Add a wrapper function around accessing the buffer in the ASM Lexer

[BrandonTJones]

Summary

While using the address sanitizer with llvm-mc-assemble-fuzzer many heap-buffer overflows happen due to reading off the end of the buffer. This patch is an attempt to fix these instances.

There are no test cases added as the plan at the moment is to add the fuzzer to oss-fuzz once the number of bugs decreases. As well as the difficulty of writing test cases only caught by the address sanitizer.

[BrandonTJones]

Ping

llvm/include/llvm/MC/MCParser/AsmLexer.h

public:
   void setBuffer(StringRef Buf, const char *ptr = nullptr);
 
   StringRef LexUntilEndOfStatement() override;
 
   size_t peekTokens(MutableArrayRef<AsmToken> Buf,
                     bool ShouldSkipSpace = true) override;
 
   const MCAsmInfo &getMAI() const { return MAI; }
+  bool isEOF();
+  bool tokOutOfBounds(const AsmToken tok);
 
 private:
   bool isAtStartOfComment(const char *Ptr);
   bool isAtStatementSeparator(const char *Ptr);
+  char peekPtr(int offset = 0);
   int getNextChar();
   AsmToken ReturnError(const char *Loc, const std::string &Msg);
 
   AsmToken LexIdentifier();
   AsmToken LexSlash();
   AsmToken LexLineComment();
   AsmToken LexDigit();
   AsmToken LexSingleQuote();

llvm/lib/MC/MCParser/AsmLexer.cpp

 }
 
 int AsmLexer::getNextChar() {
   if (CurPtr == CurBuf.end())
     return EOF;
   return (unsigned char)*CurPtr++;
 }
 
-/// The leading integral digit sequence and dot/e should have already been
+/// peekPtr: This is a function to extrapolate getting the char at the
+/// CurPtr without consuming it. This prevents accessing memory
+/// past the end of the buffer.
+char AsmLexer::peekPtr(int offset) {
+  if (CurPtr + offset >= CurBuf.end() || CurPtr + offset < CurBuf.begin())
+    return EOF;
+  return *(CurPtr + offset);
+}
+
+bool AsmLexer::isEOF() { return CurPtr == CurBuf.end(); }
+
+bool AsmLexer::tokOutOfBounds(const AsmToken tok) {
+  const char *Loc = tok.getLoc().getPointer();
+  return Loc >= CurBuf.end();
+}
+
+/// LexFloatLiteral: [0-9]*[.][0-9]*([eE][+-]?[0-9]*)?
+///
+/// The leading integral digit sequence and dot should have already been
 /// consumed, some or all of the fractional digit sequence *can* have been
 /// consumed.
 AsmToken AsmLexer::LexFloatLiteral() {
   // Skip the fractional digit sequence.
-  while (isDigit(*CurPtr))
+  while (isDigit(peekPtr()))
     ++CurPtr;
 
-  if (*CurPtr == '-' || *CurPtr == '+')
+  if (peekPtr() == '-' || peekPtr() == '+')
     return ReturnError(CurPtr, "Invalid sign in float literal");
 
   // Check for exponent
-  if ((*CurPtr == 'e' || *CurPtr == 'E')) {
+  if ((peekPtr() == 'e' || peekPtr() == 'E')) {
     ++CurPtr;
 
-    if (*CurPtr == '-' || *CurPtr == '+')
+    if (peekPtr() == '-' || peekPtr() == '+')
       ++CurPtr;
 
-    while (isDigit(*CurPtr))
+    while (isDigit(peekPtr()))
       ++CurPtr;
   }
 
   return AsmToken(AsmToken::Real,
                   StringRef(TokStart, CurPtr - TokStart));
 }
 
 /// LexHexFloatLiteral matches essentially (.[0-9a-fA-F]*)?[pP][+-]?[0-9a-fA-F]+
 /// while making sure there are enough actual digits around for the constant to
 /// be valid.
 ///
 /// The leading "0x[0-9a-fA-F]*" (i.e. integer part) has already been consumed
 /// before we get here.
 AsmToken AsmLexer::LexHexFloatLiteral(bool NoIntDigits) {
-  assert((*CurPtr == 'p' || *CurPtr == 'P' || *CurPtr == '.') &&
+  assert((peekPtr() == 'p' || peekPtr() == 'P' || peekPtr() == '.') &&
          "unexpected parse state in floating hex");
   bool NoFracDigits = true;
 
   // Skip the fractional part if there is one
-  if (*CurPtr == '.') {
+  if (peekPtr() == '.') {
     ++CurPtr;
 
     const char *FracStart = CurPtr;
-    while (isHexDigit(*CurPtr))
+    while (isHexDigit(peekPtr()))
       ++CurPtr;
 
     NoFracDigits = CurPtr == FracStart;
   }
 
   if (NoIntDigits && NoFracDigits)
     return ReturnError(TokStart, "invalid hexadecimal floating-point constant: "
                                  "expected at least one significand digit");
 
   // Make sure we do have some kind of proper exponent part
-  if (*CurPtr != 'p' && *CurPtr != 'P')
+  if (peekPtr() != 'p' && peekPtr() != 'P')
     return ReturnError(TokStart, "invalid hexadecimal floating-point constant: "
                                  "expected exponent part 'p'");
   ++CurPtr;
 
-  if (*CurPtr == '+' || *CurPtr == '-')
+  if (peekPtr() == '+' || peekPtr() == '-')
     ++CurPtr;
 
   // N.b. exponent digits are *not* hex
   const char *ExpStart = CurPtr;
-  while (isDigit(*CurPtr))
+  while (isDigit(peekPtr()))
     ++CurPtr;
 
   if (CurPtr == ExpStart)
     return ReturnError(TokStart, "invalid hexadecimal floating-point constant: "
                                  "expected at least one exponent digit");
 
   return AsmToken(AsmToken::Real, StringRef(TokStart, CurPtr - TokStart));
 }
 
 /// LexIdentifier: [a-zA-Z_.][a-zA-Z0-9_$.@?]*
 static bool IsIdentifierChar(char c, bool AllowAt) {
   return isAlnum(c) || c == '_' || c == '$' || c == '.' ||
          (c == '@' && AllowAt) || c == '?';
 }
 
 AsmToken AsmLexer::LexIdentifier() {
   // Check for floating point literals.
-  if (CurPtr[-1] == '.' && isDigit(*CurPtr)) {
+  if (peekPtr(-1) == '.' && isDigit(peekPtr())) {
     // Disambiguate a .1243foo identifier from a floating literal.
-    while (isDigit(*CurPtr))
+    while (isDigit(peekPtr()))
       ++CurPtr;
 
-    if (!IsIdentifierChar(*CurPtr, AllowAtInIdentifier) ||
-        *CurPtr == 'e' || *CurPtr == 'E')
+    if (!IsIdentifierChar(peekPtr(), AllowAtInIdentifier) ||
+        peekPtr() == 'e' || peekPtr() == 'E')
       return LexFloatLiteral();
   }
 
-  while (IsIdentifierChar(*CurPtr, AllowAtInIdentifier))
+  while (IsIdentifierChar(peekPtr(), AllowAtInIdentifier))
     ++CurPtr;
 
   // Handle . as a special case.
   if (CurPtr == TokStart+1 && TokStart[0] == '.')
     return AsmToken(AsmToken::Dot, StringRef(TokStart, 1));
 
   return AsmToken(AsmToken::Identifier, StringRef(TokStart, CurPtr - TokStart));
 }
 
 /// LexSlash: Slash: /
 ///           C-Style Comment: /* ... */
 AsmToken AsmLexer::LexSlash() {
-  switch (*CurPtr) {
+  switch (peekPtr()) {
   case '*':
     IsAtStartOfStatement = false;
     break; // C style comment.
   case '/':
     ++CurPtr;
     return LexLineComment();
   default:
     IsAtStartOfStatement = false;
     return AsmToken(AsmToken::Slash, StringRef(TokStart, 1));
   }
 
   // C Style comment.
   ++CurPtr;  // skip the star.
   const char *CommentTextStart = CurPtr;
   while (CurPtr != CurBuf.end()) {
     switch (*CurPtr++) {
     case '*':
       // End of the comment?
-      if (*CurPtr != '/')
+      if (peekPtr() != '/')
         break;
       // If we have a CommentConsumer, notify it about the comment.
       if (CommentConsumer) {
         CommentConsumer->HandleComment(
             SMLoc::getFromPointer(CommentTextStart),
             StringRef(CommentTextStart, CurPtr - 1 - CommentTextStart));
       }
       ++CurPtr;   // End the */.
if (IsAtStartOfStatement)
     return AsmToken(AsmToken::EndOfStatement,
                     StringRef(TokStart, CurPtr - TokStart));
   IsAtStartOfStatement = true;
 
   return AsmToken(AsmToken::EndOfStatement,
                   StringRef(TokStart, CurPtr - 1 - TokStart));
 }
 
-static void SkipIgnoredIntegerSuffix(const char *&CurPtr) {
+static void SkipIgnoredIntegerSuffix(const char *&CurPtr, const char * endBuf) {
   // Skip ULL, UL, U, L and LL suffices.
-  if (CurPtr[0] == 'U')
+  if ((CurPtr < endBuf) && CurPtr[0] == 'U')
     ++CurPtr;
-  if (CurPtr[0] == 'L')
+  if ((CurPtr < endBuf) && CurPtr[0] == 'L')
     ++CurPtr;
-  if (CurPtr[0] == 'L')
+  if ((CurPtr < endBuf) && CurPtr[0] == 'L')
     ++CurPtr;
 }
 
 // Look ahead to search for first non-hex digit, if it's [hH], then we treat the
 // integer as a hexadecimal, possibly with leading zeroes.
 static unsigned doHexLookAhead(const char *&CurPtr, unsigned DefaultRadix,
-                               bool LexHex) {
+                               bool LexHex, const char * endBuf) {
   const char *FirstNonDec = nullptr;
   const char *LookAhead = CurPtr;
   while (true) {
-    if (isDigit(*LookAhead)) {
+    if ((LookAhead < endBuf) && isDigit(*LookAhead)) {
       ++LookAhead;
     } else {
       if (!FirstNonDec)
         FirstNonDec = LookAhead;
 
       // Keep going if we are looking for a 'h' suffix.
       if (LexHex && isHexDigit(*LookAhead))
         ++LookAhead;

 ///   Forward/Backward Label: [0-9][fb]
 ///   Binary integer: 0b[01]+
 ///   Octal integer: 0[0-7]+
 ///   Hex integer: 0x[0-9a-fA-F]+ or [0x]?[0-9][0-9a-fA-F]*[hH]
 ///   Decimal integer: [1-9][0-9]*
 AsmToken AsmLexer::LexDigit() {
   // MASM-flavor binary integer: [01]+[bB]
   // MASM-flavor hexadecimal integer: [0-9][0-9a-fA-F]*[hH]
-  if (LexMasmIntegers && isdigit(CurPtr[-1])) {
-    const char *FirstNonBinary = (CurPtr[-1] != '0' && CurPtr[-1] != '1') ?
-                                   CurPtr - 1 : nullptr;
+  if (LexMasmIntegers && isdigit(peekPtr(-1))) {
+    const char *FirstNonBinary =
+        (peekPtr(-1) != '0' && peekPtr(-1) != '1') ? CurPtr - 1 : nullptr;
     const char *OldCurPtr = CurPtr;
-    while (isHexDigit(*CurPtr)) {
+    while (isHexDigit(peekPtr())) {
       if (*CurPtr != '0' && *CurPtr != '1' && !FirstNonBinary)
         FirstNonBinary = CurPtr;
       ++CurPtr;
     }
 
     unsigned Radix = 0;
-    if (*CurPtr == 'h' || *CurPtr == 'H') {
+    if (peekPtr() == 'h' || peekPtr() == 'H') {
       // hexadecimal number
       ++CurPtr;
       Radix = 16;
     } else if (FirstNonBinary && FirstNonBinary + 1 == CurPtr &&
                (*FirstNonBinary == 'b' || *FirstNonBinary == 'B'))
       Radix = 2;
 
     if (Radix == 2 || Radix == 16) {
       StringRef Result(TokStart, CurPtr - TokStart);
       APInt Value(128, 0, true);
 
       if (Result.drop_back().getAsInteger(Radix, Value))
         return ReturnError(TokStart, Radix == 2 ? "invalid binary number" :
                              "invalid hexdecimal number");
 
       // MSVC accepts and ignores type suffices on integer literals.
-      SkipIgnoredIntegerSuffix(CurPtr);
+      SkipIgnoredIntegerSuffix(CurPtr, CurBuf.end());
 
       return intToken(Result, Value);
    }
 
     // octal/decimal integers, or floating point numbers, fall through
     CurPtr = OldCurPtr;
   }
 
   // Decimal integer: [1-9][0-9]*
-  if (CurPtr[-1] != '0' || CurPtr[0] == '.') {
-    unsigned Radix = doHexLookAhead(CurPtr, 10, LexMasmIntegers);
+  if (peekPtr(-1) != '0' || peekPtr() == '.') {
+    unsigned Radix = doHexLookAhead(CurPtr, 10, LexMasmIntegers, CurBuf.end());
     bool isHex = Radix == 16;
     // Check for floating point literals.
-    if (!isHex && (*CurPtr == '.' || *CurPtr == 'e' || *CurPtr == 'E')) {
-      if (*CurPtr == '.')
+    if (!isHex && (peekPtr() == '.' || peekPtr() == 'e' || peekPtr() == 'E')) {
+      if (peekPtr() == '.')
         ++CurPtr;
       return LexFloatLiteral();
     }
 
     StringRef Result(TokStart, CurPtr - TokStart);
 
     APInt Value(128, 0, true);
     if (Result.getAsInteger(Radix, Value))
       return ReturnError(TokStart, !isHex ? "invalid decimal number" :
                            "invalid hexdecimal number");
 
     // Consume the [hH].
     if (LexMasmIntegers && Radix == 16)
       ++CurPtr;
 
     // The darwin/x86 (and x86-64) assembler accepts and ignores type
     // suffices on integer literals.
-    SkipIgnoredIntegerSuffix(CurPtr);
+    SkipIgnoredIntegerSuffix(CurPtr, CurBuf.end());
 
     return intToken(Result, Value);
   }
 
-  if (!LexMasmIntegers && ((*CurPtr == 'b') || (*CurPtr == 'B'))) {
+  if (!LexMasmIntegers && ((peekPtr() == 'b') || (peekPtr() == 'B'))) {
     ++CurPtr;
     // See if we actually have "0b" as part of something like "jmp 0b\n"
-    if (!isDigit(CurPtr[0])) {
+    if (!isDigit(peekPtr())) {
       --CurPtr;
       StringRef Result(TokStart, CurPtr - TokStart);
       return AsmToken(AsmToken::Integer, Result, 0);
     }
     const char *NumStart = CurPtr;
-    while (CurPtr[0] == '0' || CurPtr[0] == '1')
+    while (peekPtr() == '0' || peekPtr() == '1')
       ++CurPtr;
 
     // Requires at least one binary digit.
     if (CurPtr == NumStart)
       return ReturnError(TokStart, "invalid binary number");
 
     StringRef Result(TokStart, CurPtr - TokStart);
 
     APInt Value(128, 0, true);
     if (Result.substr(2).getAsInteger(2, Value))
       return ReturnError(TokStart, "invalid binary number");
 
     // The darwin/x86 (and x86-64) assembler accepts and ignores ULL and LL
     // suffixes on integer literals.
-    SkipIgnoredIntegerSuffix(CurPtr);
+    SkipIgnoredIntegerSuffix(CurPtr, CurBuf.end());
 
     return intToken(Result, Value);
   }
 
-  if ((*CurPtr == 'x') || (*CurPtr == 'X')) {
+  if ((peekPtr() == 'x') || (peekPtr() == 'X')) {
     ++CurPtr;
     const char *NumStart = CurPtr;
-    while (isHexDigit(CurPtr[0]))
+    while (isHexDigit(peekPtr()))
       ++CurPtr;
 
     // "0x.0p0" is valid, and "0x0p0" (but not "0xp0" for example, which will be
     // diagnosed by LexHexFloatLiteral).
-    if (CurPtr[0] == '.' || CurPtr[0] == 'p' || CurPtr[0] == 'P')
+    if (peekPtr() == '.' || peekPtr() == 'p' || peekPtr() == 'P')
       return LexHexFloatLiteral(NumStart == CurPtr);
 
     // Otherwise requires at least one hex digit.
     if (CurPtr == NumStart)
       return ReturnError(CurPtr-2, "invalid hexadecimal number");
 
     APInt Result(128, 0);
     if (StringRef(TokStart, CurPtr - TokStart).getAsInteger(0, Result))
       return ReturnError(TokStart, "invalid hexadecimal number");
 
     // Consume the optional [hH].
-    if (LexMasmIntegers && (*CurPtr == 'h' || *CurPtr == 'H'))
+    if (LexMasmIntegers && (peekPtr() == 'h' || peekPtr() == 'H'))
       ++CurPtr;
 
     // The darwin/x86 (and x86-64) assembler accepts and ignores ULL and LL
     // suffixes on integer literals.
-    SkipIgnoredIntegerSuffix(CurPtr);
+    SkipIgnoredIntegerSuffix(CurPtr, CurBuf.end());
 
     return intToken(StringRef(TokStart, CurPtr - TokStart), Result);
   }
 
   // Either octal or hexadecimal.
   APInt Value(128, 0, true);
-  unsigned Radix = doHexLookAhead(CurPtr, 8, LexMasmIntegers);
+  unsigned Radix = doHexLookAhead(CurPtr, 8, LexMasmIntegers, CurBuf.end());
   bool isHex = Radix == 16;
   StringRef Result(TokStart, CurPtr - TokStart);
   if (Result.getAsInteger(Radix, Value))
     return ReturnError(TokStart, !isHex ? "invalid octal number" :
                        "invalid hexdecimal number");
 
   // Consume the [hH].
   if (Radix == 16)
     ++CurPtr;
 
   // The darwin/x86 (and x86-64) assembler accepts and ignores ULL and LL
   // suffixes on integer literals.
-  SkipIgnoredIntegerSuffix(CurPtr);
+  SkipIgnoredIntegerSuffix(CurPtr, CurBuf.end());
 
   return intToken(Result, Value);
 }
 
 /// LexSingleQuote: Integer: 'b'
 AsmToken AsmLexer::LexSingleQuote() {
   int CurChar = getNextChar();
 
AsmToken AsmLexer::LexQuote() {
   return AsmToken(AsmToken::String, StringRef(TokStart, CurPtr - TokStart));
 }
 
 StringRef AsmLexer::LexUntilEndOfStatement() {
   TokStart = CurPtr;
 
   while (!isAtStartOfComment(CurPtr) &&     // Start of line comment.
          !isAtStatementSeparator(CurPtr) && // End of statement marker.
-         *CurPtr != '\n' && *CurPtr != '\r' && CurPtr != CurBuf.end()) {
+         peekPtr() != '\n' && peekPtr() != '\r' && !isEOF()) {
     ++CurPtr;
   }
   return StringRef(TokStart, CurPtr-TokStart);
 }
 
 StringRef AsmLexer::LexUntilEndOfLine() {
   TokStart = CurPtr;
 
-  while (*CurPtr != '\n' && *CurPtr != '\r' && CurPtr != CurBuf.end()) {
+  while (peekPtr() != '\n' && peekPtr() != '\r' && !isEOF()) {
     ++CurPtr;
   }
   return StringRef(TokStart, CurPtr-TokStart);
 }
 
 size_t AsmLexer::peekTokens(MutableArrayRef<AsmToken> Buf,
                             bool ShouldSkipSpace) {
   SaveAndRestore<const char *> SavedTokenStart(TokStart);
size_t AsmLexer::peekTokens(MutableArrayRef<AsmToken> Buf,
   }
 
   SetError(SavedErrLoc, SavedErr);
   return ReadCount;
 }
 
 bool AsmLexer::isAtStartOfComment(const char *Ptr) {
   StringRef CommentString = MAI.getCommentString();
-
+  if (Ptr >= CurBuf.end())
+    return false;
   if (CommentString.size() == 1)
     return CommentString[0] == Ptr[0];
 
   // Allow # preprocessor commments also be counted as comments for "##" cases
   if (CommentString[1] == '#')
     return CommentString[0] == Ptr[0];
 
+  if (Ptr + CommentString.size() >= CurBuf.end())
+    return false;
   return strncmp(Ptr, CommentString.data(), CommentString.size()) == 0;
 }
 
 bool AsmLexer::isAtStatementSeparator(const char *Ptr) {
+  if (Ptr == CurBuf.end())
+    return false;
   return strncmp(Ptr, MAI.getSeparatorString(),
                  strlen(MAI.getSeparatorString())) == 0;
 }
 
 AsmToken AsmLexer::LexToken() {
   TokStart = CurPtr;
   // This always consumes at least one character.
   int CurChar = getNextChar();
return AsmToken(AsmToken::EndOfStatement,
                     StringRef(TokStart, strlen(MAI.getSeparatorString())));
   }
 
   // If we're missing a newline at EOF, make sure we still get an
   // EndOfStatement token before the Eof token.
   if (CurChar == EOF && !IsAtStartOfStatement) {
     IsAtStartOfLine = true;
     IsAtStartOfStatement = true;
-    return AsmToken(AsmToken::EndOfStatement, StringRef(TokStart, 1));
+    return AsmToken(AsmToken::EndOfStatement, StringRef(TokStart, 0));
   }
   IsAtStartOfLine = false;
   bool OldIsAtStartOfStatement = IsAtStartOfStatement;
   IsAtStartOfStatement = false;
   switch (CurChar) {
   default:
     // Handle identifier: [a-zA-Z_.][a-zA-Z0-9_$.@]*
     if (isalpha(CurChar) || CurChar == '_' || CurChar == '.')
       return LexIdentifier();
 
     // Unknown character, emit an error.
     return ReturnError(TokStart, "invalid character in input");
   case EOF:
     IsAtStartOfLine = true;
     IsAtStartOfStatement = true;
     return AsmToken(AsmToken::Eof, StringRef(TokStart, 0));
   case 0:
   case ' ':
   case '\t':
     IsAtStartOfStatement = OldIsAtStartOfStatement;
-    while (*CurPtr == ' ' || *CurPtr == '\t')
+    while (peekPtr() == ' ' || peekPtr() == '\t' || peekPtr() == 0)
       CurPtr++;
     if (SkipSpace)
       return LexToken(); // Ignore whitespace.
     else
       return AsmToken(AsmToken::Space, StringRef(TokStart, CurPtr - TokStart));
   case '\r': {
     IsAtStartOfLine = true;
     IsAtStartOfStatement = true;
     // If this is a CR followed by LF, treat that as one token.
-    if (CurPtr != CurBuf.end() && *CurPtr == '\n')
+    if (!isEOF() && peekPtr() == '\n')
       ++CurPtr;
     return AsmToken(AsmToken::EndOfStatement,
                     StringRef(TokStart, CurPtr - TokStart));
   }
   case '\n':
     IsAtStartOfLine = true;
     IsAtStartOfStatement = true;
     return AsmToken(AsmToken::EndOfStatement, StringRef(TokStart, 1));
   case ':': return AsmToken(AsmToken::Colon, StringRef(TokStart, 1));
   case '+': return AsmToken(AsmToken::Plus, StringRef(TokStart, 1));
   case '~': return AsmToken(AsmToken::Tilde, StringRef(TokStart, 1));
   case '(': return AsmToken(AsmToken::LParen, StringRef(TokStart, 1));
   case ')': return AsmToken(AsmToken::RParen, StringRef(TokStart, 1));
   case '[': return AsmToken(AsmToken::LBrac, StringRef(TokStart, 1));
   case ']': return AsmToken(AsmToken::RBrac, StringRef(TokStart, 1));
   case '{': return AsmToken(AsmToken::LCurly, StringRef(TokStart, 1));
   case '}': return AsmToken(AsmToken::RCurly, StringRef(TokStart, 1));
   case '*': return AsmToken(AsmToken::Star, StringRef(TokStart, 1));
   case ',': return AsmToken(AsmToken::Comma, StringRef(TokStart, 1));
   case '$': return AsmToken(AsmToken::Dollar, StringRef(TokStart, 1));
   case '@': return AsmToken(AsmToken::At, StringRef(TokStart, 1));
   case '\\': return AsmToken(AsmToken::BackSlash, StringRef(TokStart, 1));
   case '=':
-    if (*CurPtr == '=') {
+    if (peekPtr() == '=') {
       ++CurPtr;
       return AsmToken(AsmToken::EqualEqual, StringRef(TokStart, 2));
     }
     return AsmToken(AsmToken::Equal, StringRef(TokStart, 1));
   case '-':
-    if (*CurPtr == '>') {
+    if (peekPtr() == '>') {
       ++CurPtr;
       return AsmToken(AsmToken::MinusGreater, StringRef(TokStart, 2));
     }
     return AsmToken(AsmToken::Minus, StringRef(TokStart, 1));
   case '|':
-    if (*CurPtr == '|') {
+    if (peekPtr() == '|') {
       ++CurPtr;
       return AsmToken(AsmToken::PipePipe, StringRef(TokStart, 2));
     }
     return AsmToken(AsmToken::Pipe, StringRef(TokStart, 1));
   case '^': return AsmToken(AsmToken::Caret, StringRef(TokStart, 1));
   case '&':
-    if (*CurPtr == '&') {
+    if (peekPtr() == '&') {
       ++CurPtr;
       return AsmToken(AsmToken::AmpAmp, StringRef(TokStart, 2));
     }
     return AsmToken(AsmToken::Amp, StringRef(TokStart, 1));
   case '!':
-    if (*CurPtr == '=') {
+    if (peekPtr() == '=') {
       ++CurPtr;
       return AsmToken(AsmToken::ExclaimEqual, StringRef(TokStart, 2));
     }
     return AsmToken(AsmToken::Exclaim, StringRef(TokStart, 1));
   case '%':
     if (MAI.hasMipsExpressions()) {
       AsmToken::TokenKind Operator;
       unsigned OperatorLength;
case '/':
     return LexSlash();
   case '#': return AsmToken(AsmToken::Hash, StringRef(TokStart, 1));
   case '\'': return LexSingleQuote();
   case '"': return LexQuote();
   case '0': case '1': case '2': case '3': case '4':
   case '5': case '6': case '7': case '8': case '9':
     return LexDigit();
   case '<':
-    switch (*CurPtr) {
+    switch (peekPtr()) {
     case '<':
       ++CurPtr;
       return AsmToken(AsmToken::LessLess, StringRef(TokStart, 2));
     case '=':
       ++CurPtr;
       return AsmToken(AsmToken::LessEqual, StringRef(TokStart, 2));
     case '>':
       ++CurPtr;
       return AsmToken(AsmToken::LessGreater, StringRef(TokStart, 2));
     default:
       return AsmToken(AsmToken::Less, StringRef(TokStart, 1));
     }
   case '>':
-    switch (*CurPtr) {
+    switch (peekPtr()) {
     case '>':
       ++CurPtr;
       return AsmToken(AsmToken::GreaterGreater, StringRef(TokStart, 2));
     case '=':
       ++CurPtr;
       return AsmToken(AsmToken::GreaterEqual, StringRef(TokStart, 2));
     default:
       return AsmToken(AsmToken::Greater, StringRef(TokStart, 1));
     }
 
   // TODO: Quoted identifiers (objc methods etc)
   // local labels: [0-9][:]
   // Forward/backward labels: [0-9][fb]
   // Integers, fp constants, character constants.
   }
 }

llvm/lib/MC/MCParser/AsmParser.cpp

Lexer.setBuffer(SrcMgr.getMemoryBuffer(CurBuffer)->getBuffer(),
                   Loc.getPointer());
 }
 
 const AsmToken &AsmParser::Lex() {
   if (Lexer.getTok().is(AsmToken::Error))
     Error(Lexer.getErrLoc(), Lexer.getErr());
 
   // if it's a end of statement with a comment in it
-  if (getTok().is(AsmToken::EndOfStatement)) {
+  if (getTok().is(AsmToken::EndOfStatement) &&
+      !(Lexer.tokOutOfBounds(getTok()))) {
     // if this is a line comment output it.
     if (!getTok().getString().empty() && getTok().getString().front() != '\n' &&
         getTok().getString().front() != '\r' && MAI.preserveAsmComments())
       Out.addExplicitComment(Twine(getTok().getString()));
   }
 
   const AsmToken *tok = &Lexer.Lex();