Fix insufficient Date constructor argument validation (sebastienros#627)

lahma · May 25, 2019 · 8b88b5b · 8b88b5b
1 parent 63c7347
commit 8b88b5b
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 6 deletions.
diff --git a/Jint.Tests/Runtime/EngineTests.cs b/Jint.Tests/Runtime/EngineTests.cs
@@ -435,6 +435,12 @@ public void DateConstructor()
             ");
         }
 
+        [Fact]
+        public void DateConstructorWithInvalidParameters()
+        {
+            Assert.Throws<JavaScriptException>(() => RunTest("new Date (1,  Infinity);"));
+        }
+
         [Fact]
         public void ShouldConvertDateToNumber()
         {

diff --git a/Jint/Native/Date/DateConstructor.cs b/Jint/Native/Date/DateConstructor.cs
@@ -158,13 +158,24 @@ private double ConstructTimeValue(JsValue[] arguments, bool useUtc)
                 ExceptionHelper.ThrowArgumentOutOfRangeException(nameof(arguments), "There must be at least two arguments.");
             }
 
+            int SafeInteger(JsValue value)
+            {
+                var integer = TypeConverter.ToInteger(value);
+                if (integer > int.MaxValue || integer < int.MinValue)
+                {
+                    ExceptionHelper.ThrowTypeError(_engine, "Invalid Date.");
+                }
+
+                return (int) integer;
+            }
+
             var y = TypeConverter.ToNumber(arguments[0]);
-            var m = (int)TypeConverter.ToInteger(arguments[1]);
-            var dt = arguments.Length > 2 ? (int)TypeConverter.ToInteger(arguments[2]) : 1;
-            var h = arguments.Length > 3 ? (int)TypeConverter.ToInteger(arguments[3]) : 0;
-            var min = arguments.Length > 4 ? (int)TypeConverter.ToInteger(arguments[4]) : 0;
-            var s = arguments.Length > 5 ? (int)TypeConverter.ToInteger(arguments[5]) : 0;
-            var milli = arguments.Length > 6 ? (int)TypeConverter.ToInteger(arguments[6]) : 0;
+            var m = SafeInteger(arguments[1]);
+            var dt = arguments.Length > 2 ? SafeInteger(arguments[2]) : 1;
+            var h = arguments.Length > 3 ? SafeInteger(arguments[3]) : 0;
+            var min = arguments.Length > 4 ? SafeInteger(arguments[4]) : 0;
+            var s = arguments.Length > 5 ? SafeInteger(arguments[5]) : 0;
+            var milli = arguments.Length > 6 ? SafeInteger(arguments[6]) : 0;
 
             for (int i = 2; i < arguments.Length; i++)
             {
-Original file line number
+Diff line change
@@ Expand Up / @@ -435,6 +435,12 @@ public void DateConstructor() @@
                 ");
             }
+            [Fact]
+            public void DateConstructorWithInvalidParameters()
+            {
+                Assert.Throws<JavaScriptException>(() => RunTest("new Date (1,  Infinity);"));
+            }
             [Fact]
             public void ShouldConvertDateToNumber()
             {
@@ Expand Down @@