From e01fe424ab94395713d94f46eee57f1af0a279b4 Mon Sep 17 00:00:00 2001 From: Tor Andersson Date: Fri, 27 Dec 2013 17:33:04 +0100 Subject: [PATCH] Check hex string escapes so we don't read past the end of the string. --- js-lex.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/js-lex.c b/js-lex.c index 692251f..8465cf9 100644 --- a/js-lex.c +++ b/js-lex.c @@ -294,20 +294,20 @@ static inline js_Token lexnumber(js_State *J, const char **sp) static inline int lexescape(const char **sp) { int c = GET(); - int x, y, z, w; + int x = 0; switch (c) { case '0': return 0; case 'u': - x = tohex(GET()); - y = tohex(GET()); - z = tohex(GET()); - w = tohex(GET()); - return (x << 12) | (y << 8) | (z << 4) | w; + if (!ishex(PEEK())) return x; else x |= NEXTPEEK() << 12; + if (!ishex(PEEK())) return x; else x |= NEXTPEEK() << 8; + if (!ishex(PEEK())) return x; else x |= NEXTPEEK() << 4; + if (!ishex(PEEK())) return x; else x |= NEXTPEEK(); + return x; case 'x': - x = tohex(GET()); - y = tohex(GET()); - return (x << 4) | y; + if (!ishex(PEEK())) return x; else x |= NEXTPEEK() << 4; + if (!ishex(PEEK())) return x; else x |= NEXTPEEK(); + return x; case '\'': return '\''; case '"': return '"'; case '\\': return '\\';