#92 Out of bounds error in expression parser

[Nils Björklund]

> src/coan --version
coan, version 6.0.1 for 64 bit Unix/Linux(built Aug 27 2018,14:03:43)
coan: while parsing options: progress 0x02101: Completed, exit code 0x00

test0035.c fails on Fedora 28 because of an out of bounds error in the expression_parser. This error was discovered because Fedora 28 has added -D_GLIBCXX_ASSERTIONS flag (see https://fedoraproject.org/wiki/Changes/HardeningFlags28).

Output from manually running the test case:

> src/coan source -DFOO1 -UFOO2 --verbose test_coan/test_cases/test0035.c
coan: progress 0x00105: Args: source -DFOO1 -UFOO2 --verbose test_coan/test_cases/test0035.c 
coan: progress 0x00102: Building input tree
coan: progress 0x00103: To do (1) "/home/nils/projekt/coan-6.0.1/test_coan/test_cases/test0035.c"
coan: progress 0x00104: 1 files to process
coan: progress 0x00101: Processing file (1) "/home/nils/projekt/coan-6.0.1/test_coan/test_cases/test0035.c"
/**ARGS: source -DFOO1 -UFOO2 */
/**SYSCODE: = 1 | 32 */
/usr/include/c++/8/bits/stl_vector.h:950: std::vector<_Tp, _Alloc>::const_reference std::vector<_Tp, _Alloc>::operator[](std::vector<_Tp, _Alloc>::size_type) const [with _Tp = expression_parser<parse_buffer>::deletion_code; _Alloc = std::allocator<expression_parser<parse_buffer>::deletion_code>; std::vector<_Tp, _Alloc>::const_reference = const expression_parser<parse_buffer>::deletion_code&; std::vector<_Tp, _Alloc>::size_type = long unsigned int]: Assertion '__builtin_expect(__n < this->size(), true)' failed.
Aborted (core dumped)

Backtrace:

(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007ffff70fa5c1 in __GI_abort () at abort.c:79
#2  0x0000000000405d83 in std::__replacement_assert (
    __file=0x4876e0 "/usr/include/c++/8/bits/stl_vector.h", __line=950, 
    __function=0x488560 <std::vector<expression_parser<parse_buffer>::deletion_code, std::allocator<expression_parser<parse_buffer>::deletion_code> >::operator[](unsigned long) const::__PRETTY_FUNCTION__> "std::vector<_Tp, _Alloc>::const_reference std::vector<_Tp, _Alloc>::operator[](std::vector<_Tp, _Alloc>::size_type) const [with _Tp = expression_parser<parse_buffer>::deletion_code; _Alloc = std::allo"..., __condition=0x4876b0 "__builtin_expect(__n < this->size(), true)")
    at /usr/include/c++/8/x86_64-redhat-linux/bits/c++config.h:2389
#3  0x000000000042a971 in std::vector<expression_parser<parse_buffer>::deletion_code, std::allocator<expression_parser<parse_buffer>::deletion_code> >::operator[] (this=0x7fffffffc938, __n=39) at /usr/include/c++/8/bits/stl_vector.h:950
#4  0x00000000004295df in expression_parser<parse_buffer>::simplified[abi:cxx11]() const (this=0x7fffffffc8f0) at expression_parser.cpp:804
...

The index i is outside the _deletions vector.

The issue seems to be in the expression_parser::cut() member function. It sets _last_deletion to end, but end points one past the cut part. _last_deletion should be set to the index of rightmost cut character.

Attaching patch which seems to fix the issue. make check passes after applying the patch.

[Filipe Rosset]

I can confirm this patch is working fine on Fedora. https://bugzilla.redhat.com/show_bug.cgi?id=1626440

today, coan looks almost dead upstream, maybe it's time to migrate to github and try to engage more people to this project?