RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 19:08:10 +00:00
Code Issues Activity Actions

LibRegex: Consume exactly two chars for escaped characters

Browse source 
We were previously consuming an extra char afterwards, which could be
the charclass terminator, leading to possible OOB accesses.
This commit is contained in:
Ali Mohammad Pur 2022-09-06 23:56:12 +04:30 • committed by Ali Mohammad Pur
parent 7e1e208d08
commit 48442059fc
1 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
Userland/Libraries/LibRegex/RegexParser.cpp
View file

@ -2701,10 +2701,13 @@ size_t ECMA262Parser::ensure_total_number_of_capturing_parenthesis()
continue;
case '[':
while (!lexer.is_eof()) {
if (lexer.consume_specific('\\'))
if (lexer.consume_specific('\\')) {
lexer.consume();
else if (lexer.consume_specific(']'))
continue;
}
if (lexer.consume_specific(']')) {
break;
}
lexer.consume();
}
break;