Module Name: src
Committed By: rillig
Date: Sat Jun 19 08:57:25 UTC 2021
Modified Files:
src/usr.bin/xlint/lint1: lex.c
Log Message:
lint: fix endless loop when scanning string or character literals
If the code contains an unfinished string or character literal at the
EOF, the lexer got into an endless loop. Curiously, inpc() returned 0
in such a case instead of the common EOF.
Found by making lint1 with CC=afl-gcc and then running:
afl-fuzz \
-m 200 \
-i in_dir \
-o lint1 \
$src/usr.bin/xlint/lint1/lint1 @@ /dev/null
To generate a diff of this commit:
cvs rdiff -u -r1.39 -r1.40 src/usr.bin/xlint/lint1/lex.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/usr.bin/xlint/lint1/lex.c
diff -u src/usr.bin/xlint/lint1/lex.c:1.39 src/usr.bin/xlint/lint1/lex.c:1.40
--- src/usr.bin/xlint/lint1/lex.c:1.39 Sat Jun 19 08:37:18 2021
+++ src/usr.bin/xlint/lint1/lex.c Sat Jun 19 08:57:24 2021
@@ -1,4 +1,4 @@
-/* $NetBSD: lex.c,v 1.39 2021/06/19 08:37:18 rillig Exp $ */
+/* $NetBSD: lex.c,v 1.40 2021/06/19 08:57:24 rillig Exp $ */
/*
* Copyright (c) 1996 Christopher G. Demetriou. All Rights Reserved.
@@ -38,7 +38,7 @@
#include <sys/cdefs.h>
#if defined(__RCSID) && !defined(lint)
-__RCSID("$NetBSD: lex.c,v 1.39 2021/06/19 08:37:18 rillig Exp $");
+__RCSID("$NetBSD: lex.c,v 1.40 2021/06/19 08:57:24 rillig Exp $");
#endif
#include <ctype.h>
@@ -932,6 +932,10 @@ get_escaped_char(int delim)
return -2;
}
return c;
+ case 0:
+ /* syntax error '%s' */
+ error(249, "EOF or null byte in literal");
+ return -2;
case EOF:
return -2;
case '\\':
