Function ap_escape_quotes

server/util.c:2524–2587

* Given a string, replace any bare " with \" . */

 * Given a string, replace any bare " with \" .
 */
AP_DECLARE(char *) ap_escape_quotes(apr_pool_t *p, const char *instring)
{
    apr_size_t size, extra = 0;
    const char *inchr = instring;
    char *outchr, *outstring;

    /*
     * Look through the input string, jogging the length of the output
     * string up by an extra byte each time we find an unescaped ".
     */
    while (*inchr != '\0') {
        if (*inchr == '"') {
            extra++;
        }
        /*
         * If we find a slosh, and it's not the last byte in the string,
         * it's escaping something - advance past both bytes.
         */
        else if ((*inchr == '\\') && (inchr[1] != '\0')) {
            inchr++;
        }
        inchr++;
    }

    if (!extra) {
        return apr_pstrdup(p, instring);
    }

    /* How large will the string become, once we escaped all the quotes?
     * The tricky cases are
     * - an `instring` that is already longer than `ptrdiff_t`
     *   can hold (which is an undefined case in C, as C defines ptrdiff_t as
     *   a signed difference between pointers into the same array and one index
     *   beyond).
     * - an `instring` that, including the `extra` chars we want to add, becomes
     *   even larger than apr_size_t can handle.
     * Since this function was not designed to ever return NULL for failure, we
     * can only trigger a hard assertion failure. It seems more a programming
     * mistake (or failure to verify the input causing this) that leads to this
     * situation.
     */
    ap_assert(inchr - instring > 0);
    size = ((apr_size_t)(inchr - instring)) + 1;
    ap_assert(size + extra > size);

    outstring = apr_palloc(p, size + extra);
    inchr = instring;
    outchr = outstring;
    /*
     * Now copy the input string to the output string, inserting a slosh
     * in front of every " that doesn't already have one.
     */
    while (*inchr != '\0') {
        if (*inchr == '"') {
            *outchr++ = '\\';
        }
        else if ((*inchr == '\\') && (inchr[1] != '\0')) {
            *outchr++ = *inchr++;