Fixed RegExp compilation after 17124c81.

Previously, heap-buffer-overflow happened due to incorrect copying of
[...] regexp parts.

Found by OSS-Fuzz.

diff --git a/external/njs_regex.c b/external/njs_regex.c
index a0decefd6a91d99d8c411841f2794c59c61d6d3a..cd45afc051bd0bd67c5499ffff38e011795a6874 100644 (file)
--- a/external/njs_regex.c
+++ b/external/njs_regex.c
@@ -177,11 +177,16 @@ njs_regex_escape(njs_mp_t *mp, njs_str_t *text)
                 continue;
 
             } else {
-                *dst++ = *p;
+                *dst++ = *p++; /* Copy '['. */
+
                 while (p < end && *p != ']') {
                     *dst++ = *p++;
                 }
 
+                if (p < end) {
+                    *dst++ = *p; /* Copy ']'. */
+                }
+
                 continue;
             }
         }
@@ -189,6 +194,8 @@ njs_regex_escape(njs_mp_t *mp, njs_str_t *text)
         *dst++ = *p;
     }
 
+    njs_assert(dst == text->start + text->length);
+
     return NJS_OK;
 
 #else

diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index 33472f24fce1fb91301816a93b9103048f7a319b..541e33271eb56da2a2be1a47cbd790b7bb2e3610 100644 (file)
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -9556,6 +9556,9 @@ static njs_unit_test_t  njs_test[] =
     { njs_str("/["),
       njs_str("SyntaxError: Unterminated RegExp \"/[\" in 1") },
 
+    { njs_str("/[][a"),
+      njs_str("SyntaxError: Unterminated RegExp \"/[][a\" in 1") },
+
     { njs_str("/[\\"),
       njs_str("SyntaxError: Unterminated RegExp \"/[\\\" in 1") },
 
@@ -9591,11 +9594,24 @@ static njs_unit_test_t  njs_test[] =
       njs_str("/\\]cd/") },
 #endif
 
+    { njs_str("RegExp('[][a')"),
+      njs_str("SyntaxError: "
+              njs_pcre_var("pcre_compile2(\"(?!)[a\") failed: missing terminating ] for character class at \"\"",
+                           "pcre_compile(\"[][a\") failed: missing terminating ] for character class")) },
+
+    { njs_str("RegExp('[][a][a')"),
+      njs_str("SyntaxError: "
+              njs_pcre_var("pcre_compile2(\"(?!)[a][a\") failed: missing terminating ] for character class at \"\"",
+                           "pcre_compile(\"[][a][a\") failed: missing terminating ] for character class")) },
+
     { njs_str("RegExp('[\\\\')"),
       njs_str("SyntaxError: "
               njs_pcre_var("pcre_compile2(\"[\\\") failed: \\ at end of pattern at \"\"",
                            "pcre_compile(\"[\\\") failed: \\ at end of pattern")) },
 
+    { njs_str("RegExp('[][a]')"),
+      njs_str(njs_pcre_var("/(?!)[a]/", "/[][a]/")) },
+
     { njs_str("RegExp('\\\\0').source[1]"),
       njs_str("0") },