Fix out-of-bounds read in parser_lex_magic_comment

kddnewton · stevenjohnstone · kddnewton · commit e24e701f3a81 · 2025-11-29T14:31:34.000-05:00
Co-authored-by: Steven Johnstone &lt;steven.james.johnstone@gmail.com&gt;
diff --git a/src/prism.c b/src/prism.c
@@ -8443,7 +8443,7 @@ parser_lex_magic_comment(pm_parser_t *parser, bool semantic_token_seen) {
                 if (*cursor == '\\' && (cursor + 1 < end)) cursor++;
             }
             value_end = cursor;
-            if (*cursor == '"') cursor++;
+            if (cursor < end && *cursor == '"') cursor++;
         } else {
             value_start = cursor;
             while (cursor < end && *cursor != '"' && *cursor != ';' && !pm_char_is_whitespace(*cursor)) cursor++;

Original file line number	Diff line number	Diff line change
`@@ -8443,7 +8443,7 @@ parser_lex_magic_comment(pm_parser_t *parser, bool semantic_token_seen) {`
`8443`	`8443`	`if (*cursor == '\\' && (cursor + 1 < end)) cursor++;`
`8444`	`8444`	`}`
`8445`	`8445`	`value_end = cursor;`
`8446`		`- if (*cursor == '"') cursor++;`
	`8446`	`+ if (cursor < end && *cursor == '"') cursor++;`
`8447`	`8447`	`} else {`
`8448`	`8448`	`value_start = cursor;`
`8449`	`8449`	`while (cursor < end && cursor != '"' && cursor != ';' && !pm_char_is_whitespace(*cursor)) cursor++;`