Bug: Negation in 'luaV_shiftr' may overflow

Negation of an unchecked lua_Integer overflows with mininteger.

2 files changed, 6 insertions, 1 deletions

diff --git a/lvm.c b/lvm.c
index ec83f415..c84a665f 100644
--- a/lvm.c
+++ b/lvm.c
@@ -766,7 +766,7 @@ lua_Number luaV_modf (lua_State *L, lua_Number m, lua_Number n) {
 /*
 ** Shift left operation. (Shift right just negates 'y'.)
 */
-#define luaV_shiftr(x,y)        luaV_shiftl(x,-(y))
+#define luaV_shiftr(x,y)        luaV_shiftl(x,intop(-, 0, y))
 
 lua_Integer luaV_shiftl (lua_Integer x, lua_Integer y) {
   if (y < 0) {  /* shift right? */
diff --git a/testes/bitwise.lua b/testes/bitwise.lua
index 59781f5d..9509f7f0 100644
--- a/testes/bitwise.lua
+++ b/testes/bitwise.lua
@@ -45,6 +45,11 @@ assert(-1 >> numbits == 0 and
        -1 << numbits == 0 and
        -1 << -numbits == 0)
 
+assert(1 >> math.mininteger == 0)
+assert(1 >> math.maxinteger == 0)
+assert(1 << math.mininteger == 0)
+assert(1 << math.maxinteger == 0)
+
 assert((2^30 - 1) << 2^30 == 0)
 assert((2^30 - 1) >> 2^30 == 0)