diff options
| author | Roberto Ierusalimschy <roberto@inf.puc-rio.br> | 2004-11-03 10:22:39 -0200 |
|---|---|---|
| committer | Roberto Ierusalimschy <roberto@inf.puc-rio.br> | 2004-11-03 10:22:39 -0200 |
| commit | cfd7bc478f21494c254a8ed514271dbe655721b0 (patch) | |
| tree | 37d545ce12b1af5895027f25f092c6a93fac723f /bugs | |
| parent | 737ec947d3f33e73e587f7020dba40b1818ac64d (diff) | |
| download | lua-cfd7bc478f21494c254a8ed514271dbe655721b0.tar.gz lua-cfd7bc478f21494c254a8ed514271dbe655721b0.tar.bz2 lua-cfd7bc478f21494c254a8ed514271dbe655721b0.zip | |
better patch for buffer overflow error
Diffstat (limited to 'bugs')
| -rw-r--r-- | bugs | 30 |
1 files changed, 22 insertions, 8 deletions
| @@ -658,14 +658,28 @@ rep129(longs) | |||
| 658 | 658 | ||
| 659 | patch = [[ | 659 | patch = [[ |
| 660 | * lvm.c: | 660 | * lvm.c: |
| 661 | 329c329,331 | 661 | @@ -321,15 +321,15 @@ |
| 662 | < tl += tsvalue(top-n-1)->tsv.len; | 662 | luaG_concaterror(L, top-2, top-1); |
| 663 | --- | 663 | } else if (tsvalue(top-1)->tsv.len > 0) { /* if len=0, do nothing */ |
| 664 | > size_t l = tsvalue(top-n-1)->tsv.len; | 664 | /* at least two string values; get as many as possible */ |
| 665 | > if (l >= MAX_SIZET - tl) luaG_runerror(L, "string length overflow"); | 665 | - lu_mem tl = cast(lu_mem, tsvalue(top-1)->tsv.len) + |
| 666 | > tl += l; | 666 | - cast(lu_mem, tsvalue(top-2)->tsv.len); |
| 667 | 332d333 | 667 | + size_t tl = tsvalue(top-1)->tsv.len; |
| 668 | < if (tl > MAX_SIZET) luaG_runerror(L, "string size overflow"); | 668 | char *buffer; |
| 669 | int i; | ||
| 670 | - while (n < total && tostring(L, top-n-1)) { /* collect total length */ | ||
| 671 | - tl += tsvalue(top-n-1)->tsv.len; | ||
| 672 | - n++; | ||
| 673 | + /* collect total length */ | ||
| 674 | + for (n = 1; n < total && tostring(L, top-n-1); n++) { | ||
| 675 | + size_t l = tsvalue(top-n-1)->tsv.len; | ||
| 676 | + if (l >= MAX_SIZET - tl) luaG_runerror(L, "string length overflow"); | ||
| 677 | + tl += l; | ||
| 678 | } | ||
| 679 | - if (tl > MAX_SIZET) luaG_runerror(L, "string size overflow"); | ||
| 680 | buffer = luaZ_openspace(L, &G(L)->buff, tl); | ||
| 681 | tl = 0; | ||
| 682 | for (i=n; i>0; i--) { /* concat all strings */ | ||
| 669 | ]] | 683 | ]] |
| 670 | } | 684 | } |
| 671 | 685 | ||