Skip to content

Commit 2eca43c

Browse files
committed
Fix critical oversight in lexer buffer refilling
Since the lexer buffer wraps, the refilling gets handled in two steps: First, iff the buffer would wrap, the buffer is refilled until its end. Then, if more characters are requested, that amount is refilled too. An important detail is that `read()` may not return as many characters as requested; for this reason, the first step checks if its `read()` was "full", and skips the second step otherwise. This is also where a bug lied. After a *lot* of trying, I eventually managed to reproduce the bug on an OpenBSD VM, and after adding a couple of `assert`s in `peekInternal`, this is what happened, starting at line 724: 0. `lexerState->nbChars` is 0, `lexerState->index` is 19; 1. We end up with `target` = 42, and `writeIndex` = 19; 2. 42 + 19 is greater than `LEXER_BUF_SIZE` (= 42), so the `if` is entered; 3. Within the first `readChars`, **`read` only returns 16 bytes**, advancing `writeIndex` to 35 and `target` to 26; 4. Within the second `readChars`, a `read(26)` is issued, overflowing the buffer. The bug should be clear now: **the check at line 750 failed to work!** Why? Because `readChars` modifies `writeIndex`. The fix is simply to cache the number of characters expected, and use that.
1 parent c246942 commit 2eca43c

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

src/asm/lexer.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -729,6 +729,8 @@ static int peekInternal(uint8_t distance)
729729
ssize_t nbCharsRead = 0, totalCharsRead = 0;
730730

731731
#define readChars(size) do { \
732+
/* This buffer overflow made me lose WEEKS of my life. Never again. */ \
733+
assert(writeIndex + (size) <= LEXER_BUF_SIZE); \
732734
nbCharsRead = read(lexerState->fd, &lexerState->buf[writeIndex], (size)); \
733735
if (nbCharsRead == -1) \
734736
fatalerror("Error while reading \"%s\": %s\n", lexerState->path, errno); \
@@ -741,9 +743,11 @@ static int peekInternal(uint8_t distance)
741743

742744
/* If the range to fill passes over the buffer wrapping point, we need two reads */
743745
if (writeIndex + target > LEXER_BUF_SIZE) {
744-
readChars(LEXER_BUF_SIZE - writeIndex);
746+
size_t nbExpectedChars = LEXER_BUF_SIZE - writeIndex;
747+
748+
readChars(nbExpectedChars);
745749
/* If the read was incomplete, don't perform a second read */
746-
if (nbCharsRead < LEXER_BUF_SIZE - writeIndex)
750+
if (nbCharsRead < nbExpectedChars)
747751
target = 0;
748752
}
749753
if (target != 0)

0 commit comments

Comments
 (0)