3539

Always check if next_word() returned an empty string (if it hit eof).

Thanks Rebecca Allard for running into a crash when a .mu file ends with
'{' (without a following newline).

Open question: how to express the constraint that next_word() should
always check if its result is empty? Can *any* type system do that?!
Even the usual constraint that we must use a result isn't iron-clad: you
could save the result in a variable but then ignore it. Unless you go to
Go's extraordinary lengths of considering any dead code an error.

1 files changed, 10 insertions, 0 deletions

diff --git a/053recipe_header.cc b/053recipe_header.cc
index b23614c8..450a0142 100644
--- a/053recipe_header.cc
+++ b/053recipe_header.cc
@@ -33,6 +33,11 @@ void load_recipe_header(istream& in, recipe& result) {
   result.has_header = true;
   while (has_data(in) && in.peek() != '[' && in.peek() != '\n') {
     string s = next_word(in);
+    if (s.empty()) {
+      assert(!has_data(in));
+      raise << "incomplete recipe header at end of file (0)\n" << end();
+      return;
+    }
     if (s == "<-")
       raise << "recipe " << result.name << " should say '->' and not '<-'\n" << end();
     if (s == "->") break;
@@ -42,6 +47,11 @@ void load_recipe_header(istream& in, recipe& result) {
   }
   while (has_data(in) && in.peek() != '[' && in.peek() != '\n') {
     string s = next_word(in);
+    if (s.empty()) {
+      assert(!has_data(in));
+      raise << "incomplete recipe header at end of file (1)\n" << end();
+      return;
+    }
     result.products.push_back(reagent(s));
     trace(9999, "parse") << "header product: " << result.products.back().original_string << end();
     skip_whitespace_but_not_newline(in);