[Merge chakra-core/ChakraCore@353d42059b] [1.6>1.7] [MERGE #3480 @jia…

…nchun] fix minor out of bound read (JavascriptString::ToInteger) Merge pull request #3480 from jianchun:readob Reorder checks to avoid minor out of bound read. Fix OS#13058871
nodejs · Aug 10, 2017 · 4d89f02 · 4d89f02
1 parent 461c1b9
commit 4d89f02
Showing 1 changed file with 6 additions and 5 deletions.
diff --git a/deps/chakrashim/core/lib/Runtime/Library/JavascriptString.cpp b/deps/chakrashim/core/lib/Runtime/Library/JavascriptString.cpp
@@ -2842,26 +2842,27 @@ namespace Js
         const char16* pchEnd =  pchStart + m_charLength;
         const char16 *pch = this->GetScriptContext()->GetCharClassifier()->SkipWhiteSpace(pchStart, pchEnd);
         bool isNegative = false;
+
+        if (pch < pchEnd)
+        {
         switch (*pch)
         {
         case '-':
             isNegative = true;
             // Fall through.
         case '+':
-            if(pch < pchEnd)
-            {
                 pch++;
-            }
             break;
         }
+        }
 
         if (0 == radix)
         {
             if (pch < pchEnd && '0' != pch[0])
             {
                 radix = 10;
             }
-            else if (('x' == pch[1] || 'X' == pch[1]) && pchEnd - pch >= 2)
+            else if (pchEnd - pch >= 2 && ('x' == pch[1] || 'X' == pch[1]))
             {
                 radix = 16;
                 pch += 2;
@@ -2875,7 +2876,7 @@ namespace Js
         }
         else if (16 == radix)
         {
-            if('0' == pch[0] && ('x' == pch[1] || 'X' == pch[1]) && pchEnd - pch >= 2)
+            if(pchEnd - pch >= 2 && '0' == pch[0] && ('x' == pch[1] || 'X' == pch[1]))
             {
                 pch += 2;
             }