diff options
| author | Roberto Ierusalimschy <roberto@inf.puc-rio.br> | 2009-07-02 16:57:34 -0300 |
|---|---|---|
| committer | Roberto Ierusalimschy <roberto@inf.puc-rio.br> | 2009-07-02 16:57:34 -0300 |
| commit | 0c258c84927ffe8540fc9590bdce802d598faa6a (patch) | |
| tree | b04ec15640f57acbf48e9284af608e20e883c45f | |
| parent | d57c9cdefc6f00d8bf8bb24b96e65631a1c3ef18 (diff) | |
| download | lua-0c258c84927ffe8540fc9590bdce802d598faa6a.tar.gz lua-0c258c84927ffe8540fc9590bdce802d598faa6a.tar.bz2 lua-0c258c84927ffe8540fc9590bdce802d598faa6a.zip | |
smart use of varargs may create functions that return too
many arguments and overflow the stack of C functions.
| -rw-r--r-- | bugs | 24 |
1 files changed, 22 insertions, 2 deletions
| @@ -1880,8 +1880,8 @@ patch = [[ | |||
| 1880 | +++ lundump.c 2008/04/04 19:51:41 2.7.1.4 | 1880 | +++ lundump.c 2008/04/04 19:51:41 2.7.1.4 |
| 1881 | @@ -1,5 +1,5 @@ | 1881 | @@ -1,5 +1,5 @@ |
| 1882 | /* | 1882 | /* |
| 1883 | -** $Id: bugs,v 1.100 2009/06/15 14:12:59 roberto Exp roberto $ | 1883 | -** $Id: bugs,v 1.101 2009/07/01 21:10:33 roberto Exp roberto $ |
| 1884 | +** $Id: bugs,v 1.100 2009/06/15 14:12:59 roberto Exp roberto $ | 1884 | +** $Id: bugs,v 1.101 2009/07/01 21:10:33 roberto Exp roberto $ |
| 1885 | ** load precompiled Lua chunks | 1885 | ** load precompiled Lua chunks |
| 1886 | ** See Copyright Notice in lua.h | 1886 | ** See Copyright Notice in lua.h |
| 1887 | */ | 1887 | */ |
| @@ -2193,3 +2193,23 @@ patch = [[ | |||
| 2193 | ]], | 2193 | ]], |
| 2194 | } | 2194 | } |
| 2195 | 2195 | ||
| 2196 | But{ | ||
| 2197 | what = [[smart use of varargs may create functions that return too | ||
| 2198 | many arguments and overflow the stack of C functions]], | ||
| 2199 | report = [[Patrick Donnelly, on 2008/12/10]], | ||
| 2200 | since = [[]], | ||
| 2201 | example = [[ | ||
| 2202 | local function lunpack(i, ...) | ||
| 2203 | if i == 0 then return ... | ||
| 2204 | else | ||
| 2205 | return lunpack(i-1, 1, ...) | ||
| 2206 | end | ||
| 2207 | end | ||
| 2208 | |||
| 2209 | Now, if C calls lunpack(n) with a huge n, it may end with | ||
| 2210 | too many values in its stack and confuse its stack indices. | ||
| 2211 | ]], | ||
| 2212 | patch = [[ | ||
| 2213 | ]], | ||
| 2214 | } | ||
| 2215 | } | ||
