[PATCH v2] [RFC] libdep plugin: fix bugs in parser and drop escaping

[Harmen Stoppels]

Hi Howard,

On Thursday, June 20th, 2024 at 19:36, Howard Chu <hyc@symas.com> wrote:

>
>
> Harmen Stoppels wrote:
>
> > Second version of this patch addresses the following:
> >
> > 1. fix another buffer overflow in libdep_plugin.c when the libdep argument
> > string was tab separated instead of white space.
>
>
> When would such an argument be produced? The string was itself passed in as a
> command line argument, and a shell would delimit all arguments with a space. Any
> embedded tabs would thus be data, and not delimiters.

It can happen in a pattern `ar cfl "-L$dir -lexample" libf.a f.o`. It may be
uncommon for directories to contain a `\t`, but it is allowed, so it shouldn't
segfault the linker.

> > 2. drops handling of `\\`: previously the parser simply dropped that character,
> > it did not escape anything, and it was impossible to specify `-Lfoo\\bar`
> > with a literal `\\` in the path. Further `\\` triggered a bug where it did not
> > memmove the trailing null byte. So it is not breaking to make the parser
> > treat `\\` like a literal character.
>
> > There is no need for an escape character
> > because single and double quotes allow one to express any character as an
> > argument, include white space and quotes.
>
>
> It's quite awkward to do the necessary intermixing of single and double quotes when
> passing arguments through a Makefile and a shell, or thru autoconf to a shell to a
> Makefile, etc. etc...

Sure, but not everyone uses autotools and makefiles. For example meson is python based
and can trivially generate a ninja file with proper escaping using shlex.quote(...),
it's a python builtin.

If \ is a special escaping character in the linker, then you actually have to do double
escaping from the shell when calling `ar`, which is only more confusing:

    $ ar crl "-La\\b"

would escape the `\` in the shell, but the linker receives `-La\b` and interprets it as
an escape character for `\b` parsing it as `-Lab`, so users would have to specify

   $ ar crl "-La\\\\b"

on the command line to get `-La\b` as a command line argument...

If `\` is taken as a literal character in the linker, then

   $ ar crl "-La\\b"

is sufficient to get `-La\b` which is much better.