nodejs
diff --git a/Collapse file
‎lib/querystring.js‎
Copy file name to clipboardExpand all lines: lib/querystring.js
+6-1Lines changed: 6 additions & 1 deletion b/Collapse file
‎lib/querystring.js‎
Copy file name to clipboardExpand all lines: lib/querystring.js
+6-1Lines changed: 6 additions & 1 deletion
diff --git a/Collapse file
‎test/parallel/test-querystring.js‎
Copy file name to clipboardExpand all lines: test/parallel/test-querystring.js
+5Lines changed: 5 additions & 0 deletions b/Collapse file
‎test/parallel/test-querystring.js‎
Copy file name to clipboardExpand all lines: test/parallel/test-querystring.js
+5Lines changed: 5 additions & 0 deletions
@@ -138,7 +138,12 @@ QueryString.escape = function(str) {
     }
     // Surrogate pair
     ++i;
-    c = 0x10000 + (((c & 0x3FF) << 10) | (str.charCodeAt(i) & 0x3FF));
+    var c2;
+    if (i < str.length)
+      c2 = str.charCodeAt(i) & 0x3FF;
+    else
+      throw new URIError('URI malformed');
+    c = 0x10000 + (((c & 0x3FF) << 10) | c2);
     out += hexTable[0xF0 | (c >> 18)] +
            hexTable[0x80 | ((c >> 12) & 0x3F)] +
            hexTable[0x80 | ((c >> 6) & 0x3F)] +
 
@@ -139,6 +139,11 @@ qsWeirdObjects.forEach(function(testCase) {
   assert.equal(testCase[1], qs.stringify(testCase[0]));
 });
 
+// invalid surrogate pair throws URIError
+assert.throws(function() {
+  qs.stringify({ foo: '\udc00' });
+}, URIError);
+
 // coerce numbers to string
 assert.strictEqual('foo=0', qs.stringify({ foo: 0 }));
 assert.strictEqual('foo=0', qs.stringify({ foo: -0 }));