diff options
author | Roberto Ierusalimschy <roberto@inf.puc-rio.br> | 2025-06-17 11:40:49 -0300 |
---|---|---|
committer | Roberto Ierusalimschy <roberto@inf.puc-rio.br> | 2025-06-17 11:40:49 -0300 |
commit | f71156744851701b5d5fabdda5061b31e53f8f14 (patch) | |
tree | 5e5b99074b0387c6ebb01d3d7c9c6a0b3bddb5ab /lundump.c | |
parent | 9386e49a3173b68e8b5a7ba882c4c2faf557b61e (diff) | |
download | lua-f71156744851701b5d5fabdda5061b31e53f8f14.tar.gz lua-f71156744851701b5d5fabdda5061b31e53f8f14.tar.bz2 lua-f71156744851701b5d5fabdda5061b31e53f8f14.zip |
Check string indices when loading binary chunk
Lua is not religious about that, but it tries to avoid crashes when
loading binary chunks.
Diffstat (limited to 'lundump.c')
-rw-r--r-- | lundump.c | 12 |
1 files changed, 6 insertions, 6 deletions
@@ -154,8 +154,9 @@ static void loadString (LoadState *S, Proto *p, TString **sl) { | |||
154 | else if (size == 1) { /* previously saved string? */ | 154 | else if (size == 1) { /* previously saved string? */ |
155 | lua_Unsigned idx = loadVarint(S, LUA_MAXUNSIGNED); /* get its index */ | 155 | lua_Unsigned idx = loadVarint(S, LUA_MAXUNSIGNED); /* get its index */ |
156 | TValue stv; | 156 | TValue stv; |
157 | luaH_getint(S->h, l_castU2S(idx), &stv); /* get its value */ | 157 | if (novariant(luaH_getint(S->h, l_castU2S(idx), &stv)) != LUA_TSTRING) |
158 | *sl = ts = tsvalue(&stv); | 158 | error(S, "invalid string index"); |
159 | *sl = ts = tsvalue(&stv); /* get its value */ | ||
159 | luaC_objbarrier(L, p, ts); | 160 | luaC_objbarrier(L, p, ts); |
160 | return; /* do not save it again */ | 161 | return; /* do not save it again */ |
161 | } | 162 | } |
@@ -394,11 +395,10 @@ LClosure *luaU_undump (lua_State *L, ZIO *Z, const char *name, int fixed) { | |||
394 | LoadState S; | 395 | LoadState S; |
395 | LClosure *cl; | 396 | LClosure *cl; |
396 | if (*name == '@' || *name == '=') | 397 | if (*name == '@' || *name == '=') |
397 | S.name = name + 1; | 398 | name = name + 1; |
398 | else if (*name == LUA_SIGNATURE[0]) | 399 | else if (*name == LUA_SIGNATURE[0]) |
399 | S.name = "binary string"; | 400 | name = "binary string"; |
400 | else | 401 | S.name = name; |
401 | S.name = name; | ||
402 | S.L = L; | 402 | S.L = L; |
403 | S.Z = Z; | 403 | S.Z = Z; |
404 | S.fixed = cast_byte(fixed); | 404 | S.fixed = cast_byte(fixed); |