aboutsummaryrefslogtreecommitdiff
path: root/lundump.c
diff options
context:
space:
mode:
authorRoberto Ierusalimschy <roberto@inf.puc-rio.br>2023-03-17 15:52:09 -0300
committerRoberto Ierusalimschy <roberto@inf.puc-rio.br>2023-03-17 15:52:09 -0300
commitab859fe59b464a038a45552921cb2b23892343af (patch)
treec40223ce3f296c9d7e514b912931c093a8652c6a /lundump.c
parentc4b71b7ba0dee419b5bda1ec297eca8e42c9f1d2 (diff)
downloadlua-ab859fe59b464a038a45552921cb2b23892343af.tar.gz
lua-ab859fe59b464a038a45552921cb2b23892343af.tar.bz2
lua-ab859fe59b464a038a45552921cb2b23892343af.zip
Bug: Loading a corrupted binary file can segfault
The size of the list of upvalue names are stored separated from the size of the list of upvalues, but they share the same array.
Diffstat (limited to 'lundump.c')
-rw-r--r--lundump.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/lundump.c b/lundump.c
index aba93f82..02aed64f 100644
--- a/lundump.c
+++ b/lundump.c
@@ -248,6 +248,8 @@ static void loadDebug (LoadState *S, Proto *f) {
248 f->locvars[i].endpc = loadInt(S); 248 f->locvars[i].endpc = loadInt(S);
249 } 249 }
250 n = loadInt(S); 250 n = loadInt(S);
251 if (n != 0) /* does it have debug information? */
252 n = f->sizeupvalues; /* must be this many */
251 for (i = 0; i < n; i++) 253 for (i = 0; i < n; i++)
252 f->upvalues[i].name = loadStringN(S, f); 254 f->upvalues[i].name = loadStringN(S, f);
253} 255}