1# $NetBSD: parse.mk,v 1.4 2023/04/28 13:09:48 rillig Exp $ 2# 3# Test those parts of the parsing that do not belong in any of the other 4# categories. 5 6# expect+1: Makefile appears to contain unresolved CVS/RCS/??? merge conflicts 7<<<<<< old 8 9# No diagnostic since the following line is parsed as a variable assignment, 10# even though the variable name is empty. See also varname-empty.mk. 11====== middle 12 13# expect+1: Makefile appears to contain unresolved CVS/RCS/??? merge conflicts 14>>>>>> new 15 16 17# Since parse.c 1.578 from 2021-12-14 and before parse.c 1.681 from 18# 2022-07-24, if a line of a makefile could only be a dependency specification 19# but didn't contain any of the dependency operators ':', '!', '::' and its 20# expansion ended with a space, make read a single byte from the memory beyond 21# the expanded line's terminating '\0'. 22# 23# https://bugs.freebsd.org/265119 24one-target ${:U } 25 26 27# Since parse.c 1.656 from 2022-01-27 and before parse.c 1.662 from 28# 2022-02-05, there was an out-of-bounds read in Parse_IsVar when looking for 29# a variable assignment in a dependency line with trailing whitespace. Lines 30# without trailing whitespace were not affected. Global variable assignments 31# were guaranteed to have no trailing whitespace and were thus not affected. 32# 33# Try to reproduce some variants that may lead to a crash, depending on the 34# memory allocator. To get a crash, the terminating '\0' of the line must be 35# the last byte of a memory page. The expression '${:U}' forces this trailing 36# whitespace. 37 38# On FreeBSD x86_64, a crash could in some cases be forced using the following 39# line, which has length 47, and if the memory for the expanded line starts at 40# 0xXXXX_XXd0, the terminating '\0' may end up at 0xXXXX_Xfff: 41Try_to_crash_FreeBSD.xxxxxxxxxxxxxxxxxx: 12345 ${:U} 42 43# The following line has length 4095 after being expanded, so line[4095] == 44# '\0'. If the line is 45# allocated on a page boundary and the following page is not mapped, this line 46# leads to a segmentation fault. 47${:U:range=511:@_@1234567@:ts.}: 12345 ${:U} 48 49# The following line has length 8191, so line[8191] == '\0'. If the line is 50# allocated on a page boundary and the following page is not mapped, this line 51# leads to a segmentation fault. 52${:U:range=1023:@_@1234567@:ts.}: 12345 ${:U} 53 5412345: 55