Fix parse_operand

The buffer length len and the requested number of tokens n are mixed up
in an invalid comparison. This causes all valid requests for n < len
tokens to be denied and all invalid requests for n > len tokens to be
accepted. This may cause a buffer overflow if the caller requests more
characters than they provide space for.

src/parser/parser.c

@@ -9,8 +9,7 @@
 parse_result_t parse_number(tokenlist_entry_t *current) {
     parser_t parsers[] = {parse_octal, parse_decimal, parse_hexadecimal,
                           parse_binary, nullptr};
-    parse_result_t result = parse_any(current, parsers);
-    return parse_result_wrap(NODE_NUMBER, result);
+    return parse_any(current, parsers);
 }
 
 parse_result_t parse_plus_or_minus(tokenlist_entry_t *current) {
@@ -21,12 +20,12 @@ parse_result_t parse_plus_or_minus(tokenlist_entry_t *current) {
 parse_result_t parse_register_index(tokenlist_entry_t *current) {
     parser_t parsers[] = {parse_plus, parse_register, parse_asterisk,
                           parse_number, nullptr};
-    return parse_consecutive(current, NODE_REGISTER_INDEX, parsers);
+    return parse_consecutive(current, NODE_LABEL, parsers);
 }
 
 parse_result_t parse_register_offset(tokenlist_entry_t *current) {
     parser_t parsers[] = {parse_plus_or_minus, parse_number, nullptr};
-    return parse_consecutive(current, NODE_REGISTER_OFFSET, parsers);
+    return parse_consecutive(current, NODE_LABEL, parsers);
 }
 
 parse_result_t parse_register_expression(tokenlist_entry_t *current) {
@@ -36,7 +35,6 @@ parse_result_t parse_register_expression(tokenlist_entry_t *current) {
     error_t *err = ast_node_alloc(&expr);
     if (err)
         return parse_error(err);
-    expr->id = NODE_REGISTER_EXPRESSION;
 
     // <register>
     result = parse_register(current);
@@ -84,8 +82,7 @@ parse_result_t parse_register_expression(tokenlist_entry_t *current) {
 
 parse_result_t parse_immediate(tokenlist_entry_t *current) {
     parser_t parsers[] = {parse_number, parse_identifier, nullptr};
-    parse_result_t result = parse_any(current, parsers);
-    return parse_result_wrap(NODE_IMMEDIATE, result);
+    return parse_any(current, parsers);
 }
 
 parse_result_t parse_memory_expression(tokenlist_entry_t *current) {
@@ -96,7 +93,7 @@ parse_result_t parse_memory_expression(tokenlist_entry_t *current) {
 parse_result_t parse_memory(tokenlist_entry_t *current) {
     parser_t parsers[] = {parse_lbracket, parse_memory_expression,
                           parse_rbracket, nullptr};
-    return parse_consecutive(current, NODE_MEMORY, parsers);
+    return parse_consecutive(current, NODE_LABEL, parsers);
 }
 
 parse_result_t parse_operand(tokenlist_entry_t *current) {

src/parser/primitives.c

@@ -62,11 +62,6 @@ parse_result_t parse_dot(tokenlist_entry_t *current) {
     return parse_token(current, TOKEN_DOT, NODE_DOT, nullptr);
 }
 
-parse_result_t parse_label_reference(tokenlist_entry_t *current) {
-    return parse_token(current, TOKEN_IDENTIFIER, NODE_LABEL_REFERENCE,
-                       nullptr);
-}
-
 const char *registers[] = {
     // 64-bit registers
     "rax", "rcx", "rdx", "rbx", "rsp", "rbp", "rsi", "rdi", "r8", "r9", "r10",
@@ -80,7 +75,6 @@ const char *registers[] = {
     // 8-bit low registers
     "al", "cl", "dl", "bl", "spl", "bpl", "sil", "dil", "r8b", "r9b", "r10b",
     "r11b", "r12b", "r13b", "r14b", "r15b", nullptr};
-
 bool is_register_token(lexer_token_t *token) {
     for (size_t i = 0; registers[i] != nullptr; ++i)
         if (strcmp(token->value, registers[i]) == 0)

src/parser/primitives.h

@@ -18,7 +18,6 @@ parse_result_t parse_plus(tokenlist_entry_t *current);
 parse_result_t parse_minus(tokenlist_entry_t *current);
 parse_result_t parse_asterisk(tokenlist_entry_t *current);
 parse_result_t parse_dot(tokenlist_entry_t *current);
-parse_result_t parse_label_reference(tokenlist_entry_t *current);
 
 /* These are "primitives" with a different name and some extra validation on top
  * for example, register is just an identifier but it only matches a limited set

src/parser/util.c

@@ -33,24 +33,3 @@ parse_result_t parse_token(tokenlist_entry_t *current,
 
     return parse_success(node, current->next);
 }
-
-parse_result_t parse_result_wrap(node_id_t id, parse_result_t result) {
-    if (result.err)
-        return result;
-
-    ast_node_t *node;
-    error_t *err = ast_node_alloc(&node);
-    if (err) {
-        ast_node_free(result.node);
-        return parse_error(err);
-    }
-    node->id = id;
-
-    err = ast_node_add_child(node, result.node);
-    if (err) {
-        ast_node_free(result.node);
-        return parse_error(err);
-    }
-
-    return parse_success(node, result.next);
-}

src/parser/util.h

@@ -19,7 +19,8 @@ parse_result_t parse_success(ast_node_t *ast, tokenlist_entry_t *next);
 parse_result_t parse_token(tokenlist_entry_t *current,
                            lexer_token_id_t token_id, node_id_t ast_id,
                            token_validator_t is_valid);
-parse_result_t parse_result_wrap(node_id_t id, parse_result_t result);
+
+tokenlist_entry_t *skip_insignificant(tokenlist_entry_t *);
 
 extern error_t *err_parse_no_match;
 

tests/input/valid.asm

@@ -1,17 +1,8 @@
 .section text
 
-; Small valid code snippet that should contain all different AST nodes
-
 _start:
     mov eax, ebx
-    lea eax, [eax + ebx * 4 + 8]
-    lea eax, [eax + 8]
-    lea eax, [eax + ebx * 8]
-    lea eax, [esp - 24]
-    lea eax, [eax + ebx * 4 - 8]
-    lea eax, [_start]
-    mov eax, _start
-    mov eax, 555
+    mov eax, 555            ; move 555 into eax
     push 0o777
     xor eax, 0xDEADBEEF
     and ecx, 0o770