simon-git: putty (pre-0.77): Simon Tatham

Sat Mar 12 20:58:41 GMT 2022

TL;DR:
  269ea8aa Move predeclaration of struct unicode_data into defs.h.
  21f602be Add utility function dup_wc_to_mb.
  b360ea6a Add a manual single-char UTF-8 decoder.
  cf41bc0c Unix mb_to_wc: add missing bounds checks.
  fe00a292 Windows: diagnose failure to create the terminal window.
  90166728 Windows: initialise window_name and icon_name.
  5de1df1b Windows: avoid idempotent window title changes.
  26dcfcbd Make init_winver() idempotent.
  51f0057b Add a '#define LEGACY_WINDOWS'.
  83ff08f9 Remove hard dependency on GetFileAttributesEx.
  01c00712 Remove hard dependencies on multi-monitor functions.
  373e52bd Windows: runtime switch between Unicode and ANSI windows.
  b7af966f Windows Pageant: turn 'has_security' into a global function.
  09fd952b Windows Pageant: deal with PeekMessageW failing on legacy Windows.
  fa9968d6 windows/unicode.c: manually speak UTF-8.
  58281f9b Fix trust status when Interactor returns a seat.

Repository:     https://git.tartarus.org/simon/putty.git
On the web:     https://git.tartarus.org/?p=simon/putty.git
Branch updated: pre-0.77
Committer:      Simon Tatham <anakin at pobox.com>
Date:           2022-03-12 20:58:41

commit 269ea8aaf5d3fc2b9e577b09e217dc0ed051dd2b
web diff https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=269ea8aaf5d3fc2b9e577b09e217dc0ed051dd2b;hp=ee987ce4cdc35578207e7cd02837292f5b23ebdd
Author: Simon Tatham <anakin at pobox.com>
Date:   Sat Mar 12 16:57:51 2022 +0000

    Move predeclaration of struct unicode_data into defs.h.

    It's just the sort of thing that ought to be in there, once, so it
    doesn't have to be declared in n places.

 defs.h             | 2 ++
 unix/platform.h    | 1 -
 windows/platform.h | 1 -
 3 files changed, 2 insertions(+), 2 deletions(-)

commit 21f602be407838a53b281484afdeb068a84713b8
web diff https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=21f602be407838a53b281484afdeb068a84713b8;hp=269ea8aaf5d3fc2b9e577b09e217dc0ed051dd2b
Author: Simon Tatham <anakin at pobox.com>
Date:   Sat Mar 12 16:01:21 2022 +0000

    Add utility function dup_wc_to_mb.

    This parallels dup_mb_to_wc, which already existed. I haven't needed
    the same thing this way round yet, but I'm about to.

 misc.h               |  4 ++++
 utils/CMakeLists.txt |  1 +
 utils/dup_wc_to_mb.c | 39 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 44 insertions(+)

commit b360ea6ac19b7688ab0a8b09350298874b731c4a
web diff https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=b360ea6ac19b7688ab0a8b09350298874b731c4a;hp=21f602be407838a53b281484afdeb068a84713b8
Author: Simon Tatham <anakin at pobox.com>
Date:   Sat Mar 12 15:53:04 2022 +0000

    Add a manual single-char UTF-8 decoder.

    This parallels encode_utf8 which we already had.

    Decoding is more fraught with perils than encoding, so I've also
    included a small test program.

 CMakeLists.txt               |   5 ++
 misc.h                       |  11 +++
 utils/CMakeLists.txt         |   2 +
 utils/decode_utf8.c          | 178 +++++++++++++++++++++++++++++++++++++++++++
 utils/decode_utf8_to_wchar.c |  20 +++++
 5 files changed, 216 insertions(+)

commit cf41bc0c624eca01d5a710bee46f63e631b61aae
web diff https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=cf41bc0c624eca01d5a710bee46f63e631b61aae;hp=b360ea6ac19b7688ab0a8b09350298874b731c4a
Author: Simon Tatham <anakin at pobox.com>
Date:   Sat Mar 12 18:47:27 2022 +0000

    Unix mb_to_wc: add missing bounds checks.

    Checking various implementations of these functions against each
    other, I noticed by eyeball review that some of the special cases in
    mb_to_wc() never check the buffer limit at all. Yikes!

    Fortunately, I think there's no vulnerability, because these special
    cases are ones that write out at most one wide char per multibyte
    char, and at all the call sites (including dup_mb_to_wc) we allocate
    that much even for the first attempt. The only exception to that is
    the call in key_event() in unix/window.c, which uses a fixed-size
    output buffer, but its input will always be the data generated by an X
    keystroke event. So that one can only overrun the buffer if an X key
    event manages to translate into more than 32 wide characters of text -
    and even if that does come up in some exotic edge case, it will at
    least not be happening under _enemy_ control.

 unix/unicode.c | 4 ++++
 1 file changed, 4 insertions(+)

commit fe00a2928c5f490be2d8f70a03af5529dfbaad7f
web diff https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=fe00a2928c5f490be2d8f70a03af5529dfbaad7f;hp=cf41bc0c624eca01d5a710bee46f63e631b61aae
Author: Simon Tatham <anakin at pobox.com>
Date:   Fri Mar 11 19:11:35 2022 +0000

    Windows: diagnose failure to create the terminal window.

    It only fails in very unusual circumstances, but that's all the more
    reason to give a useful report when it does!

 windows/window.c | 4 ++++
 1 file changed, 4 insertions(+)

commit 901667280ae2708df3a73618f85a03af15a8dcd6
web diff https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=901667280ae2708df3a73618f85a03af15a8dcd6;hp=fe00a2928c5f490be2d8f70a03af5529dfbaad7f
Author: Simon Tatham <anakin at pobox.com>
Date:   Sat Mar 12 14:33:01 2022 +0000

    Windows: initialise window_name and icon_name.

    It turns out that they're still NULL at the first moment that a
    SetWindowText call tries to read one of them, because they weren't
    initialised at startup! Apparently SetWindowText notices that it's
    been passed a null pointer, and does nothing in preference to failing,
    but it's still not what I _meant_ to do.

 windows/window.c | 2 ++
 1 file changed, 2 insertions(+)

commit 5de1df1b947076f3b9d2b8253a55aa93403c4ee2
web diff https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=5de1df1b947076f3b9d2b8253a55aa93403c4ee2;hp=901667280ae2708df3a73618f85a03af15a8dcd6
Author: Simon Tatham <anakin at pobox.com>
Date:   Sat Mar 12 17:36:54 2022 +0000

    Windows: avoid idempotent window title changes.

    By testing on a platform slow enough to show the flicker, I happened
    to notice that if your shell prompt resets the window title every time
    it's displayed, this was actually resulting in a call to SetWindowText
    every time, which caused the GUI to actually do work.

    There's certainly no need for that! We can at least avoid bothering if
    the new title is identical to the old one.

 windows/window.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

commit 26dcfcbd4470eef31f61b6a617f3386947c4fad6
web diff https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=26dcfcbd4470eef31f61b6a617f3386947c4fad6;hp=5de1df1b947076f3b9d2b8253a55aa93403c4ee2
Author: Simon Tatham <anakin at pobox.com>
Date:   Sat Mar 12 15:21:18 2022 +0000

    Make init_winver() idempotent.

    This way, anyone who needs to use the version data can quickly call
    init_winver to make sure it's been set up, and not waste too much faff
    redoing the actual work.

 windows/utils/version.c | 5 +++++
 1 file changed, 5 insertions(+)

commit 51f0057b673ac948de497194f3d8a6fb0c8230da
web diff https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=51f0057b673ac948de497194f3d8a6fb0c8230da;hp=26dcfcbd4470eef31f61b6a617f3386947c4fad6
Author: Simon Tatham <anakin at pobox.com>
Date:   Sat Mar 12 17:10:11 2022 +0000

    Add a '#define LEGACY_WINDOWS'.

    This will be used to wrap some of the stranger workarounds we're
    keeping in this code base for the purposes of backwards compatibility
    to seriously old platforms like Win95.

 defs.h | 2 ++
 1 file changed, 2 insertions(+)

commit 83ff08f9db58e516f81e948e8256b50940145d30
web diff https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=83ff08f9db58e516f81e948e8256b50940145d30;hp=51f0057b673ac948de497194f3d8a6fb0c8230da
Author: Simon Tatham <anakin at pobox.com>
Date:   Fri Mar 11 18:07:50 2022 +0000

    Remove hard dependency on GetFileAttributesEx.

    This fixes a load-time failure on versions of Windows too old to have
    that function in kernel32.dll.

    We use it to determine whether a file was safe to overwrite in the
    context of PuTTY session logging: if it's safe, we skip the 'do you
    want to overwrite or append?' dialog box.

    On earlier Windows you can use FindFirstFile to get a similar effect,
    so that's what we fall back to. It's not quite the same, though - if
    you pass a wildcard then it will succeed when you'd rather it had
    failed. But it's good enough to at least work in normal cases.

 windows/utils/open_for_write_would_lose_data.c | 66 ++++++++++++++++++++------
 1 file changed, 52 insertions(+), 14 deletions(-)

commit 01c007121aa3baec3e02842c03171ec9a99882ae
web diff https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=01c007121aa3baec3e02842c03171ec9a99882ae;hp=83ff08f9db58e516f81e948e8256b50940145d30
Author: Simon Tatham <anakin at pobox.com>
Date:   Fri Mar 11 18:32:26 2022 +0000

    Remove hard dependencies on multi-monitor functions.

    These are more functions that don't exist on all our supported legacy
    versions of Windows, so we need to follow the same policy as
    everywhere else, by trying to acquire them at run time and having a
    fallback if they aren't available.

 windows/window.c | 30 ++++++++++++++++++------------
 1 file changed, 18 insertions(+), 12 deletions(-)

commit 373e52bdc66a58a10478d7891b42da9fcc314438
web diff https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=373e52bdc66a58a10478d7891b42da9fcc314438;hp=01c007121aa3baec3e02842c03171ec9a99882ae
Author: Simon Tatham <anakin at pobox.com>
Date:   Sat Mar 12 06:43:59 2022 +0000

    Windows: runtime switch between Unicode and ANSI windows.

    Turns out that PuTTY hasn't run successfully on legacy Windows since
    0.66, in spite of an ongoing intention to keep it working. Among the
    reasons for this is that CreateWindowExW simply fails with
    ERROR_CALL_NOT_IMPLEMENTED: apparently Win95 and its ilk just didn't
    have fully-Unicode windows as an option.

    Fixed by resurrecting the previous code from the git history (in
    particular, code removed by commit 67e5ceb9a8e6bc2 was useful), and
    including it as a runtime alternative.

    One subtlety was that I found I had to name the A and W window classes
    differently (by appending ".ansi" to the A one): apparently they
    occupy the same namespace even though the names are in different
    character sets, so if you somehow manage to register both classes,
    they'll collide with each other without that tweak.

 windows/window.c | 147 +++++++++++++++++++++++++++++++++++++++++++------------
 1 file changed, 116 insertions(+), 31 deletions(-)

commit b7af966fea57a36b97fb3ea63925a9dd6eccfe13
web diff https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=b7af966fea57a36b97fb3ea63925a9dd6eccfe13;hp=373e52bdc66a58a10478d7891b42da9fcc314438
Author: Simon Tatham <anakin at pobox.com>
Date:   Sat Mar 12 15:02:12 2022 +0000

    Windows Pageant: turn 'has_security' into a global function.

    Now it can be called from places other than Pageant's WinMain(). In
    particular, the attempt to make a security descriptor in
    lock_interprocess_mutex() is gated on it.

    In return, however, I've tightened up the semantics. In normal PuTTY
    builds that aren't trying to support pre-NT systems, the function
    *unconditionally* returns true, on the grounds that we don't expect to
    target any system that doesn't support the security APIs, and if
    someone manages to contrive one anyway - or, more likely, if we some
    day introduce a bug in our loading of the security API functions -
    then this safety catch should make Pageant less likely to accidentally
    fall back to 'never mind, just run in insecure mode'.

 windows/pageant.c                  | 70 +++++++++++++++++---------------------
 windows/platform.h                 |  1 +
 windows/utils/interprocess_mutex.c |  4 +--
 windows/utils/security.c           | 14 ++++++++
 4 files changed, 49 insertions(+), 40 deletions(-)

commit 09fd952b0b12bb5bdec8f755de475814c4df50b6
web diff https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=09fd952b0b12bb5bdec8f755de475814c4df50b6;hp=b7af966fea57a36b97fb3ea63925a9dd6eccfe13
Author: Simon Tatham <anakin at pobox.com>
Date:   Sat Mar 12 15:18:38 2022 +0000

    Windows Pageant: deal with PeekMessageW failing on legacy Windows.

    This makes Pageant run on Win95 again. Previously (after fixing the
    startup-time failures due to missing security APIs) it would go into
    an uninterruptible CPU-consuming spin in the message loop when every
    attempt to retrieve its messages failed because PeekMessageW doesn't
    work at all on the 95 series.

 windows/pageant.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

commit fa9968d640c49f3bb42d3d15ee81d02486e303f2
web diff https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=fa9968d640c49f3bb42d3d15ee81d02486e303f2;hp=09fd952b0b12bb5bdec8f755de475814c4df50b6
Author: Simon Tatham <anakin at pobox.com>
Date:   Sat Mar 12 16:16:01 2022 +0000

    windows/unicode.c: manually speak UTF-8.

    This is another fallback needed on Win95, where the Win32 API
    functions to convert between multibyte and wide strings exist, but
    they haven't heard of the UTF-8 code page. PuTTY can't really do
    without that these days.

    (In particular, if a server sends a remote window-title escape
    sequence while the terminal is in UTF-8 mode, then _something_ needs
    to translate the UTF-8 data into Unicode for Windows to reconvert into
    the character set used in window titles.)

    This is a weird enough thing to be doing that I've put it under the
    new #ifdef LEGACY_WINDOWS, so behaviour in the standard builds should
    be unchanged.

 windows/unicode.c | 85 ++++++++++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 81 insertions(+), 4 deletions(-)

commit 58281f9b92daf0398ae61b21ce0123fdb7d56a5e
web diff https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=58281f9b92daf0398ae61b21ce0123fdb7d56a5e;hp=fa9968d640c49f3bb42d3d15ee81d02486e303f2
Author: Simon Tatham <anakin at pobox.com>
Date:   Sat Mar 12 20:17:30 2022 +0000

    Fix trust status when Interactor returns a seat.

    While testing the unrelated pile of commits just past, I accidentally
    started a Cygwin saved session I hadn't run in ages which used the old
    Telnet-based cygtermd as a local proxy command, and found that it
    presented the Cygwin prompt with a trust sigil. Oops!

    It turns out that this is because interactor_return_seat does two
    things that can change the real seat's trust status, and it does them
    in the wrong order: it defaults the status back to trusted (as if the
    seat was brand new, because that's how they start out), and it calls
    tempseat_flush which may have buffered a trust-status reset while the
    seat was borrowed. The former should not override the latter!

 proxy/interactor.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)