From 528f90adfb4abefd1f2fa2783bf6fbd23998f20f Mon Sep 17 00:00:00 2001
From: sauwming <ming@teluu.com>
Date: Fri, 3 Nov 2023 11:40:51 +0800
Subject: [PATCH] Check for buffer EOF in scanner (#3753)

---
 pjlib-util/src/pjlib-util/scanner.c | 47 +++++++++++++++++------------
 1 file changed, 27 insertions(+), 20 deletions(-)

diff --git a/pjlib-util/src/pjlib-util/scanner.c b/pjlib-util/src/pjlib-util/scanner.c
index 177597c28..b4e5af179 100644
--- a/pjlib-util/src/pjlib-util/scanner.c
+++ b/pjlib-util/src/pjlib-util/scanner.c
@@ -142,14 +142,17 @@ PJ_DEF(void) pj_scan_skip_whitespace( pj_scanner *scanner )
 {
     register char *s = scanner->curptr;
 
-    while (PJ_SCAN_IS_SPACE(*s)) {
+    while (PJ_SCAN_CHECK_EOF(s) && PJ_SCAN_IS_SPACE(*s)) {
         ++s;
     }
 
-    if (PJ_SCAN_IS_NEWLINE(*s) && (scanner->skip_ws & PJ_SCAN_AUTOSKIP_NEWLINE)) {
-        for (;;) {
+    if (PJ_SCAN_CHECK_EOF(s) && PJ_SCAN_IS_NEWLINE(*s) &&
+        (scanner->skip_ws & PJ_SCAN_AUTOSKIP_NEWLINE))
+    {
+        for (; PJ_SCAN_CHECK_EOF(s); ) {
             if (*s == '\r') {
                 ++s;
+                if (!PJ_SCAN_CHECK_EOF(s)) break;
                 if (*s == '\n') ++s;
                 ++scanner->line;
                 scanner->curptr = scanner->start_line = s;
@@ -160,30 +163,33 @@ PJ_DEF(void) pj_scan_skip_whitespace( pj_scanner *scanner )
             } else if (PJ_SCAN_IS_SPACE(*s)) {
                 do {
                     ++s;
-                } while (PJ_SCAN_IS_SPACE(*s));
+                } while (PJ_SCAN_CHECK_EOF(s) && PJ_SCAN_IS_SPACE(*s));
             } else {
                 break;
             }
         }
     }
 
-    if (PJ_SCAN_IS_NEWLINE(*s) && (scanner->skip_ws & PJ_SCAN_AUTOSKIP_WS_HEADER)==PJ_SCAN_AUTOSKIP_WS_HEADER) {
+    if (PJ_SCAN_CHECK_EOF(s) && PJ_SCAN_IS_NEWLINE(*s) &&
+        (scanner->skip_ws & PJ_SCAN_AUTOSKIP_WS_HEADER)==
+         PJ_SCAN_AUTOSKIP_WS_HEADER)
+    {
         /* Check for header continuation. */
         scanner->curptr = s;
 
         if (*s == '\r') {
             ++s;
         }
-        if (*s == '\n') {
+        if (PJ_SCAN_CHECK_EOF(s) && *s == '\n') {
             ++s;
         }
         scanner->start_line = s;
 
-        if (PJ_SCAN_IS_SPACE(*s)) {
+        if (PJ_SCAN_CHECK_EOF(s) && PJ_SCAN_IS_SPACE(*s)) {
             register char *t = s;
             do {
                 ++t;
-            } while (PJ_SCAN_IS_SPACE(*t));
+            } while (PJ_SCAN_CHECK_EOF(t) && PJ_SCAN_IS_SPACE(*t));
 
             ++scanner->line;
             scanner->curptr = t;
@@ -220,8 +226,7 @@ PJ_DEF(int) pj_scan_peek( pj_scanner *scanner,
         return -1;
     }
 
-    /* Don't need to check EOF with PJ_SCAN_CHECK_EOF(s) */
-    while (pj_cis_match(spec, *s))
+    while (PJ_SCAN_CHECK_EOF(s) && pj_cis_match(spec, *s))
         ++s;
 
     pj_strset3(out, scanner->curptr, s);
@@ -277,17 +282,15 @@ PJ_DEF(void) pj_scan_get( pj_scanner *scanner,
 
     do {
         ++s;
-    } while (pj_cis_match(spec, *s));
-    /* No need to check EOF here (PJ_SCAN_CHECK_EOF(s)) because
-     * buffer is NULL terminated and pj_cis_match(spec,0) should be
-     * false.
-     */
+    } while (PJ_SCAN_CHECK_EOF(s) && pj_cis_match(spec, *s));
 
     pj_strset3(out, scanner->curptr, s);
 
     scanner->curptr = s;
 
-    if (PJ_SCAN_IS_PROBABLY_SPACE(*s) && scanner->skip_ws) {
+    if (!pj_scan_is_eof(scanner) &&
+        PJ_SCAN_IS_PROBABLY_SPACE(*s) && scanner->skip_ws)
+    {
         pj_scan_skip_whitespace(scanner);    
     }
 }
@@ -330,18 +333,20 @@ PJ_DEF(void) pj_scan_get_unescape( pj_scanner *scanner,
             char *start = s;
             do {
                 ++s;
-            } while (pj_cis_match(spec, *s));
+            } while (PJ_SCAN_CHECK_EOF(s) && pj_cis_match(spec, *s));
 
             if (dst != start) pj_memmove(dst, start, s-start);
             dst += (s-start);
         } 
         
-    } while (*s == '%');
+    } while (PJ_SCAN_CHECK_EOF(s) && (*s == '%'));
 
     scanner->curptr = s;
     out->slen = (dst - out->ptr);
 
-    if (PJ_SCAN_IS_PROBABLY_SPACE(*s) && scanner->skip_ws) {
+    if (!pj_scan_is_eof(scanner) &&
+        PJ_SCAN_IS_PROBABLY_SPACE(*s) && scanner->skip_ws)
+    {
         pj_scan_skip_whitespace(scanner);    
     }
 }
@@ -422,7 +427,9 @@ PJ_DEF(void) pj_scan_get_quotes(pj_scanner *scanner,
 
     scanner->curptr = s;
 
-    if (PJ_SCAN_IS_PROBABLY_SPACE(*s) && scanner->skip_ws) {
+    if (!pj_scan_is_eof(scanner) &&
+        PJ_SCAN_IS_PROBABLY_SPACE(*s) && scanner->skip_ws)
+    {
         pj_scan_skip_whitespace(scanner);
     }
 }