Skip to content

fix out-of-bounds read in antlr3UTF8LA backward traversal#236

Open
zayeem06 wants to merge 1 commit into
antlr:masterfrom
zayeem06:utf8-la-backward-bounds
Open

fix out-of-bounds read in antlr3UTF8LA backward traversal#236
zayeem06 wants to merge 1 commit into
antlr:masterfrom
zayeem06:utf8-la-backward-bounds

Conversation

@zayeem06

Copy link
Copy Markdown

antlr3UTF8LA walks backwards over UTF-8 continuation bytes to find the start of a code point when asked for a negative lookahead, but the inner skip loop had no lower bound. On input that begins with continuation bytes (malformed UTF-8), a consume followed by LA(-1) steps the pointer before input->data and reads input->data[-1], a heap buffer under-read that AddressSanitizer flags at the skip loop. Bounded the scan with nextChar > input->data so it stops at the start of the buffer; well-formed input is unaffected because the first byte of the buffer is never a continuation byte.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant