From: Alexander Borisov <alexander.borisov@nginx.com>
Date: Fri, 19 Apr 2019 14:24:29 +0000 (+0300)
Subject: Fixed overflow in Array.prototype.concat().
X-Git-Tag: 0.3.2~60
X-Git-Url: http://git.kaiwu.me/postgresql/log/contrib/postgres_fdw/static/gitweb.js?a=commitdiff_plain;h=b5792818b9d115d48854010b9f29d13c1d26a386;p=njs.git

Fixed overflow in Array.prototype.concat().

This closes #131 issue on GitHub.
---

diff --git a/njs/njs_array.c b/njs/njs_array.c
index 75b2edb3..f421f6e1 100644
--- a/njs/njs_array.c
+++ b/njs/njs_array.c
@@ -1125,7 +1125,7 @@ static njs_ret_t
 njs_array_prototype_concat(njs_vm_t *vm, njs_value_t *args, nxt_uint_t nargs,
     njs_index_t unused)
 {
-    size_t       length;
+    uint64_t     length;
     nxt_uint_t   i;
     njs_value_t  *value;
     njs_array_t  *array;
diff --git a/njs/test/njs_unit_test.c b/njs/test/njs_unit_test.c
index 7f578507..7b766fe9 100644
--- a/njs/test/njs_unit_test.c
+++ b/njs/test/njs_unit_test.c
@@ -7956,6 +7956,14 @@ static njs_unit_test_t  njs_test[] =
     { nxt_string("var x = Array(2**28)"),
       nxt_string("MemoryError") },
 
+    { nxt_string("var r; try {"
+                 "    var x = Array(2**27), y = Array(2**5).fill(x);"
+                 "    Array.prototype.concat.apply(y[0], y.slice(1));"
+                 "} catch (e) {"
+                 "    r = e.name == 'InternalError' || e.name == 'RangeError'"
+                 "} r"),
+      nxt_string("true") },
+
     { nxt_string("var a = new Array(3); a"),
       nxt_string(",,") },