diff options
| author | Roberto Ierusalimschy <roberto@inf.puc-rio.br> | 2007-07-31 16:39:52 -0300 |
|---|---|---|
| committer | Roberto Ierusalimschy <roberto@inf.puc-rio.br> | 2007-07-31 16:39:52 -0300 |
| commit | f6a81dbe9770f0e64d04b4e7be17c826d53253aa (patch) | |
| tree | b793122f3eeff25b2b7146d9261c79b66f152a1f /bugs | |
| parent | 3904a66ab0ea441504afb74160fb6ff5efd8d33b (diff) | |
| download | lua-f6a81dbe9770f0e64d04b4e7be17c826d53253aa.tar.gz lua-f6a81dbe9770f0e64d04b4e7be17c826d53253aa.tar.bz2 lua-f6a81dbe9770f0e64d04b4e7be17c826d53253aa.zip | |
BUG: too many variables in an assignment may cause a C stack overflow
Diffstat (limited to 'bugs')
| -rw-r--r-- | bugs | 28 |
1 files changed, 28 insertions, 0 deletions
| @@ -1382,6 +1382,11 @@ patch = [[remove the '#include "lobject.h" and use | |||
| 1382 | 'lua_pushfstring' instead of 'luaO_pushfstring']], | 1382 | 'lua_pushfstring' instead of 'luaO_pushfstring']], |
| 1383 | } | 1383 | } |
| 1384 | 1384 | ||
| 1385 | |||
| 1386 | |||
| 1387 | ----------------------------------------------------------------- | ||
| 1388 | -- Lua 5.1.2 | ||
| 1389 | |||
| 1385 | Bug{ | 1390 | Bug{ |
| 1386 | what = [[Lua may close standard files, | 1391 | what = [[Lua may close standard files, |
| 1387 | which then may be used by C]], | 1392 | which then may be used by C]], |
| @@ -1493,6 +1498,29 @@ ltable.c: | |||
| 1493 | } | 1498 | } |
| 1494 | 1499 | ||
| 1495 | Bug{ | 1500 | Bug{ |
| 1501 | what = [[Too many variables in an assignment may cause a | ||
| 1502 | C stack overflow]], | ||
| 1503 | report = [[Mike Pall, on 07/2007]], | ||
| 1504 | since = [[5.0]], | ||
| 1505 | example = [[ | ||
| 1506 | $ ulimit -s 1024 # Reduce C stack to 1MB for quicker results | ||
| 1507 | $ lua -e 'local s = "a,"; for i=1,18 do s = s..s end print(loadstring("local a "..s.."a=nil", ""))' | ||
| 1508 | ]], | ||
| 1509 | patch = [[ | ||
| 1510 | lparser.c: | ||
| 1511 | @@ -938,6 +938,8 @@ | ||
| 1512 | primaryexp(ls, &nv.v); | ||
| 1513 | if (nv.v.k == VLOCAL) | ||
| 1514 | check_conflict(ls, lh, &nv.v); | ||
| 1515 | + luaY_checklimit(ls->fs, nvars, LUAI_MAXCCALLS - ls->L->nCcalls, | ||
| 1516 | + "variable names"); | ||
| 1517 | assignment(ls, &nv, nvars+1); | ||
| 1518 | } | ||
| 1519 | else { /* assignment -> `=' explist1 */ | ||
| 1520 | ]], | ||
| 1521 | } | ||
| 1522 | |||
| 1523 | Bug{ | ||
| 1496 | what = [[ ]], | 1524 | what = [[ ]], |
| 1497 | report = [[ , on ]], | 1525 | report = [[ , on ]], |
| 1498 | since = [[i ]], | 1526 | since = [[i ]], |