/**

 * Copyright 2012,2016  Nick Galbreath

 * nickg@client9.com

 * BSD License -- see COPYING.txt for details

 *

 * https://libinjection.client9.com/

 *

 */

#include <string.h>

#include <stdlib.h>

#include <stdio.h>

#include <ctype.h>

#include <assert.h>

#include <stddef.h>

#include "libinjection.h"

#include "libinjection_sqli.h"

#include "libinjection_sqli_data.h"

#define LIBINJECTION_VERSION "3.9.2"

#define LIBINJECTION_SQLI_TOKEN_SIZE  sizeof(((stoken_t*)(0))->val)

#define LIBINJECTION_SQLI_MAX_TOKENS  5

#ifndef TRUE

#define TRUE 1

#endif

#ifndef FALSE

#define FALSE 0

#endif

#define CHAR_NULL    '\0'

#define CHAR_SINGLE  '\''

#define CHAR_DOUBLE  '"'

#define CHAR_TICK    '`'

/* faster than calling out to libc isdigit */

#define ISDIGIT(a) ((unsigned)((a) - '0') <= 9)

#if 0

#define FOLD_DEBUG printf("%d \t more=%d  pos=%d left=%d\n", __LINE__, more, (int)pos, (int)left);

#else

#define FOLD_DEBUG

#endif

/*

 * not making public just yet

 */

typedef enum {

    TYPE_NONE        = 0

    , TYPE_KEYWORD     = (int)'k'

    , TYPE_UNION       = (int)'U'

    , TYPE_GROUP       = (int)'B'

    , TYPE_EXPRESSION  = (int)'E'

    , TYPE_SQLTYPE     = (int)'t'

    , TYPE_FUNCTION    = (int)'f'

    , TYPE_BAREWORD    = (int)'n'

    , TYPE_NUMBER      = (int)'1'

    , TYPE_VARIABLE    = (int)'v'

    , TYPE_STRING      = (int)'s'

    , TYPE_OPERATOR    = (int)'o'

    , TYPE_LOGIC_OPERATOR = (int)'&'

    , TYPE_COMMENT     = (int)'c'

    , TYPE_COLLATE     = (int)'A'

    , TYPE_LEFTPARENS  = (int)'('

    , TYPE_RIGHTPARENS = (int)')'  /* not used? */

    , TYPE_LEFTBRACE   = (int)'{'

    , TYPE_RIGHTBRACE  = (int)'}'

    , TYPE_DOT         = (int)'.'

    , TYPE_COMMA       = (int)','

    , TYPE_COLON       = (int)':'

    , TYPE_SEMICOLON   = (int)';'

    , TYPE_TSQL        = (int)'T'  /* TSQL start */

    , TYPE_UNKNOWN     = (int)'?'

    , TYPE_EVIL        = (int)'X'  /* unparsable, abort  */

    , TYPE_FINGERPRINT = (int)'F'  /* not really a token */

    , TYPE_BACKSLASH   = (int)'\\'

} sqli_token_types;

/**

 * Initializes parsing state

 *

 */

static char flag2delim(int flag)

{

    if (flag & FLAG_QUOTE_SINGLE) {

        return CHAR_SINGLE;

    } else if (flag & FLAG_QUOTE_DOUBLE) {

        return CHAR_DOUBLE;

    } else {

        return CHAR_NULL;

    }

}

/* memchr2 finds a string of 2 characters inside another string

 * This a specialized version of "memmem" or "memchr".

 * 'memmem' doesn't exist on all platforms

 *

 * Porting notes: this is just a special version of

 *    astring.find("AB")

 *

 */

static const char *

memchr2(const char *haystack, size_t haystack_len, char c0, char c1)

{

    const char *cur = haystack;

    const char *last = haystack + haystack_len - 1;

    if (haystack_len < 2) {

        return NULL;

    }

    while (cur < last) {

        /* safe since cur < len - 1 always */

        if (cur[0] == c0 && cur[1] == c1) {

            return cur;

        }

        cur += 1;

    }

    return NULL;

}

/**

 * memmem might not exist on some systems

 */

static const char *

my_memmem(const char* haystack, size_t hlen, const char* needle, size_t nlen)

{

    const char* cur;

    const char* last;

    assert(haystack);

    assert(needle);

    assert(nlen > 1);

    last =  haystack + hlen - nlen;

    for (cur = haystack; cur <= last; ++cur) {

        if (cur[0] == needle[0] && memcmp(cur, needle, nlen) == 0) {

            return cur;

        }

    }

    return NULL;

}

/** Find largest string containing certain characters.

 *

 * C Standard library 'strspn' only works for 'c-strings' (null terminated)

 * This works on arbitrary length.

 *

 * Performance notes:

 *   not critical

 *

 * Porting notes:

 *   if accept is 'ABC', then this function would be similar to

 *   a_regexp.match(a_str, '[ABC]*'),

 */

static size_t

strlenspn(const char *s, size_t len, const char *accept)

{

    size_t i;

    for (i = 0; i < len; ++i) {

        /* likely we can do better by inlining this function

         * but this works for now

         */

        if (strchr(accept, s[i]) == NULL) {

            return i;

        }

    }

    return len;

}

static size_t

strlencspn(const char *s, size_t len, const char *accept)

{

    size_t i;

    for (i = 0; i < len; ++i) {

        /* likely we can do better by inlining this function

         * but this works for now

         */

        if (strchr(accept, s[i]) != NULL) {

            return i;

        }

    }

    return len;

}

static int char_is_white(char ch) {

    /* ' '  space is 0x32

       '\t  0x09 \011 horizontal tab

       '\n' 0x0a \012 new line

       '\v' 0x0b \013 vertical tab

       '\f' 0x0c \014 new page

       '\r' 0x0d \015 carriage return

            0x00 \000 null (oracle)

            0xa0 \240 is Latin-1

    */

    return strchr(" \t\n\v\f\r\240\000", ch) != NULL;

}

/* DANGER DANGER

 * This is -very specialized function-

 *

 * this compares a ALL_UPPER CASE C STRING

 * with a *arbitrary memory* + length

 *

 * Sane people would just make a copy, up-case

 * and use a hash table.

 *

 * Required since libc version uses the current locale

 * and is much slower.

 */

static int cstrcasecmp(const char *a, const char *b, size_t n)

{

    char cb;

    for (; n > 0; a++, b++, n--) {

        cb = *b;

        if (cb >= 'a' && cb <= 'z') {

            cb -= 0x20;

        }

        if (*a != cb) {

            return *a - cb;

        } else if (*a == '\0') {

            return -1;

        }

    }

    return (*a == 0) ? 0 : 1;

}

/**

 * Case sensitive string compare.

 *  Here only to make code more readable

 */

static int streq(const char *a, const char *b)

{

    return strcmp(a, b) == 0;

}

/**

 *

 *

 *

 * Porting Notes:

 *  given a mapping/hash of string to char

 *  this is just

 *    typecode = mapping[key.upper()]

 */

static char bsearch_keyword_type(const char *key, size_t len,

                                 const keyword_t * keywords, size_t numb)

{

    size_t pos;

    size_t left = 0;

    size_t right = numb - 1;

    while (left < right) {

        pos = (left + right) >> 1;

        /* arg0 = upper case only, arg1 = mixed case */

        if (cstrcasecmp(keywords[pos].word, key, len) < 0) {

            left = pos + 1;

        } else {

            right = pos;

        }

    }

    if ((left == right) && cstrcasecmp(keywords[left].word, key, len) == 0) {

        return keywords[left].type;

    } else {

        return CHAR_NULL;

    }

}

static char is_keyword(const char* key, size_t len)

{

    return bsearch_keyword_type(key, len, sql_keywords, sql_keywords_sz);

}

/* st_token methods

 *

 * The following functions manipulates the stoken_t type

 *

 *

 */

static void st_clear(stoken_t * st)

{

    memset(st, 0, sizeof(stoken_t));

}

static void st_assign_char(stoken_t * st, const char stype, size_t pos, size_t len,

                           const char value)

{

    /* done to eliminate unused warning */

    (void)len;

    st->type = (char) stype;

    st->pos = pos;

    st->len = 1;

    st->val[0] = value;

    st->val[1] = CHAR_NULL;

}

static void st_assign(stoken_t * st, const char stype,

                      size_t pos, size_t len, const char* value)

{

    const size_t MSIZE = LIBINJECTION_SQLI_TOKEN_SIZE;

    size_t last = len < MSIZE ? len : (MSIZE - 1);

    st->type = (char) stype;

    st->pos = pos;

    st->len = last;

    memcpy(st->val, value, last);

    st->val[last] = CHAR_NULL;

}

static void st_copy(stoken_t * dest, const stoken_t * src)

{

    memcpy(dest, src, sizeof(stoken_t));

}

static int st_is_arithmetic_op(const stoken_t* st)

{

    const char ch = st->val[0];

    return (st->type == TYPE_OPERATOR && st->len == 1 &&

            (ch == '*' || ch == '/' || ch == '-' || ch == '+' || ch == '%'));

}

static int st_is_unary_op(const stoken_t * st)

{

    const char* str = st->val;

    const size_t len = st->len;

    if (st->type != TYPE_OPERATOR) {

        return FALSE;

    }

    switch (len) {

    case 1:

        return *str == '+' || *str == '-' || *str == '!' || *str == '~';

    case 2:

        return str[0] == '!' && str[1] == '!';

    case 3:

        return cstrcasecmp("NOT", str, 3) == 0;

    default:

        return FALSE;

    }

}

/* Parsers

 *

 *

 */

static size_t parse_white(struct libinjection_sqli_state * sf)

{

    return sf->pos + 1;

}

static size_t parse_operator1(struct libinjection_sqli_state * sf)

{

    const char *cs = sf->s;

    size_t pos = sf->pos;

    st_assign_char(sf->current, TYPE_OPERATOR, pos, 1, cs[pos]);

    return pos + 1;

}

static size_t parse_other(struct libinjection_sqli_state * sf)

{

    const char *cs = sf->s;

    size_t pos = sf->pos;

    st_assign_char(sf->current, TYPE_UNKNOWN, pos, 1, cs[pos]);

    return pos + 1;

}

static size_t parse_char(struct libinjection_sqli_state * sf)

{

    const char *cs = sf->s;

    size_t pos = sf->pos;

    st_assign_char(sf->current, cs[pos], pos, 1, cs[pos]);

    return pos + 1;

}

static size_t parse_eol_comment(struct libinjection_sqli_state * sf)

{

    const char *cs = sf->s;

    const size_t slen = sf->slen;

    size_t pos = sf->pos;

    const char *endpos =

        (const char *) memchr((const void *) (cs + pos), '\n', slen - pos);

    if (endpos == NULL) {

        st_assign(sf->current, TYPE_COMMENT, pos, slen - pos, cs + pos);

        return slen;

    } else {

        st_assign(sf->current, TYPE_COMMENT, pos, (size_t)(endpos - cs) - pos, cs + pos);

        return (size_t)((endpos - cs) + 1);

    }

}

/** In ANSI mode, hash is an operator

 *  In MYSQL mode, it's a EOL comment like '--'

 */

static size_t parse_hash(struct libinjection_sqli_state * sf)

{

    sf->stats_comment_hash += 1;

    if (sf->flags & FLAG_SQL_MYSQL) {

        sf->stats_comment_hash += 1;

        return parse_eol_comment(sf);

    } else {

        st_assign_char(sf->current, TYPE_OPERATOR, sf->pos, 1, '#');

        return sf->pos + 1;

    }

}

static size_t parse_dash(struct libinjection_sqli_state * sf)

{

    const char *cs = sf->s;

    const size_t slen = sf->slen;

    size_t pos = sf->pos;

    /*

     * five cases

     * 1) --[white]  this is always a SQL comment

     * 2) --[EOF]    this is a comment

     * 3) --[notwhite] in MySQL this is NOT a comment but two unary operators

     * 4) --[notwhite] everyone else thinks this is a comment

     * 5) -[not dash]  '-' is a unary operator

     */

    if (pos + 2 < slen && cs[pos + 1] == '-' && char_is_white(cs[pos+2]) ) {

        return parse_eol_comment(sf);

    } else if (pos +2 == slen && cs[pos + 1] == '-') {

        return parse_eol_comment(sf);

    } else if (pos + 1 < slen && cs[pos + 1] == '-' && (sf->flags & FLAG_SQL_ANSI)) {

        /* --[not-white] not-white case:

         *

         */

        sf->stats_comment_ddx += 1;

        return parse_eol_comment(sf);

    } else {

        st_assign_char(sf->current, TYPE_OPERATOR, pos, 1, '-');

        return pos + 1;

    }

}

/** This detects MySQL comments, comments that

 * start with /x!   We just ban these now but

 * previously we attempted to parse the inside

 *

 * For reference:

 * the form of /x![anything]x/ or /x!12345[anything] x/

 *

 * Mysql 3 (maybe 4), allowed this:

 *    /x!0selectx/ 1;

 * where 0 could be any number.

 *

 * The last version of MySQL 3 was in 2003.

 * It is unclear if the MySQL 3 syntax was allowed

 * in MySQL 4.  The last version of MySQL 4 was in 2008

 *

 */

static size_t is_mysql_comment(const char *cs, const size_t len, size_t pos)

{

    /* so far...

     * cs[pos] == '/' && cs[pos+1] == '*'

     */

    if (pos + 2 >= len) {

        /* not a mysql comment */

        return 0;

    }

    if (cs[pos + 2] != '!') {

        /* not a mysql comment */

        return 0;

    }

    /*

     * this is a mysql comment

     *  got "/x!"

     */

    return 1;

}

static size_t parse_slash(struct libinjection_sqli_state * sf)

{

    const char* ptr;

    size_t clen;

    const char *cs = sf->s;

    const size_t slen = sf->slen;

    size_t pos = sf->pos;

    const char* cur = cs + pos;

    char ctype = TYPE_COMMENT;

    size_t pos1 = pos + 1;

    if (pos1 == slen || cs[pos1] != '*') {

        return parse_operator1(sf);

    }

    /*

     * skip over initial '/x'

     */

    ptr = memchr2(cur + 2, slen - (pos + 2), '*', '/');

    /*

     * (ptr == NULL) causes false positive in cppcheck 1.61

     * casting to type seems to fix it

     */

    if (ptr == (const char*) NULL) {

        /* till end of line */

        clen = slen - pos;

    } else {

        clen = (size_t)(ptr + 2 - cur);

    }

    /*

     * postgresql allows nested comments which makes

     * this is incompatible with parsing so

     * if we find a '/x' inside the coment, then

     * make a new token.

     *

     * Also, Mysql's "conditional" comments for version

     *  are an automatic black ban!

     */

    if (memchr2(cur + 2, (size_t)(ptr - (cur + 1)), '/', '*') !=  NULL) {

        ctype = TYPE_EVIL;

    } else if (is_mysql_comment(cs, slen, pos)) {

        ctype = TYPE_EVIL;

    }

    st_assign(sf->current, ctype, pos, clen, cs + pos);

    return pos + clen;

}

static size_t parse_backslash(struct libinjection_sqli_state * sf)

{

    const char *cs = sf->s;

    const size_t slen = sf->slen;

    size_t pos = sf->pos;

    /*

     * Weird MySQL alias for NULL, "\N" (capital N only)

     */

    if (pos + 1 < slen && cs[pos +1] == 'N') {

        st_assign(sf->current, TYPE_NUMBER, pos, 2, cs + pos);

        return pos + 2;

    } else {

        st_assign_char(sf->current, TYPE_BACKSLASH, pos, 1, cs[pos]);

        return pos + 1;

    }

}

static size_t parse_operator2(struct libinjection_sqli_state * sf)

{

    char ch;

    const char *cs = sf->s;

    const size_t slen = sf->slen;

    size_t pos = sf->pos;

    if (pos + 1 >= slen) {

        return parse_operator1(sf);

    }

    if (pos + 2 < slen &&

        cs[pos] == '<' &&

        cs[pos + 1] == '=' &&

        cs[pos + 2] == '>') {

        /*

         * special 3-char operator

         */

        st_assign(sf->current, TYPE_OPERATOR, pos, 3, cs + pos);

        return pos + 3;

    }

    ch = sf->lookup(sf, LOOKUP_OPERATOR, cs + pos, 2);

    if (ch != CHAR_NULL) {

        st_assign(sf->current, ch, pos, 2, cs+pos);

        return pos + 2;

    }

    /*

     * not an operator.. what to do with the two

     * characters we got?

     */

    if (cs[pos] == ':') {

        /* ':' is not an operator */

        st_assign(sf->current, TYPE_COLON, pos, 1, cs+pos);

        return pos + 1;

    } else {

        /*

         * must be a single char operator

         */

        return parse_operator1(sf);

    }

}

/*

 * Ok!   "  \"   "  one backslash = escaped!

 *       " \\"   "  two backslash = not escaped!

 *       "\\\"   "  three backslash = escaped!

 */

static int is_backslash_escaped(const char* end, const char* start)

{

    const char* ptr;

    for (ptr = end; ptr >= start; ptr--) {

        if (*ptr != '\\') {

            break;

        }

    }

    /* if number of backslashes is odd, it is escaped */

    return (end - ptr) & 1;

}

static size_t is_double_delim_escaped(const char* cur,  const char* end)

{

    return  ((cur + 1) < end) && *(cur+1) == *cur;

}

/* Look forward for doubling of delimiter

 *

 * case 'foo''bar' --> foo''bar

 *

 * ending quote isn't duplicated (i.e. escaped)

 * since it's the wrong char or EOL

 *

 */

static size_t parse_string_core(const char *cs, const size_t len, size_t pos,

                                stoken_t * st, char delim, size_t offset)

{

    /*

     * offset is to skip the perhaps first quote char

     */

    const char *qpos =

        (const char *) memchr((const void *) (cs + pos + offset), delim,

                              len - pos - offset);

    /*

     * then keep string open/close info

     */

    if (offset > 0) {

        /*

         * this is real quote

         */

        st->str_open = delim;

    } else {

        /*

         * this was a simulated quote

         */

        st->str_open = CHAR_NULL;

    }

    while (TRUE) {

        if (qpos == NULL) {

            /*

             * string ended with no trailing quote

             * assign what we have

             */

            st_assign(st, TYPE_STRING, pos + offset, len - pos - offset, cs + pos + offset);

            st->str_close = CHAR_NULL;

            return len;

        } else if ( is_backslash_escaped(qpos - 1, cs + pos + offset)) {

            /* keep going, move ahead one character */

            qpos =

                (const char *) memchr((const void *) (qpos + 1), delim,

                                      (size_t)((cs + len) - (qpos + 1)));

            continue;

        } else if (is_double_delim_escaped(qpos, cs + len)) {

            /* keep going, move ahead two characters */

            qpos =

                (const char *) memchr((const void *) (qpos + 2), delim,

                                      (size_t)((cs + len) - (qpos + 2)));

            continue;

        } else {

            /* hey it's a normal string */

            st_assign(st, TYPE_STRING, pos + offset,

                      (size_t)(qpos - (cs + pos + offset)), cs + pos + offset);

            st->str_close = delim;

            return (size_t)(qpos - cs + 1);

        }

    }

}

/**

 * Used when first char is a ' or "

 */

static size_t parse_string(struct libinjection_sqli_state * sf)

{

    const char *cs = sf->s;

    const size_t slen = sf->slen;

    size_t pos = sf->pos;

    /*

     * assert cs[pos] == single or double quote

     */

    return parse_string_core(cs, slen, pos, sf->current, cs[pos], 1);

}

/**

 * Used when first char is:

 *    N or n:  mysql "National Character set"

 *    E     :  psql  "Escaped String"

 */

static size_t parse_estring(struct libinjection_sqli_state * sf)

{

    const char *cs = sf->s;

    const size_t slen = sf->slen;

    size_t pos = sf->pos;

    if (pos + 2 >= slen || cs[pos+1] != CHAR_SINGLE) {

        return parse_word(sf);

    }

    return parse_string_core(cs, slen, pos, sf->current, CHAR_SINGLE, 2);

}

static size_t parse_ustring(struct libinjection_sqli_state * sf)

{

    const char *cs = sf->s;

    size_t slen = sf->slen;

    size_t pos = sf->pos;

    if (pos + 2 < slen && cs[pos+1] == '&' && cs[pos+2] == '\'') {

        sf->pos += 2;

        pos = parse_string(sf);

        sf->current->str_open = 'u';

        if (sf->current->str_close == '\'') {

            sf->current->str_close = 'u';

        }

        return pos;

    } else {

        return parse_word(sf);

    }

}

static size_t parse_qstring_core(struct libinjection_sqli_state * sf, size_t offset)

{

    char ch;

    const char *strend;

    const char *cs = sf->s;

    size_t slen = sf->slen;

    size_t pos = sf->pos + offset;

    /* if we are already at end of string..

       if current char is not q or Q

       if we don't have 2 more chars

       if char2 != a single quote

       then, just treat as word

    */

    if (pos >= slen ||

        (cs[pos] != 'q' && cs[pos] != 'Q') ||

        pos + 2 >= slen ||

        cs[pos + 1] != '\'') {

        return parse_word(sf);

    }

    ch = cs[pos + 2];

    /* the ch > 127 is un-needed since

     * we assume char is signed

     */

    if (ch < 33 /* || ch > 127 */) {

        return parse_word(sf);

    }

    switch (ch) {

    case '(' : ch = ')'; break;

    case '[' : ch = ']'; break;

    case '{' : ch = '}'; break;

    case '<' : ch = '>'; break;

    }

    strend = memchr2(cs + pos + 3, slen - pos - 3, ch, '\'');

    if (strend == NULL) {

        st_assign(sf->current, TYPE_STRING, pos + 3, slen - pos - 3, cs + pos + 3);

        sf->current->str_open = 'q';

        sf->current->str_close = CHAR_NULL;

        return slen;

    } else {

        st_assign(sf->current, TYPE_STRING, pos + 3, (size_t)(strend - cs) - pos -  3, cs + pos + 3);

        sf->current->str_open = 'q';

        sf->current->str_close = 'q';

        return (size_t)(strend - cs + 2);

    }

}

/*

 * Oracle's q string

 */

static size_t parse_qstring(struct libinjection_sqli_state * sf)

{

    return parse_qstring_core(sf, 0);

}

/*

 * mysql's N'STRING' or

 * ...  Oracle's nq string

 */

static size_t parse_nqstring(struct libinjection_sqli_state * sf)

{

    size_t slen = sf->slen;

    size_t pos = sf->pos;

    if (pos + 2 < slen && sf->s[pos+1] == CHAR_SINGLE) {

        return parse_estring(sf);

    }

    return parse_qstring_core(sf, 1);

}

/*

 * binary literal string

 * re: [bB]'[01]*'

 */

static size_t parse_bstring(struct libinjection_sqli_state *sf)

{

    size_t wlen;

    const char *cs = sf->s;

    size_t pos = sf->pos;

    size_t slen = sf->slen;

    /* need at least 2 more characters

     * if next char isn't a single quote, then

     * continue as normal word

     */

    if (pos + 2 >= slen || cs[pos+1] !=  '\'') {

        return parse_word(sf);

    }

    wlen = strlenspn(cs + pos + 2, sf->slen - pos - 2, "01");

    if (pos + 2 + wlen  >= slen || cs[pos + 2 + wlen] != '\'') {

        return parse_word(sf);

    }

    st_assign(sf->current, TYPE_NUMBER, pos, wlen + 3, cs + pos);

    return pos + 2 + wlen + 1;

}

/*

 * hex literal string

 * re: [xX]'[0123456789abcdefABCDEF]*'

 * mysql has requirement of having EVEN number of chars,

 *  but pgsql does not

 */

static size_t parse_xstring(struct libinjection_sqli_state *sf)

{

    size_t wlen;

    const char *cs = sf->s;

    size_t pos = sf->pos;

    size_t slen = sf->slen;

    /* need at least 2 more characters

     * if next char isn't a single quote, then

     * continue as normal word

     */

    if (pos + 2 >= slen || cs[pos+1] !=  '\'') {

        return parse_word(sf);

    }

    wlen = strlenspn(cs + pos + 2, sf->slen - pos - 2, "0123456789ABCDEFabcdef");

    if (pos + 2 + wlen  >= slen || cs[pos + 2 + wlen] != '\'') {

        return parse_word(sf);

    }

    st_assign(sf->current, TYPE_NUMBER, pos, wlen + 3, cs + pos);

    return pos + 2 + wlen + 1;

}

/**

 * This handles MS SQLSERVER bracket words

 * http://stackoverflow.com/questions/3551284/sql-serverwhat-do-brackets-mean-around-column-name

 *

 */

static size_t parse_bword(struct libinjection_sqli_state * sf)

{

    const char *cs = sf->s;

    size_t pos = sf->pos;

    const char* endptr = (const char*) memchr(cs + pos, ']', sf->slen - pos);

    if (endptr == NULL) {

        st_assign(sf->current, TYPE_BAREWORD, pos, sf->slen - pos, cs + pos);

        return sf->slen;