beltoforion / muparserx

A C++ Library for Parsing Expressions with Strings, Complex Numbers, Vectors, Matrices and more.
http://beltoforion.de/en/muparserx
BSD 2-Clause "Simplified" License
135 stars 60 forks source link

Assertions from 0<01?1+:1 in parser/mpParserBase.cpp, line 1103 #60

Closed nasailja closed 9 years ago

nasailja commented 9 years ago

Latest git with parser in #55 asserts with following expressions: 0<01?1=:1 0<01?1<:1 0<01?1>:1 0<01?1-:1 0<01?1+:1 0<01?1*:1 0<01?1/:1 0<01?1&:1 0<01?1<<:1 0<01?1>>:1, reduced versions of ones found with afl. The 0 in 01 is required for the assert, as is 0<01 instead of 0>01 or 0=01.

nasailja commented 9 years ago

This also triggers the assert: 0<1?1!<1?1:1!=1+:1!=1

nasailja commented 9 years ago

AFL has found about 60 unique (for some definition of unique) crashes (asserts probably) in muparserx from latest git so far. I suggest fixing asserts from currently known expressions and afterwards I can rerun the tests to see if any bugs survived.

nasailja commented 9 years ago

Another one: {0<-0?1,-0/1,-0<-0,0,-0<-0,0:0<-0,0-0<-0,0}, reduced version: {0<0?0,0:0<0}

beltoforion commented 9 years ago

Fixed in V4.0.2; Main parsing engine does no longer use assertions. You should always get an exception now.