From ae7f9075592ea3570dfba831d086c423301fbcb7 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike.dalessio@gmail.com>
Date: Wed, 30 Aug 2023 13:52:03 -0400
Subject: [PATCH] [ruby/yarp] fix: heredoc with incomplete escape at end of
 file

Previously this resulted in invalid memory access.

Found by the fuzzer.

https://github.com/ruby/yarp/commit/ec4abd87f4
---
 test/yarp/fuzzer_test.rb | 1 +
 yarp/yarp.c              | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/test/yarp/fuzzer_test.rb b/test/yarp/fuzzer_test.rb
index 2d851ff886..6dfbf94f39 100644
--- a/test/yarp/fuzzer_test.rb
+++ b/test/yarp/fuzzer_test.rb
@@ -23,4 +23,5 @@ class FuzzerTest < Test::Unit::TestCase
   snippet "incomplete hex number", "0x"
   snippet "incomplete escaped list", "%w[\\"
   snippet "incomplete escaped regex", "/a\\"
+  snippet "unterminated heredoc with unterminated escape at end of file", "<<A\n\\"
 end
diff --git a/yarp/yarp.c b/yarp/yarp.c
index 3fa143f31e..37d55cd467 100644
--- a/yarp/yarp.c
+++ b/yarp/yarp.c
@@ -7413,6 +7413,12 @@ parser_lex(yp_parser_t *parser) {
                         break;
                     }
                     case '\\': {
+                        // Check that we're not at the end of the file.
+                        if (breakpoint + 1 >= parser->end) {
+                            breakpoint = NULL;
+                            break;
+                        }
+
                         // If we hit an escape, then we need to skip past
                         // however many characters the escape takes up. However
                         // it's important that if \n or \r\n are escaped that we