bison uses invalid memory in rare situations

Bug #247141 reported by Kees Cook
2
Affects Status Importance Assigned to Milestone
bison (Ubuntu)
New
Undecided
Unassigned

Bug Description

Binary package hint: bison

As detailed here:

http://undeadly.org/cgi?action=article&sid=20080708155228

Bison should get fixed too.

http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/yacc/skeleton.c.diff?r1=1.28&r2=1.29

Bison does carry an interesting note:

  /* yyn is the number of a rule to reduce with. */
  yylen = yyr2[yyn];

  /* If YYLEN is nonzero, implement the default value of the action:
     `$$ = $1'.

     Otherwise, the following line sets YYVAL to garbage.
     This behavior is undocumented and Bison
     users should not rely upon it. Assigning to YYVAL
     unconditionally makes the parser a bit smaller, and it avoids a
     GCC warning that YYVAL may be used uninitialized. */
  yyval = yyvsp[1-yylen];

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.