shithub: libmujs

Info  •  Files  •  Log  •  Branches

Fix 699559: Off-by-one comparison in regexp parser.

--- a/regexp.c

+++ b/regexp.c

@@ -481,7 +481,7 @@

 	}

 	if (g->lookahead == L_REF) {

 		atom = newnode(g, P_REF);

-		if (g->yychar == 0 || g->yychar > g->nsub || !g->sub[g->yychar])

+		if (g->yychar == 0 || g->yychar >= g->nsub || !g->sub[g->yychar])

 			die(g, "invalid back-reference");

 		atom->n = g->yychar;

 		atom->x = g->sub[g->yychar];