Firefox · SpiderMonkey
CVE-2026-117946
Logic Error in SpiderMonkey
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifjs/src/irregexp/RegExpAPI.cpp |
modified |
Files Changed
js/src/irregexp/RegExpAPI.cpp
Patch
diff --git a/js/src/irregexp/RegExpAPI.cpp b/js/src/irregexp/RegExpAPI.cpp
index cb0f70e1113..a42e53cf2f9 100644
--- a/js/src/irregexp/RegExpAPI.cpp
+++ b/js/src/irregexp/RegExpAPI.cpp
@@ -303,14 +303,20 @@ static void ReportSyntaxError(TokenStreamAnyChars& ts,
template <typename CharT>
static bool CheckPatternSyntaxImpl(js::LifoAlloc& alloc,
JS::NativeStackLimit stackLimit,
- const CharT* input, uint32_t inputLength,
+ const CharT* input, size_t inputLength,
JS::RegExpFlags flags,
RegExpCompileData* result,
JS::AutoAssertNoGC& nogc) {
Zone zone(&alloc);
-
- return RegExpParser::VerifyRegExpSyntax(&zone, stackLimit, input, inputLength,
- flags, result, nogc);
+ static_assert(JSString::MAX_LENGTH < INT_MAX);
+ if (inputLength > JSString::MAX_LENGTH) {
+ result->error = RegExpError::kTooLarge;
+ result->error_pos = 0;
+ return false;
+ }
+ return RegExpParser::VerifyRegExpSyntax(&zone, stackLimit, input,
+ AssertedCast<int>(inputLength), flags,
+ result, nogc);
}
bool CheckPatternSyntax(js::LifoAlloc& alloc, JS::NativeStackLimit stackLimit,
Loading diff…
References
On This Page