header_rewrite: Parser::preprocess() indexes tokens[0] after pop_back() can empty the vector

[bryancall]

Summary

Parser::preprocess() in header_rewrite can pop the only token off the vector and then index tokens[0] without checking whether anything is left.

Detail

plugins/header_rewrite/parser.cc:194 consumes a trailing flags section:

if (tokens.size() > 0) {
  std::string m = tokens[tokens.size() - 1];

  if (!m.empty() && (m[0] == '[')) {
    if (m[m.size() - 1] == ']') {
      ...
      tokens.pop_back(); // consume it, so we don't concatenate it into the value
    } else {
      ...
    }
  }
}

// Special case for "conditional" values
if (tokens[0].substr(0, 2) == "%{") {

A configuration line whose only token is a flags section, [L] on a line by itself for instance, gives tokens.size() == 1. The pop_back() empties the vector, and the very next statement indexes tokens[0].

std::vector::operator[] does no bounds checking, so this is an out-of-bounds read on a configuration file that a user can write.

Proposed fix

An if (tokens.empty()) guard after the pop_back(), returning false with a TSError describing the offending line. A flags-only line is not a valid rule, so rejecting it with a message beats reading past the end of the vector.

Context

Pre-existing, and adjacent to a hunk in PR #13591. Filing it separately to keep that PR purely mechanical.