Mirrors_Framework/mujs
1
0
Fork 0
mirror of https://github.com/ccxvii/mujs.git synced 2026-02-06 01:41:37 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix bug 697141: buffer overrun in regexp string substitution.

Browse Source 
A '$' escape at the end of the string would read past the zero terminator
when looking for the escaped character.
This commit is contained in:
Tor Andersson
2016-09-21 16:02:11 +02:00
parent 8c805b4eb1
commit 5000749f5a
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
jsstring.c
View File

@@ -421,6 +421,7 @@ loop:
while (*r) {
if (*r == '$') {
switch (*(++r)) {
case 0: --r; /* end of string; back up and fall through */
case '$': js_putc(J, &sb, '$'); break;
case '`': js_putm(J, &sb, source, s); break;
case '\'': js_puts(J, &sb, s + n); break;
@@ -516,6 +517,7 @@ static void Sp_replace_string(js_State *J)
while (*r) {
if (*r == '$') {
switch (*(++r)) {
case 0: --r; /* end of string; back up and fall through */
case '$': js_putc(J, &sb, '$'); break;
case '&': js_putm(J, &sb, s, s + n); break;
case '`': js_putm(J, &sb, source, s); break;