From 6f30ce2e6094b48d2383ba4b2b6a1282fe2d0748 Mon Sep 17 00:00:00 2001
From: Colomban Wendling <ban@herbesfolles.org>
Date: Tue, 8 Oct 2024 22:45:38 +0200
Subject: [PATCH 1/4] Add test case for broken promise at EOF

---
 Units/parser-php.r/wp-guest.b/args.ctags    |  3 ++
 Units/parser-php.r/wp-guest.b/expected.tags | 14 ++++++
 Units/parser-php.r/wp-guest.b/input.php     | 55 +++++++++++++++++++++
 3 files changed, 72 insertions(+)
 create mode 100644 Units/parser-php.r/wp-guest.b/args.ctags
 create mode 100644 Units/parser-php.r/wp-guest.b/expected.tags
 create mode 100644 Units/parser-php.r/wp-guest.b/input.php

diff --git a/Units/parser-php.r/wp-guest.b/args.ctags b/Units/parser-php.r/wp-guest.b/args.ctags
new file mode 100644
index 0000000000..eb69a967a6
--- /dev/null
+++ b/Units/parser-php.r/wp-guest.b/args.ctags
@@ -0,0 +1,3 @@
+--sort=no
+--extras=+rg
+--fields=+rln
diff --git a/Units/parser-php.r/wp-guest.b/expected.tags b/Units/parser-php.r/wp-guest.b/expected.tags
new file mode 100644
index 0000000000..dd3d9b4039
--- /dev/null
+++ b/Units/parser-php.r/wp-guest.b/expected.tags
@@ -0,0 +1,14 @@
+top	input.php	/^<div id="top">$/;"	I	line:3	language:HTML	roles:def
+inner	input.php	/^ <div class="inner">$/;"	c	line:4	language:HTML	roles:attribute
+logo	input.php	/^<div id="logo">$/;"	I	line:6	language:HTML	roles:def
+pages	input.php	/^<div id="pages">$/;"	I	line:12	language:HTML	roles:def
+menubar	input.php	/^<ul class="menubar" id="menubar">$/;"	c	line:13	language:HTML	roles:attribute
+menubar	input.php	/^<ul class="menubar" id="menubar">$/;"	I	line:13	language:HTML	roles:def
+body	input.php	/^<div id="body">$/;"	I	line:26	language:HTML	roles:def
+content	input.php	/^  <main id="content">$/;"	I	line:27	language:HTML	roles:def
+post	input.php	/^  <article class="post" id="post-<?p/;"	c	line:31	language:HTML	roles:attribute
+post-<?p	input.php	/^  <article class="post" id="post-<?p/;"	I	line:31	language:HTML	roles:def
+storybody	input.php	/^    <div class="storybody"><br \/><?p/;"	c	line:37	language:HTML	roles:attribute
+postmetadata	input.php	/^    <p class="postmetadata"><\/p>$/;"	c	line:38	language:HTML	roles:attribute
+storybody	input.php	/^     <div class="storybody"><?p/;"	c	line:41	language:HTML	roles:attribute
+left	input.php	/^  <aside id="left"><?p/;"	I	line:52	language:HTML	roles:def
diff --git a/Units/parser-php.r/wp-guest.b/input.php b/Units/parser-php.r/wp-guest.b/input.php
new file mode 100644
index 0000000000..fe501d086d
--- /dev/null
+++ b/Units/parser-php.r/wp-guest.b/input.php
@@ -0,0 +1,55 @@
+<?php get_header(); ?>
+
+<div id="top">
+ <div class="inner">
+  <br clear="all" />
+<div id="logo">
+<h2><a href="<?php bloginfo('url'); ?>"><?php bloginfo('name'); ?></a></h2>
+<p>
+  <?php bloginfo('description'); ?>
+</p>
+</div>
+<div id="pages">
+<ul class="menubar" id="menubar">
+  <li><a href="<?php bloginfo('url'); ?>">Accueil</a></li>
+  <?php montheme_list_pages( array( 'depth' => 1 ) ); ?>
+</ul>
+<!--[if !IE]><-->
+<script type="text/javascript">
+  initMenu (document.getElementById ('menubar'), 0);
+</script>
+<!--><![endif]-->
+</div>
+ </div>
+</div>
+
+<div id="body">
+  <main id="content">
+
+  <?php if (have_posts()) : while (have_posts()) : the_post(); ?><br /><br />
+
+  <article class="post" id="post-<?php the_ID(); ?>">
+
+   <div class="storycontent">
+
+    <h3><a href="<?php the_permalink() ?>" rel="bookmark"><?php the_title(); ?></a></h3>
+   
+    <div class="storybody"><br /><?php the_content(__('(more...)')); ?></div>
+    <p class="postmetadata"></p>
+    
+   </div>
+     <div class="storybody"><?php comments_template(); // Get wp-comments.php template ?></div>
+  </article>
+
+
+  <?php endwhile; else: ?>
+  <p><?php _e('Sorry, no posts matched your criteria.'); ?></p>
+  <?php endif; ?>
+
+  <?php posts_nav_link(' &#8212; ', __('&laquo; Previous Page'), __('Next Page &raquo;')); ?>
+
+  </main>
+  <aside id="left"><?php get_sidebar(); ?></aside>
+</div>
+
+<?php get_footer(); ?>

From fcab90a4933cdafe6e3007012bbf9b711ef401b4 Mon Sep 17 00:00:00 2001
From: Colomban Wendling <ban@herbesfolles.org>
Date: Tue, 8 Oct 2024 22:37:16 +0200
Subject: [PATCH 2/4] read: Fix getInputLineOffset() at EOF

The previous computation could result in invalid values, which could
lead to invalid promise ranges and subsequent crashes.
---
 Units/parser-php.r/{wp-guest.b => wp-guest.d}/args.ctags | 0
 .../{wp-guest.b => wp-guest.d}/expected.tags             | 0
 Units/parser-php.r/{wp-guest.b => wp-guest.d}/input.php  | 0
 main/read.c                                              | 9 +++++++--
 4 files changed, 7 insertions(+), 2 deletions(-)
 rename Units/parser-php.r/{wp-guest.b => wp-guest.d}/args.ctags (100%)
 rename Units/parser-php.r/{wp-guest.b => wp-guest.d}/expected.tags (100%)
 rename Units/parser-php.r/{wp-guest.b => wp-guest.d}/input.php (100%)

diff --git a/Units/parser-php.r/wp-guest.b/args.ctags b/Units/parser-php.r/wp-guest.d/args.ctags
similarity index 100%
rename from Units/parser-php.r/wp-guest.b/args.ctags
rename to Units/parser-php.r/wp-guest.d/args.ctags
diff --git a/Units/parser-php.r/wp-guest.b/expected.tags b/Units/parser-php.r/wp-guest.d/expected.tags
similarity index 100%
rename from Units/parser-php.r/wp-guest.b/expected.tags
rename to Units/parser-php.r/wp-guest.d/expected.tags
diff --git a/Units/parser-php.r/wp-guest.b/input.php b/Units/parser-php.r/wp-guest.d/input.php
similarity index 100%
rename from Units/parser-php.r/wp-guest.b/input.php
rename to Units/parser-php.r/wp-guest.d/input.php
diff --git a/main/read.c b/main/read.c
index 67586051db..70f6847cb2 100644
--- a/main/read.c
+++ b/main/read.c
@@ -89,6 +89,7 @@ typedef struct sInputFile {
 	vString    *path;          /* path of input file (if any) */
 	vString    *line;          /* last line read from file */
 	const unsigned char* currentLine;  /* current line being worked on */
+	size_t currentLineEndOffset;
 	MIO        *mio;           /* MIO stream used for reading the file */
 	compoundPos    filePosition;  /* file position of current line */
 	unsigned int ungetchIdx;
@@ -159,8 +160,7 @@ extern int getInputLineOffset (void)
 		/* When EOF is saw, currentLine is set to NULL.
 		 * So the way to calculate the offset at the end of file is tricky.
 		 */
-		ret = (mio_tell (File.mio) - (File.bomFound? 3: 0))
-			- getInputFileOffsetForLine(File.input.lineNumber);
+		ret = File.currentLineEndOffset - File.ungetchIdx;
 	}
 	else
 	{
@@ -766,6 +766,7 @@ extern bool openInputFile (const char *const fileName, const langType language,
 		mio_getpos (File.mio, &File.filePosition.pos);
 		File.filePosition.offset = StartOfLine.offset = mio_tell (File.mio);
 		File.currentLine  = NULL;
+		File.currentLineEndOffset = 0;
 
 		File.line = vStringNewOrClear (File.line);
 		File.ungetchIdx = 0;
@@ -804,6 +805,7 @@ extern void resetInputFile (const langType language, bool resetLineFposMap_)
 	mio_getpos (File.mio, &File.filePosition.pos);
 	File.filePosition.offset = StartOfLine.offset = mio_tell (File.mio);
 	File.currentLine  = NULL;
+	File.currentLineEndOffset = 0;
 
 	Assert (File.line);
 	vStringClear (File.line);
@@ -1032,7 +1034,10 @@ extern int getcFromInputFile (void)
 		{
 			vString* const line = iFileGetLine (false);
 			if (line != NULL)
+			{
 				File.currentLine = (unsigned char*) vStringValue (line);
+				File.currentLineEndOffset = vStringLength (line);
+			}
 			if (File.currentLine == NULL)
 				c = EOF;
 			else

From ace859aaa0c203d9a5aa70c0e0314a2117c5e9ec Mon Sep 17 00:00:00 2001
From: Colomban Wendling <ban@herbesfolles.org>
Date: Tue, 8 Oct 2024 22:38:44 +0200
Subject: [PATCH 3/4] php: Fix HTML promises ranges

Don't include (part of) the PHP open tag in the HTML input.
---
 Units/parser-php.r/wp-guest.d/expected.tags | 10 +++++-----
 parsers/php.c                               |  9 ++++++---
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/Units/parser-php.r/wp-guest.d/expected.tags b/Units/parser-php.r/wp-guest.d/expected.tags
index dd3d9b4039..851ca47876 100644
--- a/Units/parser-php.r/wp-guest.d/expected.tags
+++ b/Units/parser-php.r/wp-guest.d/expected.tags
@@ -6,9 +6,9 @@ menubar	input.php	/^<ul class="menubar" id="menubar">$/;"	c	line:13	language:HTM
 menubar	input.php	/^<ul class="menubar" id="menubar">$/;"	I	line:13	language:HTML	roles:def
 body	input.php	/^<div id="body">$/;"	I	line:26	language:HTML	roles:def
 content	input.php	/^  <main id="content">$/;"	I	line:27	language:HTML	roles:def
-post	input.php	/^  <article class="post" id="post-<?p/;"	c	line:31	language:HTML	roles:attribute
-post-<?p	input.php	/^  <article class="post" id="post-<?p/;"	I	line:31	language:HTML	roles:def
-storybody	input.php	/^    <div class="storybody"><br \/><?p/;"	c	line:37	language:HTML	roles:attribute
+post	input.php	/^  <article class="post" id="post-/;"	c	line:31	language:HTML	roles:attribute
+post-	input.php	/^  <article class="post" id="post-/;"	I	line:31	language:HTML	roles:def
+storybody	input.php	/^    <div class="storybody"><br \/>/;"	c	line:37	language:HTML	roles:attribute
 postmetadata	input.php	/^    <p class="postmetadata"><\/p>$/;"	c	line:38	language:HTML	roles:attribute
-storybody	input.php	/^     <div class="storybody"><?p/;"	c	line:41	language:HTML	roles:attribute
-left	input.php	/^  <aside id="left"><?p/;"	I	line:52	language:HTML	roles:def
+storybody	input.php	/^     <div class="storybody">/;"	c	line:41	language:HTML	roles:attribute
+left	input.php	/^  <aside id="left">/;"	I	line:52	language:HTML	roles:def
diff --git a/parsers/php.c b/parsers/php.c
index 5db3d4a283..117f46f2e6 100644
--- a/parsers/php.c
+++ b/parsers/php.c
@@ -861,13 +861,14 @@ static bool isOpenScriptLanguagePhp (int c)
 	return true;
 }
 
-static int findPhpStart (void)
+static int findPhpStart (int *tagStartLineOffset)
 {
 	int c;
 	do
 	{
 		if ((c = getcFromInputFile ()) == '<')
 		{
+			*tagStartLineOffset = getInputLineOffset () - 1;
 			c = getcFromInputFile ();
 			/* <?, <?= and <?php, but not <?xml */
 			if (c == '?')
@@ -933,13 +934,15 @@ static void readToken (tokenInfo *const token)
 		unsigned long startSourceLineNumber = getSourceLineNumber ();
 		unsigned long startLineNumber = getInputLineNumber ();
 		int startLineOffset = getInputLineOffset ();
+		int endLineOffset;
 
-		c = findPhpStart ();
+		c = findPhpStart (&endLineOffset);
 		if (c != EOF)
 			InPhp = true;
+		else
+			endLineOffset = getInputLineOffset ();
 
 		unsigned long endLineNumber = getInputLineNumber ();
-		int endLineOffset = getInputLineOffset ();
 
 		makePromise ("HTML", startLineNumber, startLineOffset,
 					 endLineNumber, endLineOffset, startSourceLineNumber);

From 039e5890fd92e600cf2dfa3baedb6fb9544be4a1 Mon Sep 17 00:00:00 2001
From: Colomban Wendling <ban@herbesfolles.org>
Date: Tue, 12 Nov 2024 00:44:05 +0100
Subject: [PATCH 4/4] html: Avoid infinite ping-pong loop with JSP tags

JSP tags shouldn't trigger the PHP parser.  This used to happen and
trigger an infinite loop of a ping-pong effect with the HTML parser
asking the PHP parser to parse the JSP block, and the PHP parser, not
recognizing the input, asking the HTML one to deal with it.  Rinse and
repeat.
---
 Units/parser-html.r/jsp.d/README     | 6 ++++++
 Units/parser-html.r/jsp.d/args.ctags | 2 ++
 Units/parser-html.r/jsp.d/input.html | 1 +
 parsers/html.c                       | 2 +-
 4 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100644 Units/parser-html.r/jsp.d/README
 create mode 100644 Units/parser-html.r/jsp.d/args.ctags
 create mode 100644 Units/parser-html.r/jsp.d/input.html

diff --git a/Units/parser-html.r/jsp.d/README b/Units/parser-html.r/jsp.d/README
new file mode 100644
index 0000000000..17c0ac4bfd
--- /dev/null
+++ b/Units/parser-html.r/jsp.d/README
@@ -0,0 +1,6 @@
+JSP tags shouldn't trigger the PHP parser.
+
+This used to happen and trigger an infinite loop of a ping-pong effect
+with the HTML parser asking the PHP parser to parse the JSP block, and
+the PHP parser, not recognizing the input, asking the HTML one to deal
+with it.  Rinse and repeat.
diff --git a/Units/parser-html.r/jsp.d/args.ctags b/Units/parser-html.r/jsp.d/args.ctags
new file mode 100644
index 0000000000..ccee50154d
--- /dev/null
+++ b/Units/parser-html.r/jsp.d/args.ctags
@@ -0,0 +1,2 @@
+--sort=no
+--extras='*'
diff --git a/Units/parser-html.r/jsp.d/input.html b/Units/parser-html.r/jsp.d/input.html
new file mode 100644
index 0000000000..7d5f382b72
--- /dev/null
+++ b/Units/parser-html.r/jsp.d/input.html
@@ -0,0 +1 @@
+<%=
diff --git a/parsers/html.c b/parsers/html.c
index 1b6c0c0915..e535df5b31 100644
--- a/parsers/html.c
+++ b/parsers/html.c
@@ -339,7 +339,7 @@ static void readToken (tokenInfo *const token, bool skipComments)
 				ungetcToInputFile (d);
 				token->type = TOKEN_OTHER;
 			}
-			else if (d == '?' || d == '%')
+			else if (d == '?')
 			{
 				skipOtherScriptContent(d);
 				goto getNextChar;