carbon-language/carbon-lang
1
0
Fork 0
mirror of https://github.com/carbon-language/carbon-lang.git synced 2026-10-05 11:21:05 +01:00
Code Issues Packages Projects Releases 10 Wiki Activity

Fix an out-of-bounds read in TokenizedBuffer::IsRawIdentifier. (#7434)

Browse Source 
`IsRawIdentifier` checked `token_text.starts_with("r#")` and then read
`token_text[2]`, but `starts_with` only guarantees a length of two. An
`r` identifier immediately followed by `#` at the end of the source --
so the token text is exactly `r#` -- made the `token_text[2]` read run
off the end. Guard on the length first.

Found by fuzzing. The read is reached only via `GetTokenText`, so the
parser fuzzer, which does not request token text, never hit it.

Assisted-by: Claude Code
This commit is contained in:
Chandler Carruth
2026-06-29 20:06:39 +00:00
committed by GitHub
parent 7a7aefe486
commit fd62f5a58d
2 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
toolchain/lex/tokenized_buffer.cpp
+1 -1
View File
@@ -192,7 +192,7 @@ auto TokenizedBuffer::IsRawIdentifier(TokenIndex token) const -> bool {
// starting with `#`. It suffices to check that character is the first
// character of the identifier.
auto token_text = source_->text().substr(token_info.byte_offset());
return token_text.starts_with("r#") &&
return token_text.size() > 2 && token_text.starts_with("r#") &&
token_text[2] ==
value_stores_->identifiers().Get(token_info.ident_id()).front();
}