Fix length bounds check in Name::slice()

The length check did not take into account that there may be a non-zero offset at this point. Fixes #875. (cherry picked from commit 53b907d)
nikic · Sep 3, 2022 · ff24d1d · ff24d1d
1 parent e55f8c6
commit ff24d1d
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/lib/PhpParser/Node/Name.php b/lib/PhpParser/Node/Name.php
@@ -162,7 +162,7 @@ public function slice(int $offset, int $length = null) {
             $realLength = $numParts - $realOffset;
         } else {
             $realLength = $length < 0 ? $length + $numParts - $realOffset : $length;
-            if ($realLength < 0 || $realLength > $numParts) {
+            if ($realLength < 0 || $realLength > $numParts - $realOffset) {
                 throw new \OutOfBoundsException(sprintf('Length %d is out of bounds', $length));
             }
         }

diff --git a/test/PhpParser/Node/NameTest.php b/test/PhpParser/Node/NameTest.php
@@ -73,6 +73,12 @@ public function testSliceLengthTooSmall() {
         (new Name('foo\bar\baz'))->slice(0, -4);
     }
 
+    public function testSliceLengthTooLargeWithOffset() {
+        $this->expectException(\OutOfBoundsException::class);
+        $this->expectExceptionMessage('Length 3 is out of bounds');
+        (new Name('foo\bar\baz'))->slice(1, 3);
+    }
+
     public function testConcat() {
         $this->assertEquals(new Name('foo\bar\baz'), Name::concat('foo', 'bar\baz'));
         $this->assertEquals(