation_tag | ((cp >> 6U) & k_priv_utf8_scalar_mask));
    out[2] = (uint8_t)(k_priv_utf8_continuation_tag | (cp & k_priv_utf8_scalar_mask));
    return 3U;
  }
  out[0] = (uint8_t)(k_priv_utf8_four_lead_tag | (cp >> k_priv_utf8_shift_third));
  out[1] = (uint8_t)(k_priv_utf8_continuation_tag |
                     ((cp >> k_priv_utf8_shift_second) & k_priv_utf8_scalar_mask));
  out[2] = (uint8_t)(k_priv_utf8_continuation_tag | ((cp >> 6U) & k_priv_utf8_scalar_mask));
  out[3] = (uint8_t)(k_priv_utf8_continuation_tag | (cp & k_priv_utf8_scalar_mask));
  return 4U;
}

RA8_INTERNAL static uint32_t internal_digit(uint8_t c, uint32_t base)
{
  const uint32_t value = (uint32_t)c;
  if ((c >= (uint8_t)'0') && (c <= (uint8_t)'9')) {
    return value - (uint32_t)(uint8_t)'0';
  }
  if ((base == 16U) && (c >= (uint8_t)'a') && (c <= (uint8_t)'f')) {
    return (value - (uint32_t)(uint8_t)'a') + k_priv_xml_decimal_base;
  }
  if ((base == 16U) && (c >= (uint8_t)'A') && (c <= (uint8_t)'F')) {
    return (value - (uint32_t)(uint8_t)'A') + k_priv_xml_decimal_base;
  }
  return UINT32_MAX;
}

RA8_PRIV bool
priv_xml_bytes_equal(const uint8_t* source, size_t offset, const char* literal, size_t length)
{
  for (size_t i = 0U; i < length; ++i) {
    if (source[offset + i] != (uint8_t)literal[i]) {
      return false;
    }
  }
  return true;
}

RA8_INTERNAL static ra8_err_t internal_entity(const uint8_t* source,
                                              size_t         end,
                                              size_t         position,
                                              uint32_t*      out_cp,
                                              size_t*        out_used)
{
  static const char* const names[] = {"amp;", "lt;", "gt;", "quot;", "apos;"};
  static const uint32_t    cps[]   = {'&', '<', '>', '"', '\''};
  if ((position + 2U) >= end) {
    return k_ra8_err_validation_failed;
  }
  for (size_t i = 0U; i < (sizeof(names) / sizeof(names[0])); ++i) {
    const size_t length = strlen(names[i]);
    if (((position + 1U + length) <= end) &&
        priv_xml_bytes_equal(source, position + 1U, names[i], length)) {
      *out_cp   = cps[i];
      *out_used = length + 1U;
      return k_ra8_ok;
    }
  }
  if (source[position + 1U] != (uint8_t)'#') {
    return k_ra8_err_validation_failed;
  }
  size_t   cursor = position + 2U;
  uint32_t base   = k_priv_xml_decimal_base;
  // mcdc-deactivated: internal_entity radix probe; the `(position + 2U) >= end` precheck at the top of this function has already returned for every shorter span, so `cursor == position + 2U` is strictly less than `end` on every reachable path and the bound condition is constant-true.
  if ((cursor < end) && ((source[cursor] == (uint8_t)'x') || (source[cursor] == (uint8_t)'X'))) {
    base = 16U;
    ++cursor;
  }
  const size_t first_digit = cursor;
  uint32_t     cp          = 0U;
  while ((cursor < end) && (source[cursor] != (uint8_t)';')) {
    const uint32_t digit = internal_digit(source[cursor], base);
    if ((digit >= base) || (cp > ((k_priv_xml_scalar_max - digit) / base))) {
      return k_ra8_err_validation_failed;
    }
    cp = (cp * base) + digit;
    ++cursor;
  }
  if ((cursor == first_digit) || (cursor >= end) || !internal_xml_char(cp)) {
    return k_ra8_err_validation_failed;
  }
  *out_cp   = cp;
  *out_used = (cursor - position) + 1U;
  return k_ra8_ok;
}

RA8_INTERNAL static ra8_err_t internal_decode_one(const uint8_t* source,
                                                  size_t         end,
                                                  size_t         cursor,
                                                  char*          destination,
                                                  size_t         capacity,
                                                  bool           truncate,
                                                  size_t*        output,
                                                  bool*          clipped,
                                                  size_t*        out_used)
{
  uint8_t bytes[4] = {};
  size_t  count    = 0U;
  size_t  used     = 0U;
  if (source[cursor] == (uint8_t)'&') {
    uint32_t  cp  = 0U;
    ra8_err_t err = internal_entity(source, end, cursor, &cp, &used);
    if (err != k_ra8_ok) {
      return err;
    }
    count = internal_utf8(cp, bytes);
  } else {
    uint32_t        cp  = 0U;
    const ra8_err_t err = internal_utf8_next(source, end, cursor, &cp, &used);
    if (err != k_ra8_ok) {
      return err;
    }
    count = used;
    (void)memcpy(bytes, &source[cursor], count);
  }
  if ((destination != nullptr) && !*clipped && ((*output + count) >= capacity)) {
    if (!truncate) {
      return k_ra8_err_no_mem;
    }
    *clipped             = true;
    destination[*output] = '\0';
  }
  if ((destination != nullptr) && !*clipped) {
    (void)memcpy(&destination[*output], bytes, count);
  }
  if ((destination == nullptr) || !*clipped) {
    *output += count;
  }
  *out_used = used;
  return k_ra8_ok;
}

RA8_INTERNAL static ra8_err_t internal_decode(const uint8_t* source,
                                              xml_span_t     span,
                                              char*          destination,
                                              size_t         capacity,
                                              bool           truncate,
                                              size_t*        out_length)
{
  size_t       output  = 0U;
  bool         clipped = false;
  const size_t end     = (size_t)span.offset + (size_t)span.length;
  if ((destination != nullptr) && (capacity == 0U)) {
    return k_ra8_err_no_mem;
  }
  for (size_t cursor = span.offset; cursor < end;) {
    size_t          used = 0U;
    const ra8_err_t err  = internal_decode_one(source,
                                               end,
                                               cursor,
                                               destination,
                                               capacity,
                                               truncate,
                                               &output,
                                               &clipped,
                                               &used);
    if (err != k_ra8_ok) {
      return err;
    }
    cursor += used;
  }
  if (destination != nullptr) {
    destination[output] = '\0';
  }
  *out_length = output;
  return k_ra8_ok;
}

RA8_INTERNAL static ra8_err_t
internal_decoded_byte(const uint8_t* source, priv_decode_cursor_t* cursor, uint8_t* out)
{
  if (cursor->pending_at < cursor->pending_len) {
    *out = cursor->pending[cursor->pending_at];
    cursor->pending_at++;
    return k_ra8_ok;
  }
  if (cursor->position >= cursor->end) {
    return k_ra8_err_validation_failed;
  }
  if (source[cursor->position] != (uint8_t)'&') {
    *out = source[cursor->position];
    cursor->position++;
    return k_ra8_ok;
  }
  uint32_t        cp   = 0U;
  size_t          used = 0U;
  const ra8_err_t err  = internal_entity(source, cursor->end, cursor->position, &cp, &used);
  if (err != k_ra8_ok) {
    return err;
  }
  cursor->position += used;
  cursor->pending_len = (uint8_t)internal_utf8(cp, cursor->pending);
  cursor->pending_at  = 1U;
  *out                = cursor->pending[0];
  return k_ra8_ok;
}
 
ra8_err_t xml_decode(const uint8_t* source,
                     size_t         source_len,
                     xml_span_t     span,
                     char*          destination,
                     size_t         capacity,
                     size_t*        out_length)
{
  if ((source == nullptr) || (destination == nullptr) || (out_length == nullptr)) {
    return k_ra8_err_null_ptr;
  }
  if (!priv_xml_span_valid(source_len, span)) {
    return k_ra8_err_validation_failed;
  }
  return internal_decode(source, span, destination, capacity, false, out_length);
}
 
ra8_err_t xml_decode_prefix(const uint8_t* source,
                            size_t         source_len,
                            xml_span_t     span,
                            char*          destination,
                            size_t         capacity,
                            size_t*        out_length)
{
  if ((source == nullptr) || (destination == nullptr) || (out_length == nullptr)) {
    return k_ra8_err_null_ptr;
  }
  if (!priv_xml_span_valid(source_len, span)) {
    return k_ra8_err_validation_failed;
  }
  return internal_decode(source, span, destination, capacity, true, out_length);
}
 
ra8_err_t
xml_decoded_size(const uint8_t* source, size_t source_len, xml_span_t span, size_t* out_length)
{
  if ((source == nullptr) || (out_length == nullptr)) {
    return k_ra8_err_null_ptr;
  }
  if (!priv_xml_span_valid(source_len, span)) {
    return k_ra8_err_validation_failed;
  }
  return internal_decode(source, span, nullptr, 0U, false, out_length);
}
 
bool xml_span_equal(const uint8_t* source, size_t source_len, xml_span_t span, const char* literal)
{
  if ((source == nullptr) || (literal == nullptr) || !priv_xml_span_valid(source_len, span)) {
    return false;
  }
  const size_t length = strlen(literal);
  return ((size_t)span.length == length) &&
         priv_xml_bytes_equal(source, (size_t)span.offset, literal, length);
}
 
bool xml_span_local_equal(const uint8_t* source,
                          size_t         source_len,
                          xml_span_t     span,
                          const char*    literal)
{
  if ((source == nullptr) || !priv_xml_span_valid(source_len, span)) {
    return false;
  }
  uint32_t offset = span.offset;
  uint32_t length = span.length;
  for (uint32_t i = 0U; i < span.length; ++i) {
    if (source[span.offset + i] == (uint8_t)':') {
      offset = span.offset + i + 1U;
      length = span.length - i - 1U;
    }
  }
  return xml_span_equal(source, source_len, (xml_span_t){offset, length}, literal);
}
 
bool xml_decoded_equal(const uint8_t* source, size_t source_len, xml_span_t left, xml_span_t right)
{
  if (source == nullptr) {
    return false;
  }
  size_t left_size  = 0U;
  size_t right_size = 0U;
  if ((xml_decoded_size(source, source_len, left, &left_size) != k_ra8_ok) ||
      (xml_decoded_size(source, source_len, right, &right_size) != k_ra8_ok) ||
      (left_size != right_size)) {
    return false;
  }
  priv_decode_cursor_t li = {.position = left.offset, .end = (size_t)left.offset + left.length};
  priv_decode_cursor_t ri = {.position = right.offset, .end = (size_t)right.offset + right.length};
  for (size_t i = 0U; i < left_size; ++i) {
    uint8_t lb = 0U;
    uint8_t rb = 0U;
    // mcdc-deactivated: xml_decoded_equal byte-walk status guards; xml_decoded_size already decoded both spans end to end and reported exactly left_size/right_size bytes, so for every i < left_size both internal_decoded_byte() calls are re-walking bytes proven decodable -- only the byte-inequality condition can flip.
    if ((internal_decoded_byte(source, &li, &lb) != k_ra8_ok) ||
        (internal_decoded_byte(source, &ri, &rb) != k_ra8_ok) || (lb != rb)) {
      return false;
    }
  }
  return true;
}
 
ra8_err_t priv_xml_raw(const uint8_t* source, size_t start, size_t end)
{
  size_t cursor = start;
  while (cursor < end) {
    uint32_t        cp   = 0U;
    size_t          used = 0U;
    const ra8_err_t err  = internal_utf8_next(source, end, cursor, &cp, &used);
    if (err != k_ra8_ok) {
      return err;
    }
    cursor += used;
  }
  return k_ra8_ok;
}