Bug: Buffer overflow in string concatenation

Even if the string fits in size_t, the whole size of the TString object
can overflow when we add the header.

1 files changed, 1 insertions, 1 deletions

diff --git a/lstring.c b/lstring.c
index e921dd0f..97757355 100644
--- a/lstring.c
+++ b/lstring.c
@@ -224,7 +224,7 @@ TString *luaS_newlstr (lua_State *L, const char *str, size_t l) {
     return internshrstr(L, str, l);
   else {
     TString *ts;
-    if (l_unlikely(l >= (MAX_SIZE - sizeof(TString))/sizeof(char)))
+    if (l_unlikely(l * sizeof(char) >= (MAX_SIZE - sizeof(TString))))
       luaM_toobig(L);
     ts = luaS_createlngstrobj(L, l);
     memcpy(getlngstr(ts), str, l * sizeof(char));