Skip to content

fix oob read in UTF-16 byte-swap LA from wrong nextChar pointer type - #237

Open
zayeem06 wants to merge 1 commit into
antlr:masterfrom
zayeem06:utf16-swap-la-pointer-type
Open

fix oob read in UTF-16 byte-swap LA from wrong nextChar pointer type#237
zayeem06 wants to merge 1 commit into
antlr:masterfrom
zayeem06:utf16-swap-la-pointer-type

Conversation

@zayeem06

Copy link
Copy Markdown

antlr3UTF16LALE and antlr3UTF16LABE declare their scan pointer nextChar as pANTLR3_UCHAR, which is a UINT32*, but the code assembles each character a byte at a time and steps with nextChar += 2, so every access reads four bytes and strides in four-byte units. A well-formed UTF-16 source whose byte order is opposite to the host (for example a UTF-16BE file on a little-endian build, which selects these byte-swap routines) then reads past the end of the input buffer and hands back wrong code points; ASAN reports a heap over-read at the character fetch. Declaring nextChar as pANTLR3_UINT8 makes the byte arithmetic match the reads.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant