r=thesteve, sr=brendan, bug @119909 - crashing RegExp with > 10 backrefs.

This commit is contained in:
rogerl%netscape.com 2002-02-20 05:43:26 +00:00
parent d157ef3ec0
commit e2486ebfbe

View File

@ -2282,7 +2282,7 @@ js_ExecuteRegExp(JSContext *cx, JSRegExp *re, JSString *str, size_t *indexp,
res->moreLength = 10;
morepar = (JSSubString*) JS_malloc(cx,
10 * sizeof(JSSubString));
} else if (morenum > res->moreLength) {
} else if (morenum >= res->moreLength) {
res->moreLength += 10;
morepar = (JSSubString*) JS_realloc(cx, morepar,
res->moreLength * sizeof(JSSubString));