1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[ruby/yarp] fix: incomplete escape in list at the end of file

Browse Source 
Previously this resulted in invalid memory access.

Found by the fuzzer.

https://github.com/ruby/yarp/commit/78ed75ed75
This commit is contained in:
Mike Dalessio 2023-08-29 23:03:16 -04:00 committed by git
parent 46e47404a8
commit 7cebb9b737
2 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
test/yarp/fuzzer_test.rb
View File

@ -21,4 +21,5 @@ class FuzzerTest < Test::Unit::TestCase
snippet "incomplete binary number", "0b" snippet "incomplete binary number", "0b"
snippet "incomplete octal number", "0o" snippet "incomplete octal number", "0o"
snippet "incomplete hex number", "0x" snippet "incomplete hex number", "0x"
snippet "incomplete escaped list", "%w[\\"
end end

6
yarp/yarp.c
View File

@ -6952,6 +6952,12 @@ parser_lex(yp_parser_t *parser) {
// literally. In this case we'll skip past the next character // literally. In this case we'll skip past the next character
// and find the next breakpoint. // and find the next breakpoint.
if (*breakpoint == '\\') { if (*breakpoint == '\\') {
// Check that we're not at the end of the file.
if (breakpoint + 1 >= parser->end) {
breakpoint = NULL;
continue;
}
yp_unescape_type_t unescape_type = lex_mode->as.list.interpolation ? YP_UNESCAPE_ALL : YP_UNESCAPE_MINIMAL; yp_unescape_type_t unescape_type = lex_mode->as.list.interpolation ? YP_UNESCAPE_ALL : YP_UNESCAPE_MINIMAL;
size_t difference = yp_unescape_calculate_difference(parser, breakpoint, unescape_type, false); size_t difference = yp_unescape_calculate_difference(parser, breakpoint, unescape_type, false);