diff options
author | Roberto Ierusalimschy <roberto@inf.puc-rio.br> | 2021-09-22 13:10:39 -0300 |
---|---|---|
committer | Roberto Ierusalimschy <roberto@inf.puc-rio.br> | 2021-09-22 13:10:39 -0300 |
commit | deac067ed39a44c001599c0d15de09872496b2aa (patch) | |
tree | d7373651e7d54a8ca5ffa4841379a4d9149164aa /lutf8lib.c | |
parent | 2ff34717227b8046b0fdcb96206f11f5e888664e (diff) | |
download | lua-deac067ed39a44c001599c0d15de09872496b2aa.tar.gz lua-deac067ed39a44c001599c0d15de09872496b2aa.tar.bz2 lua-deac067ed39a44c001599c0d15de09872496b2aa.zip |
Avoid overflows when incrementing parameters in C
Any C function can receive maxinteger as an integer argument, and
therefore cannot increment it without some care (e.g., doing unsigned
arithmetic as the core does).
Diffstat (limited to 'lutf8lib.c')
-rw-r--r-- | lutf8lib.c | 11 |
1 files changed, 4 insertions, 7 deletions
@@ -224,14 +224,11 @@ static int byteoffset (lua_State *L) { | |||
224 | static int iter_aux (lua_State *L, int strict) { | 224 | static int iter_aux (lua_State *L, int strict) { |
225 | size_t len; | 225 | size_t len; |
226 | const char *s = luaL_checklstring(L, 1, &len); | 226 | const char *s = luaL_checklstring(L, 1, &len); |
227 | lua_Integer n = lua_tointeger(L, 2) - 1; | 227 | lua_Unsigned n = (lua_Unsigned)lua_tointeger(L, 2); |
228 | if (n < 0) /* first iteration? */ | 228 | if (n < len) { |
229 | n = 0; /* start from here */ | 229 | while (iscont(s + n)) n++; /* skip continuation bytes */ |
230 | else if (n < (lua_Integer)len) { | ||
231 | n++; /* skip current byte */ | ||
232 | while (iscont(s + n)) n++; /* and its continuations */ | ||
233 | } | 230 | } |
234 | if (n >= (lua_Integer)len) | 231 | if (n >= len) /* (also handles original 'n' being negative) */ |
235 | return 0; /* no more codepoints */ | 232 | return 0; /* no more codepoints */ |
236 | else { | 233 | else { |
237 | utfint code; | 234 | utfint code; |