Skip to content

Commit 55868f3

Browse files
matetokodimatetokodi
committed
Raise syntax error on invalid unicode escape sequences
Instead of failing with an assertion The parser context was required for raising the error, which had to be added to all functions that can call `lexer_unchecked_hex_to_character`. JerryScript-DCO-1.0-Signed-off-by: Máté Tokodi mate.tokodi@szteszoftver.hu
1 parent 2dbb6f7 commit 55868f3

File tree

7 files changed

+76
-38
lines changed

7 files changed

+76
-38
lines changed

‎jerry-core/parser/js/js-lexer.c‎

Lines changed: 31 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -150,7 +150,8 @@ lexer_hex_in_braces_to_code_point (const uint8_t *source_p, /**< current source
150150
* @return character value
151151
*/
152152
static lit_code_point_t
153-
lexer_unchecked_hex_to_character (const uint8_t **source_p) /**< [in, out] current source position */
153+
lexer_unchecked_hex_to_character (parser_context_t *context_p, /**< context */
154+
const uint8_t **source_p) /**< [in, out] current source position */
154155
{
155156
lit_code_point_t result = 0;
156157
const uint8_t *char_p = *source_p;
@@ -174,13 +175,19 @@ lexer_unchecked_hex_to_character (const uint8_t **source_p) /**< [in, out] curre
174175
}
175176
else
176177
{
177-
JERRY_ASSERT ((byte >= LIT_CHAR_LOWERCASE_A && byte <= LIT_CHAR_LOWERCASE_F)
178-
|| (byte >= LIT_CHAR_UPPERCASE_A && byte <= LIT_CHAR_UPPERCASE_F));
178+
if (!((byte >= LIT_CHAR_LOWERCASE_A && byte <= LIT_CHAR_LOWERCASE_F)
179+
|| (byte >= LIT_CHAR_UPPERCASE_A && byte <= LIT_CHAR_UPPERCASE_F)))
180+
{
181+
parser_raise_error (context_p, PARSER_ERR_INVALID_UNICODE_ESCAPE_SEQUENCE);
182+
}
179183

180184
result += LEXER_TO_ASCII_LOWERCASE (byte) - (LIT_CHAR_LOWERCASE_A - 10);
181185
}
182186

183-
JERRY_ASSERT (result <= LIT_UNICODE_CODE_POINT_MAX);
187+
if (result > LIT_UNICODE_CODE_POINT_MAX)
188+
{
189+
parser_raise_error (context_p, PARSER_ERR_INVALID_UNICODE_ESCAPE_SEQUENCE);
190+
}
184191

185192
if (length == 0)
186193
{
@@ -713,7 +720,7 @@ lexer_parse_identifier (parser_context_t *context_p, /**< context */
713720

714721
if (JERRY_UNLIKELY (context_p->token.lit_location.status_flags & LEXER_LIT_LOCATION_HAS_ESCAPE))
715722
{
716-
lexer_convert_ident_to_cesu8 (buffer_p, ident_start_p, (prop_length_t) length);
723+
lexer_convert_ident_to_cesu8 (context_p, buffer_p, ident_start_p, (prop_length_t) length);
717724
ident_start_p = buffer_p;
718725
}
719726

@@ -2070,7 +2077,8 @@ lexer_scan_private_identifier (parser_context_t *context_p) /**< context */
20702077
* Convert an ident with escapes to a utf8 string.
20712078
*/
20722079
void
2073-
lexer_convert_ident_to_cesu8 (uint8_t *destination_p, /**< destination string */
2080+
lexer_convert_ident_to_cesu8 (parser_context_t *context_p, /**< context */
2081+
uint8_t *destination_p, /**< destination string */
20742082
const uint8_t *source_p, /**< source string */
20752083
prop_length_t length) /**< length of destination string */
20762084
{
@@ -2083,7 +2091,8 @@ lexer_convert_ident_to_cesu8 (uint8_t *destination_p, /**< destination string */
20832091
if (*source_p == LIT_CHAR_BACKSLASH)
20842092
{
20852093
source_p += 2;
2086-
destination_p += lit_code_point_to_cesu8_bytes (destination_p, lexer_unchecked_hex_to_character (&source_p));
2094+
destination_p +=
2095+
lit_code_point_to_cesu8_bytes (destination_p, lexer_unchecked_hex_to_character (context_p, &source_p));
20872096
continue;
20882097
}
20892098

@@ -2130,7 +2139,7 @@ lexer_convert_literal_to_chars (parser_context_t *context_p, /**< context */
21302139

21312140
if (literal_p->type == LEXER_IDENT_LITERAL)
21322141
{
2133-
lexer_convert_ident_to_cesu8 (destination_start_p, literal_p->char_p, literal_p->length);
2142+
lexer_convert_ident_to_cesu8 (context_p, destination_start_p, literal_p->char_p, literal_p->length);
21342143
return destination_start_p;
21352144
}
21362145

@@ -2229,7 +2238,8 @@ lexer_convert_literal_to_chars (parser_context_t *context_p, /**< context */
22292238
if (*source_p == LIT_CHAR_LOWERCASE_X || *source_p == LIT_CHAR_LOWERCASE_U)
22302239
{
22312240
source_p++;
2232-
destination_p += lit_code_point_to_cesu8_bytes (destination_p, lexer_unchecked_hex_to_character (&source_p));
2241+
destination_p +=
2242+
lit_code_point_to_cesu8_bytes (destination_p, lexer_unchecked_hex_to_character (context_p, &source_p));
22332243
continue;
22342244
}
22352245

@@ -3286,7 +3296,8 @@ lexer_check_property_modifier (parser_context_t *context_p) /**< context */
32863296
* @return true if the two identifiers are the same
32873297
*/
32883298
static bool
3289-
lexer_compare_identifier_to_chars (const uint8_t *left_p, /**< left identifier */
3299+
lexer_compare_identifier_to_chars (parser_context_t *context_p, /**< context */
3300+
const uint8_t *left_p, /**< left identifier */
32903301
const uint8_t *right_p, /**< right identifier string */
32913302
size_t size) /**< byte size of the two identifiers */
32923303
{
@@ -3307,7 +3318,7 @@ lexer_compare_identifier_to_chars (const uint8_t *left_p, /**< left identifier *
33073318
if (*left_p == LIT_CHAR_BACKSLASH)
33083319
{
33093320
left_p += 2;
3310-
lit_code_point_t code_point = lexer_unchecked_hex_to_character (&left_p);
3321+
lit_code_point_t code_point = lexer_unchecked_hex_to_character (context_p, &left_p);
33113322

33123323
escape_size = lit_code_point_to_cesu8_bytes (utf8_buf, code_point);
33133324
}
@@ -3346,7 +3357,8 @@ lexer_compare_identifier_to_chars (const uint8_t *left_p, /**< left identifier *
33463357
* @return true if the identifier equals to string
33473358
*/
33483359
bool
3349-
lexer_compare_identifier_to_string (const lexer_lit_location_t *left_p, /**< left literal */
3360+
lexer_compare_identifier_to_string (parser_context_t *context_p, /**< context */
3361+
const lexer_lit_location_t *left_p, /**< left literal */
33503362
const uint8_t *right_p, /**< right identifier string */
33513363
size_t size) /**< byte size of the right identifier */
33523364
{
@@ -3360,7 +3372,7 @@ lexer_compare_identifier_to_string (const lexer_lit_location_t *left_p, /**< lef
33603372
return memcmp (left_p->char_p, right_p, size) == 0;
33613373
}
33623374

3363-
return lexer_compare_identifier_to_chars (left_p->char_p, right_p, size);
3375+
return lexer_compare_identifier_to_chars (context_p, left_p->char_p, right_p, size);
33643376
} /* lexer_compare_identifier_to_string */
33653377

33663378
/**
@@ -3385,25 +3397,25 @@ lexer_compare_identifiers (parser_context_t *context_p, /**< context */
33853397

33863398
if (!(left_p->status_flags & LEXER_LIT_LOCATION_HAS_ESCAPE))
33873399
{
3388-
return lexer_compare_identifier_to_chars (right_p->char_p, left_p->char_p, length);
3400+
return lexer_compare_identifier_to_chars (context_p, right_p->char_p, left_p->char_p, length);
33893401
}
33903402

33913403
if (!(right_p->status_flags & LEXER_LIT_LOCATION_HAS_ESCAPE))
33923404
{
3393-
return lexer_compare_identifier_to_chars (left_p->char_p, right_p->char_p, length);
3405+
return lexer_compare_identifier_to_chars (context_p, left_p->char_p, right_p->char_p, length);
33943406
}
33953407

33963408
if (length <= 64)
33973409
{
33983410
uint8_t buf_p[64];
3399-
lexer_convert_ident_to_cesu8 (buf_p, left_p->char_p, length);
3400-
return lexer_compare_identifier_to_chars (right_p->char_p, buf_p, length);
3411+
lexer_convert_ident_to_cesu8 (context_p, buf_p, left_p->char_p, length);
3412+
return lexer_compare_identifier_to_chars (context_p, right_p->char_p, buf_p, length);
34013413
}
34023414

34033415
uint8_t *dynamic_buf_p = parser_malloc (context_p, length);
34043416

3405-
lexer_convert_ident_to_cesu8 (dynamic_buf_p, left_p->char_p, length);
3406-
bool result = lexer_compare_identifier_to_chars (right_p->char_p, dynamic_buf_p, length);
3417+
lexer_convert_ident_to_cesu8 (context_p, dynamic_buf_p, left_p->char_p, length);
3418+
bool result = lexer_compare_identifier_to_chars (context_p, right_p->char_p, dynamic_buf_p, length);
34073419
parser_free (dynamic_buf_p, length);
34083420

34093421
return result;

‎jerry-core/parser/js/js-parser-expr.c‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -604,7 +604,10 @@ parser_parse_class_body (parser_context_t *context_p, /**< context */
604604
else if (is_static && !is_private)
605605
{
606606
if (LEXER_IS_IDENT_OR_STRING (context_p->token.lit_location.type)
607-
&& lexer_compare_identifier_to_string (&context_p->token.lit_location, (uint8_t *) "prototype", 9))
607+
&& lexer_compare_identifier_to_string (context_p,
608+
&context_p->token.lit_location,
609+
(uint8_t *) "prototype",
610+
9))
608611
{
609612
parser_raise_error (context_p, PARSER_ERR_CLASS_STATIC_PROTOTYPE);
610613
}
@@ -742,7 +745,7 @@ parser_parse_class_body (parser_context_t *context_p, /**< context */
742745
{
743746
if (is_static && !is_private)
744747
{
745-
if (lexer_compare_identifier_to_string (&context_p->token.lit_location, (uint8_t *) "prototype", 9))
748+
if (lexer_compare_identifier_to_string (context_p, &context_p->token.lit_location, (uint8_t *) "prototype", 9))
746749
{
747750
parser_raise_error (context_p, PARSER_ERR_CLASS_STATIC_PROTOTYPE);
748751
}
@@ -1444,7 +1447,7 @@ parser_parse_object_literal (parser_context_t *context_p) /**< context */
14441447
const lexer_lit_location_t *literal_p = (const lexer_lit_location_t *) context_p->lit_object.literal_p;
14451448
bool is_proto = ((context_p->token.lit_location.type == LEXER_IDENT_LITERAL
14461449
|| context_p->token.lit_location.type == LEXER_STRING_LITERAL)
1447-
&& lexer_compare_identifier_to_string (literal_p, (uint8_t *) "__proto__", 9)
1450+
&& lexer_compare_identifier_to_string (context_p, literal_p, (uint8_t *) "__proto__", 9)
14481451
&& lexer_check_next_character (context_p, LIT_CHAR_COLON));
14491452
if (is_proto)
14501453
{

‎jerry-core/parser/js/js-parser-internal.h‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -748,7 +748,10 @@ void lexer_parse_string (parser_context_t *context_p, lexer_string_options_t opt
748748
void lexer_expect_identifier (parser_context_t *context_p, uint8_t literal_type);
749749
bool lexer_scan_identifier (parser_context_t *context_p, lexer_parse_options_t opts);
750750
void lexer_check_property_modifier (parser_context_t *context_p);
751-
void lexer_convert_ident_to_cesu8 (uint8_t *destination_p, const uint8_t *source_p, prop_length_t length);
751+
void lexer_convert_ident_to_cesu8 (parser_context_t *context_p,
752+
uint8_t *destination_p,
753+
const uint8_t *source_p,
754+
prop_length_t length);
752755

753756
const uint8_t *lexer_convert_literal_to_chars (parser_context_t *context_p,
754757
const lexer_lit_location_t *literal_p,
@@ -764,7 +767,10 @@ void lexer_convert_push_number_to_push_literal (parser_context_t *context_p);
764767
uint16_t lexer_construct_function_object (parser_context_t *context_p, uint32_t extra_status_flags);
765768
uint16_t lexer_construct_class_static_block_function (parser_context_t *context_p);
766769
void lexer_construct_regexp_object (parser_context_t *context_p, bool parse_only);
767-
bool lexer_compare_identifier_to_string (const lexer_lit_location_t *left_p, const uint8_t *right_p, size_t size);
770+
bool lexer_compare_identifier_to_string (parser_context_t *context_p,
771+
const lexer_lit_location_t *left_p,
772+
const uint8_t *right_p,
773+
size_t size);
768774
bool lexer_compare_identifiers (parser_context_t *context_p,
769775
const lexer_lit_location_t *left_p,
770776
const lexer_lit_location_t *right_p);

‎jerry-core/parser/js/js-parser.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1401,7 +1401,8 @@ parser_resolve_private_identifier_eval (parser_context_t *context_p) /**< contex
14011401
ecma_string_t *search_key_p;
14021402
uint8_t *destination_p = (uint8_t *) parser_malloc (context_p, context_p->token.lit_location.length);
14031403

1404-
lexer_convert_ident_to_cesu8 (destination_p,
1404+
lexer_convert_ident_to_cesu8 (context_p,
1405+
destination_p,
14051406
context_p->token.lit_location.char_p,
14061407
context_p->token.lit_location.length);
14071408

‎jerry-core/parser/js/js-scanner-util.c‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -390,9 +390,10 @@ scanner_seek (parser_context_t *context_p) /**< context */
390390
* Checks whether a literal is equal to "arguments".
391391
*/
392392
static inline bool JERRY_ATTR_ALWAYS_INLINE
393-
scanner_literal_is_arguments (lexer_lit_location_t *literal_p) /**< literal */
393+
scanner_literal_is_arguments (parser_context_t *context_p, /**< context */
394+
lexer_lit_location_t *literal_p) /**< literal */
394395
{
395-
return lexer_compare_identifier_to_string (literal_p, (const uint8_t *) "arguments", 9);
396+
return lexer_compare_identifier_to_string (context_p, literal_p, (const uint8_t *) "arguments", 9);
396397
} /* scanner_literal_is_arguments */
397398

398399
/**
@@ -408,7 +409,7 @@ scanner_find_duplicated_arg (parser_context_t *context_p, lexer_lit_location_t *
408409
return false;
409410
}
410411

411-
if (scanner_literal_is_arguments (lit_loc_p))
412+
if (scanner_literal_is_arguments (context_p, lit_loc_p))
412413
{
413414
return true;
414415
}
@@ -469,7 +470,7 @@ scanner_find_duplicated_arg (parser_context_t *context_p, lexer_lit_location_t *
469470

470471
ecma_string_t *arg_string = ecma_get_string_from_value (literal_start_p[literal_index]);
471472
uint8_t *destination_p = (uint8_t *) parser_malloc (context_p, lit_loc_p->length);
472-
lexer_convert_ident_to_cesu8 (destination_p, lit_loc_p->char_p, lit_loc_p->length);
473+
lexer_convert_ident_to_cesu8 (context_p, destination_p, lit_loc_p->char_p, lit_loc_p->length);
473474
ecma_string_t *search_key_p = ecma_new_ecma_string_from_utf8 (destination_p, lit_loc_p->length);
474475
scanner_free (destination_p, lit_loc_p->length);
475476

@@ -510,7 +511,7 @@ scanner_scope_find_lexical_declaration (parser_context_t *context_p, /**< contex
510511
{
511512
uint8_t *destination_p = (uint8_t *) scanner_malloc (context_p, literal_p->length);
512513

513-
lexer_convert_ident_to_cesu8 (destination_p, literal_p->char_p, literal_p->length);
514+
lexer_convert_ident_to_cesu8 (context_p, destination_p, literal_p->char_p, literal_p->length);
514515

515516
name_p = ecma_new_ecma_string_from_utf8 (destination_p, literal_p->length);
516517

@@ -728,7 +729,7 @@ scanner_pop_literal_pool (parser_context_t *context_p, /**< context */
728729
continue;
729730
}
730731

731-
if (!(status_flags & SCANNER_LITERAL_POOL_NO_ARGUMENTS) && scanner_literal_is_arguments (literal_p))
732+
if (!(status_flags & SCANNER_LITERAL_POOL_NO_ARGUMENTS) && scanner_literal_is_arguments (context_p, literal_p))
732733
{
733734
JERRY_ASSERT (arguments_type != SCANNER_ARGUMENTS_NOT_PRESENT);
734735
status_flags |= SCANNER_LITERAL_POOL_NO_ARGUMENTS;
@@ -1307,7 +1308,7 @@ scanner_filter_arguments (parser_context_t *context_p, /**< context */
13071308
literal_p->type = type;
13081309
}
13091310

1310-
if (has_arguments && scanner_literal_is_arguments (literal_p))
1311+
if (has_arguments && scanner_literal_is_arguments (context_p, literal_p))
13111312
{
13121313
has_arguments = false;
13131314
}
@@ -1332,7 +1333,7 @@ scanner_filter_arguments (parser_context_t *context_p, /**< context */
13321333
new_literal_p = (lexer_lit_location_t *) parser_list_append (context_p, &new_literal_pool_p->literal_pool);
13331334
*new_literal_p = *literal_p;
13341335
}
1335-
else if (has_arguments && scanner_literal_is_arguments (literal_p))
1336+
else if (has_arguments && scanner_literal_is_arguments (context_p, literal_p))
13361337
{
13371338
/* Arguments object is directly referenced from the function arguments */
13381339
new_literal_pool_p->status_flags |= SCANNER_LITERAL_POOL_ARGUMENTS_IN_ARGS;
@@ -1412,7 +1413,7 @@ scanner_add_custom_literal (parser_context_t *context_p, /**< context */
14121413
return literal_p;
14131414
}
14141415
}
1415-
else if (lexer_compare_identifier_to_string (literal_p, char_p, length))
1416+
else if (lexer_compare_identifier_to_string (context_p, literal_p, char_p, length))
14161417
{
14171418
/* The non-escaped version is preferred. */
14181419
literal_p->char_p = char_p;
@@ -1517,7 +1518,7 @@ scanner_append_argument (parser_context_t *context_p, /**< context */
15171518
break;
15181519
}
15191520
}
1520-
else if (lexer_compare_identifier_to_string (literal_p, char_p, length))
1521+
else if (lexer_compare_identifier_to_string (context_p, literal_p, char_p, length))
15211522
{
15221523
break;
15231524
}
@@ -1660,7 +1661,7 @@ scanner_detect_invalid_var (parser_context_t *context_p, /**< context */
16601661
return;
16611662
}
16621663
}
1663-
else if (lexer_compare_identifier_to_string (literal_p, char_p, length))
1664+
else if (lexer_compare_identifier_to_string (context_p, literal_p, char_p, length))
16641665
{
16651666
scanner_raise_redeclaration_error (context_p);
16661667
return;

‎tests/jerry/fail/regression-test-issue-5134.js‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
// Copyright JS Foundation and other contributors, http://js.foundation
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
import{a as "\{{12,34}"

‎tools/cppcheck/suppressions-list‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ knownConditionTrueFalse:jerry-core/*.c
1414
knownConditionTrueFalse:jerry-math/*.c
1515
negativeIndex:jerry-core/*.c
1616
nullPointerArithmetic:jerry-core/parser/js/js-parser-line-info-create.c:572
17-
nullPointerArithmetic:jerry-core/parser/js/js-scanner-util.c:2345
17+
nullPointerArithmetic:jerry-core/parser/js/js-scanner-util.c:2346
1818
nullPointerArithmeticRedundantCheck:jerry-core/*.c
1919
nullPointerRedundantCheck:jerry-core/*.c
2020
nullPointerRedundantCheck:jerry-ext/*.c
@@ -31,7 +31,7 @@ shiftNegativeLHS:jerry-math/*.c
3131
shiftTooManyBits:jerry-core/*.c
3232
shiftTooManyBitsSigned:jerry-math/*.c
3333
signConversionCond:jerry-core/*.c
34-
uninitvar:jerry-core/parser/js/js-parser-expr.c:3423
34+
uninitvar:jerry-core/parser/js/js-parser-expr.c:3426
3535
uninitvar:tests/unit-core/test-api-objecttype.c:119
3636
unmatchedSuppression:jerry-core/*.inc.h
3737
unreadVariable:jerry-core/*.c

0 commit comments

Comments
 (0)