Make sure to free default @text format on error

It seems that bison doesn't call destructors for mid-rule action
components on error, since it does not know their type.

A mid-rule action was used to allocate the "text" string used as format
by string literals without a format, which would leak on error.
This patch replaces it with a new NoFormat component of type <literal>.
Now bison will call jv_free() on that string after a syntax error.

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60836

  $ ./jq '"'
  jq: error: syntax error, unexpected end of file, expecting QQSTRING_TEXT or QQSTRING_INTERP_START or QQSTRING_END (Unix shell quoting issues?) at <top-level>, line 1:
  "
  jq: 1 compile error

  =================================================================
  ==1495450==ERROR: LeakSanitizer: detected memory leaks

  Direct leak of 21 byte(s) in 1 object(s) allocated from:
      #0 0x7fc21aee1359 in __interceptor_malloc /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:69
      #1 0x557ccb6ff608 in jv_mem_alloc src/jv_alloc.c:141

  SUMMARY: AddressSanitizer: 21 byte(s) leaked in 1 allocation(s).
This commit is contained in:
Emanuele Torre authored and Nico Williams committed 2023-07-25 14:51:58 -05:00
1 parent a949745059
commit ae95864b6b
2 files changed
+585 -571

No files matched your search

Generated
+577 -569
View File
File diff suppressed because it is too large. Load diff
+8 -2
View File
@@ -122,6 +122,7 @@ struct lexer_param;
%type <blk> Param Params Arg Args
%type <blk> Patterns RepPatterns Pattern ArrayPats ObjPats ObjPat
%type <literal> Keyword
%type <literal> NoFormat
%{
#include "lexer.h"
struct lexer_param {
@@ -593,10 +594,15 @@ IDENT {
}
NoFormat:
%empty {
$$ = jv_string("text");
}
String:
QQSTRING_START { $<literal>$ = jv_string("text"); } QQString QQSTRING_END {
QQSTRING_START NoFormat QQString QQSTRING_END {
$$ = $3;
jv_free($<literal>2);
jv_free($2);
} |
FORMAT QQSTRING_START { $<literal>$ = $1; } QQString QQSTRING_END {
$$ = $4;