fixes dlclark#32 make sure octal parsing only eats chars 0-7

regexp_test.go

@@ -1092,3 +1092,40 @@ func TestEmptyCaptureLargeRepeat(t *testing.T) {
 		t.Fatal("Expected 2 matches, got more")
 	}
 }
+
+func TestFuzzBytes(t *testing.T) {
+	//some crash cases found from fuzzing
+
+	var testCases = []struct {
+		r, s []byte
+	}{
+		{
+			r: []byte{0x28, 0x28, 0x29, 0x5c, 0x37, 0x28, 0x3f, 0x28, 0x29, 0x29},
+			s: []byte{0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30},
+		},
+		{
+			r: []byte{0x28, 0x5c, 0x32, 0x28, 0x3f, 0x28, 0x30, 0x29, 0x29},
+			s: []byte{0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30},
+		},
+		{
+			r: []byte{0x28, 0x3f, 0x28, 0x29, 0x29, 0x5c, 0x31, 0x30, 0x28, 0x3f, 0x28, 0x30, 0x29},
+			s: []byte{0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30},
+		},
+		{
+			r: []byte{0x28, 0x29, 0x28, 0x28, 0x29, 0x5c, 0x37, 0x28, 0x3f, 0x28, 0x29, 0x29},
+			s: []byte{0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30},
+		},
+	}
+
+	for _, c := range testCases {
+		r := string(c.r)
+		t.Run(r, func(t *testing.T) {
+			_, err := Compile(r, Multiline|ECMAScript|Debug)
+			// should fail compiling
+			if err == nil {
+				t.Fatal("should fail compile, but didn't")
+			}
+		})
+	}
+
+}

syntax/parser.go

@@ -1818,7 +1818,7 @@ func (p *parser) scanOctal() rune {
 	//we know the first char is good because the caller had to check
 	i := 0
 	d := int(p.rightChar(0) - '0')
-	for c > 0 && d <= 7 {
+	for c > 0 && d <= 7 && d >= 0 {
 		if i >= 0x20 && p.useOptionE() {
 			break
 		}