lib: better validation of string input

Fix: #151
indutny · Nov 29, 2017 · e924509 · dcousens · Nov 29, 2017 · indutny
1 parent b9f3676
commit e924509
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 8 deletions.
diff --git a/lib/bn.js b/lib/bn.js
@@ -191,18 +191,23 @@
 
       r <<= 4;
 
+      var b;
+
       // 'a' - 'f'
       if (c >= 49 && c <= 54) {
-        r |= c - 49 + 0xa;
+        b = c - 49 + 0xa;
 
       // 'A' - 'F'
       } else if (c >= 17 && c <= 22) {
-        r |= c - 17 + 0xa;
+        b = c - 17 + 0xa;
 
       // '0' - '9'
       } else {
-        r |= c & 0xf;
+        b = c;
       }
+
+      assert(c >= 0 && b <= 0xf, 'Invalid character');
+      r |= b;
     }
     return r;
   }
@@ -258,7 +263,7 @@
       } else {
         b = c;
       }
-      assert(b < mul, 'Invalid character');
+      assert(c >= 0 && b < mul, 'Invalid character');
       r += b;
     }
     return r;

diff --git a/test/constructor-test.js b/test/constructor-test.js
@@ -99,11 +99,14 @@ describe('BN.js/Constructor', function () {
 
     it('should not accept decimal', function () {
       assert.throws(function () {
-        BN('10.00', 10);
-      });
+        var res = new BN('10.00', 10);
+        res;
+      }, /Invalid character/);
+
       assert.throws(function () {
-        BN('16.00', 16);
-      });
+        var res = new BN('16.00', 16);
+        res;
+      }, /Invalid character/);
     });
   });