On Fri, Sep 04, 2015 at 03:17:31PM +1000, Damien Miller wrote:
> Hi,
> 
> Comments appreciated.

as micm@ already mentioned, utf8_stringprep.c in patch is in two (or
three ?) copies of itself in the same file.

> diff --git a/sshconnect2.c b/sshconnect2.c
> index 2b525ac..04120e7 100644
> --- a/sshconnect2.c
> +++ b/sshconnect2.c
> @@ -455,21 +457,51 @@ input_userauth_error(int type, u_int32_t seq, void 
> *ctxt)
>       return 0;
>  }
>  
> +/* Check whether we can display UTF-8 safely */
> +static int
> +utf8_ok(void)
> +{
> +     static int ret = -1;
> +     char *cp;
> +
> +     if (ret == -1) {
> +             setlocale(LC_CTYPE, "");
> +             cp = nl_langinfo(CODESET);
> +             ret = strcmp(cp, "UTF-8") == 0;
> +     }
> +     return ret;
> +}
> +

it could be have a possible problem here. but I don't known enough ssh
code to be sure.

setlocale(1) isn't thread safe, and it changes the behaviour of
multiple functions.

with static variable `ret', you ensure it is called only once. but the
program will don't have the same behaviour in all its life-time:

  - between start and the first `utf8_ok' call, it will use C locale,
  - and after, it will use the implementation-defined native environment
    (value from LC_* and LANG environment variable).
  
for openbsd, which currently support only C and UTF-8 locales it should
be ok. I don't see others functions than isspace(3) type (isalnum(3),
...) in ssh, and it shouldn't be difference between C and UTF-8 (they
share the same ctype table for 0-255). but for portable, it could be
wrong.

but be aware that some functions, like, `mblen' (used in sftp.c, so not
in same context than `utf8_ok' I think), could copte badly with
setlocale() call (man mblen extract): 

     Calling any other functions in libc never change the internal state of
     the mblen(), except for calling setlocale(3) with the LC_CTYPE category
     changed to that of the current locale.  Such setlocale(3) calls cause the
     internal state of this function to be indeterminate.

Regards.
-- 
Sebastien Marie

Reply via email to