From 81ac4a25861a4c5738ed3540e99c24902ddd593c Mon Sep 17 00:00:00 2001 From: Dmitry Volyntsev Date: Tue, 13 Mar 2018 20:37:01 +0300 Subject: [PATCH] Fixed 1 byte heap buffer overflow. --- njs/njs_vm.c | 4 ++-- njs/test/njs_unit_test.c | 3 +++ 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/njs/njs_vm.c b/njs/njs_vm.c index 7e8ff996..7db6c5ac 100644 --- a/njs/njs_vm.c +++ b/njs/njs_vm.c @@ -3514,11 +3514,11 @@ again: for (i = 0; i < backtrace->items; i++) { if (be[i].line != 0) { - len += sizeof(" at (:)\n") - 1 + 10 + len += sizeof(" at (:)\n") + 10 + be[i].name.length; } else { - len += sizeof(" at (native)\n") - 1 + len += sizeof(" at (native)\n") + be[i].name.length; } } diff --git a/njs/test/njs_unit_test.c b/njs/test/njs_unit_test.c index 69de8e34..b7855372 100644 --- a/njs/test/njs_unit_test.c +++ b/njs/test/njs_unit_test.c @@ -5706,6 +5706,9 @@ static njs_unit_test_t njs_test[] = { nxt_string("Object.prototype.__proto__ === null"), nxt_string("true") }, + { nxt_string("Object.prototype.__proto__.f()"), + nxt_string("InternalError: method 'f' query failed:-1") }, + { nxt_string("Object.prototype.toString.call(Object.prototype)"), nxt_string("[object Object]") }, -- 2.47.3