From 966dbfc1f96a57d2cdeec89474dd540e9c87e240 Mon Sep 17 00:00:00 2001
From: Ben Noordhuis <info@bnoordhuis.nl>
Date: Thu, 17 Oct 2024 20:39:43 +0200
Subject: [PATCH] Fix crash in deserializer on bad regexp

---
 quickjs.c           | 7 ++++++-
 tests/test_bjson.js | 1 +
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/quickjs.c b/quickjs.c
index 4f4fc95..2587a64 100644
--- a/quickjs.c
+++ b/quickjs.c
@@ -35361,7 +35361,12 @@ static JSValue JS_ReadRegExp(BCReaderState *s)
         return JS_EXCEPTION;
     }
 
-    assert(!bc->is_wide_char);
+    if (bc->is_wide_char) {
+        js_free_string(ctx->rt, pattern);
+        js_free_string(ctx->rt, bc);
+        return JS_ThrowInternalError(ctx, "bad regexp bytecode");
+    }
+
     if (is_be())
         lre_byte_swap(bc->u.str8, bc->len, /*is_byte_swapped*/TRUE);
 
diff --git a/tests/test_bjson.js b/tests/test_bjson.js
index 9409676..6a2ee2c 100644
--- a/tests/test_bjson.js
+++ b/tests/test_bjson.js
@@ -232,6 +232,7 @@ function bjson_test_fuzz()
     var corpus = [
         "EBAAAAAABGA=",
         "EObm5oIt",
+        "EAARABMGBgYGBgYGBgYGBv////8QABEALxH/vy8R/78=",
     ];
     for (var input of corpus) {
         var buf = base64decode(input);