Fixed bug #142 "segvault with null terminated input"

Steps to reproduce:
    $ echo -ne "&\x00" > A
    $ re2c A
    Segmentation fault

Analyses: when re2c finds NULL in the input file, it checks for the
end of input; if indeed it has reached the end of input, it stops.
Otherwise, it's just some NULL byte in the middle of input; it should
be handled like any other character.

The first case (NULL as end of input) was handled correctly, but
in the second case (NULL in the middle of input) re2c crashed:
someone forgot to put an appropriate 'goto' statement, which caused
completely ad-hoc control flow in lexer.

diff --git a/re2c/bootstrap/src/parse/lex.cc b/re2c/bootstrap/src/parse/lex.cc
index 9c7e0143857f0df7de9fec72332d8bd404a2f87c..0033c1ab42c370c571edac3b5a0f8d15773c1550 100644 (file)
--- a/re2c/bootstrap/src/parse/lex.cc
+++ b/re2c/bootstrap/src/parse/lex.cc
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.16 on Thu Jan 21 10:47:47 2016 */
+/* Generated by re2c 0.16 on Wed May 11 15:12:59 2016 */
 #line 1 "../src/parse/lex.re"
 #include "src/util/c99_stdint.h"
 #include <stddef.h>
@@ -118,14 +118,14 @@ echo:
        ++YYCURSOR;
 #line 202 "../src/parse/lex.re"
        {
-                                       if (!ignore_eoc && opts->target == opt_t::CODE)
-                                       {
-                                               out.wraw(tok, tok_len () - 1);
-                                               // -1 so we don't write out the \0
-                                       }
-                                       if(cur == eof)
-                                       {
+                                       if(cur == eof) {
+                                               if (!ignore_eoc && opts->target == opt_t::CODE) {
+                                                       out.wraw(tok, tok_len () - 1);
+                                                       // -1 so we don't write out the \0
+                                               }
                                                return Stop;
+                                       } else {
+                                               goto echo;
                                        }
                                }
 #line 132 "src/parse/lex.cc"

diff --git a/re2c/src/parse/lex.re b/re2c/src/parse/lex.re
index 2fd98fb93012074973a6edce08f9792595b20241..707c72aac32540a21b7e3d7f0317597ec3023b34 100644 (file)
--- a/re2c/src/parse/lex.re
+++ b/re2c/src/parse/lex.re
@@ -200,14 +200,14 @@ echo:
                                        goto echo;
                                }
        zero            {
-                                       if (!ignore_eoc && opts->target == opt_t::CODE)
-                                       {
-                                               out.wraw(tok, tok_len () - 1);
-                                               // -1 so we don't write out the \0
-                                       }
-                                       if(cur == eof)
-                                       {
+                                       if(cur == eof) {
+                                               if (!ignore_eoc && opts->target == opt_t::CODE) {
+                                                       out.wraw(tok, tok_len () - 1);
+                                                       // -1 so we don't write out the \0
+                                               }
                                                return Stop;
+                                       } else {
+                                               goto echo;
                                        }
                                }
        *                       {

diff --git a/re2c/test/bug142.c b/re2c/test/bug142.c
new file mode 100644 (file)
index 0000000..2a481bf
Binary files /dev/null and b/re2c/test/bug142.c differ

diff --git a/re2c/test/bug142.re b/re2c/test/bug142.re
new file mode 100644 (file)
index 0000000..fc045eb
Binary files /dev/null and b/re2c/test/bug142.re differ