Skip to content

Commit

Permalink
Check for the invalid binary! literals
Browse files Browse the repository at this point in the history
This fixes the crash caused by:
>> #{a}

END marker or garbage/trash in VAL_TYPE()
REBVAL init on tick #28232 at /home/zsx/r3-dev/src/core/l-types.c:1028
Kind=50
Containing series for value pointer found, panicking it:
managed series was likely created during evaluator tick: 28232
=================================================================
==4319==ERROR: AddressSanitizer: heap-use-after-free on address 0x6020000b27d0 at pc 0x0000004f9f47 bp 0x7fffffffcde0 sp 0x7fffffffcdd0
READ of size 4 at 0x6020000b27d0 thread T0
    #0 0x4f9f46 in Panic_Series_Debug /home/zsx/r3-dev/src/core/m-series.c:512
    #1 0x47d073 in Panic_Value_Debug /home/zsx/r3-dev/src/core/c-value.c:81
    #2 0x481e85 in Panic_Core /home/zsx/r3-dev/src/core/d-crash.c:220
    #3 0x432a3c in VAL_TYPE_Debug /home/zsx/r3-dev/make/../src/include/sys-value.h:165
    #4 0x4349fc in Bind_Values_Inner_Loop /home/zsx/r3-dev/src/core/c-bind.c:54
    #5 0x434dff in Bind_Values_Core /home/zsx/r3-dev/src/core/c-bind.c:141
    #6 0x4077bc in Do_String /home/zsx/r3-dev/src/os/host-main.c:323
    #7 0x408799 in Host_Repl /home/zsx/r3-dev/src/os/host-main.c:569
    #8 0x40a228 in main /home/zsx/r3-dev/src/os/host-main.c:1078
    #9 0x7ffff65b2290 in __libc_start_main (/usr/lib/libc.so.6+0x20290)
    #10 0x404009 in _start (/home/zsx/stuffs/work/r3-build/MakeFiles/Debug/r3-core+0x404009)

0x6020000b27d0 is located 0 bytes inside of 4-byte region [0x6020000b27d0,0x6020000b27d4)
freed by thread T0 here:
    #0 0x7ffff6efeb00 in __interceptor_free /build/gcc-multilib/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:45
    #1 0x4f2622 in Make_Series /home/zsx/r3-dev/src/core/m-pools.c:894
    #2 0x4a255b in Make_Array /home/zsx/r3-dev/make/../src/include/sys-array.h:213
    #3 0x4a3371 in Copy_Values_Len_Extra_Skip_Shallow /home/zsx/r3-dev/src/core/f-blocks.c:144
    #4 0x4dc5c5 in Scan_Array /home/zsx/r3-dev/src/core/l-scan.c:1852
    #5 0x4dcad5 in Scan_UTF8_Managed /home/zsx/r3-dev/src/core/l-scan.c:1936
    #6 0x40772b in Do_String /home/zsx/r3-dev/src/os/host-main.c:304
    #7 0x408799 in Host_Repl /home/zsx/r3-dev/src/os/host-main.c:569
    #8 0x40a228 in main /home/zsx/r3-dev/src/os/host-main.c:1078
    #9 0x7ffff65b2290 in __libc_start_main (/usr/lib/libc.so.6+0x20290)

previously allocated by thread T0 here:
    #0 0x7ffff6efee60 in __interceptor_malloc /build/gcc-multilib/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:62
    #1 0x4f25e2 in Make_Series /home/zsx/r3-dev/src/core/m-pools.c:893
    #2 0x4a255b in Make_Array /home/zsx/r3-dev/make/../src/include/sys-array.h:213
    #3 0x4a3371 in Copy_Values_Len_Extra_Skip_Shallow /home/zsx/r3-dev/src/core/f-blocks.c:144
    #4 0x4dc5c5 in Scan_Array /home/zsx/r3-dev/src/core/l-scan.c:1852
    #5 0x4dcad5 in Scan_UTF8_Managed /home/zsx/r3-dev/src/core/l-scan.c:1936
    #6 0x40772b in Do_String /home/zsx/r3-dev/src/os/host-main.c:304
    #7 0x408799 in Host_Repl /home/zsx/r3-dev/src/os/host-main.c:569
    #8 0x40a228 in main /home/zsx/r3-dev/src/os/host-main.c:1078
    #9 0x7ffff65b2290 in __libc_start_main (/usr/lib/libc.so.6+0x20290)

and turns it to:

>> #{a}
** Syntax error: invalid "binary" -- "#{a}"
** Near: (line 1) #{a}
  • Loading branch information
zsx committed Jan 13, 2017
1 parent f745cf9 commit de895f7
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion src/core/l-scan.c
Original file line number Diff line number Diff line change
Expand Up @@ -1647,7 +1647,9 @@ static REBARR *Scan_Array(
break;

case TOKEN_BINARY:
Scan_Binary(value, bp, len);
if (!Scan_Binary(value, bp, len)) {
goto syntax_error;
}
break;

case TOKEN_PAIR:
Expand Down

0 comments on commit de895f7

Please sign in to comment.