Buffer overrun in Lexer with string literal longer than 4096 characters #316

andreasabel · 2020-11-07T00:39:35Z

The generated lexer uses a fixed buffer that can overrun when lexing a long string literal:

bnfc/source/src/BNFC/Backend/C/CFtoFlexC.hs

Lines 86 to 89 in fb85ff1

    
           "void YY_BUFFER_APPEND(char *s)", 
        
           "{", 
        
           "  strcat(YY_PARSED_STRING, s); /* Do something better here! */", 
        
           "}",

(The authors were probably aware of the problem but did not care to fix it.)
Currently the length is fixed to 4096 characters, a longer string (5000 characters) overruns the buffer, leading e.g. to a crash (C) or a parse failure (C++).
This affects the C and C++ backends.

This bug surface when setting the buffer size to 2048 (previously it was 2000 and going one byte over went unnoticed). We need to maintain cur_ < buf_size (not just cur_ <= buf_size).

andreasabel added bug C++ C lexer Concerning the generated lexer labels Nov 7, 2020

andreasabel added this to the 2.9 milestone Nov 7, 2020

andreasabel closed this as completed in 926c493 Nov 20, 2020

andreasabel self-assigned this Nov 20, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Buffer overrun in Lexer with string literal longer than 4096 characters #316

Buffer overrun in Lexer with string literal longer than 4096 characters #316

Buffer overrun in Lexer with string literal longer than 4096 characters #316

Buffer overrun in Lexer with string literal longer than 4096 characters #316

Comments