YourWishes/jerryscript
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix heap buffer overflow in re_parse_char_class (#2352)

Browse Source 
This patch fixes #2230 and fixes #2237.
Test cases are added for both issues and also adds new cases which caused the same error.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu
This commit is contained in:
Robert Fancsik
2018-05-28 10:13:17 +02:00
committed by László Langó
parent ac9fce1d8d
commit e6664f6364
3 changed files with 64 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jerry-core/parser/regexp/re-parser.c
+8 -4
View File
@@ -409,7 +409,7 @@ re_parse_char_class (re_parser_ctx_t *parser_ctx_p, /**< number of classes */
}
}
}
else if (ch == LIT_CHAR_LOWERCASE_X)
else if (ch == LIT_CHAR_LOWERCASE_X && re_hex_lookup (parser_ctx_p, 2))
{
ecma_char_t code_unit;
@@ -419,7 +419,9 @@ re_parse_char_class (re_parser_ctx_t *parser_ctx_p, /**< number of classes */
}
parser_ctx_p->input_curr_p += 2;
if (is_range == false && lit_utf8_peek_next (parser_ctx_p->input_curr_p) == LIT_CHAR_MINUS)
if (parser_ctx_p->input_curr_p < parser_ctx_p->input_end_p
&& is_range == false
&& lit_utf8_peek_next (parser_ctx_p->input_curr_p) == LIT_CHAR_MINUS)
{
start = code_unit;
continue;
@@ -427,7 +429,7 @@ re_parse_char_class (re_parser_ctx_t *parser_ctx_p, /**< number of classes */
ch = code_unit;
}
else if (ch == LIT_CHAR_LOWERCASE_U)
else if (ch == LIT_CHAR_LOWERCASE_U && re_hex_lookup (parser_ctx_p, 4))
{
ecma_char_t code_unit;
@@ -437,7 +439,9 @@ re_parse_char_class (re_parser_ctx_t *parser_ctx_p, /**< number of classes */
}
parser_ctx_p->input_curr_p += 4;
if (is_range == false && lit_utf8_peek_next (parser_ctx_p->input_curr_p) == LIT_CHAR_MINUS)
if (parser_ctx_p->input_curr_p < parser_ctx_p->input_end_p
&& is_range == false
&& lit_utf8_peek_next (parser_ctx_p->input_curr_p) == LIT_CHAR_MINUS)
{
start = code_unit;
continue;