From: Igor Sysoev <igor@sysoev.ru>
Date: Fri, 4 Nov 2016 13:22:56 +0000 (+0300)
Subject: String.prototype.repeat() did not check the count parameter
X-Git-Tag: 0.1.5~20
X-Git-Url: http://www.kaiwu.me/postgresql/commit/?a=commitdiff_plain;h=b452dffd26de5bea8ee474dad4985a362f030964;p=njs.git

String.prototype.repeat() did not check the count parameter
for single character strings.  The count parameter should be
checked also for empty string.

In collaboration with Andrey Zelenkov and Valentin Bartenev.
---

diff --git a/njs/njs_string.c b/njs/njs_string.c
index a95b622f..59e0bf9b 100644
--- a/njs/njs_string.c
+++ b/njs/njs_string.c
@@ -1756,21 +1756,23 @@ njs_string_prototype_repeat(njs_vm_t *vm, njs_value_t *args, nxt_uint_t nargs,
 
     (void) njs_string_prop(&string, &args[0]);
 
-    if (string.size == 0) {
-        vm->retval = njs_string_empty;
-        return NXT_OK;
-    }
-
     if (nargs > 1) {
-        max = NJS_STRING_MAX_LENGTH / string.size;
+        max = (string.size > 1) ? NJS_STRING_MAX_LENGTH / string.size
+                                : NJS_STRING_MAX_LENGTH;
+
         n = args[1].data.u.number;
 
-        if (nxt_slow_path(n < 0 || n > max)) {
+        if (nxt_slow_path(n < 0 || n >= max)) {
             vm->exception = &njs_exception_range_error;
             return NXT_ERROR;
         }
     }
 
+    if (string.size == 0) {
+        vm->retval = njs_string_empty;
+        return NXT_OK;
+    }
+
     size = string.size * n;
     length = string.length * n;
 
diff --git a/njs/test/njs_unit_test.c b/njs/test/njs_unit_test.c
index 1f97d83f..c7301cc0 100644
--- a/njs/test/njs_unit_test.c
+++ b/njs/test/njs_unit_test.c
@@ -3633,6 +3633,37 @@ static njs_unit_test_t  njs_test[] =
     { nxt_string("'abc'.repeat(-1)"),
       nxt_string("RangeError") },
 
+    { nxt_string("''.repeat(-1)"),
+      nxt_string("RangeError") },
+
+    { nxt_string("'a'.repeat(2147483647)"),
+      nxt_string("RangeError") },
+
+    { nxt_string("'a'.repeat(2147483648)"),
+      nxt_string("RangeError") },
+
+    { nxt_string("'a'.repeat(Infinity)"),
+      nxt_string("RangeError") },
+
+    { nxt_string("'a'.repeat(NaN)"),
+      nxt_string("") },
+
+    { nxt_string("''.repeat(2147483646)"),
+      nxt_string("") },
+
+    /* ES6: "". */
+    { nxt_string("''.repeat(2147483647)"),
+      nxt_string("RangeError") },
+
+    { nxt_string("''.repeat(2147483648)"),
+      nxt_string("RangeError") },
+
+    { nxt_string("''.repeat(Infinity)"),
+      nxt_string("RangeError") },
+
+    { nxt_string("''.repeat(NaN)"),
+      nxt_string("") },
+
     { nxt_string("encodeURI()"),
       nxt_string("undefined")},