read_key,lineeedit: parse position answerback faster; sanitize its use

it's still not reliable, and probably cannot be made so...
added comment with explanation.

function                                             old     new   delta
put_prompt                                            52     110     +58
read_key                                             601     607      +6
lineedit_read_key                                    201     207      +6
win_changed                                          108     104      -4
read_line_input                                     4824    4809     -15
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 3/2 up/down: 70/-19)             Total: 51 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

2 files changed, 58 insertions, 33 deletions

diff --git a/libbb/lineedit.c b/libbb/lineedit.c
index bfd0e3346..2e1bc5d2e 100644
--- a/libbb/lineedit.c
+++ b/libbb/lineedit.c
@@ -370,6 +370,7 @@ static void input_backward(unsigned num)
 static void put_prompt(void)
 {
 	out1str(cmdedit_prompt);
+	fflush(NULL);
 	if (ENABLE_FEATURE_EDITING_ASK_TERMINAL) {
 		/* Ask terminal where is the cursor now.
 		 * lineedit_read_key handles response and corrects
@@ -380,7 +381,33 @@ static void put_prompt(void)
 		 * Note: we print it _after_ prompt, because
 		 * prompt may contain CR. Example: PS1='\[\r\n\]\w '
 		 */
-		out1str("\033" "[6n");
+		/* Problem: if there is buffered input on stdin,
+		 * the response will be delivered later,
+		 * possibly to an unsuspecting application.
+		 * Testcase: "sleep 1; busybox ash" + press and hold [Enter].
+		 * Result:
+		 * ~/srcdevel/bbox/fix/busybox.t4 #
+		 * ~/srcdevel/bbox/fix/busybox.t4 #
+		 * ^[[59;34~/srcdevel/bbox/fix/busybox.t4 #  <-- garbage
+		 * ~/srcdevel/bbox/fix/busybox.t4 #
+		 *
+		 * Checking for input with poll only makes the race narrower,
+		 * I still can trigger it. Strace:
+		 *
+		 * write(1, "~/srcdevel/bbox/fix/busybox.t4 # ", 33) = 33
+		 * poll([{fd=0, events=POLLIN}], 1, 0) = 0 (Timeout)  <-- no input exists
+		 * write(1, "\33[6n", 4) = 4  <-- send the ESC sequence, quick!
+		 * poll([{fd=0, events=POLLIN}], 1, 4294967295) = 1 ([{fd=0, revents=POLLIN}])
+		 * read(0, "\n", 1)      = 1  <-- oh crap, user's input got in first
+		 */
+		struct pollfd pfd;
+
+		pfd.fd = STDIN_FILENO;
+		pfd.events = POLLIN;
+		if (safe_poll(&pfd, 1, 0) == 0) {
+			out1str("\033" "[6n");
+			fflush(NULL); /* make terminal see it ASAP! */
+		}
 	}
 	cursor = 0;
 	{
@@ -1603,7 +1630,7 @@ static void cmdedit_setwidth(unsigned w, int redraw_flg)
 		int new_y = (cursor + cmdedit_prmt_len) / w;
 		/* redraw */
 		redraw((new_y >= cmdedit_y ? new_y : cmdedit_y), command_len - cursor);
-		fflush(stdout);
+		fflush(NULL);
 	}
 }
 
@@ -1640,6 +1667,7 @@ static int lineedit_read_key(char *read_key_buffer)
 		ic = read_key(STDIN_FILENO, read_key_buffer);
 
 		if (ENABLE_FEATURE_EDITING_ASK_TERMINAL
+		 && cursor == 0 /* otherwise it may be bogus */
 		 && (int32_t)ic == KEYCODE_CURSOR_POS
 		) {
 			int col = ((ic >> 32) & 0x7fff) - 1;
@@ -1708,7 +1736,7 @@ int FAST_FUNC read_line_input(const char *prompt, char *command, int maxsize, li
 	) {
 		/* Happens when e.g. stty -echo was run before */
 		parse_and_put_prompt(prompt);
-		fflush(stdout);
+		/* fflush(stdout); - done by parse_and_put_prompt */
 		if (fgets(command, maxsize, stdin) == NULL)
 			len = -1; /* EOF or error */
 		else
@@ -2190,7 +2218,7 @@ int FAST_FUNC read_line_input(const char *prompt, char *command, int maxsize, li
 	tcsetattr_stdin_TCSANOW(&initial_settings);
 	/* restore SIGWINCH handler */
 	signal(SIGWINCH, previous_SIGWINCH_handler);
-	fflush(stdout);
+	fflush(NULL);
 
 	len = command_len;
 	DEINIT_S();
@@ -2204,7 +2232,7 @@ int FAST_FUNC read_line_input(const char *prompt, char *command, int maxsize, li
 int FAST_FUNC read_line_input(const char* prompt, char* command, int maxsize)
 {
 	fputs(prompt, stdout);
-	fflush(stdout);
+	fflush(NULL);
 	fgets(command, maxsize, stdin);
 	return strlen(command);
 }
diff --git a/libbb/read_key.c b/libbb/read_key.c
index ec1b3a4a8..a2253ce3e 100644
--- a/libbb/read_key.c
+++ b/libbb/read_key.c
@@ -202,6 +202,31 @@ int64_t FAST_FUNC read_key(int fd, char *buffer)
 			break;
 		}
 		n++;
+		/* Try to decipher "ESC [ NNN ; NNN R" sequence */
+		if (ENABLE_FEATURE_EDITING_ASK_TERMINAL
+		 && n >= 5
+		 && buffer[0] == '['
+		 && buffer[n-1] == 'R'
+		 && isdigit(buffer[1])
+		) {
+			char *end;
+			unsigned long row, col;
+
+			row = strtoul(buffer + 1, &end, 10);
+			if (*end != ';' || !isdigit(end[1]))
+				continue;
+			col = strtoul(end + 1, &end, 10);
+			if (*end != 'R')
+				continue;
+			if (row < 1 || col < 1 || (row | col) > 0x7fff)
+				continue;
+
+			buffer[-1] = 0;
+			/* Pack into "1 <row15bits> <col16bits>" 32-bit sequence */
+			col |= (((-1 << 15) | row) << 16);
+			/* Return it in high-order word */
+			return ((int64_t) col << 32) | (uint32_t)KEYCODE_CURSOR_POS;
+		}
 	}
  got_all:
 
@@ -213,34 +238,6 @@ int64_t FAST_FUNC read_key(int fd, char *buffer)
 		return 27;
 	}
 
-	/* Try to decipher "ESC [ NNN ; NNN R" sequence */
-	if (ENABLE_FEATURE_EDITING_ASK_TERMINAL
-	 && n >= 5
-	 && buffer[0] == '['
-	 && isdigit(buffer[1])
-	 && buffer[n-1] == 'R'
-	) {
-		char *end;
-		unsigned long row, col;
-
-		row = strtoul(buffer + 1, &end, 10);
-		if (*end != ';' || !isdigit(end[1]))
-			goto not_R;
-		col = strtoul(end + 1, &end, 10);
-		if (*end != 'R')
-			goto not_R;
-		if (row < 1 || col < 1 || (row | col) > 0x7fff)
-			goto not_R;
-
-		buffer[-1] = 0;
-
-		/* Pack into "1 <row15bits> <col16bits>" 32-bit sequence */
-		col |= (((-1 << 15) | row) << 16);
-		/* Return it in high-order word */
-		return ((int64_t) col << 32) | (uint32_t)KEYCODE_CURSOR_POS;
-	}
- not_R:
-
 	/* We were doing "buffer[-1] = n; return c;" here, but this results
 	 * in unknown key sequences being interpreted as ESC + garbage.
 	 * This was not useful. Pretend there was no key pressed,