From c4603ba5ce229db83a2a4fb93e6d4b4e3ec3776a Mon Sep 17 00:00:00 2001 From: Ulya Trofimovich Date: Fri, 17 Apr 2020 22:47:14 +0100 Subject: [PATCH] Fix crash in lexer refill (reported by Agostino Sarubbo). The crash happened in a rare case of a very long lexeme that doen't fit into the buffer, forcing buffer reallocation. The crash was caused by an incorrect calculation of the shift offset (it was smaller than necessary). As a consequence, the data from buffer start and up to the beginning of the current lexeme was not discarded (as it should have been), resulting in less free space for new data than expected. --- src/parse/scanner.cc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/parse/scanner.cc b/src/parse/scanner.cc index 1d6e9efa..bd651314 100644 --- a/src/parse/scanner.cc +++ b/src/parse/scanner.cc @@ -155,13 +155,14 @@ bool Scanner::fill(size_t need) if (!buf) fatal("out of memory"); memmove(buf, tok, copy); - shift_ptrs_and_fpos(buf - bot); + shift_ptrs_and_fpos(buf - tok); delete [] bot; bot = buf; free = BSIZE - copy; } + DASSERT(lim + free <= bot + BSIZE); if (!read(free)) { eof = lim; memset(lim, 0, YYMAXFILL);