-
Notifications
You must be signed in to change notification settings - Fork 172
Closed
Labels
Milestone
Description
The generated lexer uses a fixed buffer that can overrun when lexing a long string literal:
bnfc/source/src/BNFC/Backend/C/CFtoFlexC.hs
Lines 86 to 89 in fb85ff1
"void YY_BUFFER_APPEND(char *s)", | |
"{", | |
" strcat(YY_PARSED_STRING, s); /* Do something better here! */", | |
"}", |
(The authors were probably aware of the problem but did not care to fix it.)
Currently the length is fixed to 4096 characters, a longer string (5000 characters) overruns the buffer, leading e.g. to a crash (C) or a parse failure (C++).
This affects the C and C++ backends.