Sorry for replying so late, I will review it ASAP.

I think we should check the boundary of current_tag_{key,value}_ptr at every time we bump the value of them, Otherwise, we may overflow our stack when encountering malformed messages.

Use strtok is safer than ptr++.

Use strtok is safer than ptr++.

How? The loop needs to look for both ;/= and .

Use strtok is safer than ptr++.

How? The loop needs to look for both ;/= and .

ptr = strtok(line, delim)(first call), The delim parameter of can be ; = as you want.

See also: https://www.tutorialspoint.com/c_standard_library/c_function_strtok.htm

I think we should check the boundary of current_tag_{key,value}_ptr at every time we bump the value of them, Otherwise, we may overflow our stack when encountering malformed messages.

Oh, good point. What if I add this at the beginning of the loop instead?

if (p >= (tags_ptr + TAGS_SIZE_LIMIT)) {
    g_free(imsg->tags);
    goto bad;

As current_tag_{key,value}_ptr are incremented at most once per loop iteration, this should guarantee they don't overflow.

ptr = strtok(line, delim)(first call), The delim parameter of can be ; = as you want.

But it can't be all of them at the same time; so I would need to call strtok twice and discard the largest result, this seems wasteful

Oh, good point. What if I add this at the beginning of the loop instead?

if (p >= (tags_ptr + TAGS_SIZE_LIMIT)) {
    g_free(imsg->tags);
    goto bad;

It is okay and would be better if you print a related error message using `ERR_FR.

As current_tag_{key,value}_ptr are incremented at most once per loop iteration, this should guarantee they don't overflow.

When escaping chars, ptrs are incremented twice?

But it can't be all of them at the same time; so I would need to call strtok twice and discard the largest result, this seems wasteful

Yes, so there are 2 ways:

1. use strtok, the flow of your code may changed: we can "check all of them" in same time
2. don't change the code, but check whehter *p == '\0' every time after bump it.

It is okay and would be better if you print a related error message using `ERR_FR.

Sure

When escaping chars, ptrs are incremented twice?

p is incremented twice, but current_tag_{key,value}_ptr only once

It is okay and would be better if you print a related error message using `ERR_FR.

Sure

When escaping chars, ptrs are incremented twice?

p is incremented twice, but current_tag_{key,value}_ptr only once

Ahhh, yes, my fault.

Done!

Sorry for delay again, I am quite busy with both my life and work.

I will test the function of this PR weekend, then evently it can be merged.