From 341f47a6dd3690754fe9660bc248875c7b810260 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike.dalessio@gmail.com>
Date: Wed, 30 Aug 2023 08:31:33 -0400
Subject: [PATCH] [ruby/yarp] fix: incomplete escape in regex at the end of
 file

Previously this resulted in invalid memory access.

Found by the fuzzer.

https://github.com/ruby/yarp/commit/55b9dfb41c
---
 test/yarp/fuzzer_test.rb | 1 +
 yarp/yarp.c              | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/test/yarp/fuzzer_test.rb b/test/yarp/fuzzer_test.rb
index 52d7f77e9f..2d851ff886 100644
--- a/test/yarp/fuzzer_test.rb
+++ b/test/yarp/fuzzer_test.rb
@@ -22,4 +22,5 @@ class FuzzerTest < Test::Unit::TestCase
   snippet "incomplete octal number", "0o"
   snippet "incomplete hex number", "0x"
   snippet "incomplete escaped list", "%w[\\"
+  snippet "incomplete escaped regex", "/a\\"
 end
diff --git a/yarp/yarp.c b/yarp/yarp.c
index 3b2f29bf01..3fa143f31e 100644
--- a/yarp/yarp.c
+++ b/yarp/yarp.c
@@ -7091,6 +7091,12 @@ parser_lex(yp_parser_t *parser) {
                 // literally. In this case we'll skip past the next character
                 // and find the next breakpoint.
                 if (*breakpoint == '\\') {
+                    // Check that we're not at the end of the file.
+                    if (breakpoint + 1 >= parser->end) {
+                        breakpoint = NULL;
+                        continue;
+                    }
+
                     size_t difference = yp_unescape_calculate_difference(parser, breakpoint, YP_UNESCAPE_ALL, false);
 
                     // If the result is an escaped newline ...