Making FOREACH and NEXT instructions robust to invalid input.

diff --git a/src/njs_value.h b/src/njs_value.h
index 7297df3953d7b5640e201e7d29297235f9222dba..b86634067f00f4e5560f1de973a94cd06b56ce34 100644 (file)
--- a/src/njs_value.h
+++ b/src/njs_value.h
@@ -70,7 +70,7 @@ typedef enum {
     NJS_DATA_TAG_TEXT_ENCODER,
     NJS_DATA_TAG_TEXT_DECODER,
     NJS_DATA_TAG_ARRAY_ITERATOR,
-    NJS_DATA_TAG_FS_STAT,
+    NJS_DATA_TAG_FOREACH_NEXT,
     NJS_DATA_TAG_MAX
 } njs_data_tag_t;
 
@@ -135,7 +135,6 @@ union njs_value_s {
             njs_promise_t             *promise;
             njs_prop_handler_t        prop_handler;
             njs_value_t               *value;
-            njs_property_next_t       *next;
             void                      *data;
         } u;
     } data;

diff --git a/src/njs_vmcode.c b/src/njs_vmcode.c
index 6b10200ee19eb8c17370f739b2db2a1c9ad9b71e..d6be604166b2ab20b958f034590897d8d27efc28 100644 (file)
--- a/src/njs_vmcode.c
+++ b/src/njs_vmcode.c
@@ -819,7 +819,8 @@ next:
                 pnext = (njs_vmcode_prop_next_t *) pc;
                 retval = njs_scope_value(vm, pnext->retval);
 
-                next = value2->data.u.next;
+                njs_assert(njs_is_data(value2, NJS_DATA_TAG_FOREACH_NEXT));
+                next = njs_data(value2);
 
                 if (next->index < next->array->length) {
                     *retval = next->array->start[next->index++];
@@ -1468,7 +1469,7 @@ njs_vmcode_property_foreach(njs_vm_t *vm, njs_value_t *object,
         return NJS_ERROR;
     }
 
-    vm->retval.data.u.next = next;
+    njs_set_data(&vm->retval, next, NJS_DATA_TAG_FOREACH_NEXT);
 
     code = (njs_vmcode_prop_foreach_t *) pc;