diff options
Diffstat (limited to 'lvm.c')
| -rw-r--r-- | lvm.c | 7 |
1 files changed, 4 insertions, 3 deletions
| @@ -1,5 +1,5 @@ | |||
| 1 | /* | 1 | /* |
| 2 | ** $Id: lvm.c,v 2.7 2004/05/31 18:51:50 roberto Exp roberto $ | 2 | ** $Id: lvm.c,v 2.8 2004/06/02 19:07:55 roberto Exp roberto $ |
| 3 | ** Lua virtual machine | 3 | ** Lua virtual machine |
| 4 | ** See Copyright Notice in lua.h | 4 | ** See Copyright Notice in lua.h |
| 5 | */ | 5 | */ |
| @@ -308,10 +308,11 @@ void luaV_concat (lua_State *L, int total, int last) { | |||
| 308 | char *buffer; | 308 | char *buffer; |
| 309 | int i; | 309 | int i; |
| 310 | while (n < total && tostring(L, top-n-1)) { /* collect total length */ | 310 | while (n < total && tostring(L, top-n-1)) { /* collect total length */ |
| 311 | tl += tsvalue(top-n-1)->len; | 311 | size_t l = tsvalue(top-n-1)->len; |
| 312 | if (l >= MAX_SIZET - tl) luaG_runerror(L, "string length overflow"); | ||
| 313 | tl += l; | ||
| 312 | n++; | 314 | n++; |
| 313 | } | 315 | } |
| 314 | if (tl > MAX_SIZET) luaG_runerror(L, "string size overflow"); | ||
| 315 | buffer = luaZ_openspace(L, &G(L)->buff, tl); | 316 | buffer = luaZ_openspace(L, &G(L)->buff, tl); |
| 316 | tl = 0; | 317 | tl = 0; |
| 317 | for (i=n; i>0; i--) { /* concat all strings */ | 318 | for (i=n; i>0; i--) { /* concat all strings */ |
