{"action":"created","issue":{"url":"https://api.github.com/repos/orangeduck/mpc/issues/20","labels_url":"https://api.github.com/repos/orangeduck/mpc/issues/20/labels{/name}","comments_url":"https://api.github.com/repos/orangeduck/mpc/issues/20/comments","events_url":"https://api.github.com/repos/orangeduck/mpc/issues/20/events","html_url":"https://github.com/orangeduck/mpc/issues/20","id":56242918,"number":20,"title":"Clang address sanitizer detects buffer overflow when mpc_err_print is used","user":{"login":"swhalen","id":108744,"avatar_url":"https://avatars.githubusercontent.com/u/108744?v=3","gravatar_id":"","url":"https://api.github.com/users/swhalen","html_url":"https://github.com/swhalen","followers_url":"https://api.github.com/users/swhalen/followers","following_url":"https://api.github.com/users/swhalen/following{/other_user}","gists_url":"https://api.github.com/users/swhalen/gists{/gist_id}","starred_url":"https://api.github.com/users/swhalen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/swhalen/subscriptions","organizations_url":"https://api.github.com/users/swhalen/orgs","repos_url":"https://api.github.com/users/swhalen/repos","events_url":"https://api.github.com/users/swhalen/events{/privacy}","received_events_url":"https://api.github.com/users/swhalen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-02-02T14:28:50Z","updated_at":"2015-02-08T10:45:49Z","closed_at":null,"body":"Hello,\r\n\r\nWhile playing with the code from your book _Build Your Own Lisp_ (which is great, by the way!), using Clang's address sanitizer, I noticed that a buffer overflow was detected upon use of `mpc_err_print`. Consider the following MWE:\r\n\r\n```\r\n#include \"mpc.h\"\r\n\r\nint main(int argc, char** argv) {\r\n    mpc_parser_t* Foobar = mpc_new(\"foobar\");\r\n    mpca_lang(MPCA_LANG_DEFAULT, \"foobar : \\\"foo\\\" | \\\"bar\\\";\", Foobar);\r\n    mpc_result_t r;\r\n    if (mpc_parse(\"<stdin>\", argv[1], Foobar, &r)) {\r\n        mpc_ast_print(r.output);\r\n        mpc_ast_delete(r.output);\r\n    } else {\r\n        mpc_err_print(r.error);\r\n        mpc_err_delete(r.error);\r\n    }\r\n    mpc_cleanup(1, Foobar);\r\n    return 0;\r\n}\r\n```\r\nwhen this is compiled (on Ubuntu 14.04 with clang-3.5.1) with\r\n```\r\nclang -fsanitize=address -std=c99 -Wall test.c mpc.c -lm -o test\r\n```\r\nI get the following results:\r\n```\r\n$ ./test foo\r\nstring:1:1 'foo'\r\n```\r\n```\r\n$ ./test baz\r\n=================================================================\r\n==21438==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000001371ca3 at pc 0x0000004462b0 bp 0x7fffe8244c10 sp 0x7fffe82443d0\r\nREAD of size 4 at 0x000001371ca3 thread T0\r\n    #0 0x4462af (/home/<snip>/test+0x4462af)\r\n    #1 0x4471ee (/home/<snip>/test+0x4471ee)\r\n    #2 0x4bcb0c (/home/<snip>/test+0x4bcb0c)\r\n    #3 0x4bc2dc (/home/<snip>/test+0x4bc2dc)\r\n    #4 0x4bb12e (/home/<snip>/test+0x4bb12e)\r\n    #5 0x4baf84 (/home/<snip>/test+0x4baf84)\r\n    #6 0x4ba7e3 (/home/<snip>/test+0x4ba7e3)\r\n    #7 0x7fb57c3bbec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)\r\n    #8 0x4ba36c (/home/<snip>/test+0x4ba36c)\r\n\r\n0x000001371ca3 is located 0 bytes to the right of global variable 'char_unescape_buffer' defined in 'mpc.c:125:13' (0x1371ca0) of size 3\r\nSUMMARY: AddressSanitizer: global-buffer-overflow ??:0 ??\r\nShadow bytes around the buggy address:\r\n  0x000080266340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x000080266350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x000080266360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x000080266370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x000080266380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n=>0x000080266390: 00 00 00 00[03]f9 f9 f9 f9 f9 f9 f9 00 00 00 00\r\n  0x0000802663a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0000802663b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0000802663c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0000802663d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0000802663e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07 \r\n  Heap left redzone:       fa\r\n  Heap right redzone:      fb\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack partial redzone:   f4\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Container overflow:      fc\r\n  ASan internal:           fe\r\n==21438==ABORTING\r\n```\r\n\r\nI think I have narrowed the problem down to the call to `mpc_err_char_unescape(x->recieved)` on line 181 of `mpc.c`, but unfortunately I'm just a beginner at C and haven't got any further than that!"},"comment":{"url":"https://api.github.com/repos/orangeduck/mpc/issues/comments/73405707","html_url":"https://github.com/orangeduck/mpc/issues/20#issuecomment-73405707","issue_url":"https://api.github.com/repos/orangeduck/mpc/issues/20","id":73405707,"user":{"login":"orangeduck","id":177299,"avatar_url":"https://avatars.githubusercontent.com/u/177299?v=3","gravatar_id":"","url":"https://api.github.com/users/orangeduck","html_url":"https://github.com/orangeduck","followers_url":"https://api.github.com/users/orangeduck/followers","following_url":"https://api.github.com/users/orangeduck/following{/other_user}","gists_url":"https://api.github.com/users/orangeduck/gists{/gist_id}","starred_url":"https://api.github.com/users/orangeduck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/orangeduck/subscriptions","organizations_url":"https://api.github.com/users/orangeduck/orgs","repos_url":"https://api.github.com/users/orangeduck/repos","events_url":"https://api.github.com/users/orangeduck/events{/privacy}","received_events_url":"https://api.github.com/users/orangeduck/received_events","type":"User","site_admin":false},"created_at":"2015-02-08T10:45:49Z","updated_at":"2015-02-08T10:45:49Z","body":"Please verify if this is fixed in d6347af7b4aa70b79546106c4ce8a9ae273208f7 and thanks again."}}