From: Alexander Borisov <alexander.borisov@nginx.com>
Date: Thu, 27 Feb 2020 11:30:14 +0000 (+0300)
Subject: Fixed heap-buffer-overflow in lexer introduced in 87d05fb35ff9.
X-Git-Url: http://git.kaiwu.me/postgresql/log/contrib/postgres_fdw/static/gitweb.js?a=commitdiff_plain;h=65308d947f0ca878fb965b31d34d7f2c9ac5105d;p=njs.git

Fixed heap-buffer-overflow in lexer introduced in 87d05fb35ff9.
---

diff --git a/src/njs_lexer.c b/src/njs_lexer.c
index d58cb53e..3045eea1 100644
--- a/src/njs_lexer.c
+++ b/src/njs_lexer.c
@@ -864,7 +864,7 @@ njs_lexer_multi(njs_lexer_t *lexer, njs_lexer_token_t *token,
 
     token->text.start = lexer->start - 1;
 
-    while (length != 0 && multi != NULL) {
+    while (length != 0 && multi != NULL && lexer->start < lexer->end) {
         c = lexer->start[0];
 
         if (c == multi->symbol) {
diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index 087435f7..059846c4 100644
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -33,6 +33,21 @@ static njs_unit_test_t  njs_test[] =
     { njs_str("/***/1/*\n**/"),
       njs_str("1") },
 
+    { njs_str(">"),
+      njs_str("SyntaxError: Unexpected token \">\" in 1") },
+
+    { njs_str(">>"),
+      njs_str("SyntaxError: Unexpected token \">>\" in 1") },
+
+    { njs_str(">>>"),
+      njs_str("SyntaxError: Unexpected token \">>>\" in 1") },
+
+    { njs_str("=="),
+      njs_str("SyntaxError: Unexpected token \"==\" in 1") },
+
+    { njs_str("?"),
+      njs_str("SyntaxError: Unexpected token \"?\" in 1") },
+
     /* Variable declarations. */
 
     { njs_str("var x"),