[ruby/prism] Fix out-of-bounds read in parser_lex_magic_comment

kddnewton · stevenjohnstone · matzbot · commit 748dc9ac8d68 · 2025-11-29T19:48:37.000Z
ruby/prism@e24e701f3a Co-authored-by: Steven Johnstone <steven.james.johnstone@gmail.com>
diff --git a/prism/prism.c b/prism/prism.c
@@ -8445,7 +8445,7 @@ parser_lex_magic_comment(pm_parser_t *parser, bool semantic_token_seen) {
                 if (*cursor == '\\' && (cursor + 1 < end)) cursor++;
             }
             value_end = cursor;
-            if (*cursor == '"') cursor++;
+            if (cursor < end && *cursor == '"') cursor++;
         } else {
             value_start = cursor;
             while (cursor < end && *cursor != '"' && *cursor != ';' && !pm_char_is_whitespace(*cursor)) cursor++;

Original file line number	Diff line number	Diff line change
`@@ -8445,7 +8445,7 @@ parser_lex_magic_comment(pm_parser_t *parser, bool semantic_token_seen) {`
`8445`	`8445`	`if (*cursor == '\\' && (cursor + 1 < end)) cursor++;`
`8446`	`8446`	`}`
`8447`	`8447`	`value_end = cursor;`
`8448`		`- if (*cursor == '"') cursor++;`
	`8448`	`+ if (cursor < end && *cursor == '"') cursor++;`
`8449`	`8449`	`} else {`
`8450`	`8450`	`value_start = cursor;`
`8451`	`8451`	`while (cursor < end && cursor != '"' && cursor != ';' && !pm_char_is_whitespace(*cursor)) cursor++;`