Fix crash when using pango markup font

The characters & < > ' " needs to be escaped when using pango markup

Signed-off-by: Heghedus Razvan <heghedus.razvan@gmail.com>

3 files changed, 99 insertions, 6 deletions

diff --git a/common/pango.c b/common/pango.c
index 658d2876..9437c60d 100644
--- a/common/pango.c
+++ b/common/pango.c
@@ -8,6 +8,68 @@
 #include <string.h>
 #include "log.h"
 
+int escape_markup_text(const char *src, char *dest, int dest_length) {
+	int length = 0;
+
+	while (src[0]) {
+		switch (src[0]) {
+		case '&':
+			length += 5;
+			if (dest && dest_length - length >= 0) {
+				dest += sprintf(dest, "%s", "&amp;");
+			} else {
+				dest_length = -1;
+			}
+			break;
+		case '<':
+			length += 4;
+			if (dest && dest_length - length >= 0) {
+				dest += sprintf(dest, "%s", "&lt;");
+			} else {
+				dest_length = -1;
+			}
+			break;
+		case '>':
+			length += 4;
+			if (dest && dest_length - length >= 0) {
+				dest += sprintf(dest, "%s", "&gt;");
+			} else {
+				dest_length = -1;
+			}
+			break;
+		case '\'':
+			length += 6;
+			if (dest && dest_length - length >= 0) {
+				dest += sprintf(dest, "%s", "&apos;");
+			} else {
+				dest_length = -1;
+			}
+			break;
+		case '"':
+			length += 6;
+			if (dest && dest_length - length >= 0) {
+				dest += sprintf(dest, "%s", "&quot;");
+			} else {
+				dest_length = -1;
+			}
+			break;
+		default:
+			length += 1;
+			if (dest && dest_length - length >= 0) {
+				*(dest++) = *src;
+			} else {
+				dest_length = -1;
+			}
+		}
+		src++;
+	}
+	// if we could not fit the escaped string in dest, return -1
+	if (dest && dest_length == -1) {
+		return -1;
+	}
+	return length;
+}
+
 PangoLayout *get_pango_layout(cairo_t *cairo, const char *font,
 		const char *text, int32_t scale, bool markup) {
 	PangoLayout *layout = pango_cairo_create_layout(cairo);
@@ -15,13 +77,14 @@ PangoLayout *get_pango_layout(cairo_t *cairo, const char *font,
 	if (markup) {
 		char *buf;
 		GError *error = NULL;
-		if (!sway_assert(pango_parse_markup(
-					text, -1, 0, &attrs, &buf, NULL, &error),
-				"pango_parse_markup '%s' -> error %s", text,
-				error ? error->message : NULL)) {
+		bool result = pango_parse_markup(text, -1, 0, &attrs, &buf,
+				NULL, &error);
+		if (result) {
+			wlr_log(L_ERROR, "pango_parse_markup '%s' -> error %s", text,
+					error->message);
 			return NULL;
 		}
-		pango_layout_set_markup(layout, buf, -1);
+		pango_layout_set_markup(layout, text, -1);
 		free(buf);
 	} else {
 		attrs = pango_attr_list_new();
diff --git a/include/pango.h b/include/pango.h
index f6325f28..d8263f9e 100644
--- a/include/pango.h
+++ b/include/pango.h
@@ -6,6 +6,17 @@
 #include <cairo/cairo.h>
 #include <pango/pangocairo.h>
 
+/* Utility function which escape characters a & < > ' ".
+ *
+ * If the dest parameter is NULL, then the function returns the length of
+ * of the escaped src string. The dest_length doesn't matter.
+ *
+ * If the dest parameter is not NULL then the fuction escapes the src string
+ * an puts the escaped string in dest and returns the lenght of the escaped string.
+ * The dest_length parameter is the size of dest array. If the size of dest is not
+ * enough, then the function returns -1.
+ */
+int escape_markup_text(const char *src, char *dest, int dest_length);
 PangoLayout *get_pango_layout(cairo_t *cairo, const char *font,
 		const char *text, int32_t scale, bool markup);
 void get_text_size(cairo_t *cairo, const char *font, int *width, int *height,
diff --git a/sway/tree/view.c b/sway/tree/view.c
index e2cb8a7a..9bdc5198 100644
--- a/sway/tree/view.c
+++ b/sway/tree/view.c
@@ -14,6 +14,8 @@
 #include "sway/tree/layout.h"
 #include "sway/tree/view.h"
 #include "sway/tree/workspace.h"
+#include "sway/config.h"
+#include "pango.h"
 
 void view_init(struct sway_view *view, enum sway_view_type type,
 		const struct sway_view_impl *impl) {
@@ -612,6 +614,19 @@ static size_t parse_title_format(struct sway_view *view, char *buffer) {
 	return len;
 }
 
+static char *escape_title(char *buffer) {
+	int length = escape_markup_text(buffer, NULL, 0);
+	char *escaped_title = calloc(length + 1, sizeof(char));
+	int result = escape_markup_text(buffer, escaped_title, length);
+	if (result != length) {
+		wlr_log(L_ERROR, "Could not escape title: %s", buffer);
+		free(escaped_title);
+		return buffer;
+	}
+	free(buffer);
+	return escaped_title;
+}
+
 void view_update_title(struct sway_view *view, bool force) {
 	if (!view->swayc) {
 		return;
@@ -631,11 +646,15 @@ void view_update_title(struct sway_view *view, bool force) {
 	free(view->swayc->formatted_title);
 	if (title) {
 		size_t len = parse_title_format(view, NULL);
-		char *buffer = calloc(len + 1, 1);
+		char *buffer = calloc(len + 1, sizeof(char));
 		if (!sway_assert(buffer, "Unable to allocate title string")) {
 			return;
 		}
 		parse_title_format(view, buffer);
+		// now we have the title, but needs to be escaped when using pango markup
+		if (config->pango_markup) {
+			buffer = escape_title(buffer);
+		}
 
 		view->swayc->name = strdup(title);
 		view->swayc->formatted_title = buffer;