html-to-markdown 2.24.4 → 2.24.6

data/rust-vendor/getrandom-0.3.4/src/backends/use_file.rs

@@ -0,0 +1,234 @@
+//! Implementations that just need to read from a file
+use crate::Error;
+use core::{
+    ffi::c_void,
+    mem::MaybeUninit,
+    sync::atomic::{AtomicI32, Ordering},
+};
+
+#[cfg(not(any(target_os = "android", target_os = "linux")))]
+pub use crate::util::{inner_u32, inner_u64};
+
+#[path = "../util_libc.rs"]
+pub(super) mod util_libc;
+
+/// For all platforms, we use `/dev/urandom` rather than `/dev/random`.
+/// For more information see the linked man pages in lib.rs.
+///   - On Linux, "/dev/urandom is preferred and sufficient in all use cases".
+///   - On Redox, only /dev/urandom is provided.
+///   - On AIX, /dev/urandom will "provide cryptographically secure output".
+///   - On Haiku and QNX Neutrino they are identical.
+const FILE_PATH: &[u8] = b"/dev/urandom\0";
+
+// File descriptor is a "nonnegative integer", so we can safely use negative sentinel values.
+const FD_UNINIT: libc::c_int = -1;
+const FD_ONGOING_INIT: libc::c_int = -2;
+
+// In theory `libc::c_int` could be something other than `i32`, but for the
+// targets we currently support that use `use_file`, it is always `i32`.
+// If/when we add support for a target where that isn't the case, we may
+// need to use a different atomic type or make other accommodations. The
+// compiler will let us know if/when that is the case, because the
+// `FD.store(fd)` would fail to compile.
+//
+// The opening of the file, by libc/libstd/etc. may write some unknown
+// state into in-process memory. (Such state may include some sanitizer
+// bookkeeping, or we might be operating in a unikernal-like environment
+// where all the "kernel" file descriptor bookkeeping is done in our
+// process.) `get_fd_locked` stores into FD using `Ordering::Release` to
+// ensure any such state is synchronized. `get_fd` loads from `FD` with
+// `Ordering::Acquire` to synchronize with it.
+static FD: AtomicI32 = AtomicI32::new(FD_UNINIT);
+
+#[inline]
+pub fn fill_inner(dest: &mut [MaybeUninit<u8>]) -> Result<(), Error> {
+    let mut fd = FD.load(Ordering::Acquire);
+    if fd == FD_UNINIT || fd == FD_ONGOING_INIT {
+        fd = open_or_wait()?;
+    }
+    util_libc::sys_fill_exact(dest, |buf| unsafe {
+        libc::read(fd, buf.as_mut_ptr().cast::<c_void>(), buf.len())
+    })
+}
+
+/// Open a file in read-only mode.
+///
+/// # Panics
+/// If `path` does not contain any zeros.
+// TODO: Move `path` to `CStr` and use `CStr::from_bytes_until_nul` (MSRV 1.69)
+// or C-string literals (MSRV 1.77) for statics
+fn open_readonly(path: &[u8]) -> Result<libc::c_int, Error> {
+    assert!(path.contains(&0));
+    loop {
+        let fd = unsafe {
+            libc::open(
+                path.as_ptr().cast::<libc::c_char>(),
+                libc::O_RDONLY | libc::O_CLOEXEC,
+            )
+        };
+        if fd >= 0 {
+            return Ok(fd);
+        }
+        let err = util_libc::last_os_error();
+        // We should try again if open() was interrupted.
+        if err.raw_os_error() != Some(libc::EINTR) {
+            return Err(err);
+        }
+    }
+}
+
+#[cold]
+#[inline(never)]
+fn open_or_wait() -> Result<libc::c_int, Error> {
+    loop {
+        match FD.load(Ordering::Acquire) {
+            FD_UNINIT => {
+                let res = FD.compare_exchange_weak(
+                    FD_UNINIT,
+                    FD_ONGOING_INIT,
+                    Ordering::AcqRel,
+                    Ordering::Relaxed,
+                );
+                if res.is_ok() {
+                    break;
+                }
+            }
+            FD_ONGOING_INIT => sync::wait(),
+            fd => return Ok(fd),
+        }
+    }
+
+    let res = open_fd();
+    let val = match res {
+        Ok(fd) => fd,
+        Err(_) => FD_UNINIT,
+    };
+    FD.store(val, Ordering::Release);
+
+    // On non-Linux targets `wait` is just 1 ms sleep,
+    // so we don't need any explicit wake up in addition
+    // to updating value of `FD`.
+    #[cfg(any(target_os = "android", target_os = "linux"))]
+    sync::wake();
+
+    res
+}
+
+fn open_fd() -> Result<libc::c_int, Error> {
+    #[cfg(any(target_os = "android", target_os = "linux"))]
+    sync::wait_until_rng_ready()?;
+    let fd = open_readonly(FILE_PATH)?;
+    debug_assert!(fd >= 0);
+    Ok(fd)
+}
+
+#[cfg(not(any(target_os = "android", target_os = "linux")))]
+mod sync {
+    /// Sleep 1 ms before checking `FD` again.
+    ///
+    /// On non-Linux targets the critical section only opens file,
+    /// which should not block, so in the unlikely contended case,
+    /// we can sleep-wait for the opening operation to finish.
+    pub(super) fn wait() {
+        let rqtp = libc::timespec {
+            tv_sec: 0,
+            tv_nsec: 1_000_000,
+        };
+        let mut rmtp = libc::timespec {
+            tv_sec: 0,
+            tv_nsec: 0,
+        };
+        // We do not care if sleep gets interrupted, so the return value is ignored
+        unsafe {
+            libc::nanosleep(&rqtp, &mut rmtp);
+        }
+    }
+}
+
+#[cfg(any(target_os = "android", target_os = "linux"))]
+mod sync {
+    use super::{open_readonly, util_libc::last_os_error, Error, FD, FD_ONGOING_INIT};
+
+    /// Wait for atomic `FD` to change value from `FD_ONGOING_INIT` to something else.
+    ///
+    /// Futex syscall with `FUTEX_WAIT` op puts the current thread to sleep
+    /// until futex syscall with `FUTEX_WAKE` op gets executed for `FD`.
+    ///
+    /// For more information read: https://www.man7.org/linux/man-pages/man2/futex.2.html
+    pub(super) fn wait() {
+        let op = libc::FUTEX_WAIT | libc::FUTEX_PRIVATE_FLAG;
+        let timeout_ptr = core::ptr::null::<libc::timespec>();
+        let ret = unsafe { libc::syscall(libc::SYS_futex, &FD, op, FD_ONGOING_INIT, timeout_ptr) };
+        // FUTEX_WAIT should return either 0 or EAGAIN error
+        debug_assert!({
+            match ret {
+                0 => true,
+                -1 => last_os_error().raw_os_error() == Some(libc::EAGAIN),
+                _ => false,
+            }
+        });
+    }
+
+    /// Wake up all threads which wait for value of atomic `FD` to change.
+    pub(super) fn wake() {
+        let op = libc::FUTEX_WAKE | libc::FUTEX_PRIVATE_FLAG;
+        let ret = unsafe { libc::syscall(libc::SYS_futex, &FD, op, libc::INT_MAX) };
+        debug_assert!(ret >= 0);
+    }
+
+    // Polls /dev/random to make sure it is ok to read from /dev/urandom.
+    //
+    // Polling avoids draining the estimated entropy from /dev/random;
+    // short-lived processes reading even a single byte from /dev/random could
+    // be problematic if they are being executed faster than entropy is being
+    // collected.
+    //
+    // OTOH, reading a byte instead of polling is more compatible with
+    // sandboxes that disallow `poll()` but which allow reading /dev/random,
+    // e.g. sandboxes that assume that `poll()` is for network I/O. This way,
+    // fewer applications will have to insert pre-sandbox-initialization logic.
+    // Often (blocking) file I/O is not allowed in such early phases of an
+    // application for performance and/or security reasons.
+    //
+    // It is hard to write a sandbox policy to support `libc::poll()` because
+    // it may invoke the `poll`, `ppoll`, `ppoll_time64` (since Linux 5.1, with
+    // newer versions of glibc), and/or (rarely, and probably only on ancient
+    // systems) `select`. depending on the libc implementation (e.g. glibc vs
+    // musl), libc version, potentially the kernel version at runtime, and/or
+    // the target architecture.
+    //
+    // BoringSSL and libstd don't try to protect against insecure output from
+    // `/dev/urandom'; they don't open `/dev/random` at all.
+    //
+    // OpenSSL uses `libc::select()` unless the `dev/random` file descriptor
+    // is too large; if it is too large then it does what we do here.
+    //
+    // libsodium uses `libc::poll` similarly to this.
+    pub(super) fn wait_until_rng_ready() -> Result<(), Error> {
+        let fd = open_readonly(b"/dev/random\0")?;
+        let mut pfd = libc::pollfd {
+            fd,
+            events: libc::POLLIN,
+            revents: 0,
+        };
+
+        let res = loop {
+            // A negative timeout means an infinite timeout.
+            let res = unsafe { libc::poll(&mut pfd, 1, -1) };
+            if res >= 0 {
+                // We only used one fd, and cannot timeout.
+                debug_assert_eq!(res, 1);
+                break Ok(());
+            }
+            let err = last_os_error();
+            // Assuming that `poll` is called correctly,
+            // on Linux it can return only EINTR and ENOMEM errors.
+            match err.raw_os_error() {
+                Some(libc::EINTR) => continue,
+                _ => break Err(err),
+            }
+        };
+        unsafe { libc::close(fd) };
+        res
+    }
+}

data/rust-vendor/getrandom-0.3.4/src/backends/vxworks.rs

@@ -0,0 +1,54 @@
+//! Implementation for VxWorks
+use crate::Error;
+use core::{
+    cmp::Ordering::{Equal, Greater, Less},
+    mem::MaybeUninit,
+    sync::atomic::{AtomicBool, Ordering::Relaxed},
+};
+
+#[path = "../util_libc.rs"]
+mod util_libc;
+
+pub use crate::util::{inner_u32, inner_u64};
+
+static RNG_INIT: AtomicBool = AtomicBool::new(false);
+
+#[cold]
+fn init() -> Result<(), Error> {
+    let ret = unsafe { libc::randSecure() };
+    match ret.cmp(&0) {
+        Greater => RNG_INIT.store(true, Relaxed),
+        Equal => unsafe {
+            libc::usleep(10);
+        },
+        Less => return Err(Error::VXWORKS_RAND_SECURE),
+    }
+    Ok(())
+}
+
+#[inline]
+pub fn fill_inner(dest: &mut [MaybeUninit<u8>]) -> Result<(), Error> {
+    while !RNG_INIT.load(Relaxed) {
+        init()?;
+    }
+
+    // Prevent overflow of i32
+    let chunk_size = usize::try_from(i32::MAX).expect("VxWorks does not support 16-bit targets");
+    for chunk in dest.chunks_mut(chunk_size) {
+        let chunk_len: libc::c_int = chunk
+            .len()
+            .try_into()
+            .expect("chunk size is bounded by i32::MAX");
+        let p: *mut libc::c_uchar = chunk.as_mut_ptr().cast();
+        let ret = unsafe { libc::randABytes(p, chunk_len) };
+        if ret != 0 {
+            return Err(util_libc::last_os_error());
+        }
+    }
+    Ok(())
+}
+
+impl Error {
+    /// On VxWorks, call to `randSecure` failed (random number generator is not yet initialized).
+    pub(crate) const VXWORKS_RAND_SECURE: Error = Self::new_internal(10);
+}

data/rust-vendor/getrandom-0.3.4/src/backends/wasi_p1.rs

@@ -0,0 +1,32 @@
+//! Implementation for WASI Preview 1
+use crate::Error;
+use core::mem::MaybeUninit;
+
+pub use crate::util::{inner_u32, inner_u64};
+
+// This linking is vendored from the wasi crate:
+// https://docs.rs/wasi/0.11.0+wasi-snapshot-preview1/src/wasi/lib_generated.rs.html#2344-2350
+#[link(wasm_import_module = "wasi_snapshot_preview1")]
+extern "C" {
+    fn random_get(arg0: i32, arg1: i32) -> i32;
+}
+
+/// WASI p1 uses `u16` for error codes in its witx definitions:
+/// https://github.com/WebAssembly/WASI/blob/38454e9e/legacy/preview1/witx/typenames.witx#L34-L39
+const MAX_ERROR_CODE: i32 = u16::MAX as i32;
+
+#[inline]
+pub fn fill_inner(dest: &mut [MaybeUninit<u8>]) -> Result<(), Error> {
+    // Based on the wasi code:
+    // https://docs.rs/wasi/0.11.0+wasi-snapshot-preview1/src/wasi/lib_generated.rs.html#2046-2062
+    // Note that size of an allocated object can not be bigger than isize::MAX bytes.
+    // WASI 0.1 supports only 32-bit WASM, so casting length to `i32` is safe.
+    #[allow(clippy::cast_possible_truncation, clippy::cast_possible_wrap)]
+    let ret = unsafe { random_get(dest.as_mut_ptr() as i32, dest.len() as i32) };
+    match ret {
+        0 => Ok(()),
+        // WASI functions should return positive error codes which are smaller than `MAX_ERROR_CODE`
+        code if code <= MAX_ERROR_CODE => Err(Error::from_neg_error_code(-code)),
+        _ => Err(Error::UNEXPECTED),
+    }
+}

data/rust-vendor/getrandom-0.3.4/src/backends/wasm_js.rs

@@ -0,0 +1,72 @@
+//! Implementation for WASM based on Web and Node.js
+use crate::Error;
+use core::mem::MaybeUninit;
+
+pub use crate::util::{inner_u32, inner_u64};
+
+#[cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))]
+compile_error!("`wasm_js` backend can be enabled only for OS-less WASM targets!");
+
+use wasm_bindgen::{prelude::wasm_bindgen, JsValue};
+
+// Maximum buffer size allowed in `Crypto.getRandomValuesSize` is 65536 bytes.
+// See https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues
+const MAX_BUFFER_SIZE: usize = 65536;
+
+#[cfg(not(target_feature = "atomics"))]
+#[inline]
+pub fn fill_inner(dest: &mut [MaybeUninit<u8>]) -> Result<(), Error> {
+    for chunk in dest.chunks_mut(MAX_BUFFER_SIZE) {
+        if get_random_values(chunk).is_err() {
+            return Err(Error::WEB_CRYPTO);
+        }
+    }
+    Ok(())
+}
+
+#[cfg(target_feature = "atomics")]
+pub fn fill_inner(dest: &mut [MaybeUninit<u8>]) -> Result<(), Error> {
+    // getRandomValues does not work with all types of WASM memory,
+    // so we initially write to browser memory to avoid exceptions.
+    let buf_len = usize::min(dest.len(), MAX_BUFFER_SIZE);
+    let buf_len_u32 = buf_len
+        .try_into()
+        .expect("buffer length is bounded by MAX_BUFFER_SIZE");
+    let buf = js_sys::Uint8Array::new_with_length(buf_len_u32);
+    for chunk in dest.chunks_mut(buf_len) {
+        let chunk_len = chunk
+            .len()
+            .try_into()
+            .expect("chunk length is bounded by MAX_BUFFER_SIZE");
+        // The chunk can be smaller than buf's length, so we call to
+        // JS to create a smaller view of buf without allocation.
+        let sub_buf = if chunk_len == buf_len_u32 {
+            &buf
+        } else {
+            &buf.subarray(0, chunk_len)
+        };
+
+        if get_random_values(sub_buf).is_err() {
+            return Err(Error::WEB_CRYPTO);
+        }
+
+        sub_buf.copy_to_uninit(chunk);
+    }
+    Ok(())
+}
+
+#[wasm_bindgen]
+extern "C" {
+    // Crypto.getRandomValues()
+    #[cfg(not(target_feature = "atomics"))]
+    #[wasm_bindgen(js_namespace = ["globalThis", "crypto"], js_name = getRandomValues, catch)]
+    fn get_random_values(buf: &mut [MaybeUninit<u8>]) -> Result<(), JsValue>;
+    #[cfg(target_feature = "atomics")]
+    #[wasm_bindgen(js_namespace = ["globalThis", "crypto"], js_name = getRandomValues, catch)]
+    fn get_random_values(buf: &js_sys::Uint8Array) -> Result<(), JsValue>;
+}
+
+impl Error {
+    /// The environment does not support the Web Crypto API.
+    pub(crate) const WEB_CRYPTO: Error = Self::new_internal(10);
+}

data/rust-vendor/getrandom-0.3.4/src/backends/windows.rs

@@ -0,0 +1,61 @@
+//! Implementation for Windows 10 and later
+//!
+//! On Windows 10 and later, ProcessPrng "is the primary interface to the
+//! user-mode per-processor PRNGs" and only requires bcryptprimitives.dll,
+//! making it a better option than the other Windows RNG APIs:
+//!   - BCryptGenRandom: https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgenrandom
+//!     - Requires bcrypt.dll (which loads bcryptprimitives.dll anyway)
+//!     - Can cause crashes/hangs as BCrypt accesses the Windows Registry:
+//!       https://github.com/rust-lang/rust/issues/99341
+//!     - Causes issues inside sandboxed code:
+//!       https://issues.chromium.org/issues/40277768
+//!   - CryptGenRandom: https://learn.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-cryptgenrandom
+//!     - Deprecated and not available on UWP targets
+//!     - Requires advapi32.lib/advapi32.dll (in addition to bcryptprimitives.dll)
+//!     - Thin wrapper around ProcessPrng
+//!   - RtlGenRandom: https://learn.microsoft.com/en-us/windows/win32/api/ntsecapi/nf-ntsecapi-rtlgenrandom
+//!     - Deprecated and not available on UWP targets
+//!     - Requires advapi32.dll (in addition to bcryptprimitives.dll)
+//!     - Requires using name "SystemFunction036"
+//!     - Thin wrapper around ProcessPrng
+//!
+//! For more information see the Windows RNG Whitepaper: https://aka.ms/win10rng
+use crate::Error;
+use core::mem::MaybeUninit;
+
+pub use crate::util::{inner_u32, inner_u64};
+
+// Binding to the Windows.Win32.Security.Cryptography.ProcessPrng API. As
+// bcryptprimitives.dll lacks an import library, we use "raw-dylib". This
+// was added in Rust 1.65 for x86_64/aarch64 and in Rust 1.71 for x86.
+// We don't need MSRV 1.71, as we only use this backend on Rust 1.78 and later.
+#[cfg_attr(
+    target_arch = "x86",
+    link(
+        name = "bcryptprimitives",
+        kind = "raw-dylib",
+        import_name_type = "undecorated"
+    )
+)]
+#[cfg_attr(
+    not(target_arch = "x86"),
+    link(name = "bcryptprimitives", kind = "raw-dylib")
+)]
+extern "system" {
+    fn ProcessPrng(pbdata: *mut u8, cbdata: usize) -> BOOL;
+}
+#[allow(clippy::upper_case_acronyms, clippy::incompatible_msrv)]
+type BOOL = core::ffi::c_int; // MSRV 1.64, similarly OK for this backend.
+const TRUE: BOOL = 1;
+
+#[inline]
+pub fn fill_inner(dest: &mut [MaybeUninit<u8>]) -> Result<(), Error> {
+    let result = unsafe { ProcessPrng(dest.as_mut_ptr().cast::<u8>(), dest.len()) };
+    // Since Windows 10, calls to the user-mode RNG are guaranteed to never
+    // fail during runtime (rare windows W); `ProcessPrng` will only ever
+    // return 1 (which is how windows represents TRUE).
+    // See the bottom of page 6 of the aforementioned Windows RNG
+    // whitepaper for more information.
+    debug_assert!(result == TRUE);
+    Ok(())
+}

data/rust-vendor/getrandom-0.3.4/src/backends/windows_legacy.rs

@@ -0,0 +1,48 @@
+//! Legacy implementation for Windows XP and later
+//!
+//! For targets where we cannot use ProcessPrng (added in Windows 10), we use
+//! RtlGenRandom. See windows.rs for a more detailed discussion of the Windows
+//! RNG APIs (and why we don't use BCryptGenRandom). On versions prior to
+//! Windows 10, this implementation is secure. On Windows 10 and later, this
+//! implementation behaves identically to the windows.rs implementation, except
+//! that it forces the loading of an additional DLL (advapi32.dll).
+//!
+//! This implementation will not work on UWP targets (which lack advapi32.dll),
+//! but such targets require Windows 10, so can use the standard implementation.
+use crate::Error;
+use core::{ffi::c_void, mem::MaybeUninit};
+
+pub use crate::util::{inner_u32, inner_u64};
+
+#[cfg(not(windows))]
+compile_error!("`windows_legacy` backend can be enabled only for Windows targets!");
+
+// Binding to the Windows.Win32.Security.Authentication.Identity.RtlGenRandom
+// API. Don't use windows-targets as it doesn't support Windows 7 targets.
+#[link(name = "advapi32")]
+extern "system" {
+    #[link_name = "SystemFunction036"]
+    fn RtlGenRandom(randombuffer: *mut c_void, randombufferlength: u32) -> BOOLEAN;
+}
+#[allow(clippy::upper_case_acronyms)]
+type BOOLEAN = u8;
+const TRUE: BOOLEAN = 1u8;
+
+#[inline]
+pub fn fill_inner(dest: &mut [MaybeUninit<u8>]) -> Result<(), Error> {
+    // Prevent overflow of u32
+    let chunk_size = usize::try_from(i32::MAX).expect("Windows does not support 16-bit targets");
+    for chunk in dest.chunks_mut(chunk_size) {
+        let chunk_len = u32::try_from(chunk.len()).expect("chunk size is bounded by i32::MAX");
+        let ret = unsafe { RtlGenRandom(chunk.as_mut_ptr().cast::<c_void>(), chunk_len) };
+        if ret != TRUE {
+            return Err(Error::WINDOWS_RTL_GEN_RANDOM);
+        }
+    }
+    Ok(())
+}
+
+impl Error {
+    /// Call to Windows [`RtlGenRandom`](https://docs.microsoft.com/en-us/windows/win32/api/ntsecapi/nf-ntsecapi-rtlgenrandom) failed.
+    pub(crate) const WINDOWS_RTL_GEN_RANDOM: Error = Self::new_internal(10);
+}