From 97334b06e36b62e8f2078e35da0ab4b1d3cafc15 Mon Sep 17 00:00:00 2001
From: Oldes <oldes.huhuman@gmail.com>
Date: Fri, 28 Jun 2019 21:53:48 +0200
Subject: [PATCH] FIX: in rare cases scanner was making *null holes* in
 strings, when the internal buffer was extended.

The original R3-alpha version was not affected, but there was a AddressSanitizer error report, which Atronix fixed in this commit: https://github.com/zsx/r3/commit/3d7484cc74fee6538172d375efedb18f6a27f123

Atronix fixed this issue later in this commit: https://github.com/zsx/r3/commit/2e56b0c295d8ba8752ae4918e64a8b61397e0a1b

Which I have not noticed.

In my commit I included this fix also in Scan_Item function.
---
 src/core/l-scan.c             | 14 ++++++++------
 src/tests/units/lexer-test.r3 | 27 +++++++++++++++++++++++++++
 2 files changed, 35 insertions(+), 6 deletions(-)

diff --git a/src/core/l-scan.c b/src/core/l-scan.c
index d4947a5a6f..e22dbbfbaa 100644
--- a/src/core/l-scan.c
+++ b/src/core/l-scan.c
@@ -457,11 +457,11 @@
 
 		src++;
 
-		*UNI_SKIP(buf, buf->tail) = chr;
-
-		if (SERIES_LEN(buf) >= SERIES_REST(buf)) Extend_Series(buf, 1);
+		if (SERIES_FULL(buf))
+			Extend_Series(buf, 1);
 
-		buf->tail ++;
+		*UNI_SKIP(buf, buf->tail) = chr;
+		buf->tail++;
     }
 
 	src++; // Skip ending quote or brace.
@@ -532,9 +532,11 @@
 
 		src++;
 
-		*UNI_SKIP(buf, buf->tail) = c; // not affected by Extend_Series
+		if (SERIES_FULL(buf))
+			Extend_Series(buf, 1);
 
-		if (++(buf->tail) >= SERIES_REST(buf)) Extend_Series(buf, 1);
+		*UNI_SKIP(buf, buf->tail) = c;
+		buf->tail++;
     }
 
 	if (*src && *src == term) src++;
diff --git a/src/tests/units/lexer-test.r3 b/src/tests/units/lexer-test.r3
index a730ad50fe..9c817a466d 100644
--- a/src/tests/units/lexer-test.r3
+++ b/src/tests/units/lexer-test.r3
@@ -26,4 +26,31 @@ Rebol [
 
 ===end-group===
 
+
+===start-group=== "Special tests"
+
+	--test-- "NULLs inside loaded string"
+	;@@ https://github.com/Oldes/Rebol3/commit/6f59240d7d4379a50fec29c4e74290ad61ba73ba
+		out: ""
+		--assert not error? try [
+		;- using CALL as it could be reproduced only when the internal buffer is being extended durring load
+			data: make string! 40000
+			insert/dup data "ABCD" 10000
+
+			dir: join system/options/path %r3/src/tests/units/files/
+
+			save dir/tmp.data reduce [1 data]
+			exe: rejoin [system/options/home last split-path system/options/boot]
+
+			;@@ CALL seems not to work same on all OSes :-(
+			either system/version/4 = 3 [
+				call/wait/output probe rejoin [to-local-file exe { -s } to-local-file dir/bug-load-null.r3] out
+			][	call/wait/output probe reduce [exe dir/bug-load-null.r3] out ]
+
+			probe out
+		]
+		--assert out = "Test OK"
+		error? try [ delete dir/tmp.data ]
+
+===end-group===
 ~~~end-file~~~
\ No newline at end of file