String.prototype.repeat() did not check the count parameter

for single character strings.  The count parameter should be
checked also for empty string.

In collaboration with Andrey Zelenkov and Valentin Bartenev.

diff --git a/njs/njs_string.c b/njs/njs_string.c
index a95b622f6751681ee583aba3b4905d4d0ccccba6..59e0bf9b916888696710f8f84ca78d63ffc0681e 100644 (file)
--- a/njs/njs_string.c
+++ b/njs/njs_string.c
@@ -1756,21 +1756,23 @@ njs_string_prototype_repeat(njs_vm_t *vm, njs_value_t *args, nxt_uint_t nargs,
 
     (void) njs_string_prop(&string, &args[0]);
 
-    if (string.size == 0) {
-        vm->retval = njs_string_empty;
-        return NXT_OK;
-    }
-
     if (nargs > 1) {
-        max = NJS_STRING_MAX_LENGTH / string.size;
+        max = (string.size > 1) ? NJS_STRING_MAX_LENGTH / string.size
+                                : NJS_STRING_MAX_LENGTH;
+
         n = args[1].data.u.number;
 
-        if (nxt_slow_path(n < 0 || n > max)) {
+        if (nxt_slow_path(n < 0 || n >= max)) {
             vm->exception = &njs_exception_range_error;
             return NXT_ERROR;
         }
     }
 
+    if (string.size == 0) {
+        vm->retval = njs_string_empty;
+        return NXT_OK;
+    }
+
     size = string.size * n;
     length = string.length * n;
 

diff --git a/njs/test/njs_unit_test.c b/njs/test/njs_unit_test.c
index 1f97d83f704bbad0e2a88814b37fe78d76dc78b4..c7301cc043a91a4354afabb7a2ae0ee7831fc677 100644 (file)
--- a/njs/test/njs_unit_test.c
+++ b/njs/test/njs_unit_test.c
@@ -3633,6 +3633,37 @@ static njs_unit_test_t  njs_test[] =
     { nxt_string("'abc'.repeat(-1)"),
       nxt_string("RangeError") },
 
+    { nxt_string("''.repeat(-1)"),
+      nxt_string("RangeError") },
+
+    { nxt_string("'a'.repeat(2147483647)"),
+      nxt_string("RangeError") },
+
+    { nxt_string("'a'.repeat(2147483648)"),
+      nxt_string("RangeError") },
+
+    { nxt_string("'a'.repeat(Infinity)"),
+      nxt_string("RangeError") },
+
+    { nxt_string("'a'.repeat(NaN)"),
+      nxt_string("") },
+
+    { nxt_string("''.repeat(2147483646)"),
+      nxt_string("") },
+
+    /* ES6: "". */
+    { nxt_string("''.repeat(2147483647)"),
+      nxt_string("RangeError") },
+
+    { nxt_string("''.repeat(2147483648)"),
+      nxt_string("RangeError") },
+
+    { nxt_string("''.repeat(Infinity)"),
+      nxt_string("RangeError") },
+
+    { nxt_string("''.repeat(NaN)"),
+      nxt_string("") },
+
     { nxt_string("encodeURI()"),
       nxt_string("undefined")},