Re: Pike 8.1 widestring out-of-bounds bug

On Tue, 7 Jun 2016, Pontus Rodling wrote:

> Hi,
>
> I've been trying out Pike 8.1 with some projects and ran into a nasty
> issue where the bbcode parsing module for a community site started
> spewing out random garbage at the end of the processed data, garbage
> that was somewhat different every time.
>
> As it turns out, some operations on widestrings causes Pike to read data
> outside of string memory.
> This was tested in 8.1 / 407d071f2ae0.
>
>
> I've managed to narrow it down to a very simple test:
>
> Pike v8.0 release 245 running Hilfe v3.5 (Incremental Pike Frontend)
>> "ABCD\u2019"[1..][1..] == "ABCD\u2019"[2..];
> (1) Result: 1    // Good
>
> Pike v8.1 release 4 running Hilfe v3.5 (Incremental Pike Frontend)
>> "ABCD\u2019"[1..][1..] == "ABCD\u2019"[2..];
> (1) Result: 0    // Bad
[...]

Thanks for the report and test case.

Fixed in git.

 	/grubba

-- 
Henrik Grubbström					[email protected]
Roxen Internet Software AB