Changeset 10663 in webkit for trunk/JavaScriptCore/pcre

Timestamp:

Sep 29, 2005, 3:05:12 PM (20 years ago)

Author:

eseidel

Message:

Bug #: 5176
Submitted by: Mitz Pettel <​[email protected]>
Reviewed by: darin

Fix JSC memory smasher in TOT.
​http://bugzilla.opendarwin.org/show_bug.cgi?id=5176

• pcre/pcre_exec.c: (match):

File:

• trunk/JavaScriptCore/pcre/pcre_exec.c (modified) (3 diffs)

trunk/JavaScriptCore/pcre/pcre_exec.c

@@ -1810 +1810 @@
       int dc;
       ecode += length;
-      GETCHARINC(dc, eptr);
+      switch (md->end_subject - eptr)
+      {
+        case 0:
+          RRETURN(MATCH_NOMATCH);
+        case 1:
+          dc = *eptr++;
+          if (IS_LEADING_SURROGATE(dc))
+            RRETURN(MATCH_NOMATCH);
+          break;
+        default:
+          GETCHARINC(dc, eptr);
+      }
       if (fc != dc) RRETURN(MATCH_NOMATCH);
 #else
@@ -1838 +1849 @@
       GETUTF8CHARLEN(fc, ecode, length);
 
-#if !PCRE_UTF16
+#if PCRE_UTF16
+      if (md->end_subject - eptr == 0) RRETURN(MATCH_NOMATCH);
+#else
       if (length > md->end_subject - eptr) RRETURN(MATCH_NOMATCH);
 #endif
@@ -1862 +1875 @@
         {
         int dc;
-        GETCHARINC(dc, eptr);
+#if PCRE_UTF16
+        if (md->end_subject - eptr == 1) {
+          dc = *eptr++;
+          if (IS_LEADING_SURROGATE(dc))
+            RRETURN(MATCH_NOMATCH);
+        } else
+#endif
+          GETCHARINC(dc, eptr);
         ecode += length;