summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRoberto Ierusalimschy <roberto@inf.puc-rio.br>2016-06-21 14:22:34 -0300
committerRoberto Ierusalimschy <roberto@inf.puc-rio.br>2016-06-21 14:22:34 -0300
commitfac00ca023c16f6d06beec502e8320017e3c6af2 (patch)
tree255d360243a0ecccbf20ceb6ede05a783a2a2b98
parent6487fb11fcae97b6cb7d06e32063fd786b35874c (diff)
downloadlua-fac00ca023c16f6d06beec502e8320017e3c6af2.tar.gz
lua-fac00ca023c16f6d06beec502e8320017e3c6af2.tar.bz2
lua-fac00ca023c16f6d06beec502e8320017e3c6af2.zip
bug: expression list with four or more expressions in
a 'for' loop can crash the interpreter.
-rw-r--r--bugs39
1 files changed, 39 insertions, 0 deletions
diff --git a/bugs b/bugs
index eb439c8b..d0f9ad1e 100644
--- a/bugs
+++ b/bugs
@@ -3602,6 +3602,45 @@ patch = [[
3602} 3602}
3603 3603
3604 3604
3605Bug{
3606what = [[expression list with four or more expressions in
3607a 'for' loop can crash the interpreter]],
3608report = [[Marco Schöpl, 2016/06/17]],
3609since = [[5.2]],
3610fix = nil,
3611example = [[
3612-- the next loop will probably crash the interpreter
3613repeat until load "for _ in _,_,_,_ do local function _() end"
3614]],
3615patch = [[
3616--- lparser.c 2016/05/13 19:10:16 2.153
3617+++ lparser.c 2016/06/17 19:52:48
3618@@ -323,6 +323,8 @@
3619 luaK_nil(fs, reg, extra);
3620 }
3621 }
3622+ if (nexps > nvars)
3623+ ls->fs->freereg -= nexps - nvars; /* remove extra values */
3624 }
3625
3626
3627@@ -1160,11 +1162,8 @@
3628 int nexps;
3629 checknext(ls, '=');
3630 nexps = explist(ls, &e);
3631- if (nexps != nvars) {
3632+ if (nexps != nvars)
3633 adjust_assign(ls, nvars, nexps, &e);
3634- if (nexps > nvars)
3635- ls->fs->freereg -= nexps - nvars; /* remove extra values */
3636- }
3637 else {
3638 luaK_setoneret(ls->fs, &e); /* close last expression */
3639 luaK_storevar(ls->fs, &lh->v, &e);
3640]]
3641}
3642
3643
3605--[=[ 3644--[=[
3606Bug{ 3645Bug{
3607what = [[ ]], 3646what = [[ ]],