From bc8b525440c306470330450536743b993700d328 Mon Sep 17 00:00:00 2001 From: Anna Henningsen Date: Tue, 3 May 2016 03:22:47 +0200 Subject: buffer: fix lastIndexOf index underflow issue Fix `buffer.lastIndexOf()` for the case that the first character of the needle is contained in the haystack, but in a location that makes it impossible to be part of a full match. For example, when searching for 'abc' in 'abcdef', only the 'cdef' part needs to be searched for 'c', because earlier locations can be excluded by index calculations alone. Previously, such a search would result in an assertion failure. This applies only to Node.js v6, as `lastIndexOf` was added in it. PR-URL: https://github.com/nodejs/node/pull/6511 Reviewed-By: James M Snell Reviewed-By: Trevor Norris --- src/string_search.h | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) (limited to 'src/string_search.h') diff --git a/src/string_search.h b/src/string_search.h index a9345eb802..0426fd840c 100644 --- a/src/string_search.h +++ b/src/string_search.h @@ -261,19 +261,19 @@ inline size_t FindFirstCharacter(Vector pattern, const uint8_t search_byte = GetHighestValueByte(pattern_first_char); size_t pos = index; do { - size_t bytes_to_search; + const size_t bytes_to_search = (max_n - pos) * sizeof(Char); const void* void_pos; if (subject.forward()) { // Assert that bytes_to_search won't overflow CHECK_LE(pos, max_n); CHECK_LE(max_n - pos, SIZE_MAX / sizeof(Char)); - bytes_to_search = (max_n - pos) * sizeof(Char); void_pos = memchr(subject.start() + pos, search_byte, bytes_to_search); } else { CHECK_LE(pos, subject.length()); CHECK_LE(subject.length() - pos, SIZE_MAX / sizeof(Char)); - bytes_to_search = (subject.length() - pos) * sizeof(Char); - void_pos = MemrchrFill(subject.start(), search_byte, bytes_to_search); + void_pos = MemrchrFill(subject.start() + pattern.length() - 1, + search_byte, + bytes_to_search); } const Char* char_pos = static_cast(void_pos); if (char_pos == nullptr) @@ -308,7 +308,9 @@ inline size_t FindFirstCharacter(Vector pattern, if (subject.forward()) { pos = memchr(subject.start() + index, pattern_first_char, max_n - index); } else { - pos = MemrchrFill(subject.start(), pattern_first_char, subj_len - index); + pos = MemrchrFill(subject.start() + pattern.length() - 1, + pattern_first_char, + max_n - index); } const uint8_t* char_pos = static_cast(pos); if (char_pos == nullptr) { -- cgit v1.2.1