Re: Heap-buffer-overflow in read_token_word() when read element with -1 index

[Martin D Kealey]

Hi Александр

On Thu, 24 Apr 2025 at 03:30, Александр Ушаков <ausha...@astralinux.ru>
wrote:

> #define current_delimiter(ds) \
>   (ds.delimiter_depth && !(ds.delimiter_depth - 1 < 0) ?
> ds.delimiters[ds.delimiter_depth - 1] : 0)


This seems unnecessarily complex; why not simply

#define current_delimiter(ds) (ds.delimiter_depth > 0 ?
> ds.delimiters[ds.delimiter_depth - 1] : 0)


However this would seem to be looking in the wrong place.

ds.delimiter_depth should never be negative; so I would focus on tracking
down how it gets that way, and in particular why pop_delimiter() might get
called too often.

In the meantime I would put a guard in it to stop it underflowing:

#define pop_delimiter(D) pop_delimiter_checked (&(D))
static inline void
pop_delimiter_checked (struct dstack *ds)
{
  assert (ds->delimiter_depth > 0);
  ds->delimiter_depth--;
}

-Martin