Skip to content

scanner: return stream read errors to callers - #295

Open
SantanDon wants to merge 1 commit into
hyperrealm:masterfrom
SantanDon:security/return-scanner-read-errors
Open

scanner: return stream read errors to callers#295
SantanDon wants to merge 1 commit into
hyperrealm:masterfrom
SantanDon:security/return-scanner-read-errors

Conversation

@SantanDon

Copy link
Copy Markdown

Summary

Prevent Flex stream read errors from terminating the process inside libconfig.

Flex's default YY_INPUT calls YY_FATAL_ERROR("input in flex scanner failed") when fread() fails for a reason other than EINTR. That is reasonable for a standalone scanner, but not for a library API: the caller never gets a chance to handle the error.

This overrides the scanner input hook so it keeps the existing EINTR retry behavior, but leaves other stream read failures for the scanner's EOF rule to report as TOK_ERROR. The existing parser cleanup path then unwinds includes and config_read*() returns CONFIG_FALSE with the usual error fields populated.

No public API or ABI changes are involved.

Reproduction

On POSIX, this public issue #292 reproducer is enough:

config_t cfg;
config_init(&cfg);
config_read_string(&cfg, "@include \".\"");

A directory can be opened as a stream, but reading it fails. On current master (e485a729d2cf27321a560a61af0816b123337d00), the process exits from the generated scanner with:

input in flex scanner failed

With this change, the call returns normally:

returned=0 error=input in flex scanner failed line=1

The same process-fatal scanner behavior was also reported historically in #56.

Tests

  • Added IncludeReadError, which verifies config_read_string(..., "@include \".\"") returns false instead of terminating the test process.
  • All existing functional tests that pass on the baseline also pass with this change.
  • In a Linux run from this Windows checkout, two parse-error fixture comparisons fail identically on baseline and patched trees because the expected files retain CRLF while Linux produces LF; the patch adds no new failure.
  • Valid-file config_read_file() smoke test passes under ASan/UBSan.
  • git diff --check is clean.

Fixes #292.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

config_read_string aborts process via yy_fatal_error → exit() on malformed input

1 participant