Fuzzer issues

external/njs_regex.c

@@ -573,9 +573,10 @@ njs_regex_is_valid(njs_regex_t *regex)
 
 
 njs_int_t
-njs_regex_named_captures(njs_regex_t *regex, njs_str_t *name, int n)
+njs_regex_named_capture(njs_regex_t *regex, njs_str_t *name, int n,
+    uint32_t *capture)
 {
-    char  *entry;
+    u_char  *entry;
 
     if (name == NULL) {
         return regex->nentries;
@@ -587,10 +588,12 @@ njs_regex_named_captures(njs_regex_t *regex, njs_str_t *name, int n)
 
     entry = regex->entries + regex->entry_size * n;
 
-    name->start = (u_char *) entry + 2;
+    name->start = entry + 2;
     name->length = njs_strlen(name->start);
 
-    return (entry[0] << 8) + entry[1];
+    *capture = (entry[0] << 8) + entry[1];
+
+    return NJS_OK;
 }
 
 
@@ -744,4 +747,3 @@ njs_pcre_free(void *p)
 
 #endif
 
-

src/njs_array.c

@@ -1961,7 +1961,7 @@ njs_array_prototype_concat(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs,
                             return NJS_ERROR;
                         }
 
-                        njs_set_invalid(&value);
+                        continue;
                     }
 
                     ret = njs_value_property_i64_set(vm, &this, length,
@@ -2917,8 +2917,11 @@ static njs_int_t
 njs_array_prototype_sort(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs,
     njs_index_t unused, njs_value_t *retval)
 {
+    double                 idx;
     int64_t                i, nslots, nunds, length;
+    uint32_t               n;
     njs_int_t              ret;
+    njs_array_t            *keys;
     njs_value_t            *this, *comparefn;
     njs_function_t         *compare;
     njs_array_sort_slot_t  *slots;
@@ -2982,11 +2985,35 @@ njs_array_prototype_sort(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs,
         }
     }
 
-    for (; i < length; i++) {
-        ret = njs_value_property_i64_delete(vm, this, i, NULL);
-        if (njs_slow_path(ret == NJS_ERROR)) {
+    if (njs_is_fast_array(this)) {
+        for (; i < length; i++) {
+            ret = njs_value_property_i64_delete(vm, this, i, NULL);
+            if (njs_slow_path(ret == NJS_ERROR)) {
+                goto exception;
+            }
+        }
+
+    } else {
+        keys = njs_array_indices(vm, this);
+        if (njs_slow_path(keys == NULL)) {
             goto exception;
         }
+
+        for (n = 0; n < keys->length; n++) {
+            idx = njs_string_to_index(&keys->start[n]);
+
+            if (idx >= i && idx < length) {
+                ret = njs_value_property_delete(vm, this,
+                                                 keys->start[n].atom_id,
+                                                 NULL, 1);
+                if (njs_slow_path(ret == NJS_ERROR)) {
+                    njs_array_destroy(vm, keys);
+                    goto exception;
+                }
+            }
+        }
+
+        njs_array_destroy(vm, keys);
     }
 
 done:

src/njs_object.c

@@ -1140,7 +1140,7 @@ njs_object_own_enumerate_object(njs_vm_t *vm, const njs_object_t *object,
         }
 
         entry = NULL;
-        njs_set_object(&value, (njs_object_t *) object);
+        njs_set_type_object(&value, (njs_object_t *) object, object->type);
 
         for (i = 0; i< items_sorted->length; i++) {
             ret = njs_value_property_val(vm, &value, &items_sorted->start[i],

src/njs_object.h

@@ -19,7 +19,6 @@ typedef enum {
     NJS_OBJECT_PROP_CONFIGURABLE = 16,
     NJS_OBJECT_PROP_WRITABLE = 32,
     NJS_OBJECT_PROP_UNSET = 64,
-    NJS_OBJECT_PROP_IS_STRING = 128,
 #define NJS_OBJECT_PROP_VALUE_ECW (NJS_OBJECT_PROP_VALUE                     \
                                    | NJS_OBJECT_PROP_ENUMERABLE              \
                                    | NJS_OBJECT_PROP_CONFIGURABLE            \
@@ -264,10 +263,6 @@ njs_object_prop_define_val(njs_vm_t *vm, njs_value_t *object, njs_value_t *name,
         }
     }
 
-    if (njs_is_string(name)) {
-       flags |= NJS_OBJECT_PROP_IS_STRING;
-    }
-
     return njs_object_prop_define(vm, object, name->atom_id, value, flags);
 }
 

src/njs_object_prop.c

@@ -136,27 +136,17 @@ njs_object_prop_define(njs_vm_t *vm, njs_value_t *object, unsigned atom_id,
     uint32_t              length, index, set_enumerable, set_configurable,
                           set_writable;
     njs_int_t             ret;
+    njs_str_t             string;
     njs_array_t           *array;
     njs_value_t           key, retval;
     njs_object_prop_t     _prop;
-    njs_object_prop_t     *prop = &_prop, *prev, *obj_prop;
+    njs_object_prop_t     *prop, *prev, *obj_prop;
     njs_property_query_t  pq;
 
-again:
-
     set_enumerable = 1;
     set_configurable = 1;
     set_writable = 1;
-
-    njs_property_query_init(&pq, NJS_PROPERTY_QUERY_SET, 1);
-
-    ret = (flags & NJS_OBJECT_PROP_CREATE)
-                ? NJS_DECLINED
-                : njs_property_query(vm, &pq, object, atom_id);
-
-    if (njs_slow_path(ret == NJS_ERROR)) {
-        return ret;
-    }
+    prop = &_prop;
 
     switch (njs_prop_type(flags)) {
     case NJS_OBJECT_PROP_DESCRIPTOR:
@@ -208,6 +198,18 @@ njs_object_prop_define(njs_vm_t *vm, njs_value_t *object, unsigned atom_id,
         break;
     }
 
+again:
+
+    njs_property_query_init(&pq, NJS_PROPERTY_QUERY_SET, 1);
+
+    ret = (flags & NJS_OBJECT_PROP_CREATE)
+                ? NJS_DECLINED
+                : njs_property_query(vm, &pq, object, atom_id);
+
+    if (njs_slow_path(ret == NJS_ERROR)) {
+        return ret;
+    }
+
     if (njs_fast_path(ret == NJS_DECLINED)) {
 
 set_prop:
@@ -219,22 +221,38 @@ njs_object_prop_define(njs_vm_t *vm, njs_value_t *object, unsigned atom_id,
             return NJS_ERROR;
         }
 
-        if (njs_slow_path(njs_is_typed_array(object) &&
-           (flags & NJS_OBJECT_PROP_IS_STRING)))
-        {
+        if (njs_slow_path(njs_is_typed_array(object))) {
             /* Integer-Indexed Exotic Objects [[DefineOwnProperty]]. */
 
+            if (njs_atom_is_number(atom_id)) {
+                index = njs_atom_number(atom_id);
+
+                if (index < njs_typed_array_length(njs_typed_array(object))) {
+                    goto complete;
+                }
+
+                goto invalid_index;
+            }
+
             ret = njs_atom_to_value(vm, &key, atom_id);
             if (njs_slow_path(ret != NJS_OK)) {
                 return ret;
             }
 
-            if (!isnan(njs_string_to_index(&key))) {
-                njs_type_error(vm, "Invalid typed array index");
-                return NJS_ERROR;
+            if (njs_is_string(&key)) {
+                njs_string_get(vm, &key, &string);
+
+                if (!isnan(njs_string_to_index(&key))
+                    || (string.length == 3
+                        && memcmp(string.start, "NaN", 3) == 0))
+                {
+                    goto invalid_index;
+                }
             }
         }
 
+complete:
+
         /* 6.2.5.6 CompletePropertyDescriptor */
 
         if (njs_is_accessor_descriptor(prop)) {
@@ -558,6 +576,12 @@ njs_object_prop_define(njs_vm_t *vm, njs_value_t *object, unsigned atom_id,
     njs_atom_string_get(vm, atom_id, &pq.fhq.key);
     njs_type_error(vm, "Cannot redefine property: \"%V\"", &pq.fhq.key);
 
+    return NJS_ERROR;
+
+invalid_index:
+
+    njs_type_error(vm, "Invalid typed array index");
+
     return NJS_ERROR;
 }
 

src/njs_regex.h

@@ -32,7 +32,7 @@ typedef struct {
     int         backrefmax;
     int         nentries;
     int         entry_size;
-    char        *entries;
+    u_char      *entries;
 } njs_regex_t;
 
 
@@ -76,8 +76,8 @@ NJS_EXPORT njs_int_t njs_regex_compile(njs_regex_t *regex, u_char *source,
     size_t len, njs_regex_flags_t flags, njs_regex_compile_ctx_t *ctx,
     njs_trace_t *trace);
 NJS_EXPORT njs_bool_t njs_regex_is_valid(njs_regex_t *regex);
-NJS_EXPORT njs_int_t njs_regex_named_captures(njs_regex_t *regex,
-    njs_str_t *name, int n);
+NJS_EXPORT njs_int_t njs_regex_named_capture(njs_regex_t *regex,
+    njs_str_t *name, int n, uint32_t *capture);
 NJS_EXPORT njs_regex_match_data_t *njs_regex_match_data(njs_regex_t *regex,
     njs_regex_generic_ctx_t *ctx);
 NJS_EXPORT void njs_regex_match_data_free(njs_regex_match_data_t *match_data,