diff options
| author | Mike Dalessio <mike.dalessio@gmail.com> | 2023-08-29 15:38:48 -0400 |
|---|---|---|
| committer | git <svn-admin@ruby-lang.org> | 2023-08-30 18:27:48 +0000 |
| commit | 6f8126faebeddf8a93a7c0041c096bf584efcefb (patch) | |
| tree | ec57121d31871f31c022cfc4714b8c910256c960 | |
| parent | 476f38d62dd24caf80c586b642a25ede66b13fab (diff) | |
[ruby/yarp] fix: string escape char "\" at the end of a file
Previously this resulted in invalid memory access.
Found by the fuzzer.
https://github.com/ruby/yarp/commit/178862e2ca
| -rw-r--r-- | test/yarp/fuzzer_test.rb | 1 | ||||
| -rw-r--r-- | yarp/yarp.c | 6 |
2 files changed, 7 insertions, 0 deletions
diff --git a/test/yarp/fuzzer_test.rb b/test/yarp/fuzzer_test.rb index 6962e6be76..e2aa9dab61 100644 --- a/test/yarp/fuzzer_test.rb +++ b/test/yarp/fuzzer_test.rb @@ -14,4 +14,5 @@ class FuzzerTest < Test::Unit::TestCase snippet "incomplete global variable", "$" snippet "incomplete symbol", ":" + snippet "incomplete escaped string", '"\\' end diff --git a/yarp/yarp.c b/yarp/yarp.c index 15511ebc9e..91c814af9a 100644 --- a/yarp/yarp.c +++ b/yarp/yarp.c @@ -7224,6 +7224,12 @@ parser_lex(yp_parser_t *parser) { breakpoint = yp_strpbrk(parser, breakpoint + 1, breakpoints, parser->end - (breakpoint + 1)); break; case '\\': { + // Check that we're not at the end of the file. + if (breakpoint + 1 >= parser->end) { + breakpoint = NULL; + break; + } + // If we hit escapes, then we need to treat the next token // literally. In this case we'll skip past the next character and // find the next breakpoint. |