Fix bugs A, B, C, D, E, F

A: file_read rejects non-number/negative size before the size_t cast (was: std::length_error escaping as Fatal Error).

B: json_stringify tracks visited lists/dicts, errors on cycles (was: stack overflow segfault).

C: json_parse parse_val takes a depth param, caps at 1000 (was: stack overflow segfault on deep input).

D: std_db_query_rows bind loop uses a separate bind counter (was: explicit db handle shifted all later params, silent null).

E: Chunk::deserialize / ObjFunction::deserialize take a depth param, cap at 1000 (was: stack overflow segfault on nested .shbc).

F: OP_CLOSURE checks upvalue index against the frame stack window (is_local) or the enclosing closure's upvalue count (was: OOB read / wild capture segfault).

Author: Shrey-N

.github/workflows/ci.yml

@@ -90,9 +90,11 @@ jobs:
             with open(f, encoding="utf-8") as fh:
                 src = fh.read()
             once = subprocess.run([exe, "fmt", "--stdin"], input=src,
-                                  capture_output=True, text=True).stdout
+                                  capture_output=True, text=True,
+                                  encoding="utf-8").stdout
             twice = subprocess.run([exe, "fmt", "--stdin"], input=once,
-                                   capture_output=True, text=True).stdout
+                                   capture_output=True, text=True,
+                                   encoding="utf-8").stdout
             if once != twice:
                 print(f"NOT IDEMPOTENT: {f}")
                 bad += 1

.gitignore

@@ -1,6 +1,7 @@
 # Build artifacts
 build/
 build_cpp/
+build_asan/
 package/
 dist/
 bin/

shell_lite/chunk.cpp

@@ -3,6 +3,7 @@
 #include "objects.hpp"
 #include "vm.hpp"
 #include <iostream>
+#include <memory>
 namespace shell_lite {
 
 int Chunk::add_constant(Value value) {
@@ -75,31 +76,31 @@ void Chunk::serialize(std::ostream& out) const {
     }
 }
 
-Chunk* Chunk::deserialize(std::istream& in, GCArena& arena) {
-    auto* c = new Chunk();
+Chunk* Chunk::deserialize(std::istream& in, GCArena& arena, int depth) {
+    auto c = std::make_unique<Chunk>();
+    if (depth > 1000) {
+        throw std::runtime_error("Function nesting too deep in bytecode");
+    }
     uint32_t magic = 0;
     read_bin(in, magic);
     if (!in || magic != 0x43424853) {
-        delete c;
         throw std::runtime_error("Invalid SHBC bytecode: missing magic header");
     }
     uint32_t version = 0;
     read_bin(in, version);
     if (!in || version > 0x00010000) {
-        delete c;
         throw std::runtime_error("Unsupported SHBC bytecode version");
     }
 
     uint32_t const_count = 0;
     read_bin(in, const_count);
     if (!in || const_count > 1000000) {
-        delete c;
         throw std::runtime_error("Invalid constant count in bytecode");
     }
     for (uint32_t i = 0; i < const_count; ++i) {
         uint8_t tag = 0;
         read_bin(in, tag);
-        if (!in) { delete c; throw std::runtime_error("Unexpected EOF in bytecode constants"); }
+        if (!in) { throw std::runtime_error("Unexpected EOF in bytecode constants"); }
         if (tag == 0x00) {
             c->constants.push_back(Value());
         } else if (tag == 0x01) {
@@ -110,35 +111,32 @@ Chunk* Chunk::deserialize(std::istream& in, GCArena& arena) {
             c->constants.push_back(Value(d));
         } else if (tag == 0x03) {
             uint32_t len = 0; read_bin(in, len);
-            if (!in || len > 10000000) { delete c; throw std::runtime_error("Invalid string length in bytecode"); }
+            if (!in || len > 10000000) { throw std::runtime_error("Invalid string length in bytecode"); }
             std::string s(len, '\0');
             in.read(&s[0], len);
-            if (!in) { delete c; throw std::runtime_error("Unexpected EOF reading string constant"); }
+            if (!in) { throw std::runtime_error("Unexpected EOF reading string constant"); }
             c->constants.push_back(Value(arena.allocate_string(s)));
         } else if (tag == 0x04) {
-            c->constants.push_back(Value(ObjFunction::deserialize(in, arena)));
+            c->constants.push_back(Value(ObjFunction::deserialize(in, arena, depth + 1)));
         } else {
-            delete c;
             throw std::runtime_error("Invalid constant type tag in SHBC");
         }
     }
 
     uint32_t code_size = 0;
     read_bin(in, code_size);
     if (!in || code_size > 10000000) {
-        delete c;
         throw std::runtime_error("Invalid code size in bytecode");
     }
     c->code.resize(code_size);
     if (code_size > 0) {
         in.read(reinterpret_cast<char*>(c->code.data()), code_size);
-        if (!in) { delete c; throw std::runtime_error("Unexpected EOF reading bytecode"); }
+        if (!in) { throw std::runtime_error("Unexpected EOF reading bytecode"); }
     }
 
     uint32_t loc_count = 0;
     read_bin(in, loc_count);
     if (!in || loc_count > 1000000) {
-        delete c;
         throw std::runtime_error("Invalid location count in bytecode");
     }
     for (uint32_t i = 0; i < loc_count; ++i) {
@@ -148,10 +146,9 @@ Chunk* Chunk::deserialize(std::istream& in, GCArena& arena) {
     }
 
     if (!c->verify()) {
-        delete c;
         throw std::runtime_error("Bytecode verification failed for chunk");
     }
-    return c;
+    return c.release();
 }
 
 bool Chunk::verify() const {

shell_lite/chunk.hpp

@@ -128,7 +128,7 @@ struct Chunk {
   Chunk *clone(GCArena &target,
                std::unordered_map<GCObject *, GCObject *> &clones);
   void serialize(std::ostream& out) const;
-  static Chunk* deserialize(std::istream& in, GCArena& arena);
+  static Chunk* deserialize(std::istream& in, GCArena& arena, int depth = 0);
   bool verify() const;
 };
 

shell_lite/formatter.cpp

@@ -455,8 +455,6 @@ int Formatter::expr_end(Node *node) {
   return e;
 }
 
-// last line of a statement by matching brackets in the source
-// ast nodes dont cover closers sitting on their own line
 int Formatter::bracket_end(int from_line, int bound_line) const {
   if (from_line < 1 || (size_t)from_line > line_offsets_.size())
     return from_line;
@@ -490,8 +488,6 @@ int Formatter::bracket_end(int from_line, int bound_line) const {
     if (depth == 0 && has_code)
       candidate = line;
     has_code = false;
-    // a depth zero line followed by same or lower indent ends the statement
-    // continuations are deeper indented or sit inside brackets
     if (depth == 0 && line + 1 < last && line_indent(line + 1) <= base_indent)
       stop = true;
   };

shell_lite/modules/module_core.cpp

@@ -8,6 +8,8 @@
 #include <sstream>
 #include <cmath>
 #include <functional>
+#include <set>
+#include <unordered_set>
 #include <unordered_map>
 #include <cstdint>
 #include <cstdio>
@@ -881,7 +883,27 @@ void register_stdlib_core(VM *vm) {
     Value v = vm->peek(arg_count - 1);
     int indent_size = (arg_count >= 2) ? (int)vm->peek(arg_count - 2).as_number() : 0;
 
+    std::unordered_set<const void*> seen;
+    auto json_escape = [](const std::string& s) -> std::string {
+      std::string res = "\"";
+      for (char c : s) {
+        switch (c) {
+          case '"': res += "\\\""; break;
+          case '\\': res += "\\\\"; break;
+          case '\b': res += "\\b"; break;
+          case '\f': res += "\\f"; break;
+          case '\n': res += "\\n"; break;
+          case '\r': res += "\\r"; break;
+          case '\t': res += "\\t"; break;
+          default: res += c; break;
+        }
+      }
+      res += "\"";
+      return res;
+    };
     std::function<std::string(Value, int)> stringify = [&](Value val, int depth) -> std::string {
+      if (depth > 1000)
+        throw std::runtime_error("json_stringify: nesting too deep");
       if (val.is_null()) return "null";
       if (val.is_bool()) return val.as_bool() ? "true" : "false";
       if (val.is_number()) {
@@ -893,80 +915,75 @@ void register_stdlib_core(VM *vm) {
         ss << num;
         return ss.str();
       }
-      if (val.is_string()) {
-        std::string s = val.as_string();
-        std::string res = "\"";
-        for (char c : s) {
-          switch (c) {
-            case '"': res += "\\\""; break;
-            case '\\': res += "\\\\"; break;
-            case '\b': res += "\\b"; break;
-            case '\f': res += "\\f"; break;
-            case '\n': res += "\\n"; break;
-            case '\r': res += "\\r"; break;
-            case '\t': res += "\\t"; break;
-            default: res += c; break;
-          }
-        }
-        res += "\"";
-        return res;
-      }
+      if (val.is_string()) return json_escape(val.as_string());
       if (val.is_list()) {
         auto *list = static_cast<ObjList*>(val.get_obj());
-        if (list->elements.empty()) return "[]";
-        if (indent_size > 0) {
+        if (!seen.insert(list).second)
+          throw std::runtime_error("json_stringify: cyclic structure");
+        std::string res;
+        if (list->elements.empty()) res = "[]";
+        else if (indent_size > 0) {
           std::string indent_str(depth * indent_size, ' ');
           std::string inner_indent((depth + 1) * indent_size, ' ');
-          std::string res = "[\n";
+          res = "[\n";
           for (size_t i = 0; i < list->elements.size(); ++i) {
             if (i > 0) res += ",\n";
             res += inner_indent + stringify(list->elements[i], depth + 1);
           }
           res += "\n" + indent_str + "]";
-          return res;
         } else {
-          std::string res = "[";
+          res = "[";
           for (size_t i = 0; i < list->elements.size(); ++i) {
             if (i > 0) res += ", ";
-            res += stringify(list->elements[i], 0);
+            res += stringify(list->elements[i], depth + 1);
           }
           res += "]";
-          return res;
         }
+        seen.erase(list);
+        return res;
       }
       if (val.is_dict()) {
         auto *dict = static_cast<ObjDict*>(val.get_obj());
-        if (dict->elements.empty()) return "{}";
-        if (indent_size > 0) {
+        if (!seen.insert(dict).second)
+          throw std::runtime_error("json_stringify: cyclic structure");
+        std::string res;
+        if (dict->elements.empty()) res = "{}";
+        else if (indent_size > 0) {
           std::string indent_str(depth * indent_size, ' ');
           std::string inner_indent((depth + 1) * indent_size, ' ');
-          std::string res = "{\n";
+          res = "{\n";
           bool first = true;
           for (auto &pair : dict->elements) {
             if (!first) res += ",\n";
             first = false;
-            res += inner_indent + stringify(Value(vm->arena().allocate_string(pair.first)), 0);
+            res += inner_indent + json_escape(pair.first);
             res += ": " + stringify(pair.second, depth + 1);
           }
           res += "\n" + indent_str + "}";
-          return res;
         } else {
-          std::string res = "{";
+          res = "{";
           bool first = true;
           for (auto &pair : dict->elements) {
             if (!first) res += ", ";
             first = false;
-            res += stringify(Value(vm->arena().allocate_string(pair.first)), 0);
+            res += json_escape(pair.first);
             res += ": ";
-            res += stringify(pair.second, 0);
+            res += stringify(pair.second, depth + 1);
           }
           res += "}";
-          return res;
         }
+        seen.erase(dict);
+        return res;
       }
       return "\"" + val.to_string() + "\"";
     };
-    return Value(vm->arena().allocate_string(stringify(v, 0)));
+    try {
+      return Value(vm->arena().allocate_string(stringify(v, 0)));
+    } catch (const std::exception& e) {
+      vm->has_error = true;
+      vm->error_value = Value(vm->arena().allocate_string(e.what()));
+      return Value();
+    }
   };
 
   NativeRegistry::register_builtin(vm, "json_stringify", -1, json_stringify_fn);
@@ -1020,9 +1037,10 @@ void register_stdlib_core(VM *vm) {
       return out;
     };
 
-    std::function<Value()> parse_val = [&]() -> Value {
+    std::function<Value(int)> parse_val = [&](int depth) -> Value {
       skip_ws();
       if (pos >= s.size()) { error_out = true; return Value(); }
+      if (depth > 1000) { error_out = true; return Value(); }
       char c = s[pos];
       if (c == 'n' && s.substr(pos, 4) == "null") {
         pos += 4;
@@ -1046,7 +1064,8 @@ void register_stdlib_core(VM *vm) {
         skip_ws();
         if (match_c(']')) return Value(list);
         while (true) {
-          Value elem = parse_val();
+          Value elem = parse_val(depth + 1);
+          if (error_out) break;
           list->elements.push_back(elem);
           skip_ws();
           if (match_c(']')) break;
@@ -1065,7 +1084,8 @@ void register_stdlib_core(VM *vm) {
           std::string key = parse_str();
           skip_ws();
           if (!match_c(':')) { error_out = true; break; }
-          Value v = parse_val();
+          Value v = parse_val(depth + 1);
+          if (error_out) break;
           dict->elements[key] = v;
           skip_ws();
           if (match_c('}')) break;
@@ -1098,7 +1118,7 @@ void register_stdlib_core(VM *vm) {
       return Value();
     };
 
-    Value result = parse_val();
+    Value result = parse_val(0);
     skip_ws();
     if (pos < s.size()) error_out = true;
     return result;

shell_lite/modules/module_db.cpp

@@ -120,7 +120,16 @@ void register_stdlib_db(VM* vm) {
             vm->error_value = Value(vm->arena().allocate_string("Database not open. Call db_open() or connect_database() first."));
             return Value();
         }
-        std::string query = vm->peek(arg_count - 1).to_string();
+        int query_peek = -1;
+        for (int i = arg_count - 1; i >= 0; --i) {
+            if (!vm->peek(i).is_database()) { query_peek = i; break; }
+        }
+        if (query_peek < 0) {
+            vm->has_error = true;
+            vm->error_value = Value(vm->arena().allocate_string("db_query expects a query string"));
+            return Value();
+        }
+        std::string query = vm->peek(query_peek).to_string();
 
         sqlite3_stmt* stmt = nullptr;
         if (sqlite3_prepare_v2(conn, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
@@ -129,13 +138,17 @@ void register_stdlib_db(VM* vm) {
             return Value();
         }
 
-        for (int i = 0; i < arg_count - 1; ++i) {
-            Value v = vm->peek(arg_count - 2 - i);
+        int bind_idx = 1;
+        int query_arg = arg_count - 1 - query_peek;
+        for (int j = 0; j < arg_count; ++j) {
+            if (j == query_arg) continue;
+            Value v = vm->peek(arg_count - 1 - j);
             if (v.is_database()) continue;
-            if (v.is_null()) sqlite3_bind_null(stmt, i + 1);
-            else if (v.is_number()) sqlite3_bind_double(stmt, i + 1, v.as_number());
-            else if (v.is_bool()) sqlite3_bind_int(stmt, i + 1, v.as_bool() ? 1 : 0);
-            else sqlite3_bind_text(stmt, i + 1, v.to_string().c_str(), -1, SQLITE_TRANSIENT);
+            if (v.is_null()) sqlite3_bind_null(stmt, bind_idx);
+            else if (v.is_number()) sqlite3_bind_double(stmt, bind_idx, v.as_number());
+            else if (v.is_bool()) sqlite3_bind_int(stmt, bind_idx, v.as_bool() ? 1 : 0);
+            else sqlite3_bind_text(stmt, bind_idx, v.to_string().c_str(), -1, SQLITE_TRANSIENT);
+            ++bind_idx;
         }
 
         auto result_list = vm->arena().allocate<ObjList>();