Re: [bison crash] Assertion failure abort with src/muscle-tab.c:323

[Akim Demaille]

Hi Ahcheong!

> Le 6 mars 2020 à 07:01, Ahcheong Lee <address@hidden> a écrit :
> 
> Hello, this is Ahcheong Lee
> I'm currently working on a new fuzzing technique, and I found some crashes
> on GNU bison3.5.2.
> For ease of maintenance, I'll send one crash by one by email.
> 
> There was an assertion failure in src/muscle-tab.c:323
> string_decode: Assertion *(value) == '[''

Thanks a lot!  I introduced that bug more than 6 years ago, in Bison 3.0.1...

Cheers!

commit b82b387da9b637a10edc97632435d53f5d340ba8
Author: Akim Demaille <address@hidden>
Date:   Sat Mar 7 07:41:47 2020 +0100

    muscles: fix incorrect decoding of $
    
    Bug introduced in 458171e6df5a0110a35ee45ad8b2e9f6fb426f1d.
    https://lists.gnu.org/archive/html/bison-patches/2013-11/msg00009.html
    
    Reported by Ahcheong Lee.
    https://lists.gnu.org/r/bug-bison/2020-03/msg00010.html
    
    * src/muscle-tab.c (COMMON_DECODE): "$" is coded as "$][", not "$[][".
    * tests/input.at ("%define" enum variables): Check that case.

diff --git a/src/muscle-tab.c b/src/muscle-tab.c
index 36773eb6..5778b8f3 100644
--- a/src/muscle-tab.c
+++ b/src/muscle-tab.c
@@ -292,7 +292,6 @@ muscle_location_grow (char const *key, location loc)
 
 #define COMMON_DECODE(Value)                                    \
   case '$':                                                     \
-    ++(Value); aver (*(Value) == '[');                          \
     ++(Value); aver (*(Value) == ']');                          \
     ++(Value); aver (*(Value) == '[');                          \
     obstack_sgrow (&muscle_obstack, "$");                       \
diff --git a/src/system.h b/src/system.h
index b0ffb23a..0210f6c6 100644
--- a/src/system.h
+++ b/src/system.h
@@ -209,10 +209,10 @@ typedef size_t uintptr_t;
 
 /* Output Str both quoted for M4 (i.e., embed in [[...]]), and escaped
    for our postprocessing (i.e., escape M4 special characters).  If
-   Str is empty (or NULL), output "[]" instead of "[[]]" as it make M4
-   programming easier (m4_ifval can be used).
+   Str is empty (or NULL), output "[]" instead of "[[]]" as it makes
+   M4 programming easier (m4_ifval can be used).
 
-   For instance "[foo]" -> "[[@{foo@}]]", "$$" -> "[[$][$][]]". */
+   For instance "[foo]" -> "[[@{foo@}]]", "$$" -> "[[$][$][]]".  */
 
 # define obstack_quote(Obs, Str)                \
   do {                                          \
diff --git a/tests/input.at b/tests/input.at
index b004ea9e..4c1f5b25 100644
--- a/tests/input.at
+++ b/tests/input.at
@@ -2069,6 +2069,25 @@ input.y:1.1-34:     accepted value: 'consistent'
 input.y:1.1-34:     accepted value: 'accepting'
 ]])
 
+# Check escapes.
+AT_DATA([[input.y]],
+[[%define lr.default-reduction {[$@]}
+%%
+start: %empty;
+]])
+AT_BISON_CHECK([[-fcaret input.y]], [[1]], [[]],
+[[input.y:1.1-35: warning: %define variable 'lr.default-reduction' requires 
keyword values [-Wdeprecated]
+    1 | %define lr.default-reduction {[$@]}
+      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+input.y:1.1-35: error: invalid value for %define variable 
'lr.default-reduction': '[$@]'
+    1 | %define lr.default-reduction {[$@]}
+      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+input.y:1.1-35:     accepted value: 'most'
+input.y:1.1-35:     accepted value: 'consistent'
+input.y:1.1-35:     accepted value: 'accepting'
+]])
+
+
 # Back-end.
 AT_DATA([[input.y]],
 [[%define api.push-pull neither