From 8725a300002aa83c82bd44303f5a8bcf5856a9af Mon Sep 17 00:00:00 2001
From: Benjamin Kramer <benny.kra@googlemail.com>
Date: Sun, 29 Mar 2015 14:11:37 +0000
Subject: [PATCH] [lex] Don't read past the end of the buffer

While dereferencing ThisTokEnd is fine and we know that it's not in
[a-zA-Z0-9_.], ThisTokEnd[1] is really past the end.

Found by asan and with a little help from clang-fuzz.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@233491 91177308-0d34-0410-b5e6-96231b3b80d8
---
 lib/Lex/LiteralSupport.cpp | 7 ++++---
 test/Lexer/eof-number.c    | 9 +++++++++
 2 files changed, 13 insertions(+), 3 deletions(-)
 create mode 100644 test/Lexer/eof-number.c

diff --git a/lib/Lex/LiteralSupport.cpp b/lib/Lex/LiteralSupport.cpp
index 88b64dd8ff..aed9164879 100644
--- a/lib/Lex/LiteralSupport.cpp
+++ b/lib/Lex/LiteralSupport.cpp
@@ -748,11 +748,11 @@ void NumericLiteralParser::ParseNumberStartingWithZero(SourceLocation TokLoc) {
   s++;
 
   int c1 = s[0];
-  int c2 = s[1];
 
   // Handle a hex number like 0x1234.
-  if ((c1 == 'x' || c1 == 'X') && (isHexDigit(c2) || c2 == '.')) {
+  if ((c1 == 'x' || c1 == 'X') && (isHexDigit(s[1]) || s[1] == '.')) {
     s++;
+    assert(s < ThisTokEnd && "didn't maximally munch?");
     radix = 16;
     DigitsBegin = s;
     s = SkipHexDigits(s);
@@ -804,7 +804,7 @@ void NumericLiteralParser::ParseNumberStartingWithZero(SourceLocation TokLoc) {
   }
 
   // Handle simple binary numbers 0b01010
-  if ((c1 == 'b' || c1 == 'B') && (c2 == '0' || c2 == '1')) {
+  if ((c1 == 'b' || c1 == 'B') && (s[1] == '0' || s[1] == '1')) {
     // 0b101010 is a C++1y / GCC extension.
     PP.Diag(TokLoc,
             PP.getLangOpts().CPlusPlus14
@@ -813,6 +813,7 @@ void NumericLiteralParser::ParseNumberStartingWithZero(SourceLocation TokLoc) {
                 ? diag::ext_binary_literal_cxx14
                 : diag::ext_binary_literal);
     ++s;
+    assert(s < ThisTokEnd && "didn't maximally munch?");
     radix = 2;
     DigitsBegin = s;
     s = SkipBinaryDigits(s);
diff --git a/test/Lexer/eof-number.c b/test/Lexer/eof-number.c
new file mode 100644
index 0000000000..d97a6fec4b
--- /dev/null
+++ b/test/Lexer/eof-number.c
@@ -0,0 +1,9 @@
+// RUN: %clang_cc1 %s -verify -fsyntax-only -Wnewline-eof
+// vim: set binary noeol:
+
+// This file intentionally ends without a \n on the last line.  Make sure your
+// editor doesn't add one.
+
+// expected-error@+2{{unterminated conditional directive}}
+// expected-warning@+1{{no newline at end of file}}
+#if 0
\ No newline at end of file
-- 
2.40.0