diff options
author | Milo Yip <miloyip@gmail.com> | 2016-04-17 06:59:09 +0300 |
---|---|---|
committer | Milo Yip <miloyip@gmail.com> | 2016-04-17 06:59:09 +0300 |
commit | be352d954818c027bd09d075135420da1ea5921c (patch) | |
tree | 0a1ee243949f08fd49812a7979fbc49ea919500b /include/rapidjson/internal | |
parent | 8f4e99b2e5ebe80db4cfd0865879a24212e9d340 (diff) |
Fix a bug in regex
Due to dereferencing a pointer which may be invalidated
Diffstat (limited to 'include/rapidjson/internal')
-rw-r--r-- | include/rapidjson/internal/regex.h | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/include/rapidjson/internal/regex.h b/include/rapidjson/internal/regex.h index c0a3ec57..422a5240 100644 --- a/include/rapidjson/internal/regex.h +++ b/include/rapidjson/internal/regex.h @@ -468,17 +468,17 @@ private: static SizeType Min(SizeType a, SizeType b) { return a < b ? a : b; } void CloneTopOperand(Stack<Allocator>& operandStack) { - const Frag *src = operandStack.template Top<Frag>(); - SizeType count = stateCount_ - src->minIndex; // Assumes top operand contains states in [src->minIndex, stateCount_) + const Frag src = *operandStack.template Top<Frag>(); // Copy constructor to prevent invalidation + SizeType count = stateCount_ - src.minIndex; // Assumes top operand contains states in [src->minIndex, stateCount_) State* s = states_.template Push<State>(count); - memcpy(s, &GetState(src->minIndex), count * sizeof(State)); + memcpy(s, &GetState(src.minIndex), count * sizeof(State)); for (SizeType j = 0; j < count; j++) { if (s[j].out != kRegexInvalidState) s[j].out += count; if (s[j].out1 != kRegexInvalidState) s[j].out1 += count; } - *operandStack.template Push<Frag>() = Frag(src->start + count, src->out + count, src->minIndex + count); + *operandStack.template Push<Frag>() = Frag(src.start + count, src.out + count, src.minIndex + count); stateCount_ += count; } |