[jruby-joni] 17/31: more validation tests

[Hideki Yamane]

This is an automated email from the git hooks/post-receive script.

henrich pushed a commit to branch debian/sid
in repository jruby-joni.

commit 85aea5b7825c72b52a14c8307d3fbafdca9ad80d
Author: Marcin Mielzynski <lopx at gazeta.pl>
Date:   Fri Feb 2 17:46:13 2018 +0100

    more validation tests
---
 src/org/joni/Lexer.java                   | 14 ++++++++------
 src/org/joni/ScannerSupport.java          |  8 +++++---
 src/org/joni/exception/ErrorMessages.java |  1 +
 test/org/joni/test/TestError.java         |  2 +-
 4 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/src/org/joni/Lexer.java b/src/org/joni/Lexer.java
index bd80c21..221acca 100644
--- a/src/org/joni/Lexer.java
+++ b/src/org/joni/Lexer.java
@@ -552,7 +552,7 @@ class Lexer extends ScannerSupport {
 
         if (peekIs('{') && syntax.opEscXBraceHex8()) {
             inc();
-            int num = scanUnsignedHexadecimalNumber(8);
+            int num = scanUnsignedHexadecimalNumber(0, 8);
             if (num < 0) newValueException(ERR_TOO_BIG_WIDE_CHAR_VALUE);
             if (left()) {
                 int c2 = peek();
@@ -569,7 +569,7 @@ class Lexer extends ScannerSupport {
                 p = last;
             }
         } else if (syntax.opEscXHex2()) {
-            int num = scanUnsignedHexadecimalNumber(2);
+            int num = scanUnsignedHexadecimalNumber(0, 2);
             if (num < 0) newValueException(ERR_TOO_BIG_NUMBER);
             if (p == last) { /* can't read nothing. */
                 num = 0; /* but, it's not error */
@@ -585,7 +585,8 @@ class Lexer extends ScannerSupport {
         int last = p;
 
         if (syntax.op2EscUHex4()) {
-            int num = scanUnsignedHexadecimalNumber(4);
+            int num = scanUnsignedHexadecimalNumber(4, 4);
+            if (num < -1) newValueException(ERR_TOO_SHORT_DIGITS);
             if (num < 0) newValueException(ERR_TOO_BIG_NUMBER);
             if (p == last) {  /* can't read nothing. */
                 num = 0; /* but, it's not error */
@@ -767,7 +768,7 @@ class Lexer extends ScannerSupport {
         int last = p;
         if (peekIs('{') && syntax.opEscXBraceHex8()) {
             inc();
-            int num = scanUnsignedHexadecimalNumber(8);
+            int num = scanUnsignedHexadecimalNumber(0, 8);
             if (num < 0) newValueException(ERR_TOO_BIG_WIDE_CHAR_VALUE);
             if (left()) {
                 if (enc.isXDigit(peek())) newValueException(ERR_TOO_LONG_WIDE_CHAR_VALUE);
@@ -782,7 +783,7 @@ class Lexer extends ScannerSupport {
                 p = last;
             }
         } else if (syntax.opEscXHex2()) {
-            int num = scanUnsignedHexadecimalNumber(2);
+            int num = scanUnsignedHexadecimalNumber(0, 2);
             if (num < 0) newValueException(ERR_TOO_BIG_NUMBER);
             if (p == last) { /* can't read nothing. */
                 num = 0; /* but, it's not error */
@@ -798,7 +799,8 @@ class Lexer extends ScannerSupport {
         int last = p;
 
         if (syntax.op2EscUHex4()) {
-            int num = scanUnsignedHexadecimalNumber(4);
+            int num = scanUnsignedHexadecimalNumber(4, 4);
+            if (num < -1) newValueException(ERR_TOO_SHORT_DIGITS);
             if (num < 0) newValueException(ERR_TOO_BIG_NUMBER);
             if (p == last) { /* can't read nothing. */
                 num = 0; /* but, it's not error */
diff --git a/src/org/joni/ScannerSupport.java b/src/org/joni/ScannerSupport.java
index fde0d1d..9b98579 100644
--- a/src/org/joni/ScannerSupport.java
+++ b/src/org/joni/ScannerSupport.java
@@ -72,21 +72,23 @@ abstract class ScannerSupport extends IntHolder implements ErrorMessages {
         return num;
     }
 
-    protected final int scanUnsignedHexadecimalNumber(int maxLength) {
+    protected final int scanUnsignedHexadecimalNumber(int minLength, int maxLength) {
         int last = c;
         int num = 0;
+        int restLen = maxLength - minLength;
         while(left() && maxLength-- != 0) {
             fetch();
             if (enc.isXDigit(c)) {
-                int onum = num;
                 int val = enc.xdigitVal(c);
+                if ((Integer.MAX_VALUE - val) / 16 < num) return -1;
                 num = (num << 4) + val;
-                if (((onum ^ num) & INT_SIGN_BIT) != 0) return -1;
             } else {
                 unfetch();
+                maxLength++;
                 break;
             }
         }
+        if (maxLength > restLen) return -2;
         c = last;
         return num;
     }
diff --git a/src/org/joni/exception/ErrorMessages.java b/src/org/joni/exception/ErrorMessages.java
index 8605c5c..c138574 100644
--- a/src/org/joni/exception/ErrorMessages.java
+++ b/src/org/joni/exception/ErrorMessages.java
@@ -77,6 +77,7 @@ public interface ErrorMessages extends org.jcodings.exception.ErrorMessages {
     final String ERR_TOO_BIG_BACKREF_NUMBER = "too big backref number";
     final String ERR_INVALID_BACKREF = Config.USE_NAMED_GROUP ? "invalid backref number/name" : "invalid backref number";
     final String ERR_NUMBERED_BACKREF_OR_CALL_NOT_ALLOWED = "numbered backref/call is not allowed. (use name)";
+    final String ERR_TOO_SHORT_DIGITS = "too short digits";
     final String ERR_INVALID_WIDE_CHAR_VALUE = "invalid wide-char value";
     final String ERR_EMPTY_GROUP_NAME = "group name is empty";
     final String ERR_INVALID_GROUP_NAME = "invalid group name <%n>";
diff --git a/test/org/joni/test/TestError.java b/test/org/joni/test/TestError.java
index f520907..2d614ce 100755
--- a/test/org/joni/test/TestError.java
+++ b/test/org/joni/test/TestError.java
@@ -57,7 +57,7 @@ public class TestError extends Test {
 	    xerrs("[c-a]", ErrorMessages.ERR_EMPTY_RANGE_IN_CHAR_CLASS);
 	    xerrs("\\x{FFFFFFFF}", ErrorMessages.ERR_TOO_BIG_WIDE_CHAR_VALUE);
 	    xerrs("\\x{100000000}", ErrorMessages.ERR_TOO_LONG_WIDE_CHAR_VALUE);
-	    // xerrs("\\u026x", ErrorMessages.ERR_TOO_SHORT_DIGITS);
+	    xerrs("\\u026x", ErrorMessages.ERR_TOO_SHORT_DIGITS);
 	    xerrs("()(?\\!(?'a')\\1)", ErrorMessages.ERR_UNDEFINED_GROUP_OPTION);
 	    xerrs("\\((", ErrorMessages.ERR_END_PATTERN_WITH_UNMATCHED_PARENTHESIS);
 	    xerrs("(|", ErrorMessages.ERR_END_PATTERN_WITH_UNMATCHED_PARENTHESIS);

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-java/jruby-joni.git