[llvm-branch-commits] [cfe-branch] r322649 - Merging r322390:

[Hans Wennborg via llvm-branch-commits]

Author: hans
Date: Wed Jan 17 05:24:15 2018
New Revision: 322649

URL: http://llvm.org/viewvc/llvm-project?rev=322649&view=rev
Log:
Merging r322390:
------------------------------------------------------------------------
r322390 | vsapsai | 2018-01-12 10:54:35 -0800 (Fri, 12 Jan 2018) | 20 lines

[Lex] Avoid out-of-bounds dereference in LexAngledStringLiteral.

Fix makes the loop in LexAngledStringLiteral more like the loops in
LexStringLiteral, LexCharConstant. When we skip a character after
backslash, we need to check if we reached the end of the file instead of
reading the next character unconditionally.

Discovered by OSS-Fuzz:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3832

rdar://problem/35572754

Reviewers: arphaman, kcc, rsmith, dexonsmith

Reviewed By: rsmith, dexonsmith

Subscribers: cfe-commits, rsmith, dexonsmith

Differential Revision: https://reviews.llvm.org/D41423

------------------------------------------------------------------------

Added:
    cfe/branches/release_60/test/Lexer/null-character-in-literal.c
      - copied unchanged from r322390, cfe/trunk/test/Lexer/null-character-in-literal.c
Modified:
    cfe/branches/release_60/   (props changed)
    cfe/branches/release_60/lib/Lex/Lexer.cpp
    cfe/branches/release_60/unittests/Lex/LexerTest.cpp

Propchange: cfe/branches/release_60/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Wed Jan 17 05:24:15 2018
@@ -1,4 +1,4 @@
 /cfe/branches/type-system-rewrite:134693-134817
-/cfe/trunk:321754,321771,321933,322018,322236,322350,322405,322420,322518,322593
+/cfe/trunk:321754,321771,321933,322018,322236,322350,322390,322405,322420,322518,322593
 /cfe/trunk/test:170344
 /cfe/trunk/test/SemaTemplate:126920

Modified: cfe/branches/release_60/lib/Lex/Lexer.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/branches/release_60/lib/Lex/Lexer.cpp?rev=322649&r1=322648&r2=322649&view=diff
==============================================================================
--- cfe/branches/release_60/lib/Lex/Lexer.cpp (original)
+++ cfe/branches/release_60/lib/Lex/Lexer.cpp Wed Jan 17 05:24:15 2018
@@ -2009,18 +2009,21 @@ bool Lexer::LexAngledStringLiteral(Token
   const char *AfterLessPos = CurPtr;
   char C = getAndAdvanceChar(CurPtr, Result);
   while (C != '>') {
-    // Skip escaped characters.
-    if (C == '\\' && CurPtr < BufferEnd) {
-      // Skip the escaped character.
-      getAndAdvanceChar(CurPtr, Result);
-    } else if (C == '\n' || C == '\r' ||             // Newline.
-               (C == 0 && (CurPtr-1 == BufferEnd ||  // End of file.
-                           isCodeCompletionPoint(CurPtr-1)))) {
+    // Skip escaped characters.  Escaped newlines will already be processed by
+    // getAndAdvanceChar.
+    if (C == '\\')
+      C = getAndAdvanceChar(CurPtr, Result);
+
+    if (C == '\n' || C == '\r' ||             // Newline.
+        (C == 0 && (CurPtr-1 == BufferEnd ||  // End of file.
+                    isCodeCompletionPoint(CurPtr-1)))) {
       // If the filename is unterminated, then it must just be a lone <
       // character.  Return this as such.
       FormTokenWithChars(Result, AfterLessPos, tok::less);
       return true;
-    } else if (C == 0) {
+    }
+
+    if (C == 0) {
       NulCharacter = CurPtr-1;
     }
     C = getAndAdvanceChar(CurPtr, Result);

Modified: cfe/branches/release_60/unittests/Lex/LexerTest.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/branches/release_60/unittests/Lex/LexerTest.cpp?rev=322649&r1=322648&r2=322649&view=diff
==============================================================================
--- cfe/branches/release_60/unittests/Lex/LexerTest.cpp (original)
+++ cfe/branches/release_60/unittests/Lex/LexerTest.cpp Wed Jan 17 05:24:15 2018
@@ -476,6 +476,8 @@ TEST_F(LexerTest, GetBeginningOfTokenWit
 TEST_F(LexerTest, AvoidPastEndOfStringDereference) {
   std::vector<Token> LexedTokens = Lex("  //  \\\n");
   EXPECT_TRUE(LexedTokens.empty());
+  EXPECT_TRUE(Lex("#include <\\\\").empty());
+  EXPECT_TRUE(Lex("#include <\\\\\n").empty());
 }
 
 TEST_F(LexerTest, StringizingRasString) {