bug: 'io.lines' does not check maximum number of options

1 files changed, 35 insertions, 0 deletions

diff --git a/bugs b/bugs
index 81b9de95..24755610 100644
--- a/bugs
+++ b/bugs
@@ -3460,6 +3460,41 @@ patch = [[
 
 --[=[
 Bug{
+what = [['io.lines' does not check maximum number of options]],
+report = [[Patrick Donnell, 2015/07/10]],
+since = [[3.0]],
+fix = nil,
+example = [[
+-- can segfault in some machines
+t ={}; for i = 1, 253 do t[i] = 1 end
+io.lines("someexistingfile", table.unpack(t))()
+]],
+patch = [[
+--- liolib.c    2015/07/07 17:03:34     2.146
++++ liolib.c    2015/07/15 14:40:28     2.147
+@@ -318,8 +318,15 @@
+ static int io_readline (lua_State *L);
+ 
+ 
++/*
++** maximum number of arguments to 'f:lines'/'io.lines' (it + 3 must fit
++** in the limit for upvalues of a closure)
++*/
++#define MAXARGLINE     250
++
+ static void aux_lines (lua_State *L, int toclose) {
+   int n = lua_gettop(L) - 1;  /* number of arguments to read */
++  luaL_argcheck(L, n <= MAXARGLINE, MAXARGLINE + 2, "too many arguments");
+   lua_pushinteger(L, n);  /* number of arguments to read */
+   lua_pushboolean(L, toclose);  /* close/not close file when finished */
+   lua_rotate(L, 2, 2);  /* move 'n' and 'toclose' to their positions */
+]]
+}
+]=]
+
+
+--[=[
+Bug{
 what = [[ ]],
 report = [[ ]],
 since = [[ ]],