re2 - npm Package Compare versions

Comparing version 1.25.1 to 1.25.2

lib/addon.cc

@@ -200,6 +200,9 @@ #include "./wrapped_re2.h"
 	auto s = t.ToLocalChecked();
-	auto argLength = utf8Length(s, isolate);
-	// Pure ASCII iff the UTF-16 length (s->Length(), O(1)) equals the UTF-8
-	// byte length: any non-ASCII char makes the byte count strictly larger.
-	bool isAscii = static_cast<size_t>(s->Length()) == argLength;
+	// length validation walks UTF-16 code units, so lastIndex must be bounded by
+	// the UTF-16 length (s->Length(), O(1)) — not the UTF-8 byte length, which is
+	// larger for non-ASCII and would let an out-of-range lastIndex read past the buffer.
+	auto argLength = static_cast<size_t>(s->Length());
+	// Pure ASCII iff the UTF-16 length equals the UTF-8 byte length: any
+	// non-ASCII char makes the byte count strictly larger.
+	bool isAscii = argLength == utf8Length(s, isolate);
 
@@ -264,3 +267,3 @@ auto buffer = node::Buffer::New(isolate, s).ToLocalChecked();
 
-	byteIndex = index < newIndex ? getUtf16PositionByCounter(data, byteIndex, newIndex - index) : getUtf16PositionByCounter(data, 0, newIndex);
+	byteIndex = index < newIndex ? getUtf16PositionByCounter(data, size, byteIndex, newIndex - index) : getUtf16PositionByCounter(data, size, 0, newIndex);
 	index = newIndex;
@@ -267,0 +270,0 @@ }

lib/match.cc

@@ -48,3 +48,12 @@ #include "./wrapped_re2.h"
 			groups.push_back(match);
-			byteIndex = match.data() - str.data + match.size();
+			size_t offset = match.data() - str.data;
+			if (match.size())
+			{
+				byteIndex = offset + match.size();
+			}
+			else
+			{
+				// zero-width match: advance one code point or the loop never terminates
+				byteIndex = offset + (offset < str.size ? getUtf8CharSize(str.data[offset]) : 1);
+			}
 		}
@@ -51,0 +60,0 @@

lib/wrapped_re2.h

@@ -264,5 +264,5 @@ #pragma once
 
-inline size_t getUtf16PositionByCounter(const char *data, size_t from, size_t n)
+inline size_t getUtf16PositionByCounter(const char *data, size_t size, size_t from, size_t n)
 {
-	for (; n > 0; --n)
+	for (; n > 0 && from < size; --n)
 	{
@@ -275,3 +275,3 @@ size_t s = getUtf8CharSize(data[from]);
 	}
-	return from;
+	return from > size ? size : from;
 }

package.json

 {
   "name": "re2",
-  "version": "1.25.1",
+  "version": "1.25.2",
   "description": "Bindings for RE2: fast, safe alternative to backtracking regular expression engines.",
@@ -5,0 +5,0 @@ "homepage": "https://github.com/uhop/node-re2",

README.md

@@ -439,3 +439,4 @@ # node-re2 [![NPM version][npm-img]][npm-url]
 
-- 1.25.1 *Security fix (GHSA-8hcv-x26h-mcgp): a global `replace()` using an output-amplifying template (`$'` or `` $` ``) on very large input could exceed V8's maximum string length and abort the whole process. It now throws a catchable `RangeError`, matching the built-in engine.*
+- 1.25.2 *Two DoS security fixes: a global `match()` with an empty-matchable pattern (`a*`, `(?:)`, …) no longer loops forever exhausting memory (GHSA-6hxr-mr5r-9836), and an out-of-range `lastIndex` on a non-ASCII subject no longer reads past the buffer and crashes (GHSA-ff84-5f28-78qj). Both now match the built-in engine. Thx, [ataberk-xyz](https://github.com/ataberk-xyz).*
+- 1.25.1 *Security fix (GHSA-8hcv-x26h-mcgp): a global `replace()` using an output-amplifying template (`$'` or `` $` ``) on very large input could exceed V8's maximum string length and abort the whole process. It now throws a catchable `RangeError`, matching the built-in engine. Thx, [ataberk-xyz](https://github.com/ataberk-xyz).*
 - 1.25.0 *Full Unicode 17.0.0 property classes (Fixes #226). New `maxMem` option for `RE2.Set`. Faster matching on pure-ASCII inputs. Narrowed Node support — drops Node 25.x and older patch releases.*
@@ -442,0 +443,0 @@ - 1.24.1 *Support for Node 22, 24, 26 + precompiled binaries.*

New alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 2 instances

Improved metrics

Total package byte prevSize

13136819

0.01%

Number of lines in readme file

477

0.21%

Number of low supply chain risk alerts

1

-50%

No dependency changes