[src/trunk]: src/usr.bin/xlint/lint1 lint: fix endless loop when scanning str...

[rillig <rillig%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/e66cab3eb0c3
branches:  trunk
changeset: 984030:e66cab3eb0c3
user:      rillig <rillig%NetBSD.org@localhost>
date:      Sat Jun 19 08:57:24 2021 +0000

description:
lint: fix endless loop when scanning string or character literals

If the code contains an unfinished string or character literal at the
EOF, the lexer got into an endless loop.  Curiously, inpc() returned 0
in such a case instead of the common EOF.

Found by making lint1 with CC=afl-gcc and then running:

afl-fuzz \
    -m 200 \
    -i in_dir \
    -o lint1 \
    $src/usr.bin/xlint/lint1/lint1 @@ /dev/null

diffstat:

 usr.bin/xlint/lint1/lex.c |  8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diffs (29 lines):

diff -r 7282947f9e79 -r e66cab3eb0c3 usr.bin/xlint/lint1/lex.c
--- a/usr.bin/xlint/lint1/lex.c Sat Jun 19 08:37:18 2021 +0000
+++ b/usr.bin/xlint/lint1/lex.c Sat Jun 19 08:57:24 2021 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: lex.c,v 1.39 2021/06/19 08:37:18 rillig Exp $ */
+/* $NetBSD: lex.c,v 1.40 2021/06/19 08:57:24 rillig Exp $ */
 
 /*
  * Copyright (c) 1996 Christopher G. Demetriou.  All Rights Reserved.
@@ -38,7 +38,7 @@
 
 #include <sys/cdefs.h>
 #if defined(__RCSID) && !defined(lint)
-__RCSID("$NetBSD: lex.c,v 1.39 2021/06/19 08:37:18 rillig Exp $");
+__RCSID("$NetBSD: lex.c,v 1.40 2021/06/19 08:57:24 rillig Exp $");
 #endif
 
 #include <ctype.h>
@@ -932,6 +932,10 @@
                        return -2;
                }
                return c;
+       case 0:
+               /* syntax error '%s' */
+               error(249, "EOF or null byte in literal");
+               return -2;
        case EOF:
                return -2;
        case '\\':