[libc][obvious] fix printf failing to stop on %\0

[michaelrj]

Summary

Previously, the printf parser would treat "%\0" as a conversion with the
name "\0", and advance past the null byte causing a buffer overflow.
This patch corrects that in both printf and scanf.

libc/src/stdio/printf_core/parser.cpp

#endif // LLVM_LIBC_PRINTF_DISABLE_WRITE_INT
     case ('s'):
       section.conv_val_ptr = GET_ARG_VAL_SIMPLEST(void *, conv_index);
       break;
     default:
       // if the conversion is undefined, change this to a raw section.
       section.has_conv = false;
       break;
     }
+    // If the end of the format section is on the '\0'. This means we need to
+    // not advance the cur_pos.
+    if (str[cur_pos] != '\0')
       ++cur_pos;
+
   } else {
     // raw section
     section.has_conv = false;
     while (str[cur_pos] != '%' && str[cur_pos] != '\0')
       ++cur_pos;
   }
   section.raw_string = {str + starting_pos, cur_pos - starting_pos};
   return section;
#endif // LLVM_LIBC_PRINTF_DISABLE_WRITE_INT
         conv_size = TYPE_DESC<int>;
         break;
       }
 
       set_type_desc(conv_index, conv_size);
       if (conv_index == index)
         return conv_size;
     }
+    // If the end of the format section is on the '\0'. This means we need to
+    // not advance the local_pos.
+    if (str[local_pos] != '\0')
       ++local_pos;
   }
 
   // If there is no size for the requested index, then just guess that it's an
   // int.
   return TYPE_DESC<int>;
 }
 
 void Parser::args_to_index(size_t index) {

libc/src/stdio/scanf_core/parser.cpp

#endif // LLVM_LIBC_SCANF_DISABLE_INDEX_MODE
 
     // If NO_WRITE is not set, then read the next arg as the output pointer.
     if ((section.flags & FormatFlags::NO_WRITE) == 0) {
       // Since all outputs are pointers, there's no need to distinguish when
       // reading from va_args. They're all the same size and stored the same.
       section.output_ptr = GET_ARG_VAL_SIMPLEST(void *, conv_index);
     }
 
+    // If the end of the format section is on the '\0'. This means we need to
+    // not advance the cur_pos and we should not count this has having a
+    // conversion.
+    if (str[cur_pos] != '\0') {
       ++cur_pos;
+    } else {
+      section.has_conv = false;
+    }
 
     // If the format is a bracketed one, then we need to parse out the insides
     // of the brackets.
     if (section.conv_name == '[') {
       constexpr char CLOSING_BRACKET = ']';
       constexpr char INVERT_FLAG = '^';
       constexpr char RANGE_OPERATOR = '-';
 

libc/test/src/stdio/printf_core/parser_test.cpp

TEST(LlvmLibcPrintfParserTest, EvalOneArg) {
 
   expected.raw_string = {str, 2};
   expected.conv_val_raw = arg1;
   expected.conv_name = 'd';
 
   ASSERT_PFORMAT_EQ(expected, format_arr[0]);
 }
 
+TEST(LlvmLibcPrintfParserTest, EvalBadArg) {
+  __llvm_libc::printf_core::FormatSection format_arr[10];
+  const char *str = "%\0abc";
+  int arg1 = 12345;
+  evaluate(format_arr, str, arg1);
+
+  __llvm_libc::printf_core::FormatSection expected;
+  expected.has_conv = false;
+  expected.raw_string = {str, 1};
+
+  ASSERT_PFORMAT_EQ(expected, format_arr[0]);
+}
+
 TEST(LlvmLibcPrintfParserTest, EvalOneArgWithFlags) {
   __llvm_libc::printf_core::FormatSection format_arr[10];
   const char *str = "%+-0 #d";
   int arg1 = 12345;
   evaluate(format_arr, str, arg1);
 
   __llvm_libc::printf_core::FormatSection expected;
   expected.has_conv = true;

libc/test/src/stdio/scanf_core/parser_test.cpp

TEST(LlvmLibcScanfParserTest, EvalOneArg) {
 
   expected.raw_string = str;
   expected.output_ptr = &arg1;
   expected.conv_name = 'd';
 
   ASSERT_SFORMAT_EQ(expected, format_arr[0]);
 }
 
+TEST(LlvmLibcScanfParserTest, EvalBadArg) {
+  __llvm_libc::scanf_core::FormatSection format_arr[10];
+  const char *str = "%\0abc";
+  int arg1 = 12345;
+  evaluate(format_arr, str, &arg1);
+
+  __llvm_libc::scanf_core::FormatSection expected;
+  expected.has_conv = false;
+  expected.raw_string = {str, 1};
+
+  ASSERT_SFORMAT_EQ(expected, format_arr[0]);
+}
+
 TEST(LlvmLibcScanfParserTest, EvalOneArgWithFlag) {
   __llvm_libc::scanf_core::FormatSection format_arr[10];
   const char *str = "%*d";
   // Since NO_WRITE is set, the argument shouldn't be used, but I've included
   // one anyways because in the case that it doesn't work it's better for it to
   // have a real argument to check against.
   int arg1 = 12345;
   evaluate(format_arr, str, &arg1);