Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix use of uninitialized value when parsing regexp #3227

Merged
merged 1 commit into from
Nov 12, 2024

Conversation

peterzhu2118
Copy link
Member

Parsing the regexp /\A{/ causes uses an uninitialized value because it tries to parse it as a range quantifier, so it reads the character after the closing curly bracket. This is using uninitialized values because prism strings are not null terminated. This can be seen in the Valgrind output:

==834710== Conditional jump or move depends on uninitialised value(s)
==834710==    at 0x5DA010: pm_regexp_parse_range_quantifier (regexp.c:163)
==834710==    by 0x5DA010: pm_regexp_parse_quantifier (regexp.c:243)
==834710==    by 0x5DAD69: pm_regexp_parse_expression (regexp.c:738)
==834710==    by 0x5DAD69: pm_regexp_parse_pattern (regexp.c:761)
==834710==    by 0x5DAD69: pm_regexp_parse (regexp.c:773)
==834710==    by 0x5A2EE7: parse_regular_expression_named_captures (prism.c:20886)
==834710==    by 0x5A2EE7: parse_expression_infix (prism.c:21388)
==834710==    by 0x5A5FA5: parse_expression (prism.c:21804)
==834710==    by 0x5A64F3: parse_statements (prism.c:13858)
==834710==    by 0x5A9730: parse_program (prism.c:22011)
==834710==    by 0x576F0D: parse_input_success_p (extension.c:1062)
==834710==    by 0x576F0D: parse_success_p (extension.c:1084)

This commit adds checks for the end of the string to pm_regexp_parse_range_quantifier.

Parsing the regexp /\A{/ causes uses an uninitialized value because it
tries to parse it as a range quantifier, so it reads the character after
the closing curly bracket. This is using uninitialized values because
prism strings are not null terminated. This can be seen in the Valgrind
output:

    ==834710== Conditional jump or move depends on uninitialised value(s)
    ==834710==    at 0x5DA010: pm_regexp_parse_range_quantifier (regexp.c:163)
    ==834710==    by 0x5DA010: pm_regexp_parse_quantifier (regexp.c:243)
    ==834710==    by 0x5DAD69: pm_regexp_parse_expression (regexp.c:738)
    ==834710==    by 0x5DAD69: pm_regexp_parse_pattern (regexp.c:761)
    ==834710==    by 0x5DAD69: pm_regexp_parse (regexp.c:773)
    ==834710==    by 0x5A2EE7: parse_regular_expression_named_captures (prism.c:20886)
    ==834710==    by 0x5A2EE7: parse_expression_infix (prism.c:21388)
    ==834710==    by 0x5A5FA5: parse_expression (prism.c:21804)
    ==834710==    by 0x5A64F3: parse_statements (prism.c:13858)
    ==834710==    by 0x5A9730: parse_program (prism.c:22011)
    ==834710==    by 0x576F0D: parse_input_success_p (extension.c:1062)
    ==834710==    by 0x576F0D: parse_success_p (extension.c:1084)

This commit adds checks for the end of the string to
pm_regexp_parse_range_quantifier.
@eileencodes eileencodes merged commit e4ec598 into main Nov 12, 2024
56 checks passed
@eileencodes eileencodes deleted the pz-regexp-uninit-val branch November 12, 2024 14:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants