detection of erroneous numeric strings with \0 (such as "1\0")

4 files changed, 17 insertions, 13 deletions

diff --git a/llex.c b/llex.c
index 22a83ff1..5a742cf6 100644
--- a/llex.c
+++ b/llex.c
@@ -1,5 +1,5 @@
 /*
-** $Id: llex.c,v 2.40 2010/10/25 12:24:36 roberto Exp roberto $
+** $Id: llex.c,v 2.41 2010/11/18 18:38:44 roberto Exp roberto $
 ** Lexical Analyzer
 ** See Copyright Notice in lua.h
 */
@@ -200,6 +200,9 @@ static void buffreplace (LexState *ls, char from, char to) {
 #define getlocaledecpoint()     (localeconv()->decimal_point[0])
 #endif
 
+
+#define buff2d(b,e)     luaO_str2d(luaZ_buffer(b), luaZ_bufflen(b) - 1, e)
+
 /*
 ** in case of format error, try to change decimal point separator to
 ** the one defined in the current locale and check again
@@ -208,7 +211,7 @@ static void trydecpoint (LexState *ls, SemInfo *seminfo) {
   char old = ls->decpoint;
   ls->decpoint = getlocaledecpoint();
   buffreplace(ls, old, ls->decpoint);  /* try new decimal separator */
-  if (!luaO_str2d(luaZ_buffer(ls->buff), &seminfo->r)) {
+  if (!buff2d(ls->buff, &seminfo->r)) {
     /* format error with correct decimal point: no more options */
     buffreplace(ls, ls->decpoint, '.');  /* undo change (for error message) */
     lexerror(ls, "malformed number", TK_NUMBER);
@@ -226,7 +229,7 @@ static void read_numeral (LexState *ls, SemInfo *seminfo) {
   } while (lislalnum(ls->current) || ls->current == '.');
   save(ls, '\0');
   buffreplace(ls, '.', ls->decpoint);  /* follow locale for decimal point */
-  if (!luaO_str2d(luaZ_buffer(ls->buff), &seminfo->r))  /* format error? */
+  if (!buff2d(ls->buff, &seminfo->r))  /* format error? */
     trydecpoint(ls, seminfo); /* try to update decimal point separator */
 }
 
diff --git a/lobject.c b/lobject.c
index b3bacc08..598520ac 100644
--- a/lobject.c
+++ b/lobject.c
@@ -1,5 +1,5 @@
 /*
-** $Id: lobject.c,v 2.42 2010/10/29 11:13:14 roberto Exp roberto $
+** $Id: lobject.c,v 2.43 2010/10/29 15:54:55 roberto Exp roberto $
 ** Some generic functions over Lua objects
 ** See Copyright Notice in lua.h
 */
@@ -106,19 +106,20 @@ lua_Number luaO_arith (int op, lua_Number v1, lua_Number v2) {
 }
 
 
-static int checkend (const char *s, const char *endptr) {
+static int checkend (const char *s, const char *e, const char *endptr) {
   if (endptr == s) return 0;  /* no characters converted */
   while (lisspace(cast(unsigned char, *endptr))) endptr++;
-  return (*endptr == '\0');  /* OK if no trailing characters */
+  return (endptr == e);  /* OK if no trailing characters */
 }
 
 
-int luaO_str2d (const char *s, lua_Number *result) {
+int luaO_str2d (const char *s, size_t len, lua_Number *result) {
   char *endptr;
+  const char *e = s + len;  /* string 's' ends here */
   *result = lua_str2number(s, &endptr);
-  if (checkend(s, endptr)) return 1;  /* conversion OK? */
+  if (checkend(s, e, endptr)) return 1;  /* conversion OK? */
   *result = cast_num(strtoul(s, &endptr, 0)); /* try hexadecimal */
-  return checkend(s, endptr);
+  return checkend(s, e, endptr);
 }
 
 
diff --git a/lobject.h b/lobject.h
index b9e554b4..823b5cd2 100644
--- a/lobject.h
+++ b/lobject.h
@@ -1,5 +1,5 @@
 /*
-** $Id: lobject.h,v 2.42 2010/07/26 15:53:23 roberto Exp roberto $
+** $Id: lobject.h,v 2.43 2010/11/26 14:32:31 roberto Exp roberto $
 ** Type definitions for Lua objects
 ** See Copyright Notice in lua.h
 */
@@ -412,7 +412,7 @@ LUAI_FUNC int luaO_fb2int (int x);
 LUAI_FUNC int luaO_ceillog2 (lu_int32 x);
 LUAI_FUNC lua_Number luaO_arith (int op, lua_Number v1, lua_Number v2);
 LUAI_FUNC int luaO_rawequalObj (const TValue *t1, const TValue *t2);
-LUAI_FUNC int luaO_str2d (const char *s, lua_Number *result);
+LUAI_FUNC int luaO_str2d (const char *s, size_t len, lua_Number *result);
 LUAI_FUNC const char *luaO_pushvfstring (lua_State *L, const char *fmt,
                                                        va_list argp);
 LUAI_FUNC const char *luaO_pushfstring (lua_State *L, const char *fmt, ...);
diff --git a/lvm.c b/lvm.c
index a20367ad..06dc4861 100644
--- a/lvm.c
+++ b/lvm.c
@@ -1,5 +1,5 @@
 /*
-** $Id: lvm.c,v 2.124 2010/10/25 19:01:37 roberto Exp roberto $
+** $Id: lvm.c,v 2.125 2010/10/29 17:52:46 roberto Exp roberto $
 ** Lua virtual machine
 ** See Copyright Notice in lua.h
 */
@@ -35,7 +35,7 @@
 const TValue *luaV_tonumber (const TValue *obj, TValue *n) {
   lua_Number num;
   if (ttisnumber(obj)) return obj;
-  if (ttisstring(obj) && luaO_str2d(svalue(obj), &num)) {
+  if (ttisstring(obj) && luaO_str2d(svalue(obj), tsvalue(obj)->len, &num)) {
     setnvalue(n, num);
     return n;
   }