From: Rafael Garcia-Suarez <rgarciasuarez@gmail.com>
Date: Mon, 2 Dec 2002 20:03:09 +0000 (+0000)
Subject: Fix bug #18573 : in a double-quoted string, a \c not followed
X-Git-Url: http://git.shadowcat.co.uk/gitweb/gitweb.cgi?a=commitdiff_plain;h=961ce445580b4e9c0fefe3823cbf9226fa16b9bc;p=p5sagit%2Fp5-mst-13.2.git

Fix bug #18573 : in a double-quoted string, a \c not followed
by any character may corrupt memory due to reading past the
end of the input buffer. Add a new error message corresponding
to this case.

p4raw-id: //depot/perl@18233
---

diff --git a/pod/perldiag.pod b/pod/perldiag.pod
index 6d755f0..e40a348 100644
--- a/pod/perldiag.pod
+++ b/pod/perldiag.pod
@@ -2089,6 +2089,11 @@ double-quotish context.
 C<open(FH, "command |")> construction, but the command was missing or
 blank.
 
+=item Missing control char name in \c
+
+(F) A double-quoted string ended with "\c", without the required control
+character name.
+
 =item Missing name in "my sub"
 
 (F) The reserved syntax for lexically scoped subroutines requires that
diff --git a/t/comp/parser.t b/t/comp/parser.t
index dc83256..ab43e73 100644
--- a/t/comp/parser.t
+++ b/t/comp/parser.t
@@ -9,7 +9,7 @@ BEGIN {
 }
 
 require "./test.pl";
-plan( tests => 9 );
+plan( tests => 10 );
 
 eval '%@x=0;';
 like( $@, qr/^Can't modify hash dereference in repeat \(x\)/, '%@x=0' );
@@ -47,3 +47,7 @@ like( $@, qr/^Can't modify constant item in read /,
 # This used to dump core (bug #17920)
 eval q{ sub { sub { f1(f2();); my($a,$b,$c) } } };
 like( $@, qr/error/, 'lexical block discarded by yacc' );
+
+# bug #18573, used to corrupt memory
+eval q{ "\c" };
+like( $@, qr/^Missing control char name in \\c/, q("\c" string) );
diff --git a/toke.c b/toke.c
index 7d73497..722609b 100644
--- a/toke.c
+++ b/toke.c
@@ -1611,7 +1611,7 @@ S_scan_const(pTHX_ char *start)
 	    /* \c is a control character */
 	    case 'c':
 		s++;
-		{
+		if (s < send) {
 		    U8 c = *s++;
 #ifdef EBCDIC
 		    if (isLOWER(c))
@@ -1619,6 +1619,9 @@ S_scan_const(pTHX_ char *start)
 #endif
 		    *d++ = NATIVE_TO_NEED(has_utf8,toCTRL(c));
 		}
+		else {
+		    yyerror("Missing control char name in \\c");
+		}
 		continue;
 
 	    /* printf-style backslashes, formfeeds, newlines, etc */