From: Richard van Velzen <rvanvelzen@experty.com>
Date: Mon, 9 Nov 2015 10:28:27 +0000 (+0100)
Subject: Prevent ReDoS by not using a regexp to verify floating point numbers
X-Git-Url: https://git.ndcode.org/public/gitweb.cgi?a=commitdiff_plain;h=63d35f8f6db6d90d6142132d2d5f0bd5d3d698aa;p=UglifyJS.git

Prevent ReDoS by not using a regexp to verify floating point numbers

`parseFloat` will return `NaN` for invalid numbers anyway, which is the check used to throw the parse error.

Fixes #857
---

diff --git a/lib/parse.js b/lib/parse.js
index 1ab03589..4c548a26 100644
--- a/lib/parse.js
+++ b/lib/parse.js
@@ -59,7 +59,6 @@ var OPERATOR_CHARS = makePredicate(characters("+-*&%=<>!?|~^"));
 
 var RE_HEX_NUMBER = /^0x[0-9a-f]+$/i;
 var RE_OCT_NUMBER = /^0[0-7]+$/;
-var RE_DEC_NUMBER = /^\d*\.?\d*(?:e[+-]?\d*(?:\d\.?|\.?\d)\d*)?$/i;
 
 var OPERATORS = makePredicate([
     "in",
@@ -182,7 +181,7 @@ function parse_js_number(num) {
         return parseInt(num.substr(2), 16);
     } else if (RE_OCT_NUMBER.test(num)) {
         return parseInt(num.substr(1), 8);
-    } else if (RE_DEC_NUMBER.test(num)) {
+    } else {
         return parseFloat(num);
     }
 };