[PATCH] xtables: use strspn() to check if string needs to be quoted

[PATCH] xtables: use strspn() to check if string needs to be quoted

[Max Kellermann]

Problem: the call xtables_save_string("'") prints just a single quote,
not enclosed in double quoted and not escaped.

Steps to reproduce:

 $ iptables -A foo -m comment --comment "'" -j ACCEPT
 $ iptables-multi save|grep foo
 -A foo -m comment --comment ' -j ACCEPT

The cause was the use of strcspn() to locate the first character which
justified quoting the string in double quotes.  That however was
wrong, because the way strcspn() was called, it returned a pointer to
the first character that was not to be escaped, which did the right
thing most of the time, but not for strings consisting only of quote
characters.  This patch changes strcspn() to strspn().
---
 xtables.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/xtables.c b/xtables.c
index fc59f75..57d5d13 100644
--- a/xtables.c
+++ b/xtables.c
@@ -1638,7 +1638,7 @@ void xtables_save_string(const char *value)
 	size_t length;
 	const char *p;
 
-	length = strcspn(value, no_quote_chars);
+	length = strspn(value, no_quote_chars);
 	if (length > 0 && value[length] == 0) {
 		/* no quoting required */
 		putchar(' ');

Re: [PATCH] xtables: use strspn() to check if string needs to be quoted

[Patrick McHardy]

Am 14.02.2011 07:54, schrieb Max Kellermann:
> Problem: the call xtables_save_string("'") prints just a single quote,
> not enclosed in double quoted and not escaped.
> 
> Steps to reproduce:
> 
>  $ iptables -A foo -m comment --comment "'" -j ACCEPT
>  $ iptables-multi save|grep foo
>  -A foo -m comment --comment ' -j ACCEPT
> 
> The cause was the use of strcspn() to locate the first character which
> justified quoting the string in double quotes.  That however was
> wrong, because the way strcspn() was called, it returned a pointer to
> the first character that was not to be escaped, which did the right
> thing most of the time, but not for strings consisting only of quote
> characters.  This patch changes strcspn() to strspn().

Looks good to me, applied. But please remember to sign off your
patches.