Fix linked list iteration when displaying errors

tenderlove · tenderlove · commit 48283779400d · 2025-07-17T11:10:41.000-07:00
When a script has problem with the magic comment encoding, we only
display that error.  However, if there are other syntax errors in the
file, the error linked list could contain multiple items.  This lead to
an inconsistency in the "size" field of the linked list, and the actual
items in the linked list.  In other words, the linked list had more than
one item, but the size field was one.

The error display routine would only allocate `size` items, but
iterating the linked list would overrun the array.  This commit changes
the iterator to compare the current node to the "finish" node in the
linked list, no longer assuming the linked list ends with NULL.

[Bug #21461]
diff --git a/prism_compile.c b/prism_compile.c
@@ -10613,7 +10613,9 @@ pm_parse_errors_format_sort(const pm_parser_t *parser, const pm_list_t *error_li
     if (errors == NULL) return NULL;
 
     int32_t start_line = parser->start_line;
-    for (pm_diagnostic_t *error = (pm_diagnostic_t *) error_list->head; error != NULL; error = (pm_diagnostic_t *) error->node.next) {
+    pm_diagnostic_t *finish = (pm_diagnostic_t * )error_list->tail->next;
+
+    for (pm_diagnostic_t *error = (pm_diagnostic_t *) error_list->head; error != finish; error = (pm_diagnostic_t *) error->node.next) {
         pm_line_column_t start = pm_newline_list_line_column(newline_list, error->location.start, start_line);
         pm_line_column_t end = pm_newline_list_line_column(newline_list, error->location.end, start_line);
 
