1 files changed, 158 insertions, 32 deletions

diff --git a/lib/transform.c b/lib/transform.c
index 36972f0..c8ed54d 100644
--- a/lib/transform.c
+++ b/lib/transform.c
@@ -63,23 +63,42 @@ struct transform
   unsigned match_number;
   regex_t regex;
   int has_regex;
+  int error;
   /* Compiled replacement expression */
   struct replace_segm *repl_head, *repl_tail;
   size_t segm_count; /* Number of elements in the above list */
 };
 
+static inline int
+transform_err(struct transform *tf)
+{
+  return tf->error;
+}
+
+static void
+transform_seterr (struct transform *tf, int ec)
+{
+  errno_to_pam (errno);
+  tf->error = ec;
+}
+
 
 static struct transform *transform_head, *transform_tail;
+static char *case_ctl_buffer;
+static size_t case_ctl_bufsize;
 
 static struct transform *
-new_transform ()
+new_transform (void)
+{
+  struct transform *p = calloc (1, sizeof *p);
+  if (p)
     {
-  struct transform *p = gray_zalloc (sizeof *p);
       if (transform_tail)
 	transform_tail->next = p;
       else
 	transform_head = p;
       transform_tail = p;
+    }
   return p;
 }
 
@@ -102,7 +121,9 @@ free_transform (struct transform *tr)
 static struct replace_segm *
 add_segment (struct transform *tf)
 {
-  struct replace_segm *segm = gray_malloc (sizeof *segm);
+  struct replace_segm *segm = malloc (sizeof *segm);
+  if (segm)
+    {
       segm->next = NULL;
       if (tf->repl_tail)
 	tf->repl_tail->next = segm;
@@ -110,6 +131,9 @@ add_segment (struct transform *tf)
 	tf->repl_head = segm;
       tf->repl_tail = segm;
       tf->segm_count++;
+    }
+  else
+    transform_seterr (tf, errno_to_pam (errno));
   return segm;
 }
 
@@ -122,59 +146,87 @@ free_segment (struct replace_segm *segm)
 }
 
 static void
-add_literal_segment (struct transform *tf, char *str, char *end)
+add_literal_segment (struct transform *tf, char const *str, char const *end)
 {
   size_t len = end - str;
   if (len)
     {
       struct replace_segm *segm = add_segment (tf);
+      if (segm)
+	{
 	  segm->type = segm_literal;
-      segm->v.literal.ptr = gray_malloc (len + 1);
+	  segm->v.literal.ptr = malloc (len + 1);
+	  if (segm->v.literal.ptr)
+	    {
 	      memcpy (segm->v.literal.ptr, str, len);
 	      segm->v.literal.ptr[len] = 0;
 	      segm->v.literal.size = len;
 	    }
+	  else
+	    transform_seterr (tf, errno_to_pam (errno));
+	}
+    }
 }
 
 static void
 add_char_segment (struct transform *tf, int chr)
 {
   struct replace_segm *segm = add_segment (tf);
+  if (segm)
+    {
       segm->type = segm_literal;
-  segm->v.literal.ptr = gray_malloc (2);
+      segm->v.literal.ptr = malloc (2);
+      if (segm->v.literal.ptr)
+	{
 	  segm->v.literal.ptr[0] = chr;
 	  segm->v.literal.ptr[1] = 0;
 	  segm->v.literal.size = 1;
 	}
+      else
+	transform_seterr (tf, errno_to_pam (errno));
+    }
+}
 
 static void
 add_backref_segment (struct transform *tf, size_t ref)
 {
   struct replace_segm *segm = add_segment (tf);
+  if (segm)
+    {
       segm->type = segm_backref;
       segm->v.ref = ref;
     }
+}
 
 static void
 add_case_ctl_segment (struct transform *tf, enum case_ctl_type ctl)
 {
   struct replace_segm *segm = add_segment (tf);
+  if (segm)
+    {
       segm->type = segm_case_ctl;
       segm->v.ctl = ctl;
     }
+}
 
-static const char *
-parse_transform_expr (const char *expr)
+static int
+parse_transform_expr (const char *expr, const char **endp)
 {
   int delim;
   int i, j, rc;
-  char *str, *beg, *cur;
+  char *str;
+  const char *beg;
+  const char *cur;
   const char *p;
   int cflags = 0;
   struct transform *tf = new_transform ();
 
   if (expr[0] != 's')
-    gray_raise ("Invalid transform expression");
+    {
+      _pam_log(LOG_ERR, "invalid transform expression");
+      *endp = expr;
+      return PAM_SERVICE_ERR;
+    }
 
   delim = expr[1];
 
@@ -184,7 +236,11 @@ parse_transform_expr (const char *expr)
       i++;
 
   if (expr[i] != delim)
-    gray_raise ("Invalid transform expression");
+    {
+      _pam_log(LOG_ERR, "invalid transform expression");
+      *endp = expr + i;
+      return PAM_SERVICE_ERR;
+    }
 
   /* Scan replacement expression */
   for (j = i + 1; expr[j] && expr[j] != delim; j++)
@@ -192,7 +248,11 @@ parse_transform_expr (const char *expr)
       j++;
 
   if (expr[j] != delim)
-    gray_raise ("Invalid transform expression");
+    {
+      _pam_log(LOG_ERR, "invalid transform expression");
+      *endp = expr + j;
+      return PAM_SERVICE_ERR;
+    }
 
   /* Check flags */
   tf->transform_type = transform_first;
@@ -218,14 +278,21 @@ parse_transform_expr (const char *expr)
 	break;
 
       default:
-	gray_raise("Unknown flag in transform expression: %c", *p);
+	_pam_log(LOG_ERR, "unknown flag in transform expression: %c", *p);
+	*endp = p;
+	return PAM_SERVICE_ERR;
       }
 
   if (*p == ';')
     p++;
   
   /* Extract and compile regex */
-  str = gray_malloc (i - 1);
+  str = malloc (i - 1);
+  if (!str)
+    {
+      *endp = p;
+      return errno_to_pam (errno);
+    }
   memcpy (str, expr + 2, i - 2);
   str[i - 2] = 0;
 
@@ -235,7 +302,10 @@ parse_transform_expr (const char *expr)
     {
       char errbuf[512];
       regerror (rc, &tf->regex, errbuf, sizeof (errbuf));
-      gray_raise("Invalid transform expression: %s", errbuf);
+      _pam_log(LOG_ERR, "invalid transform expression: %s", errbuf);
+      free (str);
+      *endp = p;
+      return PAM_SERVICE_ERR;
     }
   tf->has_regex = 1;
   if (str[0] == '^' || str[strlen (str) - 1] == '$')
@@ -245,12 +315,25 @@ parse_transform_expr (const char *expr)
 
   /* Extract and compile replacement expr */
   i++;
-  str = gray_malloc (j - i + 1);
+  str = malloc (j - i + 1);
+  if (!str)
+    {
+      *endp = p;
+      return errno_to_pam (errno);
+    }
+
   memcpy (str, expr + i, j - i);
   str[j - i] = 0;
 
   for (cur = beg = str; *cur;)
     {
+      if (transform_err (tf))
+	{
+	  *endp = expr + i + (beg - str);
+	  free (str);
+	  return transform_err (tf);
+	}
+
       if (*cur == '\\')
 	{
 	  size_t n;
@@ -260,10 +343,15 @@ parse_transform_expr (const char *expr)
 	    {
 	    case '0': case '1': case '2': case '3': case '4':
 	    case '5': case '6': case '7': case '8': case '9':
-	      n = strtoul (cur, &cur, 10);
+	      n = strtoul (cur, (char**)&cur, 10);
 	      if (n > tf->regex.re_nsub)
-		gray_raise ("Invalid transform replacement: "
+		{
+		  _pam_log(LOG_ERR,
+			   "invalid transform replacement: "
 			   "back reference out of range");
+		  transform_seterr (tf, PAM_SERVICE_ERR);
+		}
+	      else
 		add_backref_segment (tf, n);
 	      break;
 
@@ -367,19 +455,33 @@ parse_transform_expr (const char *expr)
 	cur++;
     }
   add_literal_segment (tf, beg, cur);
-
-  return p;
+  if (transform_err (tf))
+    {
+      *endp = expr + i + (beg - str);
+      free (str);
+      return transform_err (tf);
+    }
+  *endp = p;
+  return 0;
 }
 
-void
+int
 gray_set_transform_expr (const char *expr)
 {
   while (*expr)
-    expr = parse_transform_expr (expr);
+    {
+      int rc = parse_transform_expr (expr, &expr);
+      if (rc != PAM_SUCCESS)
+	{
+	  gray_free_transform_expr ();
+	  return rc;
+	}
+    }
+  return PAM_SUCCESS;
 }
 
 void
-gray_free_transform_expr ()
+gray_free_transform_expr (void)
 {
   while (transform_head)
     {
@@ -388,6 +490,9 @@ gray_free_transform_expr ()
       transform_head = next;
     }
   transform_tail = NULL;
+  free (case_ctl_buffer);
+  case_ctl_buffer = NULL;
+  case_ctl_bufsize = 0;
 }
 
 /* Run case conversion specified by CASE_CTL on array PTR of SIZE
@@ -395,14 +500,15 @@ gray_free_transform_expr ()
 static char *
 run_case_conv (enum case_ctl_type case_ctl, char *ptr, size_t size)
 {
-  static char *case_ctl_buffer;
-  static size_t case_ctl_bufsize;
   char *p;
   
   if (case_ctl_bufsize < size)
     {
+      p = realloc (case_ctl_buffer, size);
+      if (!p)
+	return NULL;
+      case_ctl_buffer = p;
       case_ctl_bufsize = size;
-      case_ctl_buffer = gray_realloc (case_ctl_buffer, case_ctl_bufsize);
     }
   memcpy (case_ctl_buffer, ptr, size);
   switch (case_ctl)
@@ -432,7 +538,7 @@ run_case_conv (enum case_ctl_type case_ctl, char *ptr, size_t size)
 }
 
 
-void
+static int
 _single_transform_name_to_slist (struct transform *tf, gray_slist_t slist,
 				 char *input)
 {
@@ -450,8 +556,9 @@ _single_transform_name_to_slist (struct transform *tf, gray_slist_t slist,
                               save_ctl = ctl_stop;            \
 			    }
   
-  rmp = gray_malloc ((tf->regex.re_nsub + 1) * sizeof (*rmp));
-
+  rmp = malloc ((tf->regex.re_nsub + 1) * sizeof (*rmp));
+  if (!rmp)
+    return errno;
   while (*input)
     {
       size_t disp;
@@ -488,6 +595,8 @@ _single_transform_name_to_slist (struct transform *tf, gray_slist_t slist,
 		      ptr = run_case_conv (case_ctl,
 					   segm->v.literal.ptr,
 					   segm->v.literal.size);
+		      if (!ptr)
+			return errno;
 		      CASE_CTL_RESET();
 		    }
 		  gray_slist_append (slist, ptr, segm->v.literal.size);
@@ -503,6 +612,8 @@ _single_transform_name_to_slist (struct transform *tf, gray_slist_t slist,
 		      if (case_ctl != ctl_stop)
 			{
 			  ptr = run_case_conv (case_ctl, ptr, size);
+			  if (!ptr)
+			    return errno;
 			  CASE_CTL_RESET();
 			}
 		      
@@ -551,20 +662,35 @@ _single_transform_name_to_slist (struct transform *tf, gray_slist_t slist,
 
   gray_slist_append_char (slist, 0);
   free (rmp);
+  return gray_slist_err (slist);
 }
 
 int
 gray_transform_name_to_slist (gray_slist_t slist, char *input, char **output)
 {
+  if (transform_head)
+    {
       struct transform *tf;
-
       for (tf = transform_head; tf; tf = tf->next)
 	{
-      _single_transform_name_to_slist (tf, slist, input);
+	  int rc = _single_transform_name_to_slist (tf, slist, input);
+	  if (rc)
+	    return errno_to_pam(rc);
+	  input = gray_slist_finish (slist);
+	  if (!input)
+	    return errno_to_pam(errno);
+	}
+    }
+  else
+    {
+      gray_slist_append(slist, input, strlen(input) + 1);
       input = gray_slist_finish (slist);
+      if (!input)
+	return errno_to_pam(errno);
     }
   *output = input;
-  return transform_head != NULL;
+  
+  return PAM_SUCCESS;
 }