details: https://hg.nginx.org/njs/rev/341cd52d4348
branches:
changeset: 1437:341cd52d4348
user: Alexander Borisov <alexander.borisov@nginx.com>
date: Fri Jun 19 19:48:12 2020 +0300
description:
Parser: fixed heap-use-after-free in optional chain.

diffstat:

src/njs_parser.c | 4 ----
src/test/njs_unit_test.c | 3 +++
2 files changed, 3 insertions(+), 4 deletions(-)

diffs (27 lines):

diff -r a712d6442c0a -r 341cd52d4348 src/njs_parser.c
--- a/src/njs_parser.c Thu Jun 18 18:56:24 2020 +0000
+++ b/src/njs_parser.c Fri Jun 19 19:48:12 2020 +0300
@@ -2881,10 +2881,6 @@ njs_parser_optional_chain(njs_parser_t *
break;

default:
- if (!njs_lexer_token_is_identifier_name(token)) {
- njs_lexer_consume_token(parser->lexer, 1);
- }
-
ret = njs_parser_property(parser, token, current);

switch (ret) {
diff -r a712d6442c0a -r 341cd52d4348 src/test/njs_unit_test.c
--- a/src/test/njs_unit_test.c Thu Jun 18 18:56:24 2020 +0000
+++ b/src/test/njs_unit_test.c Fri Jun 19 19:48:12 2020 +0300
@@ -17016,6 +17016,9 @@ static njs_unit_test_t njs_test[] =

{ njs_str("{{} ({a: 1, b: {}\n}\n})\n}"),
njs_str("SyntaxError: Unexpected token \"}\" in 3") },
+
+ { njs_str("object?."),
+ njs_str("SyntaxError: Unexpected end of input in 1") },
};


_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel