Skip to content

Commit e3cacae

Browse files
committed
xkbcomp: fix crashes in the parser when geometry tokens appear
In the XKB format, floats and various keywords can only be used in the xkb_geometry section. xkbcommon removed support xkb_geometry, but still parses it for backward compatibility. As part of ignoring it, the float AST node and various keywords were removed, and instead NULL was returned by their parsing actions. However, the rest of the code does not handle NULLs, and so when they appear crashes usually ensue. To fix this, restore the float AST node and the ignored keywords. None of the evaluating code expects them, so nice error are displayed. Caught with the afl fuzzer. Signed-off-by: Ran Benita <ran234@gmail.com>
1 parent 1f9d124 commit e3cacae

File tree

4 files changed

+23
-5
lines changed

4 files changed

+23
-5
lines changed

Diff for: src/xkbcomp/ast-build.c

+8
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,13 @@ ExprCreateInteger(int ival)
105105
return expr;
106106
}
107107

108+
ExprDef *
109+
ExprCreateFloat(void)
110+
{
111+
EXPR_CREATE(ExprFloat, expr, EXPR_VALUE, EXPR_TYPE_FLOAT);
112+
return expr;
113+
}
114+
108115
ExprDef *
109116
ExprCreateBoolean(bool set)
110117
{
@@ -783,6 +790,7 @@ static const char *expr_value_type_strings[_EXPR_TYPE_NUM_VALUES] = {
783790
[EXPR_TYPE_UNKNOWN] = "unknown",
784791
[EXPR_TYPE_BOOLEAN] = "boolean",
785792
[EXPR_TYPE_INT] = "int",
793+
[EXPR_TYPE_FLOAT] = "float",
786794
[EXPR_TYPE_STRING] = "string",
787795
[EXPR_TYPE_ACTION] = "action",
788796
[EXPR_TYPE_KEYNAME] = "keyname",

Diff for: src/xkbcomp/ast-build.h

+3
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,9 @@ ExprCreateString(xkb_atom_t str);
3636
ExprDef *
3737
ExprCreateInteger(int ival);
3838

39+
ExprDef *
40+
ExprCreateFloat(void);
41+
3942
ExprDef *
4043
ExprCreateBoolean(bool set);
4144

Diff for: src/xkbcomp/ast.h

+7
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,7 @@ enum expr_value_type {
9595
EXPR_TYPE_UNKNOWN = 0,
9696
EXPR_TYPE_BOOLEAN,
9797
EXPR_TYPE_INT,
98+
EXPR_TYPE_FLOAT,
9899
EXPR_TYPE_STRING,
99100
EXPR_TYPE_ACTION,
100101
EXPR_TYPE_KEYNAME,
@@ -186,6 +187,12 @@ typedef struct {
186187
int ival;
187188
} ExprInteger;
188189

190+
typedef struct {
191+
ExprCommon expr;
192+
/* We don't support floats, but we still represnt them in the AST, in
193+
* order to provide proper error messages. */
194+
} ExprFloat;
195+
189196
typedef struct {
190197
ExprCommon expr;
191198
xkb_atom_t key_name;

Diff for: src/xkbcomp/parser.y

+5-5
Original file line numberDiff line numberDiff line change
@@ -591,13 +591,13 @@ Element : ACTION_TOK
591591
| INDICATOR
592592
{ $$ = xkb_atom_intern_literal(param->ctx, "indicator"); }
593593
| SHAPE
594-
{ $$ = XKB_ATOM_NONE; }
594+
{ $$ = xkb_atom_intern_literal(param->ctx, "shape"); }
595595
| ROW
596-
{ $$ = XKB_ATOM_NONE; }
596+
{ $$ = xkb_atom_intern_literal(param->ctx, "row"); }
597597
| SECTION
598-
{ $$ = XKB_ATOM_NONE; }
598+
{ $$ = xkb_atom_intern_literal(param->ctx, "section"); }
599599
| TEXT
600-
{ $$ = XKB_ATOM_NONE; }
600+
{ $$ = xkb_atom_intern_literal(param->ctx, "text"); }
601601
;
602602

603603
OptMergeMode : MergeMode { $$ = $1; }
@@ -687,7 +687,7 @@ Terminal : String
687687
| Integer
688688
{ $$ = ExprCreateInteger($1); }
689689
| Float
690-
{ $$ = NULL; }
690+
{ $$ = ExprCreateFloat(/* Discard $1 */); }
691691
| KEYNAME
692692
{ $$ = ExprCreateKeyName($1); }
693693
;

0 commit comments

Comments
 (0)