re2 1.25.1 → 1.25.2

package/README.md

@@ -436,7 +436,8 @@ Tables are baked in at build time from Unicode 17.0. To target a newer Unicode v
 
 ## Release history
 
-- 1.25.1 *Security fix (GHSA-8hcv-x26h-mcgp): a global `replace()` using an output-amplifying template (`$'` or `` $` ``) on very large input could exceed V8's maximum string length and abort the whole process. It now throws a catchable `RangeError`, matching the built-in engine.*
+- 1.25.2 *Two DoS security fixes: a global `match()` with an empty-matchable pattern (`a*`, `(?:)`, …) no longer loops forever exhausting memory (GHSA-6hxr-mr5r-9836), and an out-of-range `lastIndex` on a non-ASCII subject no longer reads past the buffer and crashes (GHSA-ff84-5f28-78qj). Both now match the built-in engine. Thx, [ataberk-xyz](https://github.com/ataberk-xyz).*
+- 1.25.1 *Security fix (GHSA-8hcv-x26h-mcgp): a global `replace()` using an output-amplifying template (`$'` or `` $` ``) on very large input could exceed V8's maximum string length and abort the whole process. It now throws a catchable `RangeError`, matching the built-in engine. Thx, [ataberk-xyz](https://github.com/ataberk-xyz).*
 - 1.25.0 *Full Unicode 17.0.0 property classes (Fixes #226). New `maxMem` option for `RE2.Set`. Faster matching on pure-ASCII inputs. Narrowed Node support — drops Node 25.x and older patch releases.*
 - 1.24.1 *Support for Node 22, 24, 26 + precompiled binaries.*
 - 1.24.0 *Fixed multi-threaded crash in worker threads (#235). Added named import: `import {RE2} from 're2'`. Added CJS test. Updated docs and dependencies.*

package/lib/addon.cc

@@ -197,10 +197,13 @@ const StrVal &WrappedRE2::prepareArgument(const v8::Local<v8::Value> &arg, bool
 	auto isolate = v8::Isolate::GetCurrent();
 
 	auto s = t.ToLocalChecked();
-	auto argLength = utf8Length(s, isolate);
-	// Pure ASCII iff the UTF-16 length (s->Length(), O(1)) equals the UTF-8
-	// byte length: any non-ASCII char makes the byte count strictly larger.
-	bool isAscii = static_cast<size_t>(s->Length()) == argLength;
+	// length validation walks UTF-16 code units, so lastIndex must be bounded by
+	// the UTF-16 length (s->Length(), O(1)) — not the UTF-8 byte length, which is
+	// larger for non-ASCII and would let an out-of-range lastIndex read past the buffer.
+	auto argLength = static_cast<size_t>(s->Length());
+	// Pure ASCII iff the UTF-16 length equals the UTF-8 byte length: any
+	// non-ASCII char makes the byte count strictly larger.
+	bool isAscii = argLength == utf8Length(s, isolate);
 
 	auto buffer = node::Buffer::New(isolate, s).ToLocalChecked();
 	lastCache.Reset(buffer);
@@ -260,7 +263,7 @@ void StrVal::setIndex(size_t newIndex)
 		return;
 	}
 
-	byteIndex = index < newIndex ? getUtf16PositionByCounter(data, byteIndex, newIndex - index) : getUtf16PositionByCounter(data, 0, newIndex);
+	byteIndex = index < newIndex ? getUtf16PositionByCounter(data, size, byteIndex, newIndex - index) : getUtf16PositionByCounter(data, size, 0, newIndex);
 	index = newIndex;
 }
 

package/lib/match.cc

@@ -45,7 +45,16 @@ NAN_METHOD(WrappedRE2::Match)
 		while (re2->regexp.Match(str, byteIndex, str.size, anchor, &match, 1))
 		{
 			groups.push_back(match);
-			byteIndex = match.data() - str.data + match.size();
+			size_t offset = match.data() - str.data;
+			if (match.size())
+			{
+				byteIndex = offset + match.size();
+			}
+			else
+			{
+				// zero-width match: advance one code point or the loop never terminates
+				byteIndex = offset + (offset < str.size ? getUtf8CharSize(str.data[offset]) : 1);
+			}
 		}
 
 		if (groups.empty())

package/lib/wrapped_re2.h

@@ -261,9 +261,9 @@ inline void writeUtf8(v8::Local<v8::String> s, v8::Isolate *isolate, char *buffe
 
 #endif
 
-inline size_t getUtf16PositionByCounter(const char *data, size_t from, size_t n)
+inline size_t getUtf16PositionByCounter(const char *data, size_t size, size_t from, size_t n)
 {
-	for (; n > 0; --n)
+	for (; n > 0 && from < size; --n)
 	{
 		size_t s = getUtf8CharSize(data[from]);
 		from += s;
@@ -271,5 +271,5 @@ inline size_t getUtf16PositionByCounter(const char *data, size_t from, size_t n)
 			--n; // this utf8 character will take two utf16 characters
 				 // the decrement above is protected to avoid an overflow of an unsigned integer
 	}
-	return from;
+	return from > size ? size : from;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "re2",
-  "version": "1.25.1",
+  "version": "1.25.2",
   "description": "Bindings for RE2: fast, safe alternative to backtracking regular expression engines.",
   "homepage": "https://github.com/uhop/node-re2",
   "bugs": "https://github.com/uhop/node-re2/issues",