Skip to content

Commit 0a79d6c

Browse files
SAY-5ksh8281
SAY-5
authored and
ksh8281
committed
Fix out-of-bounds read in lexer comment/hashbang skipping
skipSingleLine, skipSingleLineComment, and skipMultiLineComment incremented the source index and then called peekCharWithoutEOF() without re-checking eof(), causing a one-byte heap read past the source buffer when the input ends with a bare \r or a trailing '*'. Guard each follow-up peek with eof(). Fixes #1568 Signed-off-by: SAY-5 <[email protected]>
1 parent 634fe86 commit 0a79d6c

1 file changed

Lines changed: 4 additions & 4 deletions

File tree

‎src/parser/Lexer.cpp‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -755,7 +755,7 @@ void Scanner::skipSingleLine()
755755
++this->index;
756756

757757
if (isLineTerminator(ch)) {
758-
if (ch == 13 && this->peekCharWithoutEOF() == 10) {
758+
if (ch == 13 && !this->eof() && this->peekCharWithoutEOF() == 10) {
759759
++this->index;
760760
}
761761
++this->lineNumber;
@@ -772,7 +772,7 @@ void Scanner::skipSingleLineComment(void)
772772
++this->index;
773773

774774
if (isLineTerminator(ch)) {
775-
if (ch == 13 && this->peekCharWithoutEOF() == 10) {
775+
if (ch == 13 && !this->eof() && this->peekCharWithoutEOF() == 10) {
776776
++this->index;
777777
}
778778
++this->lineNumber;
@@ -790,12 +790,12 @@ void Scanner::skipMultiLineComment(void)
790790
++this->index;
791791

792792
if (isLineTerminator(ch)) {
793-
if (ch == 0x0D && this->peekCharWithoutEOF() == 0x0A) {
793+
if (ch == 0x0D && !this->eof() && this->peekCharWithoutEOF() == 0x0A) {
794794
++this->index;
795795
}
796796
++this->lineNumber;
797797
this->lineStart = this->index;
798-
} else if (ch == 0x2A && this->peekCharWithoutEOF() == 0x2F) {
798+
} else if (ch == 0x2A && !this->eof() && this->peekCharWithoutEOF() == 0x2F) {
799799
// Block comment ends with '*/'.
800800
++this->index;
801801
return;

0 commit comments

Comments
 (0)