Fixed out of bounds read in configuration lexer (not handling EOF in configuration...

Found by american fuzzy lop (thanks to Henri Salo).

diff --git a/re2c/bootstrap/src/ast/lex_conf.cc b/re2c/bootstrap/src/ast/lex_conf.cc
index 0d3fd39866fd301860cf5c2613ab000cbdfa349d..0764f6ecebf6481044299a1e90c03b0c158489ae 100644 (file)
--- a/re2c/bootstrap/src/ast/lex_conf.cc
+++ b/re2c/bootstrap/src/ast/lex_conf.cc
@@ -1,4 +1,4 @@
-/* Generated by re2c 1.1.1 on Mon Oct 29 22:56:51 2018 */
+/* Generated by re2c 1.1.1 on Sun Nov  4 22:33:41 2018 */
 #line 1 "../src/ast/lex_conf.re"
 #include "src/util/c99_stdint.h"
 #include <string>
@@ -3953,7 +3953,7 @@ std::string Scanner::lex_conf_string ()
 {
        unsigned char yych;
        static const unsigned char yybm[] = {
-               128, 128, 128, 128, 128, 128, 128, 128, 
+                 0, 128, 128, 128, 128, 128, 128, 128, 
                128,   0,   0, 128, 128, 128, 128, 128, 
                128, 128, 128, 128, 128, 128, 128, 128, 
                128, 128, 128, 128, 128, 128, 128, 128, 
@@ -3990,6 +3990,7 @@ std::string Scanner::lex_conf_string ()
        yych = (unsigned char)*cur;
        if (yych <= '!') {
                if (yych <= '\n') {
+                       if (yych <= 0x00) goto yy839;
                        if (yych <= 0x08) goto yy840;
                } else {
                        if (yych != ' ') goto yy840;
@@ -4003,9 +4004,10 @@ std::string Scanner::lex_conf_string ()
                        if (yych != ';') goto yy840;
                }
        }
+yy839:
 #line 293 "../src/ast/lex_conf.re"
        { goto end; }
-#line 4009 "src/ast/lex_conf.cc"
+#line 4011 "src/ast/lex_conf.cc"
 yy840:
        ++cur;
        if (lim <= cur) fill(1);
@@ -4018,7 +4020,7 @@ yy840:
         s = std::string(tok, tok_len());
         goto end;
     }
-#line 4022 "src/ast/lex_conf.cc"
+#line 4024 "src/ast/lex_conf.cc"
 yy843:
        ++cur;
 #line 274 "../src/ast/lex_conf.re"
@@ -4037,7 +4039,7 @@ yy843:
             }
         }
     }
-#line 4041 "src/ast/lex_conf.cc"
+#line 4043 "src/ast/lex_conf.cc"
 }
 #line 294 "../src/ast/lex_conf.re"
 

diff --git a/re2c/src/ast/lex_conf.re b/re2c/src/ast/lex_conf.re
index 445e4268efadd4578204318253dc73f739c37d96..5a6cec35ba85f05387da43b056a6601aa9dbcc53 100644 (file)
--- a/re2c/src/ast/lex_conf.re
+++ b/re2c/src/ast/lex_conf.re
@@ -28,7 +28,7 @@ namespace re2c
 
     conf_assign = space* "=" space*;
 
-    naked_char = . \ (space | [;]);
+    naked_char = [^\x00\n] \ (space | [;]);
     naked      = (naked_char \ ['"]) naked_char*;
 
     number = "0" | ("-"? [1-9] [0-9]*);

diff --git a/re2c/test/american_fuzzy_lop/007.c b/re2c/test/american_fuzzy_lop/007.c
new file mode 100644 (file)
index 0000000..848ca11
--- /dev/null
+++ b/re2c/test/american_fuzzy_lop/007.c
@@ -0,0 +1 @@
+re2c: error: line 2, column 18: missing ending ';' in configuration

diff --git a/re2c/test/american_fuzzy_lop/007.re b/re2c/test/american_fuzzy_lop/007.re
new file mode 100644 (file)
index 0000000..01a7523
--- /dev/null
+++ b/re2c/test/american_fuzzy_lop/007.re
@@ -0,0 +1,2 @@
+/*!re2c
+  re2c:startlabel=
\ No newline at end of file