wren icon indicating copy to clipboard operation
wren copied to clipboard

Duplicate method names formed by invalid tokens can cause stack overflows

Open graphitemaster opened this issue 4 years ago • 2 comments

The use of any invalid token (in this case I'm using ]) in a method name counts as termination of parsing, but proceeding valid tokens in a method name contributes to the max of 64 tokens for an identifier when a whitespace character to signify the next token is encountered. The stack storage for the identifier is now setup for overflow, as a redeclaration of the method name smashes the stack. Sample code is provided here

class Foo {
  IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII]I I
  IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII]I I
}

If this does not crash try adding more I before the ]

My output

[graphite@graphite bin]# ./wren_test c.wren 
[./c line 2] Error at ']': Expect '{' to begin method body.
[./c line 2] Error at 'I': Expect '}' at end of block.
[./c line 3] Error at 'IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII': Class Foo already defines a method 'IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII'.
*** stack smashing detected ***: terminated
Aborted (core dumped)

graphitemaster avatar May 30 '21 16:05 graphitemaster

A check for length is probably missing somewhere...

mhermier avatar May 30 '21 16:05 mhermier

Close, but the problem is we're not accounting for lengthily variable names being used TWICE in an error rather than once...

joshgoebel avatar Jan 19 '22 08:01 joshgoebel