Skip to content

Commit

Permalink
Check for leading zero in js_isarrayindex that caused false positives.
Browse files Browse the repository at this point in the history
We're supposed to check whether a string turned into an integer and back
is itself, while also returning the value of the integer. We were
unintentionally allowing integers with leading zero through.
  • Loading branch information
ccxvii committed Jan 20, 2020
1 parent fe71080 commit e082e6e
Showing 1 changed file with 5 additions and 0 deletions.
5 changes: 5 additions & 0 deletions jsrun.c
Original file line number Diff line number Diff line change
Expand Up @@ -444,6 +444,11 @@ void js_rot(js_State *J, int n)
int js_isarrayindex(js_State *J, const char *p, int *idx)
{
int n = 0;

/* check for '0' and integers with leading zero */
if (p[0] == '0')
return (p[1] == 0) ? *idx = 0, 1 : 0;

while (*p) {
int c = *p++;
if (c >= '0' && c <= '9') {
Expand Down

0 comments on commit e082e6e

Please sign in to comment.