From 44343585cf663c5c17d9eb281ac9b1337c87ca9a Mon Sep 17 00:00:00 2001
From: Benjamin Kaufmann <kaufmann@cs.uni-potsdam.de>
Date: Fri, 20 Sep 2024 08:56:48 +0200
Subject: [PATCH] Minor fixes.

* Fix potential out of bounds read in AspifTextOutput::atomArity.
* Fix potential integer overflow in matchDomHeuPred and "Test alarm".
* Fix potential invalid memcpy call in TheoryAtom construction -
  pointers passed to std::memcpy must not be null even if the size
  to copy is 0.
---
 src/aspif_text.cpp         | 5 +++--
 src/match_basic_types.cpp  | 2 +-
 src/theory_data.cpp        | 2 +-
 tests/test_application.cpp | 6 +++---
 4 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/src/aspif_text.cpp b/src/aspif_text.cpp
index f31836b..8873af5 100644
--- a/src/aspif_text.cpp
+++ b/src/aspif_text.cpp
@@ -354,9 +354,10 @@ struct AspifTextOutput::Data {
 		for (StringSpan ignore;;) {
 			POTASSCO_REQUIRE(matchAtomArg(args, ignore), "invalid empty argument in name");
 			++arity;
-			if (*args++ == ')') break;
+			if (*args != ',') break;
+			++args;
 		}
-		POTASSCO_REQUIRE(!*args, "invalid character in name");
+		POTASSCO_REQUIRE(*args == ')' && !*++args, "invalid character in name");
 		return arity;
 	}
 
diff --git a/src/match_basic_types.cpp b/src/match_basic_types.cpp
index 600a4c7..1a52481 100644
--- a/src/match_basic_types.cpp
+++ b/src/match_basic_types.cpp
@@ -247,7 +247,7 @@ int matchDomHeuPred(const char*& in, StringSpan& atom, Heuristic_t& type, int& b
 	if (!matchAtomArg(in, atom) || !match(in, ",")) { return -1; }
 	if (!match(in, type)        || !match(in, ",")) { return -2; }
 	if (!match(in, bias)) { return -3; }
-	prio = static_cast<unsigned>(bias < 0 ? -bias : bias);
+	prio = bias < 0 ? static_cast<unsigned>(~bias) + 1u : static_cast<unsigned>(bias);
 	if (!match(in, ",")) { return match(in, ")") ? 1 : -3; }
 	if (!match(in, p) || p < 0) { return -4; }
 	prio = static_cast<unsigned>(p);
diff --git a/src/theory_data.cpp b/src/theory_data.cpp
index bcb0558..47a12fc 100644
--- a/src/theory_data.cpp
+++ b/src/theory_data.cpp
@@ -128,7 +128,7 @@ TheoryAtom::TheoryAtom(Id_t a, Id_t term, const IdSpan& args, Id_t* op, Id_t* rh
 	, guard_(op != 0)
 	, termId_(term)
 	, nTerms_(static_cast<uint32_t>(Potassco::size(args))) {
-	std::memcpy(term_, Potassco::begin(args), nTerms_ * sizeof(Id_t));
+	nTerms_ == 0 || std::memcpy(term_, Potassco::begin(args), nTerms_ * sizeof(Id_t));
 	if (op) {
 		term_[nTerms_] = *op;
 		term_[nTerms_ + 1] = *rhs;
diff --git a/tests/test_application.cpp b/tests/test_application.cpp
index 6097360..bf0b035 100644
--- a/tests/test_application.cpp
+++ b/tests/test_application.cpp
@@ -88,9 +88,9 @@ TEST_CASE("Test alarm", "[app]") {
 	struct TimedApp : MyApp {
 		TimedApp() : stop(0) {}
 		void run() {
-			int i = 0;
+			unsigned i = 0;
 			while (!stop) { ++i;  }
-			setExitCode(i);
+			setExitCode(1 + stop);
 		}
 		virtual bool onSignal(int) {
 			stop = 1;
@@ -102,7 +102,7 @@ TEST_CASE("Test alarm", "[app]") {
 	TimedApp app;
 	char* argv[] = {(char*)"app", (char*)"--time-limit=1", 0};
 	int argc = 2;
-	app.main(argc, argv);
+	REQUIRE(app.main(argc, argv) == 2);
 	REQUIRE(app.stop == 1);
 }
 }}}