2013-05-31 18:33:16

by Stephen Warren

[permalink] [raw]
Subject: [PATCH V2] dtc: ensure #line directives don't consume data from the next line

From: Stephen Warren <[email protected]>

Previously, the #line parsing regex ended with ({WS}+[0-9]+)?. The {WS}
could match line-break characters. If the #line directive did not contain
the optional flags field at the end, this could cause any integer data on
the next line to be consumed as part of the #line directive parsing. This
could cause syntax errors (i.e. #line parsing consuming the leading 0
from a hex literal 0x1234, leaving x1234 to be parsed as cell data,
which is a syntax error), or invalid compilation results (i.e. simply
consuming literal 1234 as part of the #line processing, thus removing it
from the cell data).

Fix this by replacing {WS} with [ \t] so that it can't match line-breaks.

Convert all instances of {WS}, even though the other instances should be
irrelevant for any well-formed #line directive. This is done for
consistency and ultimate safety.

Reported-by: Ian Campbell <[email protected]>
Signed-off-by: Stephen Warren <[email protected]>
---
v2: Convert all instances of {WS} in the regex.

This is a patch for dtc upstream, in response to thread "DTB build
failure due to preproccessing". If/when it's accepted into dtc, I'll
follow up with a kernel patch that makes the same fix.
---
dtc-lexer.l | 2 +-
tests/line_directives.dts | 10 ++++++++++
2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/dtc-lexer.l b/dtc-lexer.l
index 254d5af..3b41bfc 100644
--- a/dtc-lexer.l
+++ b/dtc-lexer.l
@@ -71,7 +71,7 @@ static int pop_input_file(void);
push_input_file(name);
}

-<*>^"#"(line)?{WS}+[0-9]+{WS}+{STRING}({WS}+[0-9]+)? {
+<*>^"#"(line)?[ \t]+[0-9]+[ \t]+{STRING}([ \t]+[0-9]+)? {
char *line, *tmp, *fn;
/* skip text before line # */
line = yytext;
diff --git a/tests/line_directives.dts b/tests/line_directives.dts
index e9d0800..046ef37 100644
--- a/tests/line_directives.dts
+++ b/tests/line_directives.dts
@@ -8,4 +8,14 @@
# 6 "bar.dts"

/ {
+/*
+ * Make sure optional flags don't consume integer data on next line. The issue
+ * was that the {WS} in the trailing ({WS}+[0-9]+)? could cross the * line-
+ * break, and consume the leading "0" of the hex constant, leaving "x12345678"
+ * to be parsed as a number, which is invalid syntax.
+ */
+ prop1 = <
+# 10 "qux.dts"
+ 0x12345678
+ >;
};
--
1.7.10.4


2013-06-01 05:44:55

by David Gibson

[permalink] [raw]
Subject: Re: [PATCH V2] dtc: ensure #line directives don't consume data from the next line

On Fri, May 31, 2013 at 12:33:04PM -0600, Stephen Warren wrote:
> From: Stephen Warren <[email protected]>
>
> Previously, the #line parsing regex ended with ({WS}+[0-9]+)?. The {WS}
> could match line-break characters. If the #line directive did not contain
> the optional flags field at the end, this could cause any integer data on
> the next line to be consumed as part of the #line directive parsing. This
> could cause syntax errors (i.e. #line parsing consuming the leading 0
> from a hex literal 0x1234, leaving x1234 to be parsed as cell data,
> which is a syntax error), or invalid compilation results (i.e. simply
> consuming literal 1234 as part of the #line processing, thus removing it
> from the cell data).
>
> Fix this by replacing {WS} with [ \t] so that it can't match line-breaks.
>
> Convert all instances of {WS}, even though the other instances should be
> irrelevant for any well-formed #line directive. This is done for
> consistency and ultimate safety.
>
> Reported-by: Ian Campbell <[email protected]>
> Signed-off-by: Stephen Warren <[email protected]>

Nice catch.

Acked-by: David Gibson <[email protected]>

I'll pull it into my github tree. Jon, please either apply directly
or pull from my tree.

--
David Gibson | I'll have my music baroque, and my code
david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


Attachments:
(No filename) (1.41 kB)
signature.asc (198.00 B)
Digital signature
Download all attachments

2013-06-03 13:33:06

by Jon Loeliger

[permalink] [raw]
Subject: Re: [PATCH V2] dtc: ensure #line directives don't consume data from the next line

> From: Stephen Warren <[email protected]>
>
> Previously, the #line parsing regex ended with ({WS}+[0-9]+)?. The {WS}
> could match line-break characters. If the #line directive did not contain
> the optional flags field at the end, this could cause any integer data on
> the next line to be consumed as part of the #line directive parsing. This
> could cause syntax errors (i.e. #line parsing consuming the leading 0
> from a hex literal 0x1234, leaving x1234 to be parsed as cell data,
> which is a syntax error), or invalid compilation results (i.e. simply
> consuming literal 1234 as part of the #line processing, thus removing it
> from the cell data).
>
> Fix this by replacing {WS} with [ \t] so that it can't match line-breaks.
>
> Convert all instances of {WS}, even though the other instances should be
> irrelevant for any well-formed #line directive. This is done for
> consistency and ultimate safety.
>
> Reported-by: Ian Campbell <[email protected]>
> Signed-off-by: Stephen Warren <[email protected]>
> ---
> v2: Convert all instances of {WS} in the regex.

Applied.

Thanks!

jdl