New abstraction for command-line arguments.

This begins the process of enabling our Windows applications to handle
Unicode characters on their command lines which don't fit in the
system code page.

Instead of passing plain strings to cmdline_process_param, we now pass
a partially opaque and platform-specific thing called a CmdlineArg.
This has a method that extracts the argument word as a default-encoded
string, and another one that tries to extract it as UTF-8 (though it
may fail if the UTF-8 isn't available).

On Windows, the command line is now constructed by calling
split_into_argv_w on the Unicode command line returned by
GetCommandLineW(), and the UTF-8 method returns text converted
directly from that wide-character form, not going via the system code
page. So it _can_ include UTF-8 characters that wouldn't have
round-tripped via CP_ACP.

This commit introduces the abstraction and switches over the
cross-platform and Windows argv-handling code to use it, with minimal
functional change. Nothing yet tries to call cmdline_arg_get_utf8().

I say 'cross-platform and Windows' because on the Unix side there's
still a lot of use of plain old argv which I haven't converted. That
would be a much larger project, and isn't currently needed: the
_current_ aim of this abstraction is to get the right things to happen
relating to Unicode on Windows, so for code that doesn't run on
Windows anyway, it's not adding value. (Also there's a tension with
GTK, which wants to talk to standard argv and extract arguments _it_
knows about, so at the very least we'd have to let it munge argv
before importing it into this new system.)

unix/CMakeLists.txt

@@ -4,6 +4,7 @@ add_sources_from_current_dir(utils
   utils/arm_arch_queries.c
   utils/block_signal.c
   utils/cloexec.c
+  utils/cmdline_arg.c
   utils/dputs.c
   utils/filename.c
   utils/fontspec.c

unix/main-gtk-simple.c

@@ -312,7 +312,6 @@ void window_setup_error(const char *errmsg)
 bool do_cmdline(int argc, char **argv, bool do_everything, Conf *conf)
 {
     bool err = false;
-    char *val;
 
     /*
      * Macros to make argument handling easier.
@@ -323,20 +322,26 @@ bool do_cmdline(int argc, char **argv, bool do_everything, Conf *conf)
      * {...} else ((void)0).
      */
 #define EXPECTS_ARG if (1) {                                            \
-        if (--argc <= 0) {                                              \
+        if (!nextarg) {                                                 \
             err = true;                                                 \
             fprintf(stderr, "%s: %s expects an argument\n", appname, p); \
             continue;                                                   \
-        } else                                                          \
-            val = *++argv;                                              \
+        } else {                                                        \
+            arglistpos++;                                               \
+        }                                                               \
     } else ((void)0)
 #define SECOND_PASS_ONLY if (1) {               \
         if (!do_everything)                     \
             continue;                           \
     } else ((void)0)
 
-    while (--argc > 0) {
-        const char *p = *++argv;
+    CmdlineArgList *arglist = cmdline_arg_list_from_argv(argc, argv);
+    size_t arglistpos = 0;
+    while (arglist->args[arglistpos]) {
+        CmdlineArg *arg = arglist->args[arglistpos++];
+        CmdlineArg *nextarg = arglist->args[arglistpos];
+        const char *p = cmdline_arg_to_str(arg);
+        const char *val = cmdline_arg_to_str(nextarg);
         int ret;
 
         /*
@@ -350,13 +355,13 @@ bool do_cmdline(int argc, char **argv, bool do_everything, Conf *conf)
             !strcmp(p, "-T"))
             p = "-title";
 
-        ret = cmdline_process_param(p, (argc > 1 ? argv[1] : NULL),
-                                    do_everything ? 1 : -1, conf);
+        ret = cmdline_process_param(
+            arg, nextarg, do_everything ? 1 : -1, conf);
 
         if (ret == -2) {
             cmdline_error("option \"%s\" requires an argument", p);
         } else if (ret == 2) {
-            --argc, ++argv;            /* skip next argument */
+            arglistpos++;
             continue;
         } else if (ret == 1) {
             continue;
@@ -458,13 +463,8 @@ bool do_cmdline(int argc, char **argv, bool do_everything, Conf *conf)
             if (!do_everything)
                 break;
 
-            if (--argc > 0) {
-                int i;
-                pty_argv = snewn(argc+1, char *);
-                ++argv;
-                for (i = 0; i < argc; i++)
-                    pty_argv[i] = argv[i];
-                pty_argv[argc] = NULL;
+            if (nextarg) {
+                pty_argv = cmdline_arg_remainder(nextarg);
                 break;                 /* finished command-line processing */
             } else
                 err = true, fprintf(stderr, "%s: -e expects an argument\n",
@@ -552,6 +552,8 @@ bool do_cmdline(int argc, char **argv, bool do_everything, Conf *conf)
         }
     }
 
+    cmdline_arg_list_free(arglist);
+
     return err;
 }
 

unix/platform.h

@@ -477,4 +477,8 @@ void plug_closing_errno(Plug *plug, int error);
 
 SeatPromptResult make_spr_sw_abort_errno(const char *prefix, int errno_value);
 
+/* Unix-specific extra functions in cmdline_arg.c */
+CmdlineArgList *cmdline_arg_list_from_argv(int argc, char **argv);
+char **cmdline_arg_remainder(CmdlineArg *argp);
+
 #endif /* PUTTY_UNIX_PLATFORM_H */

unix/plink.c

@@ -723,16 +723,19 @@ int main(int argc, char **argv)
             }
         }
     }
-    while (--argc) {
-        char *p = *++argv;
-        int ret = cmdline_process_param(p, (argc > 1 ? argv[1] : NULL),
-                                        1, conf);
+    CmdlineArgList *arglist = cmdline_arg_list_from_argv(argc, argv);
+    size_t arglistpos = 0;
+    while (arglist->args[arglistpos]) {
+        CmdlineArg *arg = arglist->args[arglistpos++];
+        CmdlineArg *nextarg = arglist->args[arglistpos];
+        const char *p = cmdline_arg_to_str(arg);
+        int ret = cmdline_process_param(arg, nextarg, 1, conf);
         if (ret == -2) {
             fprintf(stderr,
                     "plink: option \"%s\" requires an argument\n", p);
             errors = true;
         } else if (ret == 2) {
-            --argc, ++argv;
+            arglistpos++;
         } else if (ret == 1) {
             continue;
         } else if (!strcmp(p, "-s")) {
@@ -781,12 +784,11 @@ int main(int argc, char **argv)
         } else if (*p != '-') {
             strbuf *cmdbuf = strbuf_new();
 
-            while (argc > 0) {
+            while (arg) {
                 if (cmdbuf->len > 0)
                     put_byte(cmdbuf, ' '); /* add space separator */
-                put_dataz(cmdbuf, p);
-                if (--argc > 0)
-                    p = *++argv;
+                put_dataz(cmdbuf, cmdline_arg_to_str(arg));
+                arg = arglist->args[arglistpos++];
             }
 
             conf_set_str(conf, CONF_remote_cmd, cmdbuf->s);
@@ -815,6 +817,8 @@ int main(int argc, char **argv)
      */
     cmdline_run_saved(conf);
 
+    cmdline_arg_list_free(arglist);
+
     /*
      * If we have no better ideas for the remote username, use the local
      * one, as 'ssh' does.

unix/psocks.c

@@ -82,7 +82,14 @@ static pid_t subcommand_pid = -1;
 
 static bool still_running = true;
 
-static void start_subcommand(strbuf *args)
+static char **exec_args = NULL;
+
+static void found_subcommand(CmdlineArg *arg)
+{
+    exec_args = cmdline_arg_remainder(arg);
+}
+
+static void start_subcommand(void)
 {
     pid_t pid;
 
@@ -95,24 +102,6 @@ static void start_subcommand(strbuf *args)
     }
     putty_signal(SIGCHLD, sigchld);
 
-    /*
-     * Make an array of argument pointers that execvp will like.
-     */
-    size_t nargs = 0;
-    for (size_t i = 0; i < args->len; i++)
-        if (args->s[i] == '\0')
-            nargs++;
-
-    char **exec_args = snewn(nargs + 1, char *);
-    char *p = args->s;
-    for (size_t a = 0; a < nargs; a++) {
-        exec_args[a] = p;
-        size_t len = strlen(p);
-        assert(len < args->len - (p - args->s));
-        p += 1 + len;
-    }
-    exec_args[nargs] = NULL;
-
     pid = fork();
     if (pid < 0) {
         perror("fork");
@@ -123,12 +112,12 @@ static void start_subcommand(strbuf *args)
         _exit(127);
     } else {
         subcommand_pid = pid;
-        sfree(exec_args);
     }
 }
 
 static const PsocksPlatform platform = {
     open_pipes,
+    found_subcommand,
     start_subcommand,
 };
 
@@ -163,11 +152,13 @@ static bool psocks_continue(void *ctx, bool found_any_fd,
 int main(int argc, char **argv)
 {
     psocks_state *ps = psocks_new(&platform);
-    psocks_cmdline(ps, argc, argv);
+    CmdlineArgList *arglist = cmdline_arg_list_from_argv(argc, argv);
+    psocks_cmdline(ps, arglist);
 
     sk_init();
     uxsel_init();
     psocks_start(ps);
+    cmdline_arg_list_free(arglist);
 
     cli_main_loop(psocks_pw_setup, psocks_pw_check, psocks_continue, NULL);
 }

unix/sftp.c

@@ -577,5 +577,6 @@ const bool buildinfo_gtk_relevant = false;
 int main(int argc, char *argv[])
 {
     uxsel_init();
-    return psftp_main(argc, argv);
+    CmdlineArgList *arglist = cmdline_arg_list_from_argv(argc, argv);
+    return psftp_main(arglist);
 }

unix/utils/cmdline_arg.c

@@ -0,0 +1,158 @@
+/*
+ * Implementation of the CmdlineArg abstraction for Unix
+ */
+
+#include "putty.h"
+
+typedef struct CmdlineArgUnix CmdlineArgUnix;
+struct CmdlineArgUnix {
+    /*
+     * This is a writable char *, because the arguments received by
+     * main() really are writable, and moreover, you _want_ to write
+     * over them in some circumstances, to manipulate how your program
+     * shows up in ps(1). Our example is wiping out the argument to
+     * the -pw option. This isn't robust - you need to not use that
+     * option at all if you want zero risk of password exposure
+     * through ps - but we do the best we can.
+     *
+     * Some CmdlineArg structures are invented after the program
+     * starts, in which case they don't correspond to real argv words
+     * at all, and this pointer is NULL.
+     */
+    char *argv_word;
+
+    /*
+     * A CmdlineArg invented later might need to store a string that
+     * will be freed when it goes away. This pointer is non-NULL if
+     * freeing needs to happen.
+     */
+    char *to_free;
+
+    /*
+     * This const char * is the real string value of the argument.
+     */
+    const char *value;
+
+    /*
+     * Our index in the CmdlineArgList, or (size_t)-1 if we don't have
+     * one and are an argument invented later.
+     */
+    size_t index;
+
+    /*
+     * Public part of the structure.
+     */
+    CmdlineArg argp;
+};
+
+static CmdlineArgUnix *cmdline_arg_new_in_list(CmdlineArgList *list)
+{
+    CmdlineArgUnix *arg = snew(CmdlineArgUnix);
+    arg->argv_word = NULL;
+    arg->to_free = NULL;
+    arg->value = NULL;
+    arg->index = (size_t)-1;
+    arg->argp.list = list;
+    sgrowarray(list->args, list->argssize, list->nargs);
+    list->args[list->nargs++] = &arg->argp;
+    return arg;
+}
+
+static CmdlineArg *cmdline_arg_from_argv_word(CmdlineArgList *list, char *word)
+{
+    CmdlineArgUnix *arg = cmdline_arg_new_in_list(list);
+    arg->argv_word = word;
+    arg->value = arg->argv_word;
+    return &arg->argp;
+}
+
+CmdlineArgList *cmdline_arg_list_from_argv(int argc, char **argv)
+{
+    CmdlineArgList *list = snew(CmdlineArgList);
+    list->args = NULL;
+    list->nargs = list->argssize = 0;
+    for (int i = 1; i < argc; i++) {
+        CmdlineArg *argp = cmdline_arg_from_argv_word(list, argv[i]);
+        CmdlineArgUnix *arg = container_of(argp, CmdlineArgUnix, argp);
+        arg->index = i - 1; /* index in list->args[], not in argv[] */
+    }
+    sgrowarray(list->args, list->argssize, list->nargs);
+    list->args[list->nargs++] = NULL;
+    return list;
+}
+
+void cmdline_arg_free(CmdlineArg *argp)
+{
+    if (!argp)
+        return;
+
+    CmdlineArgUnix *arg = container_of(argp, CmdlineArgUnix, argp);
+    if (arg->to_free)
+        burnstr(arg->to_free);
+    sfree(arg);
+}
+
+void cmdline_arg_list_free(CmdlineArgList *list)
+{
+    for (size_t i = 0; i < list->nargs; i++)
+        cmdline_arg_free(list->args[i]);
+    sfree(list->args);
+    sfree(list);
+}
+
+CmdlineArg *cmdline_arg_from_str(CmdlineArgList *list, const char *string)
+{
+    CmdlineArgUnix *arg = cmdline_arg_new_in_list(list);
+    arg->to_free = dupstr(string);
+    arg->value = arg->to_free;
+    return &arg->argp;
+}
+
+const char *cmdline_arg_to_str(CmdlineArg *argp)
+{
+    if (!argp)
+        return NULL;
+
+    CmdlineArgUnix *arg = container_of(argp, CmdlineArgUnix, argp);
+    return arg->value;
+}
+
+const char *cmdline_arg_to_utf8(CmdlineArg *argp)
+{
+    /* For the moment, return NULL. But perhaps it makes sense to
+     * convert from the default locale into UTF-8? */
+    return NULL;
+}
+
+void cmdline_arg_wipe(CmdlineArg *argp)
+{
+    if (!argp)
+        return;
+
+    CmdlineArgUnix *arg = container_of(argp, CmdlineArgUnix, argp);
+    if (arg->argv_word)
+        smemclr(arg->argv_word, strlen(arg->argv_word));
+}
+
+char **cmdline_arg_remainder(CmdlineArg *argp)
+{
+    CmdlineArgUnix *arg = container_of(argp, CmdlineArgUnix, argp);
+    CmdlineArgList *list = argp->list;
+
+    size_t index = arg->index;
+    assert(index != (size_t)-1);
+
+    size_t nargs = 0;
+    while (list->args[index + nargs])
+        nargs++;
+
+    char **argv = snewn(nargs + 1, char *);
+    for (size_t i = 0; i < nargs; i++) {
+        CmdlineArg *ith_argp = list->args[index + i];
+        CmdlineArgUnix *ith_arg = container_of(ith_argp, CmdlineArgUnix, argp);
+        argv[i] = ith_arg->argv_word;
+    }
+    argv[nargs] = NULL;
+
+    return argv;
+}