fix(gentype): ctypedef 检查 strcmp 改 strncmp 限长比较,修 stdint.vp 读穿崩溃

prefix=1(attr 内容 'CTypedef' 正确)后仍崩——attr 是零拷贝引用
src_buf 的 token 字符串,无 NUL 结尾(后跟空格/其他字符),strcmp
无限读穿到页边界 0xC0000005。改 strncmp 限长 8 + 第 9 字节分隔符
校验;mod_id 的 strcmp 同样改 strncmp。
This commit is contained in:
TermiNexus committed 2026-08-18 10:02:26 +08:00
1 parent 8db2d1c23b
commit 23945cd168
1 file changed
+15 -5
+15 -5
View File
@@ -150,14 +150,19 @@ class TypeGenCType(TypeGenBase.TypeGenBase):
if at_attr_v[0] == 'C' and at_attr_v[1] == 'T' \
and at_attr_v[2] == 'y' and at_attr_v[3] == 'p':
attr_ok_d = 1
stdio.printf("[DIAG] ctypedef 检查: attr=%llu prefix=%d\n",
t.CUInt64T(at_attr_v), attr_ok_d)
if at_attr_v is None:
return 0
if attr_ok_d == 0:
# 内容损坏:跳过 strcmp(防读穿崩),返回 0(非 CTypedef)
return 0
if string.strcmp(at_attr_v, "CTypedef") != 0:
# 限长比较替代 strcmp:attr 是零拷贝引用 src_buf 的 token 字符串,
# 可能无 NUL 结尾("CTypedef" 后紧跟空格/其他字符),strcmp 会
# 无限读穿到页边界 → 0xC0000005(stdint.vp 崩溃根因)。strncmp
# 只读 8 字节,再校验第 9 字节为终止/分隔符(防 "CTypedefXXX" 误匹配)。
if string.strncmp(at_attr_v, "CTypedef", 8) != 0:
return 0
sep_ch_d: t.CChar = at_attr_v[8]
if sep_ch_d != '\0' and sep_ch_d != ' ' and sep_ch_d != '\n' \
and sep_ch_d != '\r' and sep_ch_d != '\t' and sep_ch_d != '|':
return 0
at_val_v: ast.AST | t.CPtr = ast.attribute_get_value(at)
if at_val_v is None or at_val_v.kind() != ast.ASTKind.Name:
@@ -166,7 +171,12 @@ class TypeGenCType(TypeGenBase.TypeGenBase):
mod_id_v: str = ast.name_get_id(mod_nm)
if mod_id_v is None:
return 0
if string.strcmp(mod_id_v, "t") != 0:
# 同样限长比较("t" 无 NUL 结尾时 strcmp 读穿)
if string.strncmp(mod_id_v, "t", 1) != 0:
return 0
sep_ch_m: t.CChar = mod_id_v[1]
if sep_ch_m != '\0' and sep_ch_m != ' ' and sep_ch_m != '\n' \
and sep_ch_m != '\r' and sep_ch_m != '\t' and sep_ch_m != '|':
return 0
return 1
def ScanCTypedefDeclarations(self, pool: memhub.MemBuddy | t.CPtr,