Fix: scanf unbounded input

[lttng-tools.git] / src / lib / lttng-ctl / filter / filter-parser.y

diff --git a/src/lib/lttng-ctl/filter/filter-parser.y b/src/lib/lttng-ctl/filter/filter-parser.y
index 3f301340dbb4ccff7150d9ce79d4d86046d07563..d746f78e8d82918c6109170e6fced1f1b70a5dca 100644 (file)
--- a/src/lib/lttng-ctl/filter/filter-parser.y
+++ b/src/lib/lttng-ctl/filter/filter-parser.y
@@ -34,15 +34,20 @@
 
 #include <common/macros.h>
 
+#define WIDTH_u64_SCANF_IS_A_BROKEN_API        "20"
+#define WIDTH_o64_SCANF_IS_A_BROKEN_API        "22"
+#define WIDTH_x64_SCANF_IS_A_BROKEN_API        "17"
+#define WIDTH_lg_SCANF_IS_A_BROKEN_API "4096"  /* Hugely optimistic approximation */
+
 LTTNG_HIDDEN
 int yydebug;
 LTTNG_HIDDEN
 int filter_parser_debug = 0;
 
 LTTNG_HIDDEN
-int yyparse(struct filter_parser_ctx *parser_ctx);
+int yyparse(struct filter_parser_ctx *parser_ctx, yyscan_t scanner);
 LTTNG_HIDDEN
-int yylex(union YYSTYPE *yyval, struct filter_parser_ctx *parser_ctx);
+int yylex(union YYSTYPE *yyval, yyscan_t scanner);
 LTTNG_HIDDEN
 int yylex_init_extra(struct filter_parser_ctx *parser_ctx, yyscan_t * ptr_yy_globals);
 LTTNG_HIDDEN
@@ -188,7 +193,7 @@ static struct filter_node *make_op_node(struct filter_parser_ctx *scanner,
 }
 
 LTTNG_HIDDEN
-void yyerror(struct filter_parser_ctx *parser_ctx, const char *str)
+void yyerror(struct filter_parser_ctx *parser_ctx, yyscan_t scanner, const char *str)
 {
        fprintf(stderr, "error %s\n", str);
 }
@@ -201,7 +206,7 @@ int yywrap(void)
 
 #define parse_error(parser_ctx, str)                           \
 do {                                                           \
-       yyerror(parser_ctx, YY_("parse error: " str "\n"));     \
+       yyerror(parser_ctx, parser_ctx->scanner, YY_("parse error: " str "\n"));        \
        YYERROR;                                                \
 } while (0)
 
@@ -238,7 +243,7 @@ static void filter_ast_free(struct filter_ast *ast)
 LTTNG_HIDDEN
 int filter_parser_ctx_append_ast(struct filter_parser_ctx *parser_ctx)
 {
-       return yyparse(parser_ctx);
+       return yyparse(parser_ctx, parser_ctx->scanner);
 }
 
 LTTNG_HIDDEN
@@ -301,7 +306,8 @@ void filter_parser_ctx_free(struct filter_parser_ctx *parser_ctx)
 %define api.pure
        /* %locations */
 %parse-param {struct filter_parser_ctx *parser_ctx}
-%lex-param {struct filter_parser_ctx *parser_ctx}
+%parse-param {yyscan_t scanner}
+%lex-param {yyscan_t scanner}
 %start translation_unit
 %token CHARACTER_CONSTANT_START SQUOTE STRING_LITERAL_START DQUOTE
 %token ESCSEQ CHAR_STRING_TOKEN
@@ -398,29 +404,39 @@ primary_expression
                {
                        $$ = make_node(parser_ctx, NODE_EXPRESSION);
                        $$->u.expression.type = AST_EXP_CONSTANT;
-                       sscanf(yylval.gs->s, "%" PRIu64,
-                              &$$->u.expression.u.constant);
+                       if (sscanf(yylval.gs->s, "%" WIDTH_u64_SCANF_IS_A_BROKEN_API SCNu64,
+                                       &$$->u.expression.u.constant) != 1) {
+                               parse_error(parser_ctx, "cannot scanf decimal constant");
+                       }
                }
        |       OCTAL_CONSTANT
                {
                        $$ = make_node(parser_ctx, NODE_EXPRESSION);
                        $$->u.expression.type = AST_EXP_CONSTANT;
-                       sscanf(yylval.gs->s, "0%" PRIo64,
-                              &$$->u.expression.u.constant);
+                       if (!strcmp(yylval.gs->s, "0")) {
+                               $$->u.expression.u.constant = 0;
+                       } else if (sscanf(yylval.gs->s, "0%" WIDTH_o64_SCANF_IS_A_BROKEN_API SCNo64,
+                                       &$$->u.expression.u.constant) != 1) {
+                               parse_error(parser_ctx, "cannot scanf octal constant");
+                       }
                }
        |       HEXADECIMAL_CONSTANT
                {
                        $$ = make_node(parser_ctx, NODE_EXPRESSION);
                        $$->u.expression.type = AST_EXP_CONSTANT;
-                       sscanf(yylval.gs->s, "0x%" PRIx64,
-                              &$$->u.expression.u.constant);
+                       if (sscanf(yylval.gs->s, "0x%" WIDTH_x64_SCANF_IS_A_BROKEN_API SCNx64,
+                                       &$$->u.expression.u.constant) != 1) {
+                               parse_error(parser_ctx, "cannot scanf hexadecimal constant");
+                       }
                }
        |       FLOAT_CONSTANT
                {
                        $$ = make_node(parser_ctx, NODE_EXPRESSION);
                        $$->u.expression.type = AST_EXP_FLOAT_CONSTANT;
-                       sscanf(yylval.gs->s, "%lg",
-                              &$$->u.expression.u.float_constant);
+                       if (sscanf(yylval.gs->s, "%" WIDTH_lg_SCANF_IS_A_BROKEN_API "lg",
+                                       &$$->u.expression.u.float_constant) != 1) {
+                               parse_error(parser_ctx, "cannot scanf float constant");
+                       }
                }
        |       STRING_LITERAL_START DQUOTE
                {