LDEV-4866 fix query parsing out of bounds

zspitzer · Jun 6, 2024 · 41dce3a · 41dce3a
1 parent 170f718
commit 41dce3a
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/core/src/main/java/lucee/runtime/db/SQLImpl.java b/core/src/main/java/lucee/runtime/db/SQLImpl.java
@@ -112,7 +112,7 @@ public String toString(boolean pattern) {
 		int index = 0;
 		for (int i = 0; i < sqlLen; i++) {
 			c = strSQL.charAt(i);
-			if (!inQuotes && sqlLen + 1 > i) {
+			if (!inQuotes && i < (sqlLen - 1)) {
 				// read multi line
 				if (c == '/' && strSQL.charAt(i + 1) == '*') {
 					int end = strSQL.indexOf("*/", i + 2);
@@ -124,7 +124,7 @@ public String toString(boolean pattern) {
 				}
 
 				// read single line
-				if (c == '-' && strSQL.charAt(i + 1) == '-') {
+				if (c == '-' && i < (sqlLen - 1) && strSQL.charAt(i + 1) == '-') {
 					int end = strSQL.indexOf('\n', i + 1);
 					if (end != -1) {
 						i = end + 1;

diff --git a/core/src/main/java/lucee/runtime/tag/util/QueryParamConverter.java b/core/src/main/java/lucee/runtime/tag/util/QueryParamConverter.java
@@ -146,7 +146,7 @@ private static SQL convert(String sql, List<SQLItems<SQLItem>> items, List<SQLIt
 
 		for (int i = 0; i < sqlLen; i++) {
 			c = sql.charAt(i);
-			if (!inQuotes && sqlLen + 1 > i) {
+			if (!inQuotes && i < (sqlLen - 1) ) {
 				// read multi line
 				if (c == '/' && sql.charAt(i + 1) == '*') {
 					int end = sql.indexOf("*/", i + 2);
@@ -158,7 +158,7 @@ private static SQL convert(String sql, List<SQLItems<SQLItem>> items, List<SQLIt
 				}
 
 				// read single line
-				if (c == '-' && sql.charAt(i + 1) == '-') {
+				if (c == '-' && i < (sqlLen - 1) && sql.charAt(i + 1) == '-') {
 					int end = sql.indexOf('\n', i + 1);
 					if (end != -1) {
 						i = end + 1;