aboutsummaryrefslogtreecommitdiff
path: root/lobject.c
diff options
context:
space:
mode:
authorRoberto Ierusalimschy <roberto@inf.puc-rio.br>2025-07-18 16:18:30 -0300
committerRoberto Ierusalimschy <roberto@inf.puc-rio.br>2025-07-18 16:18:30 -0300
commit303f4155593721dfd57dadc6e56122e465ce9efb (patch)
tree2b723c2d744a53f96b0f067e5a39a15a7f9259ad /lobject.c
parentccb8b307f11c7497e61f617b12f3a7f0a697256c (diff)
downloadlua-303f4155593721dfd57dadc6e56122e465ce9efb.tar.gz
lua-303f4155593721dfd57dadc6e56122e465ce9efb.tar.bz2
lua-303f4155593721dfd57dadc6e56122e465ce9efb.zip
Randomness added to table length computation
A bad actor could fill only a few entries in a table (power of twos in decreasing order, see tests) and produce a small table with a huge length. If your program builds a table with external data and iterates over its length, this behavior could be an issue.
Diffstat (limited to 'lobject.c')
-rw-r--r--lobject.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/lobject.c b/lobject.c
index 5c270b27..b558cfe0 100644
--- a/lobject.c
+++ b/lobject.c
@@ -31,7 +31,8 @@
31 31
32 32
33/* 33/*
34** Computes ceil(log2(x)) 34** Computes ceil(log2(x)), which is the smallest integer n such that
35** x <= (1 << n).
35*/ 36*/
36lu_byte luaO_ceillog2 (unsigned int x) { 37lu_byte luaO_ceillog2 (unsigned int x) {
37 static const lu_byte log_2[256] = { /* log_2[i - 1] = ceil(log2(i)) */ 38 static const lu_byte log_2[256] = { /* log_2[i - 1] = ceil(log2(i)) */