| commit | d4a07fbb2036bfe94ed72388907bd65870646f88 | [log] [tgz] |
|---|---|---|
| author | Geoff Lang <geofflang@chromium.org> | Tue Sep 20 10:24:23 2016 -0400 |
| committer | Geoff Lang <geofflang@chromium.org> | Wed Sep 21 17:04:33 2016 +0000 |
| tree | 6fd865c9d0c90b968b59d149553fa8620c74c4c2 | |
| parent | a59fcdf4427153313a9906e7c5944ff203bd9a7a [diff] [blame] |
Disallow bit-shifting when the left operand is negative. BUG=648063 Change-Id: I82d9fbdaf8791a396dd71eeb57d93967ba5d65bf Reviewed-on: https://chromium-review.googlesource.com/387115 Reviewed-by: Jamie Madill <jmadill@chromium.org> Reviewed-by: Corentin Wallez <cwallez@chromium.org>
diff --git a/src/compiler/preprocessor/ExpressionParser.y b/src/compiler/preprocessor/ExpressionParser.y index dc0080e..3f7fc62 100644 --- a/src/compiler/preprocessor/ExpressionParser.y +++ b/src/compiler/preprocessor/ExpressionParser.y
@@ -196,7 +196,7 @@ $$ = $1 < $3; } | expression TOK_OP_RIGHT expression { - if ($3 < 0) + if ($2 < 0 || $3 < 0) { if (!context->isIgnoringErrors()) { @@ -216,7 +216,7 @@ } } | expression TOK_OP_LEFT expression { - if ($3 < 0) + if ($2 < 0 || $3 < 0) { if (!context->isIgnoringErrors()) {