aboutsummaryrefslogtreecommitdiff
path: root/ltablib.c
diff options
context:
space:
mode:
authorRoberto Ierusalimschy <roberto@inf.puc-rio.br>2015-01-13 14:27:29 -0200
committerRoberto Ierusalimschy <roberto@inf.puc-rio.br>2015-01-13 14:27:29 -0200
commitae27be40c97635e2a191848d3180668ccd65ce80 (patch)
treedb6598e941a4c161b63345b109a3ac578909e448 /ltablib.c
parentcdd26700e8305677adf8790906a5082724ff4469 (diff)
downloadlua-ae27be40c97635e2a191848d3180668ccd65ce80.tar.gz
lua-ae27be40c97635e2a191848d3180668ccd65ce80.tar.bz2
lua-ae27be40c97635e2a191848d3180668ccd65ce80.zip
better check for overflows in 'table.move' (removes restriction that
initial position should be positive)
Diffstat (limited to 'ltablib.c')
-rw-r--r--ltablib.c8
1 files changed, 5 insertions, 3 deletions
diff --git a/ltablib.c b/ltablib.c
index 53fdec80..5bf2806d 100644
--- a/ltablib.c
+++ b/ltablib.c
@@ -1,5 +1,5 @@
1/* 1/*
2** $Id: ltablib.c,v 1.78 2014/10/25 11:50:46 roberto Exp roberto $ 2** $Id: ltablib.c,v 1.79 2014/11/02 19:19:04 roberto Exp roberto $
3** Library for Table Manipulation 3** Library for Table Manipulation
4** See Copyright Notice in lua.h 4** See Copyright Notice in lua.h
5*/ 5*/
@@ -124,8 +124,6 @@ static int tmove (lua_State *L) {
124 lua_Integer e = luaL_checkinteger(L, 3); 124 lua_Integer e = luaL_checkinteger(L, 3);
125 lua_Integer t = luaL_checkinteger(L, 4); 125 lua_Integer t = luaL_checkinteger(L, 4);
126 int tt = !lua_isnoneornil(L, 5) ? 5 : 1; /* destination table */ 126 int tt = !lua_isnoneornil(L, 5) ? 5 : 1; /* destination table */
127 /* the following restriction avoids several problems with overflows */
128 luaL_argcheck(L, f > 0, 2, "initial position must be positive");
129 if (e >= f) { /* otherwise, nothing to move */ 127 if (e >= f) { /* otherwise, nothing to move */
130 lua_Integer n, i; 128 lua_Integer n, i;
131 ta.geti = (luaL_getmetafield(L, 1, "__index") == LUA_TNIL) 129 ta.geti = (luaL_getmetafield(L, 1, "__index") == LUA_TNIL)
@@ -134,7 +132,11 @@ static int tmove (lua_State *L) {
134 ta.seti = (luaL_getmetafield(L, tt, "__newindex") == LUA_TNIL) 132 ta.seti = (luaL_getmetafield(L, tt, "__newindex") == LUA_TNIL)
135 ? (luaL_checktype(L, tt, LUA_TTABLE), lua_rawseti) 133 ? (luaL_checktype(L, tt, LUA_TTABLE), lua_rawseti)
136 : lua_seti; 134 : lua_seti;
135 luaL_argcheck(L, f > 0 || e < LUA_MAXINTEGER + f, 3,
136 "too many elements to move");
137 n = e - f + 1; /* number of elements to move */ 137 n = e - f + 1; /* number of elements to move */
138 luaL_argcheck(L, t <= LUA_MAXINTEGER - n + 1, 4,
139 "destination wrap around");
138 if (t > f) { 140 if (t > f) {
139 for (i = n - 1; i >= 0; i--) { 141 for (i = n - 1; i >= 0; i--) {
140 (*ta.geti)(L, 1, f + i); 142 (*ta.geti)(L, 1, f + i);