From 6f8126faebeddf8a93a7c0041c096bf584efcefb Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike.dalessio@gmail.com>
Date: Tue, 29 Aug 2023 15:38:48 -0400
Subject: [PATCH] [ruby/yarp] fix: string escape char "\" at the end of a file

Previously this resulted in invalid memory access.

Found by the fuzzer.

https://github.com/ruby/yarp/commit/178862e2ca
---
 test/yarp/fuzzer_test.rb | 1 +
 yarp/yarp.c              | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/test/yarp/fuzzer_test.rb b/test/yarp/fuzzer_test.rb
index 6962e6be76..e2aa9dab61 100644
--- a/test/yarp/fuzzer_test.rb
+++ b/test/yarp/fuzzer_test.rb
@@ -14,4 +14,5 @@ class FuzzerTest < Test::Unit::TestCase
 
   snippet "incomplete global variable", "$"
   snippet "incomplete symbol", ":"
+  snippet "incomplete escaped string", '"\\'
 end
diff --git a/yarp/yarp.c b/yarp/yarp.c
index 15511ebc9e..91c814af9a 100644
--- a/yarp/yarp.c
+++ b/yarp/yarp.c
@@ -7224,6 +7224,12 @@ parser_lex(yp_parser_t *parser) {
                         breakpoint = yp_strpbrk(parser, breakpoint + 1, breakpoints, parser->end - (breakpoint + 1));
                         break;
                     case '\\': {
+                        // Check that we're not at the end of the file.
+                        if (breakpoint + 1 >= parser->end) {
+                            breakpoint = NULL;
+                            break;
+                        }
+
                         // If we hit escapes, then we need to treat the next token
                         // literally. In this case we'll skip past the next character and
                         // find the next breakpoint.