details: https://hg.nginx.org/njs/rev/cba3bd29f263
branches:
changeset: 1076:cba3bd29f263
user: Valentin Bartenev <vbart@nginx.com>
date: Sat Jul 27 17:03:02 2019 +0300
description:
Fixed String.toLowerCase() and String.toUpperCase().

Previously these functions didn't took into account that the size of
a string may change during case transformation resulting in buffer
underflow or overflow.

diffstat:

njs/njs_string.c | 88 +++++++++++++++++++++++++++++++++--------------
njs/test/njs_unit_test.c | 11 ++++-
2 files changed, 71 insertions(+), 28 deletions(-)

diffs (176 lines):

diff -r 0b82f1c9268c -r cba3bd29f263 njs/njs_string.c
--- a/njs/njs_string.c Sat Jul 27 16:12:26 2019 +0300
+++ b/njs/njs_string.c Sat Jul 27 17:03:02 2019 +0300
@@ -2171,24 +2171,24 @@ njs_string_prototype_to_lower_case(njs_v
nxt_uint_t nargs, njs_index_t unused)
{
size_t size, length;
- u_char *p, *start;
+ u_char *p;
+ uint32_t code;
const u_char *s, *end;
njs_string_prop_t string;

(void) njs_string_prop(&string, &args[0]);

- start = njs_string_alloc(vm, &vm->retval, string.size, string.length);
- if (nxt_slow_path(start == NULL)) {
- return NXT_ERROR;
- }
-
- p = start;
- s = string.start;
- size = string.size;
-
- if (string.length == 0 || string.length == size) {
+ if (string.length == 0 || string.length == string.size) {
/* Byte or ASCII string. */

+ p = njs_string_alloc(vm, &vm->retval, string.size, string.length);
+ if (nxt_slow_path(p == NULL)) {
+ return NXT_ERROR;
+ }
+
+ s = string.start;
+ size = string.size;
+
while (size != 0) {
*p++ = nxt_lower_case(*s++);
size--;
@@ -2196,11 +2196,29 @@ njs_string_prototype_to_lower_case(njs_v

} else {
/* UTF-8 string. */
- end = s + size;
+ s = string.start;
+ end = s + string.size;
+ length = string.length;
+
+ size = 0;
+
+ while (length != 0) {
+ code = nxt_utf8_lower_case(&s, end);
+ size += nxt_utf8_size(code);
+ length--;
+ }
+
+ p = njs_string_alloc(vm, &vm->retval, size, string.length);
+ if (nxt_slow_path(p == NULL)) {
+ return NXT_ERROR;
+ }
+
+ s = string.start;
length = string.length;

while (length != 0) {
- p = nxt_utf8_encode(p, nxt_utf8_lower_case(&s, end));
+ code = nxt_utf8_lower_case(&s, end);
+ p = nxt_utf8_encode(p, code);
length--;
}
}
@@ -2220,24 +2238,24 @@ njs_string_prototype_to_upper_case(njs_v
nxt_uint_t nargs, njs_index_t unused)
{
size_t size, length;
- u_char *p, *start;
+ u_char *p;
+ uint32_t code;
const u_char *s, *end;
njs_string_prop_t string;

(void) njs_string_prop(&string, &args[0]);

- start = njs_string_alloc(vm, &vm->retval, string.size, string.length);
- if (nxt_slow_path(start == NULL)) {
- return NXT_ERROR;
- }
-
- p = start;
- s = string.start;
- size = string.size;
-
- if (string.length == 0 || string.length == size) {
+ if (string.length == 0 || string.length == string.size) {
/* Byte or ASCII string. */

+ p = njs_string_alloc(vm, &vm->retval, string.size, string.length);
+ if (nxt_slow_path(p == NULL)) {
+ return NXT_ERROR;
+ }
+
+ s = string.start;
+ size = string.size;
+
while (size != 0) {
*p++ = nxt_upper_case(*s++);
size--;
@@ -2245,11 +2263,29 @@ njs_string_prototype_to_upper_case(njs_v

} else {
/* UTF-8 string. */
- end = s + size;
+ s = string.start;
+ end = s + string.size;
+ length = string.length;
+
+ size = 0;
+
+ while (length != 0) {
+ code = nxt_utf8_upper_case(&s, end);
+ size += nxt_utf8_size(code);
+ length--;
+ }
+
+ p = njs_string_alloc(vm, &vm->retval, size, string.length);
+ if (nxt_slow_path(p == NULL)) {
+ return NXT_ERROR;
+ }
+
+ s = string.start;
length = string.length;

while (length != 0) {
- p = nxt_utf8_encode(p, nxt_utf8_upper_case(&s, end));
+ code = nxt_utf8_upper_case(&s, end);
+ p = nxt_utf8_encode(p, code);
length--;
}
}
diff -r 0b82f1c9268c -r cba3bd29f263 njs/test/njs_unit_test.c
--- a/njs/test/njs_unit_test.c Sat Jul 27 16:12:26 2019 +0300
+++ b/njs/test/njs_unit_test.c Sat Jul 27 17:03:02 2019 +0300
@@ -5561,16 +5561,24 @@ static njs_unit_test_t njs_test[] =
{ nxt_string("'АБВ'.toLowerCase()"),
nxt_string("абв") },

+ { nxt_string("'Ȿ'.repeat(256).toLowerCase() === 'ȿ'.repeat(256)"),
+ nxt_string("true") },
+
{ nxt_string("'abc'.toUpperCase()"),
nxt_string("ABC") },

{ nxt_string("'αβγ'.toUpperCase()"),
nxt_string("ΑΒΓ") },

+ { nxt_string("'ȿ'.repeat(256).toUpperCase() === 'Ȿ'.repeat(256)"),
+ nxt_string("true") },
+
{ nxt_string("'\x00абвгдеёжз'.toUpperCase().length"),
nxt_string("10") },

-#if 0 /* FIXME */
+ { nxt_string("['ȿ', 'Ȿ', 'ȿ'.toUpperCase(), 'Ȿ'.toLowerCase()].map((v)=>v.toUTF8().length)"),
+ nxt_string("2,3,3,2") },
+
{ nxt_string("var a = [], code;"
"for (code = 0; code < 65536; code++) {"
" var s = String.fromCharCode(code);"
@@ -5588,7 +5596,6 @@ static njs_unit_test_t njs_test[] =
" a.push(code);"
"} a"),
nxt_string("304,453,456,459,498,1012,7838,8486,8490,8491") },
-#endif

{ nxt_string("'abc'.trim()"),
nxt_string("abc") },
_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel