Fix bug #18573 : in a double-quoted string, a \c not followed

by any character may corrupt memory due to reading past the
end of the input buffer. Add a new error message corresponding
to this case.

p4raw-id: //depot/perl@18233

diff --git a/pod/perldiag.pod b/pod/perldiag.pod
index 6d755f0..e40a348 100644 (file)
--- a/pod/perldiag.pod
+++ b/pod/perldiag.pod
@@ -2089,6 +2089,11 @@ double-quotish context.
 C<open(FH, "command |")> construction, but the command was missing or
 blank.
 
+=item Missing control char name in \c
+
+(F) A double-quoted string ended with "\c", without the required control
+character name.
+
 =item Missing name in "my sub"
 
 (F) The reserved syntax for lexically scoped subroutines requires that

diff --git a/t/comp/parser.t b/t/comp/parser.t
index dc83256..ab43e73 100644 (file)
--- a/t/comp/parser.t
+++ b/t/comp/parser.t
@@ -9,7 +9,7 @@ BEGIN {
 }
 
 require "./test.pl";
-plan( tests => 9 );
+plan( tests => 10 );
 
 eval '%@x=0;';
 like( $@, qr/^Can't modify hash dereference in repeat \(x\)/, '%@x=0' );
@@ -47,3 +47,7 @@ like( $@, qr/^Can't modify constant item in read /,
 # This used to dump core (bug #17920)
 eval q{ sub { sub { f1(f2();); my($a,$b,$c) } } };
 like( $@, qr/error/, 'lexical block discarded by yacc' );
+
+# bug #18573, used to corrupt memory
+eval q{ "\c" };
+like( $@, qr/^Missing control char name in \\c/, q("\c" string) );

diff --git a/toke.c b/toke.c
index 7d73497..722609b 100644 (file)
--- a/toke.c
+++ b/toke.c
@@ -1611,7 +1611,7 @@ S_scan_const(pTHX_ char *start)
            /* \c is a control character */
            case 'c':
                s++;
-               {
+               if (s < send) {
                    U8 c = *s++;
 #ifdef EBCDIC
                    if (isLOWER(c))
@@ -1619,6 +1619,9 @@ S_scan_const(pTHX_ char *start)
 #endif
                    *d++ = NATIVE_TO_NEED(has_utf8,toCTRL(c));
                }
+               else {
+                   yyerror("Missing control char name in \\c");
+               }
                continue;
 
            /* printf-style backslashes, formfeeds, newlines, etc */