Skip to content
Permalink
Browse files Browse the repository at this point in the history
Fixed Array.prototype.lastIndexOf() with unicode string as "this".
Previously, when lastIndexOf() was called with unicode string as "this"
argument and a negative "fromIndex" argument null-pointer dererence
might occur because njs_string_offset() was called with invalid index
value whereas njs_string_offset() should always be called with valid
index argument.

The fix is to verify that from index is valid.

This closes #482 issue on Github.
  • Loading branch information
xeioex committed Apr 27, 2022
1 parent 982100b commit eafe4c7
Show file tree
Hide file tree
Showing 2 changed files with 9 additions and 3 deletions.
9 changes: 6 additions & 3 deletions src/njs_iterator.c
Expand Up @@ -560,11 +560,14 @@ njs_object_iterate_reverse(njs_vm_t *vm, njs_iterator_args_t *args,
} else {
/* UTF-8 string. */

p = njs_string_offset(string_prop.start, end, from);
p = njs_utf8_next(p, end);

p = NULL;
i = from + 1;

if (i > to) {
p = njs_string_offset(string_prop.start, end, from);
p = njs_utf8_next(p, end);
}

while (i-- > to) {
pos = njs_utf8_prev(p);

Expand Down
3 changes: 3 additions & 0 deletions src/test/njs_unit_test.c
Expand Up @@ -5103,6 +5103,9 @@ static njs_unit_test_t njs_test[] =
{ njs_str("Array.prototype.lastIndexOf.call({0:'undefined', length:0}, 'undefined')"),
njs_str("-1") },

{ njs_str("[1,0,-1,-2].map(v => Array.prototype.lastIndexOf.call('Ф', 'Ф', v))"),
njs_str("0,0,0,-1") },

{ njs_str("[''].lastIndexOf.call('00000000000000000000000000000а00')"),
njs_str("-1") },

Expand Down

0 comments on commit eafe4c7

Please sign in to comment.