227705 - Accessing *state->cpend in jsregexp.c

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Igor Bukanov]

The lines 483-485 in jsregexp.c contain:

                if ((state->cp < state->cpend) && (*state->cp == '?')
                        && ( (state->cp[1] == '=')
                                || (state->cp[1] == '!')
                                || (state->cp[1] == ':') )) {

which would access a character at state->cpend for regexp like /(?/. AFAIK since
all char arrays are 0-terminated, it does not cause any problems, but it still I
guess violates recommended practice.

In addition the line 488 contains useless check against state->cpend which
always passes since the initial "if" guaranties that at that point (state->cp <
state->cpend)

Comment 1

[Igor Bukanov]

Attachment: Fix

Comment 2

[Igor Bukanov]

CC Brendan for review

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 136972 [details] [diff] [review]
Fix

I actually checked in a much bigger change that included a version of this fix.

/be

Comment 4

[Brendan Eich [:brendan]]

.