LibRegex: Consume exactly two chars for escaped characters

We were previously consuming an extra char afterwards, which could be
the charclass terminator, leading to possible OOB accesses.
This commit is contained in:
Ali Mohammad Pur 2022-09-06 23:56:12 +04:30 committed by Ali Mohammad Pur
commit 48442059fc
Notes: sideshowbarker 2024-07-17 07:14:38 +09:00

View file

@ -2701,10 +2701,13 @@ size_t ECMA262Parser::ensure_total_number_of_capturing_parenthesis()
continue;
case '[':
while (!lexer.is_eof()) {
if (lexer.consume_specific('\\'))
if (lexer.consume_specific('\\')) {
lexer.consume();
else if (lexer.consume_specific(']'))
continue;
}
if (lexer.consume_specific(']')) {
break;
}
lexer.consume();
}
break;