[src/trunk]: src/usr.bin/xlint/lint1 lint: fix endless loop when scanning str...

[rillig <rillig%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/d845fea76ab8
branches:  trunk
changeset: 1021809:d845fea76ab8
user:      rillig <rillig%NetBSD.org@localhost>
date:      Sat Jun 19 08:57:24 2021 +0000

description:
lint: fix endless loop when scanning string or character literals

If the code contains an unfinished string or character literal at the
EOF, the lexer got into an endless loop.  Curiously, inpc() returned 0
in such a case instead of the common EOF.

Found by making lint1 with CC=afl-gcc and then running:

afl-fuzz \
    -m 200 \
    -i in_dir \
    -o lint1 \
    $src/usr.bin/xlint/lint1/lint1 @@ /dev/null

diffstat:

 usr.bin/xlint/lint1/lex.c |  8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diffs (29 lines):

diff -r ba1453bd06d5 -r d845fea76ab8 usr.bin/xlint/lint1/lex.c
--- a/usr.bin/xlint/lint1/lex.c Sat Jun 19 08:37:18 2021 +0000
+++ b/usr.bin/xlint/lint1/lex.c Sat Jun 19 08:57:24 2021 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: lex.c,v 1.39 2021/06/19 08:37:18 rillig Exp $ */
+/* $NetBSD: lex.c,v 1.40 2021/06/19 08:57:24 rillig Exp $ */
 
 /*
  * Copyright (c) 1996 Christopher G. Demetriou.  All Rights Reserved.
@@ -38,7 +38,7 @@
 
 #include <sys/cdefs.h>
 #if defined(__RCSID) && !defined(lint)
-__RCSID("$NetBSD: lex.c,v 1.39 2021/06/19 08:37:18 rillig Exp $");
+__RCSID("$NetBSD: lex.c,v 1.40 2021/06/19 08:57:24 rillig Exp $");
 #endif
 
 #include <ctype.h>
@@ -932,6 +932,10 @@
                        return -2;
                }
                return c;
+       case 0:
+               /* syntax error '%s' */
+               error(249, "EOF or null byte in literal");
+               return -2;
        case EOF:
                return -2;
        case '\\':