[src/trunk]: src/usr.bin/xlint/lint1 lint: fix endless loop when scanning str...

[rillig <rillig%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/f59c06070695
branches:  trunk
changeset: 379778:f59c06070695
user:      rillig <rillig%NetBSD.org@localhost>
date:      Sat Jun 19 08:57:24 2021 +0000

description:
lint: fix endless loop when scanning string or character literals

If the code contains an unfinished string or character literal at the
EOF, the lexer got into an endless loop.  Curiously, inpc() returned 0
in such a case instead of the common EOF.

Found by making lint1 with CC=afl-gcc and then running:

afl-fuzz \
    -m 200 \
    -i in_dir \
    -o lint1 \
    $src/usr.bin/xlint/lint1/lint1 @@ /dev/null

diffstat:

 usr.bin/xlint/lint1/lex.c |  8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diffs (29 lines):

diff -r 28bd9a69604a -r f59c06070695 usr.bin/xlint/lint1/lex.c
--- a/usr.bin/xlint/lint1/lex.c Sat Jun 19 08:37:18 2021 +0000
+++ b/usr.bin/xlint/lint1/lex.c Sat Jun 19 08:57:24 2021 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: lex.c,v 1.39 2021/06/19 08:37:18 rillig Exp $ */
+/* $NetBSD: lex.c,v 1.40 2021/06/19 08:57:24 rillig Exp $ */
 
 /*
  * Copyright (c) 1996 Christopher G. Demetriou.  All Rights Reserved.
@@ -38,7 +38,7 @@
 
 #include <sys/cdefs.h>
 #if defined(__RCSID) && !defined(lint)
-__RCSID("$NetBSD: lex.c,v 1.39 2021/06/19 08:37:18 rillig Exp $");
+__RCSID("$NetBSD: lex.c,v 1.40 2021/06/19 08:57:24 rillig Exp $");
 #endif
 
 #include <ctype.h>
@@ -932,6 +932,10 @@ get_escaped_char(int delim)
                        return -2;
                }
                return c;
+       case 0:
+               /* syntax error '%s' */
+               error(249, "EOF or null byte in literal");
+               return -2;
        case EOF:
                return -2;
        case '\\':