Fixed heap-buffer-overflow in lexer introduced in 87d05fb35ff9.

diff --git a/src/njs_lexer.c b/src/njs_lexer.c
index d58cb53e1c5e21433343f2a4198c0e20fd6cbf32..3045eea13849c8a6b58da21a3ce37cc121f78ccb 100644 (file)
--- a/src/njs_lexer.c
+++ b/src/njs_lexer.c
@@ -864,7 +864,7 @@ njs_lexer_multi(njs_lexer_t *lexer, njs_lexer_token_t *token,
 
     token->text.start = lexer->start - 1;
 
-    while (length != 0 && multi != NULL) {
+    while (length != 0 && multi != NULL && lexer->start < lexer->end) {
         c = lexer->start[0];
 
         if (c == multi->symbol) {

diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index 087435f73c0a60be38870adf358ed2f54229604f..059846c49cef9aa877c21b306aa32c927f8ba6aa 100644 (file)
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -33,6 +33,21 @@ static njs_unit_test_t  njs_test[] =
     { njs_str("/***/1/*\n**/"),
       njs_str("1") },
 
+    { njs_str(">"),
+      njs_str("SyntaxError: Unexpected token \">\" in 1") },
+
+    { njs_str(">>"),
+      njs_str("SyntaxError: Unexpected token \">>\" in 1") },
+
+    { njs_str(">>>"),
+      njs_str("SyntaxError: Unexpected token \">>>\" in 1") },
+
+    { njs_str("=="),
+      njs_str("SyntaxError: Unexpected token \"==\" in 1") },
+
+    { njs_str("?"),
+      njs_str("SyntaxError: Unexpected token \"?\" in 1") },
+
     /* Variable declarations. */
 
     { njs_str("var x"),