Fixed 1 byte heap buffer overflow.

diff --git a/njs/njs_vm.c b/njs/njs_vm.c
index 7e8ff99674839d26102d70c2606c736b68799cac..7db6c5ac76da67262a84adbe4c771ebea05ead23 100644 (file)
--- a/njs/njs_vm.c
+++ b/njs/njs_vm.c
@@ -3514,11 +3514,11 @@ again:
 
                 for (i = 0; i < backtrace->items; i++) {
                     if (be[i].line != 0) {
-                        len += sizeof("    at  (:)\n") - 1 + 10
+                        len += sizeof("    at  (:)\n") + 10
                                + be[i].name.length;
 
                     } else {
-                        len += sizeof("    at  (native)\n") - 1
+                        len += sizeof("    at  (native)\n")
                                + be[i].name.length;
                     }
                 }

diff --git a/njs/test/njs_unit_test.c b/njs/test/njs_unit_test.c
index 69de8e3426e1b1380d59d29eb729b1e762768f87..b7855372bb295f4d537e8baac2a402ada48c70d3 100644 (file)
--- a/njs/test/njs_unit_test.c
+++ b/njs/test/njs_unit_test.c
@@ -5706,6 +5706,9 @@ static njs_unit_test_t  njs_test[] =
     { nxt_string("Object.prototype.__proto__ === null"),
       nxt_string("true") },
 
+    { nxt_string("Object.prototype.__proto__.f()"),
+      nxt_string("InternalError: method 'f' query failed:-1") },
+
     { nxt_string("Object.prototype.toString.call(Object.prototype)"),
       nxt_string("[object Object]") },