[bug #68441] Entering "x ..." causes Octave to become unresponsive

Please use the bug tracker to post updates to a bug report.  The mailing list is intended as a read-only notification stream.  Info posted to this mailing list address won't appear in the tracker database where it is most useful.

Follow-up Comment #3, bug #68441 (group octave):

Making a special rule "<COMMAND_START>\001" makes lexer more robust, though I
could not figure out a test case for this so not 100% sure if we need this.


--- a/libinterp/parse-tree/lex.ll       Wed Jun 10 20:03:57 2026 +0200
+++ b/libinterp/parse-tree/lex.ll       Thu Jun 11 15:25:43 2026 -0400
@@ -455,6 +455,22 @@
   }
 
 %{
+// If we are using the push parser/lexer interface, we may see the
+// special ASCII 0x01 marker that push_lexer::fill_flex_buffer inserts
+// when it reaches the end of the input buffer (bug #68441).  The
+// marker means we need more input, so it must not become part of a
+// command argument.  This rule must precede the rules that slurp text
+// into command arguments because flex breaks ties between equal-length
+// matches by choosing the earlier rule.
+%}
+
+<COMMAND_START>\001 {
+    curr_lexer->lexer_debug ("<COMMAND_START>\\001");
+
+    HANDLE_EOB_OR_EOF (-1);
+  }
+
+%{
 // Commands normally end at the end of a line or a semicolon.
 %}
 
@@ -1881,8 +1897,18 @@
 
     // Check for possible command syntax before doing any other operations
     // that may modify the input buffer.
-
-    if (curr_lexer->previous_token_may_be_command ()
+    //
+    // If we are using the push parser/lexer interface, the current
+    // character may be the special ASCII 1 marker that
+    // push_lexer::fill_flex_buffer inserts when it reaches the end of
+    // the input buffer.  That marker means we need more input, so it
+    // must not begin a command argument.  If it did, the COMMAND_START
+    // rules would consume the marker (and any subsequent markers)
+    // without ever requesting more input, sending the lexer into an
+    // infinite loop.
+
+    if (! (curr_lexer->is_push_lexer () && yytext[0] == '\001')
+        && curr_lexer->previous_token_may_be_command ()
         && curr_lexer->space_follows_previous_token ())
       {
         yyless (0);


Also attached as a CSET (file bug68441_lexer_hardening_20260611_200.cset)

Dmitri.
-- 


(file #58708)

    _______________________________________________________

Additional Item Attachment:

Name: bug68441_lexer_hardening_20260611_200.cset Size: 3.7KiB

<https://file.savannah.gnu.org/file/bug68441_lexer_hardening_20260611_200.cset?file_id=58708>


    AGPL NOTICE

These attachments are served by Savane. You can download the corresponding
source code of Savane at
https://git.savannah.nongnu.org/cgit/administration/savane.git/snapshot/savane-c36938be85ff6c1b727bc7dd7fd30e48f9142870.tar.gz


    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?68441>

_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQQk97aszIMMAvLLwm6qLAuaBUf3TgUCaisNzgAKCRCqLAuaBUf3
ThtcAP9bypjXI/gyrLULMWhXncSgJTmG05a/Q4w5EoZrU7jZUAEAlKdJ77ShkHZ/
3mFnXCeowx9wSyvsyVzjMxv6q4yESwQ=
=Cyv1
-----END PGP SIGNATURE-----