Merge pull request #2807 from cremno/fix-capture-group-index-parsing-ub-bug

fix capture group index bug
This commit is contained in:
Yukihiro "Matz" Matsumoto
2015-05-29 02:03:13 +09:00
+8 -1
View File
@@ -5118,7 +5118,14 @@ parser_yylex(parser_state *p)
pushback(p, c);
if (last_state == EXPR_FNAME) goto gvar;
tokfix(p);
yylval.nd = new_nth_ref(p, atoi(tok(p)));
{
unsigned long n = strtoul(tok(p), NULL, 10);
if (n > INT_MAX) {
yyerror_i(p, "capture group index must be <= %d", INT_MAX);
return 0;
}
yylval.nd = new_nth_ref(p, (int)n);
}
return tNTH_REF;
default: