Author: ek.kato
Date: Tue Jul 10 04:00:09 2007
New Revision: 4683

Modified:
   branches/1.4/configure.ac
   branches/1.4/gtk/compose.c
   branches/1.4/gtk/gtk-im-uim.c
   branches/1.4/gtk/uim-cand-win-gtk.c
   branches/1.4/gtk/uim-eb.c
   branches/1.4/qt/immodule-quiminputcontext.h
   branches/1.4/qt/immodule-quiminputcontext_compose.cpp
   branches/1.4/uim/agent.c
   branches/1.4/uim/anthy.c
   branches/1.4/uim/uim-func.c
   branches/1.4/uim/uim-helper-client.c
   branches/1.4/uim/uim-scm.c
   branches/1.4/xim/compose.cpp
   branches/1.4/xim/xim.h

Log:
* qt/immodule-quiminputcontext.h
* qt/immodule-quiminputcontext_compose.cpp
* gtk/compose.c
* gtk/uim-cand-win-gtk.c
* gtk/uim-eb.c
* gtk/gtk-im-uim.c
* uim/agent.c
* uim/uim-helper-client.c
* uim/uim-scm.c
* uim/anthy.c
* uim/uim-func.c
* xim/xim.h
* xim/compose.cpp
* configure.ac
  - Port r4610:4638, r4639:4640, r4656:4661, r4667:4672,
    r4677:4678 from trunk (bug #11406, #11407, #11411, #11461).


Modified: branches/1.4/configure.ac
==============================================================================
--- branches/1.4/configure.ac   (original)
+++ branches/1.4/configure.ac   Tue Jul 10 04:00:09 2007
@@ -242,6 +242,7 @@
 
 # Check for types
 AC_TYPE_SIZE_T
+AC_TYPE_OFF_T
 AC_TYPE_PID_T
 AC_TYPE_SIGNAL
 AC_CHECK_TYPES(sig_atomic_t, , ,

Modified: branches/1.4/gtk/compose.c
==============================================================================
--- branches/1.4/gtk/compose.c  (original)
+++ branches/1.4/gtk/compose.c  Tue Jul 10 04:00:09 2007
@@ -134,10 +134,13 @@
 }
 
 static int
-nextch(FILE *fp, int *lastch)
+nextch(FILE *fp, int *lastch, size_t *remain)
 {
     int c;
 
+    if (*remain <= 1)
+       return EOF;
+
     if (*lastch != 0) {
        c = *lastch;
        *lastch = 0;
@@ -183,14 +186,14 @@
 #endif
 
 static int
-nexttoken(FILE *fp, char *tokenbuf, int *lastch)
+nexttoken(FILE *fp, char *tokenbuf, int *lastch, size_t *remain)
 {
     int c;
     int token;
     char *p;
     int i, j;
 
-    while ((c = nextch(fp, lastch)) == ' ' || c == '\t') {
+    while ((c = nextch(fp, lastch, remain)) == ' ' || c == '\t') {
     }
     switch (c) {
     case EOF:
@@ -216,26 +219,30 @@
        break;
     case '"':
        p = tokenbuf;
-       while ((c = nextch(fp, lastch)) != '"') {
+       while ((c = nextch(fp, lastch, remain)) != '"') {
            if (c == '\n' || c == EOF) {
                putbackch(c, lastch);
                token = ERROR;
                goto string_error;
            } else if (c == '\\') {
-               c = nextch(fp, lastch);
+               c = nextch(fp, lastch, remain);
                switch (c) {
                case '\\':
                case '"':
                    *p++ = c;
+                   (*remain)--;
                    break;
                case 'n':
                    *p++ = '\n';
+                   (*remain)--;
                    break;
                case 'r':
                    *p++ = '\r';
+                   (*remain)--;
                    break;
                case 't':
                    *p++ = '\t';
+                   (*remain)--;
                    break;
                case '0':
                case '1':
@@ -246,20 +253,21 @@
                case '6':
                case '7':
                    i = c - '0';
-                   c = nextch(fp, lastch);
+                   c = nextch(fp, lastch, remain);
                    for (j = 0; j < 2 && c >= '0' && c <= '7'; j++) {
                        i <<= 3;
                        i += c - '0';
-                       c = nextch(fp, lastch);
+                       c = nextch(fp, lastch, remain);
                    }
                    putbackch(c, lastch);
                    *p++ = (char)i;
+                   (*remain)--;
                    break;
                case 'X':
                case 'x':
                    i = 0;
                    for (j = 0; j < 2; j++) {
-                       c = nextch(fp, lastch);
+                       c = nextch(fp, lastch, remain);
                        i <<= 4;
                        if (c >= '0' && c <= '9') {
                            i += c - '0';
@@ -278,6 +286,7 @@
                        goto string_error;
                    }
                    *p++ = (char)i;
+                   (*remain)--;
                    break;
                case EOF:
                    putbackch(c, lastch);
@@ -285,17 +294,19 @@
                    goto string_error;
                default:
                    *p++ = c;
+                   (*remain)--;
                    break;
                }
            } else {
                *p++ = c;
+               (*remain)--;
            }
        }
        *p = '\0';
        token = STRING;
        break;
     case '#':
-       while ((c = nextch(fp, lastch)) != '\n' && c != EOF) {
+       while ((c = nextch(fp, lastch, remain)) != '\n' && c != EOF) {
        }
        if (c == '\n') {
            token = ENDOFLINE;
@@ -307,10 +318,17 @@
        if (isalnum(c) || c == '_' || c == '-') {
            p = tokenbuf;
            *p++ = c;
-           c = nextch(fp, lastch);
+           (*remain)--;
+           c = nextch(fp, lastch, remain);
            while (isalnum(c) || c == '_' || c == '-') {
                *p++ = c;
-               c = nextch(fp, lastch);
+               (*remain)--;
+               c = nextch(fp, lastch, remain);
+           }
+           if (c == '\n' || c == EOF) {
+               putbackch(c, lastch);
+               token = ERROR;
+               goto string_error;
            }
            *p = '\0';
            putbackch(c, lastch);
@@ -440,7 +458,7 @@
        return 0;
     len = strlen(mb);
     strlcpy(buf, mb, MB_LEN_MAX + 1);
-    free(mb);
+    g_free(mb);
 
     return len;
 }
@@ -450,7 +468,7 @@
 #define SEQUENCE_MAX    10
 
 static int
-parse_compose_line(FILE *fp, char* tokenbuf)
+parse_compose_line(FILE *fp, char* tokenbuf, size_t *remain)
 {
     int token;
     unsigned modifier_mask;
@@ -479,7 +497,7 @@
     g_get_charset(&encoding);
 
     do {
-       token = nexttoken(fp, tokenbuf, &lastch);
+       token = nexttoken(fp, tokenbuf, &lastch, remain);
     } while (token == ENDOFLINE);
 
     if (token == ENDOFFILE) {
@@ -491,7 +509,7 @@
        if ((token == KEY) && (strcmp("include", tokenbuf) == 0)) {
            char *filename;
            FILE *infp;
-           token = nexttoken(fp, tokenbuf, &lastch);
+           token = nexttoken(fp, tokenbuf, &lastch, remain);
            if (token != KEY && token != STRING)
                goto error;
 
@@ -506,19 +524,19 @@
        } else if ((token == KEY) && (strcmp("None", tokenbuf) == 0)) {
            modifier = 0;
            modifier_mask = AllMask;
-           token = nexttoken(fp, tokenbuf, &lastch);
+           token = nexttoken(fp, tokenbuf, &lastch, remain);
        } else {
            modifier_mask = modifier = 0;
            exclam = False;
            if (token == EXCLAM) {
                exclam = True;
-               token = nexttoken(fp, tokenbuf, &lastch);
+               token = nexttoken(fp, tokenbuf, &lastch, remain);
            }
            while (token == TILDE || token == KEY) {
                tilde = False;
                if (token == TILDE) {
                    tilde = True;
-                   token = nexttoken(fp, tokenbuf, &lastch);
+                   token = nexttoken(fp, tokenbuf, &lastch, remain);
                    if (token != KEY)
                        goto error;
                }
@@ -532,7 +550,7 @@
                } else {
                    modifier |= tmp;
                }
-               token = nexttoken(fp, tokenbuf, &lastch);
+               token = nexttoken(fp, tokenbuf, &lastch, remain);
            }
            if (exclam) {
                modifier_mask = AllMask;
@@ -544,12 +562,12 @@
            goto error;
        }
 
-       token = nexttoken(fp, tokenbuf, &lastch);
+       token = nexttoken(fp, tokenbuf, &lastch, remain);
        if (token != KEY) {
            goto error;
        }
 
-       token = nexttoken(fp, tokenbuf, &lastch);
+       token = nexttoken(fp, tokenbuf, &lastch, remain);
        if (token != GREATER) {
            goto error;
        }
@@ -565,22 +583,22 @@
        n++;
        if (n >= SEQUENCE_MAX)
            goto error;
-       token = nexttoken(fp, tokenbuf, &lastch);
+       token = nexttoken(fp, tokenbuf, &lastch, remain);
     } while (token != COLON);
 
-    token = nexttoken(fp, tokenbuf, &lastch);
+    token = nexttoken(fp, tokenbuf, &lastch, remain);
     if (token == STRING) {
        if ((rhs_string_mb = (char *)malloc(strlen(tokenbuf) + 1)) == NULL)
            goto error;
        strcpy(rhs_string_mb, tokenbuf);
-       token = nexttoken(fp, tokenbuf, &lastch);
+       token = nexttoken(fp, tokenbuf, &lastch, remain);
        if (token == KEY) {
            rhs_keysym = XStringToKeysym(tokenbuf);
            if (rhs_keysym == NoSymbol) {
                free(rhs_string_mb);
                goto error;
            }
-           token = nexttoken(fp, tokenbuf, &lastch);
+           token = nexttoken(fp, tokenbuf, &lastch, remain);
        }
        if (token != ENDOFLINE && token != ENDOFFILE) {
            free(rhs_string_mb);
@@ -591,7 +609,7 @@
        if (rhs_keysym == NoSymbol) {
            goto error;
        }
-       token = nexttoken(fp, tokenbuf, &lastch);
+       token = nexttoken(fp, tokenbuf, &lastch, remain);
        if (token != ENDOFLINE && token != ENDOFFILE) {
            goto error;
        }
@@ -611,7 +629,12 @@
        goto error;
     }
 
-    rhs_string_utf8 = g_locale_to_utf8(rhs_string_mb, -1, NULL, NULL, NULL);
+    {
+       char *result;
+       result = g_locale_to_utf8(rhs_string_mb, -1, NULL, NULL, NULL);
+       rhs_string_utf8 = strdup(result);
+       g_free(result);
+    }
 
     for (i = 0; i < n; i++) {
        for (p = *top; p; p = p->next) {
@@ -651,7 +674,7 @@
     return n;
 error:
     while (token != ENDOFLINE && token != ENDOFFILE) {
-       token = nexttoken(fp, tokenbuf, &lastch);
+       token = nexttoken(fp, tokenbuf, &lastch, remain);
     }
     return 0;
 }
@@ -659,22 +682,21 @@
 static void
 ParseComposeStringFile(FILE *fp)
 {
-    char tb[8192];
     char* tbp;
     struct stat st;
+    size_t tb_remain;
 
-    if (fstat(fileno(fp), &st) != -1) {
-       unsigned long size = (unsigned long)st.st_size;
-       if (size <= sizeof tb)
-           tbp = tb;
-       else
-           tbp = (char *)malloc(size);
+    if (fstat(fileno(fp), &st) != -1 &&
+       S_ISREG(st.st_mode) &&
+       st.st_size > 0 &&
+       st.st_size + (size_t)0 < (off_t)0 + (size_t)-1) {
 
+       tbp = (char *)malloc(st.st_size);
+       tb_remain = st.st_size;
        if (tbp != NULL) {
-           while (parse_compose_line(fp, tbp) >= 0) {
+           while (parse_compose_line(fp, tbp, &tb_remain) >= 0) {
            }
-           if (tbp != tb)
-               free (tbp);
+           free (tbp);
        }
     }
 }
@@ -840,7 +862,7 @@
        char *p = buf;
        int n;
        char *args[2], *from, *to;
-       while (isspace(*p)) {
+       while (isspace((unsigned char)*p)) {
            ++p;
        }
        if (iscomment(*p)) {
@@ -883,7 +905,7 @@
     char *p = line;
 
     while (argc < argsize) {
-       while (isspace(*p)) {
+       while (isspace((unsigned char)*p)) {
            ++p;
        }
        if (*p == '\0') {

Modified: branches/1.4/gtk/gtk-im-uim.c
==============================================================================
--- branches/1.4/gtk/gtk-im-uim.c       (original)
+++ branches/1.4/gtk/gtk-im-uim.c       Tue Jul 10 04:00:09 2007
@@ -82,7 +82,7 @@
 
 struct preedit_segment {
   int attr;
-  char *str;
+  gchar *str;
 };
 
 static int im_uim_fd = -1;
@@ -183,21 +183,23 @@
 get_user_defined_color(PangoColor *color, const gchar *uim_symbol)
 {
   gboolean parsed = FALSE;
-  gchar *literal = uim_symbol_value_str(uim_symbol);
+  char *literal = uim_symbol_value_str(uim_symbol);
 
   if (literal != NULL && literal[0] != '\0')
     parsed = pango_color_parse(color, literal);
 
-  g_free(literal);
+  free(literal);
 
   return parsed;
 }
 
-static char *
-get_preedit_segment(struct preedit_segment *ps, PangoAttrList *attrs, char 
*str)
+static gchar *
+get_preedit_segment(struct preedit_segment *ps, PangoAttrList *attrs,
+                   gchar *str)
 {
   PangoAttribute *attr;
   const gchar *segment_str = ps->str;
+  gint len;
 
   if ((ps->attr & UPreeditAttr_Separator) && !strcmp(segment_str, ""))
     segment_str = DEFAULT_SEPARATOR_STR;
@@ -259,8 +261,9 @@
     }
   }
 
-  str = (char *)realloc(str, strlen(str) + strlen(segment_str) + 1);
-  strcat(str, segment_str);
+  len = strlen(str) + strlen(segment_str) + 1;
+  str = (gchar *)g_realloc(str, len);
+  g_strlcat(str, segment_str, len);
 
   return str;
 }
@@ -565,7 +568,7 @@
   int i;
 
   for (i = 0; i < uic->nr_psegs; i++)
-    free(uic->pseg[i].str);
+    g_free(uic->pseg[i].str);
   free(uic->pseg);
 
   uic->pseg = NULL;
@@ -1114,7 +1117,7 @@
 im_uim_get_preedit_string(GtkIMContext *ic, gchar **str, PangoAttrList **attrs,
                          gint *cursor_pos)
 {
-  char *tmp;
+  gchar *tmp;
   int i, pos = 0;
   IMUIMContext *uic = IM_UIM_CONTEXT(ic);
 
@@ -1138,7 +1141,7 @@
   if (str)
     *str = tmp;
   else
-    free(tmp);
+    g_free(tmp);
 }
 
 static void

Modified: branches/1.4/gtk/uim-cand-win-gtk.c
==============================================================================
--- branches/1.4/gtk/uim-cand-win-gtk.c (original)
+++ branches/1.4/gtk/uim-cand-win-gtk.c Tue Jul 10 04:00:09 2007
@@ -393,7 +393,7 @@
          annotation = uim_eb_search_text(ueb, cand);
          uim_eb_destroy(ueb);
        }
-       g_free(book);
+       free(book);
       }
       g_free(cand);
     }

Modified: branches/1.4/gtk/uim-eb.c
==============================================================================
--- branches/1.4/gtk/uim-eb.c   (original)
+++ branches/1.4/gtk/uim-eb.c   Tue Jul 10 04:00:09 2007
@@ -109,7 +109,7 @@
 }
 
 
-char *
+gchar *
 uim_eb_search_text (uim_eb *ueb, const gchar *text_utf8)
 {
   gchar *text;

Modified: branches/1.4/qt/immodule-quiminputcontext.h
==============================================================================
--- branches/1.4/qt/immodule-quiminputcontext.h (original)
+++ branches/1.4/qt/immodule-quiminputcontext.h Tue Jul 10 04:00:09 2007
@@ -136,7 +136,7 @@
     static char *TransFileName( char *name );
     static void ParseComposeStringFile( FILE *fp );
     static void FreeComposeTree( DefTree *top );
-    static int parse_compose_line( FILE *fp, char *tokenbuf );
+    static int parse_compose_line( FILE *fp, char *tokenbuf, size_t *remain );
     static int get_mb_string( char *buf, unsigned int ks );
     static const char *get_encoding( void );
     static char *get_lang_region( void );

Modified: branches/1.4/qt/immodule-quiminputcontext_compose.cpp
==============================================================================
--- branches/1.4/qt/immodule-quiminputcontext_compose.cpp       (original)
+++ branches/1.4/qt/immodule-quiminputcontext_compose.cpp       Tue Jul 10 
04:00:09 2007
@@ -264,10 +264,13 @@
 }
 
 static int
-nextch(FILE *fp, int *lastch)
+nextch(FILE *fp, int *lastch, size_t *remain)
 {
     int c;
 
+    if (*remain <= 1)
+       return EOF;
+
     if (*lastch != 0) {
        c = *lastch;
        *lastch = 0;
@@ -313,14 +316,14 @@
 #endif
 
 static int
-nexttoken(FILE *fp, char *tokenbuf, int *lastch)
+nexttoken(FILE *fp, char *tokenbuf, int *lastch, size_t *remain)
 {
     int c;
     int token;
     char *p;
     int i, j;
 
-    while ((c = nextch(fp, lastch)) == ' ' || c == '\t') {
+    while ((c = nextch(fp, lastch, remain)) == ' ' || c == '\t') {
     }
     switch (c) {
     case EOF:
@@ -346,26 +349,30 @@
        break;
     case '"':
        p = tokenbuf;
-       while ((c = nextch(fp, lastch)) != '"') {
+       while ((c = nextch(fp, lastch, remain)) != '"') {
            if (c == '\n' || c == EOF) {
                putbackch(c, lastch);
                token = ERROR;
                goto string_error;
            } else if (c == '\\') {
-               c = nextch(fp, lastch);
+               c = nextch(fp, lastch, remain);
                switch (c) {
                case '\\':
                case '"':
                    *p++ = c;
+                   (*remain)--;
                    break;
                case 'n':
                    *p++ = '\n';
+                   (*remain)--;
                    break;
                case 'r':
                    *p++ = '\r';
+                   (*remain)--;
                    break;
                case 't':
                    *p++ = '\t';
+                   (*remain)--;
                    break;
                case '0':
                case '1':
@@ -376,20 +383,21 @@
                case '6':
                case '7':
                    i = c - '0';
-                   c = nextch(fp, lastch);
+                   c = nextch(fp, lastch, remain);
                    for (j = 0; j < 2 && c >= '0' && c <= '7'; j++) {
                        i <<= 3;
                        i += c - '0';
-                       c = nextch(fp, lastch);
+                       c = nextch(fp, lastch, remain);
                    }
                    putbackch(c, lastch);
                    *p++ = (char)i;
+                   (*remain)--;
                    break;
                case 'X':
                case 'x':
                    i = 0;
                    for (j = 0; j < 2; j++) {
-                       c = nextch(fp, lastch);
+                       c = nextch(fp, lastch, remain);
                        i <<= 4;
                        if (c >= '0' && c <= '9') {
                            i += c - '0';
@@ -408,6 +416,7 @@
                        goto string_error;
                    }
                    *p++ = (char)i;
+                   (*remain)--;
                    break;
                case EOF:
                    putbackch(c, lastch);
@@ -415,17 +424,19 @@
                    goto string_error;
                default:
                    *p++ = c;
+                   (*remain)--;
                    break;
                }
            } else {
                *p++ = c;
+               (*remain)--;
            }
        }
        *p = '\0';
        token = STRING;
        break;
     case '#':
-       while ((c = nextch(fp, lastch)) != '\n' && c != EOF) {
+       while ((c = nextch(fp, lastch, remain)) != '\n' && c != EOF) {
        }
        if (c == '\n') {
            token = ENDOFLINE;
@@ -437,10 +448,17 @@
        if (isalnum(c) || c == '_' || c == '-') {
            p = tokenbuf;
            *p++ = c;
-           c = nextch(fp, lastch);
+           (*remain)--;
+           c = nextch(fp, lastch, remain);
            while (isalnum(c) || c == '_' || c == '-') {
                *p++ = c;
-               c = nextch(fp, lastch);
+               (*remain)--;
+               c = nextch(fp, lastch, remain);
+           }
+           if (c == '\n' || c == EOF) {
+               putbackch(c, lastch);
+               token = ERROR;
+               goto string_error;
            }
            *p = '\0';
            putbackch(c, lastch);
@@ -604,7 +622,7 @@
 #define SEQUENCE_MAX    10
 
 int
-QUimInputContext::parse_compose_line(FILE *fp, char* tokenbuf)
+QUimInputContext::parse_compose_line(FILE *fp, char* tokenbuf, size_t *remain)
 {
     int token;
     unsigned modifier_mask;
@@ -633,7 +651,7 @@
     QString qs;
 
     do {
-       token = nexttoken(fp, tokenbuf, &lastch);
+       token = nexttoken(fp, tokenbuf, &lastch, remain);
     } while (token == ENDOFLINE);
 
     if (token == ENDOFFILE) {
@@ -645,7 +663,7 @@
        if ((token == KEY) && (strcmp("include", tokenbuf) == 0)) {
            char *filename;
            FILE *infp;
-           token = nexttoken(fp, tokenbuf, &lastch);
+           token = nexttoken(fp, tokenbuf, &lastch, remain);
            if (token != KEY && token != STRING)
                goto error;
 
@@ -660,19 +678,19 @@
        } else if ((token == KEY) && (strcmp("None", tokenbuf) == 0)) {
            modifier = 0;
            modifier_mask = AllMask;
-           token = nexttoken(fp, tokenbuf, &lastch);
+           token = nexttoken(fp, tokenbuf, &lastch, remain);
        } else {
            modifier_mask = modifier = 0;
            exclam = False;
            if (token == EXCLAM) {
                exclam = True;
-               token = nexttoken(fp, tokenbuf, &lastch);
+               token = nexttoken(fp, tokenbuf, &lastch, remain);
            }
            while (token == TILDE || token == KEY) {
                tilde = False;
                if (token == TILDE) {
                    tilde = True;
-                   token = nexttoken(fp, tokenbuf, &lastch);
+                   token = nexttoken(fp, tokenbuf, &lastch, remain);
                    if (token != KEY)
                        goto error;
                }
@@ -686,7 +704,7 @@
                } else {
                    modifier |= tmp;
                }
-               token = nexttoken(fp, tokenbuf, &lastch);
+               token = nexttoken(fp, tokenbuf, &lastch, remain);
            }
            if (exclam) {
                modifier_mask = AllMask;
@@ -698,12 +716,12 @@
            goto error;
        }
 
-       token = nexttoken(fp, tokenbuf, &lastch);
+       token = nexttoken(fp, tokenbuf, &lastch, remain);
        if (token != KEY) {
            goto error;
        }
 
-       token = nexttoken(fp, tokenbuf, &lastch);
+       token = nexttoken(fp, tokenbuf, &lastch, remain);
        if (token != GREATER) {
            goto error;
        }
@@ -719,22 +737,22 @@
        n++;
        if (n >= SEQUENCE_MAX)
            goto error;
-       token = nexttoken(fp, tokenbuf, &lastch);
+       token = nexttoken(fp, tokenbuf, &lastch, remain);
     } while (token != COLON);
 
-    token = nexttoken(fp, tokenbuf, &lastch);
+    token = nexttoken(fp, tokenbuf, &lastch, remain);
     if (token == STRING) {
        if ((rhs_string_mb = (char *)malloc(strlen(tokenbuf) + 1)) == NULL)
            goto error;
        strcpy(rhs_string_mb, tokenbuf);
-       token = nexttoken(fp, tokenbuf, &lastch);
+       token = nexttoken(fp, tokenbuf, &lastch, remain);
        if (token == KEY) {
            rhs_keysym = XStringToKeysym(tokenbuf);
            if (rhs_keysym == NoSymbol) {
                free(rhs_string_mb);
                goto error;
            }
-           token = nexttoken(fp, tokenbuf, &lastch);
+           token = nexttoken(fp, tokenbuf, &lastch, remain);
        }
        if (token != ENDOFLINE && token != ENDOFFILE) {
            free(rhs_string_mb);
@@ -745,7 +763,7 @@
        if (rhs_keysym == NoSymbol) {
            goto error;
        }
-       token = nexttoken(fp, tokenbuf, &lastch);
+       token = nexttoken(fp, tokenbuf, &lastch, remain);
        if (token != ENDOFLINE && token != ENDOFFILE) {
            goto error;
        }
@@ -806,7 +824,7 @@
     return n;
 error:
     while (token != ENDOFLINE && token != ENDOFFILE) {
-       token = nexttoken(fp, tokenbuf, &lastch);
+       token = nexttoken(fp, tokenbuf, &lastch, remain);
     }
     return 0;
 }
@@ -829,22 +847,21 @@
 void
 QUimInputContext::ParseComposeStringFile(FILE *fp)
 {
-    char tb[8192];
     char* tbp;
     struct stat st;
+    size_t tb_remain;
 
-    if (fstat(fileno(fp), &st) != -1) {
-       unsigned long size = (unsigned long)st.st_size;
-       if (size <= sizeof tb)
-           tbp = tb;
-       else
-           tbp = (char *)malloc(size);
+    if (fstat(fileno(fp), &st) != -1 &&
+       S_ISREG(st.st_mode) &&
+       st.st_size > 0 &&
+       st.st_size + (size_t)0 < (off_t)0 + (size_t)-1) {
 
+       tbp = (char *)malloc(st.st_size);
+       tb_remain = st.st_size;
        if (tbp != NULL) {
-           while (parse_compose_line(fp, tbp) >= 0) {
+           while (parse_compose_line(fp, tbp, &tb_remain) >= 0) {
            }
-           if (tbp != tb)
-               free (tbp);
+           free (tbp);
        }
     }
 }
@@ -969,7 +986,7 @@
        char *p = buf;
        int n;
        char *args[2], *from, *to;
-       while (isspace(*p)) {
+       while ((unsigned char)isspace(*p)) {
            ++p;
        }
        if (iscomment(*p)) {
@@ -1012,7 +1029,7 @@
     char *p = line;
 
     while (argc < argsize) {
-       while (isspace(*p)) {
+       while ((unsigned char)isspace(*p)) {
            ++p;
        }
        if (*p == '\0') {

Modified: branches/1.4/uim/agent.c
==============================================================================
--- branches/1.4/uim/agent.c    (original)
+++ branches/1.4/uim/agent.c    Tue Jul 10 04:00:09 2007
@@ -100,7 +100,7 @@
   while (1) {
     char buf[32];
     fgets(buf, 32, stdin);
-    if (isalpha((int)buf[0])) {
+    if (isalpha((unsigned char)buf[0])) {
       uim_press_key(ac->uc, buf[0], 0);
     } else {
       uim_press_key(ac->uc, UKey_Return, 0);

Modified: branches/1.4/uim/anthy.c
==============================================================================
--- branches/1.4/uim/anthy.c    (original)
+++ branches/1.4/uim/anthy.c    Tue Jul 10 04:00:09 2007
@@ -85,7 +85,7 @@
 
     len = strlen(str);
     for (i = 0; str[i] != '\0'; i++) {
-      if (isalpha(str[i]))
+      if (isalpha((unsigned char)str[i]))
         break;
     }
 

Modified: branches/1.4/uim/uim-func.c
==============================================================================
--- branches/1.4/uim/uim-func.c (original)
+++ branches/1.4/uim/uim-func.c Tue Jul 10 04:00:09 2007
@@ -441,7 +441,7 @@
      -- 2004-07-06 YamaKen
   */
   if (key_state == UMod_Shift) {
-    buf[0] = toupper(buf[0]);
+    buf[0] = toupper((unsigned char)buf[0]);
   }
   return uim_scm_make_str(buf);
 }

Modified: branches/1.4/uim/uim-helper-client.c
==============================================================================
--- branches/1.4/uim/uim-helper-client.c        (original)
+++ branches/1.4/uim/uim-helper-client.c        Tue Jul 10 04:00:09 2007
@@ -72,14 +72,15 @@
 
 int uim_helper_init_client_fd(void (*disconnect_cb)(void))
 {
-  int fd;
   struct sockaddr_un server;
   char *path = uim_helper_get_pathname();
+  FILE *serv_r = NULL, *serv_w = NULL;
+  int fd = -1;
   
   uim_fd = -1;
   
   if (!path)
-    return -1;
+    goto error;
 
   bzero(&server, sizeof(server));
   server.sun_family = PF_UNIX;
@@ -90,7 +91,7 @@
   fd = socket(PF_UNIX, SOCK_STREAM, 0);
   if (fd < 0) {
     perror("fail to create socket");
-    return -1;
+    goto error;
   }
   
 #ifdef LOCAL_CREDS /* for NetBSD */
@@ -104,13 +105,12 @@
 
   if (connect(fd, (struct sockaddr *)&server,sizeof(server)) == -1) {
     int serv_pid = 0;
-    FILE *serv_r = NULL, *serv_w = NULL;
     char buf[128];
     
     serv_pid = uim_ipc_open_command(serv_pid, &serv_r, &serv_w, 
get_server_command());
     
     if (serv_pid == 0) {
-      return -1;
+      goto error;
     }
     
     while (fgets (buf, sizeof(buf), serv_r ) != NULL ) {
@@ -119,19 +119,29 @@
     }
     
     if (connect(fd, (struct sockaddr *)&server,sizeof(server)) == -1) {
-      return -1;
+      goto error;
     }
   }
 
-  if (uim_helper_check_connection_fd(fd)) {
-    close(fd);
-    return -1;
-  }
+  if (uim_helper_check_connection_fd(fd))
+    goto error;
 
   uim_read_buf = strdup("");
   uim_disconnect_cb = disconnect_cb;
   uim_fd = fd;
   return fd;
+
+error:
+  if (fd != -1)
+    close(fd);
+
+  if (serv_r)
+    fclose(serv_r);
+ 
+  if (serv_w)
+    fclose(serv_w);
+
+  return -1;
 }
 
 void

Modified: branches/1.4/uim/uim-scm.c
==============================================================================
--- branches/1.4/uim/uim-scm.c  (original)
+++ branches/1.4/uim/uim-scm.c  Tue Jul 10 04:00:09 2007
@@ -596,7 +596,7 @@
   if (!uim_output)
     uim_output = stderr;
 
-  if (verbose_level && isdigit(verbose_level[0])) {
+  if (verbose_level && isdigit((unsigned char)verbose_level[0])) {
     vlevel = atoi(verbose_level) % 10;
   }
 

Modified: branches/1.4/xim/compose.cpp
==============================================================================
--- branches/1.4/xim/compose.cpp        (original)
+++ branches/1.4/xim/compose.cpp        Tue Jul 10 04:00:09 2007
@@ -117,10 +117,13 @@
 }
 
 static int
-nextch(FILE *fp, int *lastch)
+nextch(FILE *fp, int *lastch, size_t *remain)
 {
     int c;
 
+    if (*remain <= 1)
+       return EOF;
+
     if (*lastch != 0) {
        c = *lastch;
        *lastch = 0;
@@ -166,14 +169,14 @@
 #endif
 
 static int
-nexttoken(FILE *fp, char *tokenbuf, int *lastch)
+nexttoken(FILE *fp, char *tokenbuf, int *lastch, size_t *remain)
 {
     int c;
     int token;
     char *p;
     int i, j;
 
-    while ((c = nextch(fp, lastch)) == ' ' || c == '\t') {
+    while ((c = nextch(fp, lastch, remain)) == ' ' || c == '\t') {
     }
     switch (c) {
     case EOF:
@@ -199,26 +202,30 @@
        break;
     case '"':
        p = tokenbuf;
-       while ((c = nextch(fp, lastch)) != '"') {
+       while ((c = nextch(fp, lastch, remain)) != '"') {
            if (c == '\n' || c == EOF) {
                putbackch(c, lastch);
                token = ERROR;
                goto string_error;
            } else if (c == '\\') {
-               c = nextch(fp, lastch);
+               c = nextch(fp, lastch, remain);
                switch (c) {
                case '\\':
                case '"':
                    *p++ = c;
+                   (*remain)--;
                    break;
                case 'n':
                    *p++ = '\n';
+                   (*remain)--;
                    break;
                case 'r':
                    *p++ = '\r';
+                   (*remain)--;
                    break;
                case 't':
                    *p++ = '\t';
+                   (*remain)--;
                    break;
                case '0':
                case '1':
@@ -229,20 +236,21 @@
                case '6':
                case '7':
                    i = c - '0';
-                   c = nextch(fp, lastch);
+                   c = nextch(fp, lastch, remain);
                    for (j = 0; j < 2 && c >= '0' && c <= '7'; j++) {
                        i <<= 3;
                        i += c - '0';
-                       c = nextch(fp, lastch);
+                       c = nextch(fp, lastch, remain);
                    }
                    putbackch(c, lastch);
                    *p++ = (char)i;
+                   (*remain)--;
                    break;
                case 'X':
                case 'x':
                    i = 0;
                    for (j = 0; j < 2; j++) {
-                       c = nextch(fp, lastch);
+                       c = nextch(fp, lastch, remain);
                        i <<= 4;
                        if (c >= '0' && c <= '9') {
                            i += c - '0';
@@ -261,6 +269,7 @@
                        goto string_error;
                    }
                    *p++ = (char)i;
+                   (*remain)--;
                    break;
                case EOF:
                    putbackch(c, lastch);
@@ -268,17 +277,19 @@
                    goto string_error;
                default:
                    *p++ = c;
+                   (*remain)--;
                    break;
                }
            } else {
                *p++ = c;
+               (*remain)--;
            }
        }
        *p = '\0';
        token = STRING;
        break;
     case '#':
-       while ((c = nextch(fp, lastch)) != '\n' && c != EOF) {
+       while ((c = nextch(fp, lastch, remain)) != '\n' && c != EOF) {
        }
        if (c == '\n') {
            token = ENDOFLINE;
@@ -290,10 +301,17 @@
        if (isalnum(c) || c == '_' || c == '-') {
            p = tokenbuf;
            *p++ = c;
-           c = nextch(fp, lastch);
+           (*remain)--;
+           c = nextch(fp, lastch, remain);
            while (isalnum(c) || c == '_' || c == '-') {
                *p++ = c;
-               c = nextch(fp, lastch);
+               (*remain)--;
+               c = nextch(fp, lastch, remain);
+           }
+           if (c == '\n' || c == EOF) {
+               putbackch(c, lastch);
+               token = ERROR;
+               goto string_error;
            }
            *p = '\0';
            putbackch(c, lastch);
@@ -433,7 +451,7 @@
 #define SEQUENCE_MAX    10
 
 int
-XimIM::parse_compose_line(FILE *fp, char* tokenbuf)
+XimIM::parse_compose_line(FILE *fp, char* tokenbuf, size_t *remain)
 {
     int token;
     unsigned modifier_mask;
@@ -461,7 +479,7 @@
     const char *encoding = get_encoding();;
 
     do {
-       token = nexttoken(fp, tokenbuf, &lastch);
+       token = nexttoken(fp, tokenbuf, &lastch, remain);
     } while (token == ENDOFLINE);
 
     if (token == ENDOFFILE) {
@@ -473,7 +491,7 @@
        if ((token == KEY) && (strcmp("include", tokenbuf) == 0)) {
            char *filename;
            FILE *infp;
-           token = nexttoken(fp, tokenbuf, &lastch);
+           token = nexttoken(fp, tokenbuf, &lastch, remain);
            if (token != KEY && token != STRING)
                goto error;
 
@@ -488,19 +506,19 @@
        } else if ((token == KEY) && (strcmp("None", tokenbuf) == 0)) {
            modifier = 0;
            modifier_mask = AllMask;
-           token = nexttoken(fp, tokenbuf, &lastch);
+           token = nexttoken(fp, tokenbuf, &lastch, remain);
        } else {
            modifier_mask = modifier = 0;
            exclam = False;
            if (token == EXCLAM) {
                exclam = True;
-               token = nexttoken(fp, tokenbuf, &lastch);
+               token = nexttoken(fp, tokenbuf, &lastch, remain);
            }
            while (token == TILDE || token == KEY) {
                tilde = False;
                if (token == TILDE) {
                    tilde = True;
-                   token = nexttoken(fp, tokenbuf, &lastch);
+                   token = nexttoken(fp, tokenbuf, &lastch, remain);
                    if (token != KEY)
                        goto error;
                }
@@ -514,7 +532,7 @@
                } else {
                    modifier |= tmp;
                }
-               token = nexttoken(fp, tokenbuf, &lastch);
+               token = nexttoken(fp, tokenbuf, &lastch, remain);
            }
            if (exclam) {
                modifier_mask = AllMask;
@@ -526,12 +544,12 @@
            goto error;
        }
 
-       token = nexttoken(fp, tokenbuf, &lastch);
+       token = nexttoken(fp, tokenbuf, &lastch, remain);
        if (token != KEY) {
            goto error;
        }
 
-       token = nexttoken(fp, tokenbuf, &lastch);
+       token = nexttoken(fp, tokenbuf, &lastch, remain);
        if (token != GREATER) {
            goto error;
        }
@@ -547,22 +565,22 @@
        n++;
        if (n >= SEQUENCE_MAX)
            goto error;
-       token = nexttoken(fp, tokenbuf, &lastch);
+       token = nexttoken(fp, tokenbuf, &lastch, remain);
     } while (token != COLON);
 
-    token = nexttoken(fp, tokenbuf, &lastch);
+    token = nexttoken(fp, tokenbuf, &lastch, remain);
     if (token == STRING) {
        if ((rhs_string_mb = (char *)malloc(strlen(tokenbuf) + 1)) == NULL)
            goto error;
        strcpy(rhs_string_mb, tokenbuf);
-       token = nexttoken(fp, tokenbuf, &lastch);
+       token = nexttoken(fp, tokenbuf, &lastch, remain);
        if (token == KEY) {
            rhs_keysym = XStringToKeysym(tokenbuf);
            if (rhs_keysym == NoSymbol) {
                free(rhs_string_mb);
                goto error;
            }
-           token = nexttoken(fp, tokenbuf, &lastch);
+           token = nexttoken(fp, tokenbuf, &lastch, remain);
        }
        if (token != ENDOFLINE && token != ENDOFFILE) {
            free(rhs_string_mb);
@@ -573,7 +591,7 @@
        if (rhs_keysym == NoSymbol) {
            goto error;
        }
-       token = nexttoken(fp, tokenbuf, &lastch);
+       token = nexttoken(fp, tokenbuf, &lastch, remain);
        if (token != ENDOFLINE && token != ENDOFFILE) {
            goto error;
        }
@@ -641,7 +659,7 @@
     return n;
 error:
     while (token != ENDOFLINE && token != ENDOFFILE) {
-       token = nexttoken(fp, tokenbuf, &lastch);
+       token = nexttoken(fp, tokenbuf, &lastch, remain);
     }
     return 0;
 }
@@ -649,22 +667,21 @@
 void
 XimIM::ParseComposeStringFile(FILE *fp)
 {
-    char tb[8192];
     char* tbp;
     struct stat st;
+    size_t tb_remain;
 
-    if (fstat(fileno(fp), &st) != -1) {
-       unsigned long size = (unsigned long)st.st_size;
-       if (size <= sizeof tb)
-           tbp = tb;
-       else
-           tbp = (char *)malloc(size);
+    if (fstat(fileno(fp), &st) != -1 &&
+       S_ISREG(st.st_mode) &&
+       st.st_size > 0 &&
+       st.st_size + (size_t)0 < (off_t)0 + (size_t)-1) {
 
+       tbp = (char *)malloc(st.st_size);
+       tb_remain = st.st_size;
        if (tbp != NULL) {
-           while (parse_compose_line(fp, tbp) >= 0) {
+           while (parse_compose_line(fp, tbp, &tb_remain) >= 0) {
            }
-           if (tbp != tb)
-               free (tbp);
+           free (tbp);
        }
     }
 }
@@ -785,7 +802,7 @@
        char *p = buf;
        int n;
        char *args[2], *from, *to;
-       while (isspace(*p)) {
+       while (isspace((unsigned char)*p)) {
            ++p;
        }
        if (iscomment(*p)) {
@@ -828,7 +845,7 @@
     char *p = line;
 
     while (argc < argsize) {
-       while (isspace(*p)) {
+       while (isspace((unsigned char)*p)) {
            ++p;
        }
        if (*p == '\0') {

Modified: branches/1.4/xim/xim.h
==============================================================================
--- branches/1.4/xim/xim.h      (original)
+++ branches/1.4/xim/xim.h      Tue Jul 10 04:00:09 2007
@@ -211,7 +211,7 @@
     char *TransFileName(char *name);
     void ParseComposeStringFile(FILE *fp);
     void FreeComposeTree(DefTree *top);
-    int parse_compose_line(FILE *fp, char *tokenbuf);
+    int parse_compose_line(FILE *fp, char *tokenbuf, size_t *remain);
     int get_mb_string(char *buf, KeySym ks);
     DefTree *mTreeTop;
 };

Reply via email to