openbmc/build/tmp/deploy/sdk/witherspoon-2019-08-08/sysroots/armv6-openbmc-linux-gnueabi/usr/src/debug/rsyslog/8.1903.0-r0/rsyslog-8.1903.0/template.c
rsRetVal doEscape(uchar** pp, rs_size_t* pLen, unsigned short* pbMustBeFreed,
                  int mode)
{
    DEFiRet;
    uchar* p = NULL;
    int iLen;
    cstr_t* pStrB = NULL;
    uchar* pszGenerated;

    assert(pp != NULL);
    assert(*pp != NULL);
    assert(pLen != NULL);
    assert(pbMustBeFreed != NULL);

    /* first check if we need to do anything at all... */
    if (mode == STDSQL_ESCAPE)
        for (p = *pp; *p && *p != '\''; ++p)
            ;
    else if (mode == SQL_ESCAPE)
        for (p = *pp; *p && *p != '\'' && *p != '\\'; ++p)
            ;
    else if (mode == JSON_ESCAPE)
        for (p = *pp; *p && (*p == '"' || *p == '\\'); ++p)
            ;
    /* when we get out of the loop, we are either at the
     * string terminator or the first character to escape */
    if (p && *p == '\0')
        FINALIZE; /* nothing to do in this case! */

    p = *pp;
    iLen = *pLen;
    CHKiRet(cstrConstruct(&pStrB));

    while (*p)
    {
        if ((mode == SQL_ESCAPE || mode == STDSQL_ESCAPE) && *p == '\'')
        {
            CHKiRet(
                cstrAppendChar(pStrB, (mode == STDSQL_ESCAPE) ? '\'' : '\\'));
            iLen++; /* reflect the extra character */
        }
        else if ((mode == SQL_ESCAPE) && *p == '\\')
        {
            CHKiRet(cstrAppendChar(pStrB, '\\'));
            iLen++; /* reflect the extra character */
        }
        else if ((mode == JSON_ESCAPE) && (*p == '"' || *p == '\\'))
        {
            CHKiRet(cstrAppendChar(pStrB, '\\'));
            iLen++; /* reflect the extra character */
        }
        CHKiRet(cstrAppendChar(pStrB, *p));
        ++p;
    }
    cstrFinalize(pStrB);
    CHKiRet(cstrConvSzStrAndDestruct(&pStrB, &pszGenerated, 0));

    if (*pbMustBeFreed)
        free(*pp); /* discard previous value */

    *pp = pszGenerated;
    *pLen = iLen;
    *pbMustBeFreed = 1;

finalize_it:
    if (iRet != RS_RET_OK)
    {
        doEmergencyEscape(*pp, mode);
        if (pStrB != NULL)
            cstrDestruct(&pStrB);
    }

    RETiRet;
}
/* SQL-Escape a string. Single quotes are found and
 * replaced by two of them. A new buffer is allocated
 * for the provided string and the provided buffer is
 * freed. The length is updated. Parameter pbMustBeFreed
 * is set to 1 if a new buffer is allocated. Otherwise,
 * it is left untouched.
 * --
 * We just discovered a security issue. MySQL is so
 * "smart" to not only support the standard SQL mechanism
 * for escaping quotes, but to also provide its own (using
 * c-type syntax with backslashes). As such, it is actually
 * possible to do sql injection via rsyslogd. The cure is now
 * to escape backslashes, too. As we have found on the web, some
 * other databases seem to be similar "smart" (why do we have standards
 * at all if they are violated without any need???). Even better, MySQL's
 * smartness depends on config settings. So we add a new option to this
 * function that allows the caller to select if they want to standard or
 * "smart" encoding ;)
 * --
 * Parameter "mode" is STDSQL_ESCAPE, SQL_ESCAPE "smart" SQL engines, or
 * JSON_ESCAPE for everyone requiring escaped JSON (e.g. ElasticSearch).
 * 2005-09-22 rgerhards
 */
SQL-Escape a string. Single quotes are found and
replaced by two of them. A new buffer is allocated
for the provided string and the provided buffer is
freed. The length is updated. Parameter pbMustBeFreed
is set to 1 if a new buffer is allocated. Otherwise,
it is left untouched.

We just discovered a security issue. MySQL is so
"smart" to not only support the standard SQL mechanism
for escaping quotes, but to also provide its own (using
c-type syntax with backslashes). As such, it is actually
possible to do sql injection via rsyslogd. The cure is now
to escape backslashes, too. As we have found on the web, some
other databases seem to be similar "smart" (why do we have standards
at all if they are violated without any need???). Even better, MySQL's
smartness depends on config settings. So we add a new option to this
function that allows the caller to select if they want to standard or
"smart" encoding ;)

Parameter "mode" is STDSQL_ESCAPE, SQL_ESCAPE "smart" SQL engines, or
JSON_ESCAPE for everyone requiring escaped JSON .
SQL - Escape a string . Single quotes are found and replaced by two of them . A new buffer is allocated for the provided string and the provided buffer is freed . The length is updated . Parameter pbMustBeFreed is set to 1 if a new buffer is allocated . Otherwise it is left untouched . We just discovered a security issue . MySQL is so " smart " to not only support the standard SQL mechanism for escaping quotes but to also provide its own ( using c - type syntax with backslashes ) . As such it is actually possible to do sql injection via rsyslogd . The cure is now to escape backslashes too . As we have found on the web some other databases seem to be similar " smart " ( why do we have standards at all if they are violated without any need??? ) . Even better MySQL ' s smartness depends on config settings . So we add a new option to this function that allows the caller to select if they want to standard or " smart " encoding ; ) Parameter " mode " is STDSQL_ESCAPE SQL_ESCAPE " smart " SQL engines or JSON_ESCAPE for everyone requiring escaped JSON .
rsRetVal doEscape(uchar** pp, rs_size_t* pLen, unsigned short* pbMustBeFreed,
                  int mode)
{
    DEFiRet;
    uchar* p = NULL;
    int iLen;
    cstr_t* pStrB = NULL;
    uchar* pszGenerated;
    assert(pp != NULL);
    assert(*pp != NULL);
    assert(pLen != NULL);
    assert(pbMustBeFreed != NULL);
    if (mode == STDSQL_ESCAPE)
        for (p = *pp; *p && *p != '\''; ++p)
            ;
    else if (mode == SQL_ESCAPE)
        for (p = *pp; *p && *p != '\'' && *p != '\\'; ++p)
            ;
    else if (mode == JSON_ESCAPE)
        for (p = *pp; *p && (*p == '"' || *p == '\\'); ++p)
            ;
    if (p && *p == '\0')
        FINALIZE; 
    p = *pp;
    iLen = *pLen;
    CHKiRet(cstrConstruct(&pStrB));
    while (*p)
    {
        if ((mode == SQL_ESCAPE || mode == STDSQL_ESCAPE) && *p == '\'')
        {
            CHKiRet(
                cstrAppendChar(pStrB, (mode == STDSQL_ESCAPE) ? '\'' : '\\'));
            iLen++; 
        }
        else if ((mode == SQL_ESCAPE) && *p == '\\')
        {
            CHKiRet(cstrAppendChar(pStrB, '\\'));
            iLen++; 
        }
        else if ((mode == JSON_ESCAPE) && (*p == '"' || *p == '\\'))
        {
            CHKiRet(cstrAppendChar(pStrB, '\\'));
            iLen++; 
        }
        CHKiRet(cstrAppendChar(pStrB, *p));
        ++p;
    }
    cstrFinalize(pStrB);
    CHKiRet(cstrConvSzStrAndDestruct(&pStrB, &pszGenerated, 0));
    if (*pbMustBeFreed)
        free(*pp); 
    *pp = pszGenerated;
    *pLen = iLen;
    *pbMustBeFreed = 1;
finalize_it:
    if (iRet != RS_RET_OK)
    {
        doEmergencyEscape(*pp, mode);
        if (pStrB != NULL)
            cstrDestruct(&pStrB);
    }
    RETiRet;
}
rsRetVal doEscape ( uchar * * pp , rs_size_t * pLen , unsigned short * pbMustBeFreed , int mode ) { DEFiRet ; uchar * p = NULL ; int iLen ; cstr_t * pStrB = NULL ; uchar * pszGenerated ; assert ( pp != NULL ) ; assert ( * pp != NULL ) ; assert ( pLen != NULL ) ; assert ( pbMustBeFreed != NULL ) ; if ( mode == STDSQL_ESCAPE ) for ( p = * pp ; * p && * p != ' \' ' ; ++ p ) ; else if ( mode == SQL_ESCAPE ) for ( p = * pp ; * p && * p != ' \' ' && * p != ' \\ ' ; ++ p ) ; else if ( mode == JSON_ESCAPE ) for ( p = * pp ; * p && ( * p == ' ' || * p == ' \\ ' ) ; ++ p ) ; if ( p && * p == ' \0 ' ) FINALIZE ; p = * pp ; iLen = * pLen ; CHKiRet ( cstrConstruct ( & pStrB ) ) ; while ( * p ) { if ( ( mode == SQL_ESCAPE || mode == STDSQL_ESCAPE ) && * p == ' \' ' ) { CHKiRet ( cstrAppendChar ( pStrB , ( mode == STDSQL_ESCAPE ) ? ' \' ' : ' \\ ' ) ) ; iLen ++ ; } else if ( ( mode == SQL_ESCAPE ) && * p == ' \\ ' ) { CHKiRet ( cstrAppendChar ( pStrB , ' \\ ' ) ) ; iLen ++ ; } else if ( ( mode == JSON_ESCAPE ) && ( * p == ' ' || * p == ' \\ ' ) ) { CHKiRet ( cstrAppendChar ( pStrB , ' \\ ' ) ) ; iLen ++ ; } CHKiRet ( cstrAppendChar ( pStrB , * p ) ) ; ++ p ; } cstrFinalize ( pStrB ) ; CHKiRet ( cstrConvSzStrAndDestruct ( & pStrB , & pszGenerated , 0 ) ) ; if ( * pbMustBeFreed ) free ( * pp ) ; * pp = pszGenerated ; * pLen = iLen ; * pbMustBeFreed = 1 ; finalize_it : if ( iRet != RS_RET_OK ) { doEmergencyEscape ( * pp , mode ) ; if ( pStrB != NULL ) cstrDestruct ( & pStrB ) ; } RETiRet ; }
SQL-Escape a string.
SQL - Escape a string .
/* first check if we need to do anything at all... */ /* when we get out of the loop, we are either at the
     * string terminator or the first character to escape */ /* nothing to do in this case! */ /* reflect the extra character */ /* reflect the extra character */ /* reflect the extra character */ /* discard previous value */