Skip to content

Commit 2acdb29

Browse files
committed
fix reading beyond input buffer
This fixes a rare case when the parser first suspends inside a comment, then is given input exactly up to the newline character. Before the fix it proceeded to read past the end of the buffer or hit an assert.
1 parent f48b6dd commit 2acdb29

File tree

3 files changed

+23
-1
lines changed

3 files changed

+23
-1
lines changed

include/boost/json/basic_parser.hpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -280,7 +280,7 @@ class basic_parser
280280
num1, num2, num3, num4,
281281
num5, num6, num7, num8,
282282
exp1, exp2, exp3,
283-
val1, val2
283+
val1, val2, val3
284284
};
285285

286286
struct number

include/boost/json/basic_parser_impl.hpp

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -785,9 +785,17 @@ resume_value(const char* p,
785785
p = parse_comment(p, std::false_type(), std::false_type());
786786
if(BOOST_JSON_UNLIKELY(p == sentinel()))
787787
return maybe_suspend(p, state::val2);
788+
if(BOOST_JSON_UNLIKELY( p == end_ ))
789+
return maybe_suspend(p, state::val3);
788790
BOOST_ASSERT(st_.empty());
789791
return parse_value(p, std::true_type(), std::true_type(), allow_trailing, allow_bad_utf8);
790792
}
793+
794+
case state::val3:
795+
{
796+
st_.pop(st);
797+
return parse_value(p, std::true_type(), std::true_type(), allow_trailing, allow_bad_utf8);
798+
}
791799
}
792800
}
793801

test/basic_parser.cpp

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1109,6 +1109,20 @@ class basic_parser_test
11091109

11101110
// no newline at EOF
11111111
TEST_GOOD_EXT("1//", enabled);
1112+
1113+
{
1114+
parse_options po;
1115+
po.allow_comments = true;
1116+
fail_parser p(po);
1117+
error_code ec;
1118+
p.write(true, "//", 2, ec); // suspend while inside comment
1119+
BOOST_TEST( !ec.failed() );
1120+
p.write(true, " \n1", 2, ec); // input ends comment,
1121+
// number starts after current input
1122+
BOOST_TEST( !ec.failed() );
1123+
p.write(false, "1", 1, ec);
1124+
BOOST_TEST( !ec.failed() );
1125+
}
11121126
}
11131127

11141128
void

0 commit comments

Comments
 (0)