?a: catch symb[NSYMB] buffer overflow in lexer, cleanup, assume thechar is a rune

10 files changed, 123 insertions, 141 deletions

diff --git a/sys/src/cmd/1a/lex.c b/sys/src/cmd/1a/lex.c
index ee42859fd..73e2783fe 100644
--- a/sys/src/cmd/1a/lex.c
+++ b/sys/src/cmd/1a/lex.c
@@ -38,7 +38,7 @@ main(int argc, char *argv[])
 		break;
 	} ARGEND
 	if(*argv == 0) {
-		print("usage: %ca [-options] file.s\n", thechar);
+		print("usage: %Ca [-options] file.s\n", thechar);
 		errorexit();
 	}
 	if(argc > 1 && systemtype(Windows)){
@@ -92,10 +92,10 @@ main(int argc, char *argv[])
 int
 assemble(char *file)
 {
-	char ofile[100], incfile[20], *p;
+	char *ofile, *p;
 	int i, of;
 
-	strcpy(ofile, file);
+	ofile = strdup(file);
 	p = utfrrune(ofile, pathchar());
 	if(p) {
 		include[0] = ofile;
@@ -103,16 +103,13 @@ assemble(char *file)
 	} else
 		p = ofile;
 	if(outfile == 0) {
-		outfile = p;
-		if(outfile){
+		if(p){
+			outfile = p;
 			p = utfrrune(outfile, '.');
 			if(p)
 				if(p[1] == 's' && p[2] == 0)
 					p[0] = 0;
-			p = utfrune(outfile, 0);
-			p[0] = '.';
-			p[1] = thechar;
-			p[2] = 0;
+			outfile = smprint("%s.%C", outfile, thechar);
 		} else
 			outfile = "/dev/null";
 	}
@@ -120,15 +117,13 @@ assemble(char *file)
 	if(p) {
 		setinclude(p);
 	} else {
-		if(systemtype(Plan9)) {
-			sprint(incfile,"/%s/include", thestring);
-			setinclude(strdup(incfile));
-		}
+		if(systemtype(Plan9))
+			setinclude(smprint("/%s/include", thestring));
 	}
 
 	of = mycreat(outfile, 0664);
 	if(of < 0) {
-		yyerror("%ca: cannot create %s", thechar, outfile);
+		yyerror("%Ca: cannot create %s", thechar, outfile);
 		errorexit();
 	}
 	Binit(&obuf, of, OWRITE);
diff --git a/sys/src/cmd/2a/lex.c b/sys/src/cmd/2a/lex.c
index 6ef81e91d..f060d920f 100644
--- a/sys/src/cmd/2a/lex.c
+++ b/sys/src/cmd/2a/lex.c
@@ -38,7 +38,7 @@ main(int argc, char *argv[])
 		break;
 	} ARGEND
 	if(*argv == 0) {
-		print("usage: %ca [-options] file.s\n", thechar);
+		print("usage: %Ca [-options] file.s\n", thechar);
 		errorexit();
 	}
 	if(argc > 1 && systemtype(Windows)){
@@ -92,10 +92,10 @@ main(int argc, char *argv[])
 int
 assemble(char *file)
 {
-	char ofile[100], incfile[20], *p;
+	char *ofile, *p;
 	int i, of;
 
-	strcpy(ofile, file);
+	ofile = strdup(file);
 	p = utfrrune(ofile, pathchar());
 	if(p) {
 		include[0] = ofile;
@@ -103,16 +103,13 @@ assemble(char *file)
 	} else
 		p = ofile;
 	if(outfile == 0) {
-		outfile = p;
-		if(outfile){
+		if(p){
+			outfile = p;
 			p = utfrrune(outfile, '.');
 			if(p)
 				if(p[1] == 's' && p[2] == 0)
 					p[0] = 0;
-			p = utfrune(outfile, 0);
-			p[0] = '.';
-			p[1] = thechar;
-			p[2] = 0;
+			outfile = smprint("%s.%C", outfile, thechar);
 		} else
 			outfile = "/dev/null";
 	}
@@ -120,15 +117,13 @@ assemble(char *file)
 	if(p) {
 		setinclude(p);
 	} else {
-		if(systemtype(Plan9)) {
-			sprint(incfile,"/%s/include", thestring);
-			setinclude(strdup(incfile));
-		}
+		if(systemtype(Plan9))
+			setinclude(smprint("/%s/include", thestring));
 	}
 
 	of = mycreat(outfile, 0664);
 	if(of < 0) {
-		yyerror("%ca: cannot create %s", thechar, outfile);
+		yyerror("%Ca: cannot create %s", thechar, outfile);
 		errorexit();
 	}
 	Binit(&obuf, of, OWRITE);
diff --git a/sys/src/cmd/5a/lex.c b/sys/src/cmd/5a/lex.c
index 3ef90982d..b884b5063 100644
--- a/sys/src/cmd/5a/lex.c
+++ b/sys/src/cmd/5a/lex.c
@@ -42,7 +42,7 @@ main(int argc, char *argv[])
 		break;
 	} ARGEND
 	if(*argv == 0) {
-		print("usage: %ca [-options] file.s\n", thechar);
+		print("usage: %Ca [-options] file.s\n", thechar);
 		errorexit();
 	}
 	if(argc > 1 && systemtype(Windows)){
@@ -96,10 +96,10 @@ main(int argc, char *argv[])
 int
 assemble(char *file)
 {
-	char ofile[100], incfile[20], *p;
+	char *ofile, *p;
 	int i, of;
 
-	strcpy(ofile, file);
+	ofile = strdup(file);
 	p = utfrrune(ofile, pathchar());
 	if(p) {
 		include[0] = ofile;
@@ -107,16 +107,13 @@ assemble(char *file)
 	} else
 		p = ofile;
 	if(outfile == 0) {
-		outfile = p;
-		if(outfile){
+		if(p){
+			outfile = p;
 			p = utfrrune(outfile, '.');
 			if(p)
 				if(p[1] == 's' && p[2] == 0)
 					p[0] = 0;
-			p = utfrune(outfile, 0);
-			p[0] = '.';
-			p[1] = thechar;
-			p[2] = 0;
+			outfile = smprint("%s.%C", outfile, thechar);
 		} else
 			outfile = "/dev/null";
 	}
@@ -124,15 +121,13 @@ assemble(char *file)
 	if(p) {
 		setinclude(p);
 	} else {
-		if(systemtype(Plan9)) {
-			sprint(incfile,"/%s/include", thestring);
-			setinclude(strdup(incfile));
-		}
+		if(systemtype(Plan9))
+			setinclude(smprint("/%s/include", thestring));
 	}
 
 	of = mycreat(outfile, 0664);
 	if(of < 0) {
-		yyerror("%ca: cannot create %s", thechar, outfile);
+		yyerror("%Ca: cannot create %s", thechar, outfile);
 		errorexit();
 	}
 	Binit(&obuf, of, OWRITE);
diff --git a/sys/src/cmd/6a/lex.c b/sys/src/cmd/6a/lex.c
index b2b6aee44..ac92d8cde 100644
--- a/sys/src/cmd/6a/lex.c
+++ b/sys/src/cmd/6a/lex.c
@@ -38,7 +38,7 @@ main(int argc, char *argv[])
 		break;
 	} ARGEND
 	if(*argv == 0) {
-		print("usage: %ca [-options] file.s\n", thechar);
+		print("usage: %Ca [-options] file.s\n", thechar);
 		errorexit();
 	}
 	if(argc > 1 && systemtype(Windows)){
@@ -92,10 +92,10 @@ main(int argc, char *argv[])
 int
 assemble(char *file)
 {
-	char ofile[100], incfile[20], *p;
+	char *ofile, *p;
 	int i, of;
 
-	strcpy(ofile, file);
+	ofile = strdup(file);
 	p = utfrrune(ofile, pathchar());
 	if(p) {
 		include[0] = ofile;
@@ -103,16 +103,13 @@ assemble(char *file)
 	} else
 		p = ofile;
 	if(outfile == 0) {
-		outfile = p;
-		if(outfile){
+		if(p){
+			outfile = p;
 			p = utfrrune(outfile, '.');
 			if(p)
 				if(p[1] == 's' && p[2] == 0)
 					p[0] = 0;
-			p = utfrune(outfile, 0);
-			p[0] = '.';
-			p[1] = thechar;
-			p[2] = 0;
+			outfile = smprint("%s.%C", outfile, thechar);
 		} else
 			outfile = "/dev/null";
 	}
@@ -120,15 +117,13 @@ assemble(char *file)
 	if(p) {
 		setinclude(p);
 	} else {
-		if(systemtype(Plan9)) {
-			sprint(incfile,"/%s/include", thestring);
-			setinclude(strdup(incfile));
-		}
+		if(systemtype(Plan9))
+			setinclude(smprint("/%s/include", thestring));
 	}
 
 	of = mycreat(outfile, 0664);
 	if(of < 0) {
-		yyerror("%ca: cannot create %s", thechar, outfile);
+		yyerror("%Ca: cannot create %s", thechar, outfile);
 		errorexit();
 	}
 	Binit(&obuf, of, OWRITE);
diff --git a/sys/src/cmd/7a/lex.c b/sys/src/cmd/7a/lex.c
index 2e289ff09..952adcb43 100644
--- a/sys/src/cmd/7a/lex.c
+++ b/sys/src/cmd/7a/lex.c
@@ -38,7 +38,7 @@ main(int argc, char *argv[])
 		break;
 	} ARGEND
 	if(*argv == 0) {
-		print("usage: %ca [-options] file.s\n", thechar);
+		print("usage: %Ca [-options] file.s\n", thechar);
 		errorexit();
 	}
 	if(argc > 1 && systemtype(Windows)){
@@ -92,10 +92,10 @@ main(int argc, char *argv[])
 int
 assemble(char *file)
 {
-	char ofile[100], incfile[20], *p;
+	char *ofile, *p;
 	int i, of;
 
-	strcpy(ofile, file);
+	ofile = strdup(file);
 	p = utfrrune(ofile, pathchar());
 	if(p) {
 		include[0] = ofile;
@@ -103,16 +103,13 @@ assemble(char *file)
 	} else
 		p = ofile;
 	if(outfile == 0) {
-		outfile = p;
-		if(outfile){
+		if(p){
+			outfile = p;
 			p = utfrrune(outfile, '.');
 			if(p)
 				if(p[1] == 's' && p[2] == 0)
 					p[0] = 0;
-			p = utfrune(outfile, 0);
-			p[0] = '.';
-			p[1] = thechar;
-			p[2] = 0;
+			outfile = smprint("%s.%C", outfile, thechar);
 		} else
 			outfile = "/dev/null";
 	}
@@ -120,15 +117,13 @@ assemble(char *file)
 	if(p) {
 		setinclude(p);
 	} else {
-		if(systemtype(Plan9)) {
-			sprint(incfile,"/%s/include", thestring);
-			setinclude(strdup(incfile));
-		}
+		if(systemtype(Plan9))
+			setinclude(smprint("/%s/include", thestring));
 	}
 
 	of = mycreat(outfile, 0664);
 	if(of < 0) {
-		yyerror("%ca: cannot create %s", thechar, outfile);
+		yyerror("%Ca: cannot create %s", thechar, outfile);
 		errorexit();
 	}
 	Binit(&obuf, of, OWRITE);
diff --git a/sys/src/cmd/8a/lex.c b/sys/src/cmd/8a/lex.c
index b5c736c1d..7504c528b 100644
--- a/sys/src/cmd/8a/lex.c
+++ b/sys/src/cmd/8a/lex.c
@@ -38,7 +38,7 @@ main(int argc, char *argv[])
 		break;
 	} ARGEND
 	if(*argv == 0) {
-		print("usage: %ca [-options] file.s\n", thechar);
+		print("usage: %Ca [-options] file.s\n", thechar);
 		errorexit();
 	}
 	if(argc > 1 && systemtype(Windows)){
@@ -92,10 +92,10 @@ main(int argc, char *argv[])
 int
 assemble(char *file)
 {
-	char ofile[100], incfile[20], *p;
+	char *ofile, *p;
 	int i, of;
 
-	strcpy(ofile, file);
+	ofile = strdup(file);
 	p = utfrrune(ofile, pathchar());
 	if(p) {
 		include[0] = ofile;
@@ -103,16 +103,13 @@ assemble(char *file)
 	} else
 		p = ofile;
 	if(outfile == 0) {
-		outfile = p;
-		if(outfile){
+		if(p){
+			outfile = p;
 			p = utfrrune(outfile, '.');
 			if(p)
 				if(p[1] == 's' && p[2] == 0)
 					p[0] = 0;
-			p = utfrune(outfile, 0);
-			p[0] = '.';
-			p[1] = thechar;
-			p[2] = 0;
+			outfile = smprint("%s.%C", outfile, thechar);
 		} else
 			outfile = "/dev/null";
 	}
@@ -120,15 +117,13 @@ assemble(char *file)
 	if(p) {
 		setinclude(p);
 	} else {
-		if(systemtype(Plan9)) {
-			sprint(incfile,"/%s/include", thestring);
-			setinclude(strdup(incfile));
-		}
+		if(systemtype(Plan9))
+			setinclude(smprint("/%s/include", thestring));
 	}
 
 	of = mycreat(outfile, 0664);
 	if(of < 0) {
-		yyerror("%ca: cannot create %s", thechar, outfile);
+		yyerror("%Ca: cannot create %s", thechar, outfile);
 		errorexit();
 	}
 	Binit(&obuf, of, OWRITE);
diff --git a/sys/src/cmd/cc/lexbody b/sys/src/cmd/cc/lexbody
index 471041617..2b3134296 100644
--- a/sys/src/cmd/cc/lexbody
+++ b/sys/src/cmd/cc/lexbody
@@ -111,7 +111,7 @@ newfile(char *s, int f)
 	if(f < 0)
 		i->f = open(s, 0);
 	if(i->f < 0) {
-		yyerror("%ca: %r: %s", thechar, s);
+		yyerror("%Ca: %r: %s", thechar, s);
 		errorexit();
 	}
 	fi.c = 0;
@@ -121,8 +121,11 @@ newfile(char *s, int f)
 Sym*
 slookup(char *s)
 {
-
-	strcpy(symb, s);
+	strncpy(symb, s, NSYMB);
+	if(symb[NSYMB-1] != '\0'){
+		yyerror("symbol too long: %s", s);
+		errorexit();
+	}
 	return lookup();
 }
 
@@ -130,31 +133,34 @@ Sym*
 lookup(void)
 {
 	Sym *s;
-	long h;
+	ulong h;
 	char *p;
-	int c, l;
+	int c, n;
 
 	h = 0;
-	for(p=symb; c = *p; p++)
-		h = h+h+h + c;
-	l = (p - symb) + 1;
-	if(h < 0)
+	for(p=symb; *p;) {
+		h = h * 3;
+		h += *p++;
+	}
+	n = (p - symb) + 1;
+	if((long)h < 0)
 		h = ~h;
 	h %= NHASH;
 	c = symb[0];
 	for(s = hash[h]; s != S; s = s->link) {
 		if(s->name[0] != c)
 			continue;
-		if(memcmp(s->name, symb, l) == 0)
+		if(strcmp(s->name, symb) == 0)
 			return s;
 	}
 	s = alloc(sizeof(*s));
-	s->name = alloc(l);
-	memmove(s->name, symb, l);
+	s->name = alloc(n);
+	memmove(s->name, symb, n);
 
 	s->link = hash[h];
 	hash[h] = s;
 	syminit(s);
+
 	return s;
 }
 
@@ -220,6 +226,8 @@ l1:
 		cp = symb;
 
 	aloop:
+		if(cp >= &symb[NSYMB-1])
+			goto toolong;
 		*cp++ = c;
 		c = GETC();
 		if(isalpha(c) || isdigit(c) || c == '_' || c == '$')
@@ -295,6 +303,8 @@ l1:
 		for(;;) {
 			if(!isdigit(c))
 				break;
+			if(cp >= &symb[NSYMB-1])
+				goto toolong;
 			*cp++ = c;
 			c = GETC();
 		}
@@ -316,6 +326,8 @@ l1:
 
 	casedot:
 		for(;;) {
+			if(cp >= &symb[NSYMB-1])
+				goto toolong;
 			*cp++ = c;
 			c = GETC();
 			if(!isdigit(c))
@@ -326,13 +338,19 @@ l1:
 		goto caseout;
 
 	casee:
+		if(cp >= &symb[NSYMB-1])
+			goto toolong;
 		*cp++ = 'e';
 		c = GETC();
 		if(c == '+' || c == '-') {
+			if(cp >= &symb[NSYMB-1])
+				goto toolong;
 			*cp++ = c;
 			c = GETC();
 		}
 		while(isdigit(c)) {
+			if(cp >= &symb[NSYMB-1])
+				goto toolong;
 			*cp++ = c;
 			c = GETC();
 		}
@@ -409,6 +427,10 @@ l1:
 	}
 	peekc = c1;
 	return c;
+toolong:
+	yyerror("token too long: %.*s...", utfnlen(symb, cp-symb), symb);
+	errorexit();
+	return -1;
 }
 
 int
diff --git a/sys/src/cmd/ka/lex.c b/sys/src/cmd/ka/lex.c
index aa2a98c37..66152e405 100644
--- a/sys/src/cmd/ka/lex.c
+++ b/sys/src/cmd/ka/lex.c
@@ -38,7 +38,7 @@ main(int argc, char *argv[])
 		break;
 	} ARGEND
 	if(*argv == 0) {
-		print("usage: %ca [-options] file.s\n", thechar);
+		print("usage: %Ca [-options] file.s\n", thechar);
 		errorexit();
 	}
 	if(argc > 1 && systemtype(Windows)){
@@ -92,10 +92,10 @@ main(int argc, char *argv[])
 int
 assemble(char *file)
 {
-	char ofile[100], incfile[20], *p;
+	char *ofile, *p;
 	int i, of;
 
-	strcpy(ofile, file);
+	ofile = strdup(file);
 	p = utfrrune(ofile, pathchar());
 	if(p) {
 		include[0] = ofile;
@@ -103,16 +103,13 @@ assemble(char *file)
 	} else
 		p = ofile;
 	if(outfile == 0) {
-		outfile = p;
-		if(outfile){
+		if(p){
+			outfile = p;
 			p = utfrrune(outfile, '.');
 			if(p)
 				if(p[1] == 's' && p[2] == 0)
 					p[0] = 0;
-			p = utfrune(outfile, 0);
-			p[0] = '.';
-			p[1] = thechar;
-			p[2] = 0;
+			outfile = smprint("%s.%C", outfile, thechar);
 		} else
 			outfile = "/dev/null";
 	}
@@ -120,15 +117,13 @@ assemble(char *file)
 	if(p) {
 		setinclude(p);
 	} else {
-		if(systemtype(Plan9)) {
-			sprint(incfile,"/%s/include", thestring);
-			setinclude(strdup(incfile));
-		}
+		if(systemtype(Plan9))
+			setinclude(smprint("/%s/include", thestring));
 	}
 
 	of = mycreat(outfile, 0664);
 	if(of < 0) {
-		yyerror("%ca: cannot create %s", thechar, outfile);
+		yyerror("%Ca: cannot create %s", thechar, outfile);
 		errorexit();
 	}
 	Binit(&obuf, of, OWRITE);
diff --git a/sys/src/cmd/qa/lex.c b/sys/src/cmd/qa/lex.c
index 85f530fa0..96a4c6100 100644
--- a/sys/src/cmd/qa/lex.c
+++ b/sys/src/cmd/qa/lex.c
@@ -38,7 +38,7 @@ main(int argc, char *argv[])
 		break;
 	} ARGEND
 	if(*argv == 0) {
-		print("usage: %ca [-options] file.s\n", thechar);
+		print("usage: %Ca [-options] file.s\n", thechar);
 		errorexit();
 	}
 	if(argc > 1 && systemtype(Windows)){
@@ -92,38 +92,38 @@ main(int argc, char *argv[])
 int
 assemble(char *file)
 {
-	char ofile[100], incfile[20], *p;
+	char *ofile, *p;
 	int i, of;
 
-	strcpy(ofile, file);
-	if(p = strrchr(ofile, pathchar())) {
+	ofile = strdup(file);
+	p = utfrrune(ofile, pathchar());
+	if(p) {
 		include[0] = ofile;
 		*p++ = 0;
 	} else
 		p = ofile;
 	if(outfile == 0) {
-		outfile = p;
-		if(p = strrchr(outfile, '.'))
-			if(p[1] == 's' && p[2] == 0)
-				p[0] = 0;
-		p = strrchr(outfile, 0);
-		p[0] = '.';
-		p[1] = thechar;
-		p[2] = 0;
+		if(p){
+			outfile = p;
+			p = utfrrune(outfile, '.');
+			if(p)
+				if(p[1] == 's' && p[2] == 0)
+					p[0] = 0;
+			outfile = smprint("%s.%C", outfile, thechar);
+		} else
+			outfile = "/dev/null";
 	}
 	p = getenv("INCLUDE");
 	if(p) {
 		setinclude(p);
 	} else {
-		if(systemtype(Plan9)) {
-			sprint(incfile,"/%s/include", thestring);
-			setinclude(strdup(incfile));
-		}
+		if(systemtype(Plan9))
+			setinclude(smprint("/%s/include", thestring));
 	}
 
 	of = mycreat(outfile, 0664);
 	if(of < 0) {
-		yyerror("%ca: cannot create %s", thechar, outfile);
+		yyerror("%Ca: cannot create %s", thechar, outfile);
 		errorexit();
 	}
 	Binit(&obuf, of, OWRITE);
diff --git a/sys/src/cmd/va/lex.c b/sys/src/cmd/va/lex.c
index 61448d2eb..dc32a4f1d 100644
--- a/sys/src/cmd/va/lex.c
+++ b/sys/src/cmd/va/lex.c
@@ -42,7 +42,7 @@ main(int argc, char *argv[])
 		break;
 	} ARGEND
 	if(*argv == 0) {
-		print("usage: %ca [-options] file.s\n", thechar);
+		print("usage: %Ca [-options] file.s\n", thechar);
 		errorexit();
 	}
 	if(argc > 1 && systemtype(Windows)){
@@ -96,10 +96,10 @@ main(int argc, char *argv[])
 int
 assemble(char *file)
 {
-	char ofile[100], incfile[20], *p;
+	char *ofile, *p;
 	int i, of;
 
-	strcpy(ofile, file);
+	ofile = strdup(file);
 	p = utfrrune(ofile, pathchar());
 	if(p) {
 		include[0] = ofile;
@@ -107,16 +107,13 @@ assemble(char *file)
 	} else
 		p = ofile;
 	if(outfile == 0) {
-		outfile = p;
-		if(outfile){
+		if(p){
+			outfile = p;
 			p = utfrrune(outfile, '.');
 			if(p)
 				if(p[1] == 's' && p[2] == 0)
 					p[0] = 0;
-			p = utfrune(outfile, 0);
-			p[0] = '.';
-			p[1] = thechar;
-			p[2] = 0;
+			outfile = smprint("%s.%C", outfile, thechar);
 		} else
 			outfile = "/dev/null";
 	}
@@ -124,15 +121,13 @@ assemble(char *file)
 	if(p) {
 		setinclude(p);
 	} else {
-		if(systemtype(Plan9)) {
-			sprint(incfile,"/%s/include", thestring);
-			setinclude(strdup(incfile));
-		}
+		if(systemtype(Plan9))
+			setinclude(smprint("/%s/include", thestring));
 	}
 
 	of = mycreat(outfile, 0664);
 	if(of < 0) {
-		yyerror("%ca: cannot create %s", thechar, outfile);
+		yyerror("%Ca: cannot create %s", thechar, outfile);
 		errorexit();
 	}
 	Binit(&obuf, of, OWRITE);