details: https://hg.nginx.org/njs/rev/275d785ab5bf
branches:
changeset: 2257:275d785ab5bf
user: Dmitry Volyntsev <xeioex@nginx.com>
date: Mon Jan 08 16:40:42 2024 -0800
description:
Fixed RegExp.prototype.exec() when second argument is absent.

Previously, when the second argument is undefined, NaN is casted to
unsigned which is undefined behavior.

Found by UndefinedBehaviorSanitizer.

diffstat:

src/njs_regexp.c | 11 +++++++++--
1 files changed, 9 insertions(+), 2 deletions(-)

diffs (28 lines):

diff -r 41d0de3ad198 -r 275d785ab5bf src/njs_regexp.c
--- a/src/njs_regexp.c Mon Jan 08 16:40:42 2024 -0800
+++ b/src/njs_regexp.c Mon Jan 08 16:40:42 2024 -0800
@@ -1235,6 +1235,7 @@ njs_int_t
njs_regexp_prototype_exec(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs,
njs_index_t unused, njs_value_t *retval)
{
+ unsigned flags;
njs_int_t ret;
njs_value_t *r, *s;
njs_value_t string_lvalue;
@@ -1253,8 +1254,14 @@ njs_regexp_prototype_exec(njs_vm_t *vm,
return ret;
}

- return njs_regexp_builtin_exec(vm, r, s,
- njs_number(njs_arg(args, nargs, 2)), retval);
+ if (nargs > 2) {
+ flags = njs_number(njs_arg(args, nargs, 2));
+
+ } else {
+ flags = 0;
+ }
+
+ return njs_regexp_builtin_exec(vm, r, s, flags, retval);
}


_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
https://mailman.nginx.org/mailman/listinfo/nginx-devel