bug: lua_checkstack may have arithmetic overflow for large 'size'

1 files changed, 4 insertions, 5 deletions

diff --git a/lapi.c b/lapi.c
index 2c725bed..86c75d51 100644
--- a/lapi.c
+++ b/lapi.c
@@ -1,5 +1,5 @@
 /*
-** $Id: lapi.c,v 2.63 2008/01/25 13:42:12 roberto Exp roberto $
+** $Id: lapi.c,v 2.64 2008/02/12 13:34:12 roberto Exp roberto $
 ** Lua API
 ** See Copyright Notice in lua.h
 */
@@ -84,15 +84,14 @@ static Table *getcurrenv (lua_State *L) {
 
 
 LUA_API int lua_checkstack (lua_State *L, int size) {
-  int res;
+  int res = 1;
   lua_lock(L);
-  if ((L->top - L->base + size) > LUAI_MAXCSTACK)
+  if (size > LUAI_MAXCSTACK || (L->top - L->base + size) > LUAI_MAXCSTACK)
     res = 0;  /* stack overflow */
-  else {
+  else if (size > 0) {
     luaD_checkstack(L, size);
     if (L->ci->top < L->top + size)
       L->ci->top = L->top + size;
-    res = 1;
   }
   lua_unlock(L);
   return res;