Skip to content

Fix address-sanitizer error when parsing literal strings having invalid UTF-8 characters #208

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Feb 11, 2023
Merged

Fix address-sanitizer error when parsing literal strings having invalid UTF-8 characters #208

merged 2 commits into from
Feb 11, 2023

Conversation

cxw42
Copy link
Contributor

@cxw42 cxw42 commented Jan 14, 2023

The inner iterator in parse_ml_literal_string() and parse_literal_string() was being reset to an iterator into a different region of memory. Fix that by using the same iterator initialization as is used in the parse*_basic_string().

Fixes #199.

Demonstration of the fix:
poc2.zip

$ unzip poc2.zip
$ g++ -fsanitize=address -g -o issue199 issue199.cpp && ./issue199 poc.toml ; echo $?
[error] parse_ml_basic_string: invalid utf8 sequence found
 --> poc.toml
   |
 1 | str3 = 'C:\highway\to\�he\danger\zone'
   |                       ^--- here
1

cxw42 added 2 commits January 14, 2023 18:32
@cxw42
fix: parse_literal_string() properly issues invalid-utf8 errors
e3639d2 
When creating the inner iterator, make sure it points into the same
vector as the outer iterator.  Otherwise, attempts to reset the iterator
wind up causing it to read out-of-bounds.

Fixes ToruNiina#199.
@cxw42
fix: parse_ml_literal_string() properly issues invalid-utf8 errors
a2f884b 
Fix the same out-of-bounds read as in parse_literal_string().
@cxw42 cxw42 mentioned this pull request Jan 14, 2023
Closed
@ToruNiina ToruNiina merged commit 75daa2d into ToruNiina:master Feb 11, 2023
@ToruNiina
Copy link
Owner

LGTM. Thank you!

@cxw42 cxw42 deleted the issue199-nonutf-string branch April 10, 2023 01:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Heap buffer overflow (out-of-bounds read) in toml::detail::location::reset()
2 participants
@cxw42 @ToruNiina