From 9b854e6dbcf569113f68e63d87644b69eb00a228 Mon Sep 17 00:00:00 2001
From: Roberto Ierusalimschy <roberto@inf.puc-rio.br>
Date: Tue, 8 Jun 2004 13:23:58 -0300
Subject: BUG: string concatenation may cause arithmetic overflow, leading to a
buffer overflow.
---
bugs | 36 ++++++++++++++++++++++++++++++++++++
1 file changed, 36 insertions(+)
(limited to 'bugs')
diff --git a/bugs b/bugs
index 59af0765..5ad6f1c5 100644
--- a/bugs
+++ b/bugs
@@ -633,3 +633,39 @@ patch = [[
]],
}
+
+
+
+-----------------------------------------------------------------
+-- Lua 5.0.2
+
+Bug{
+what = [[string concatenation may cause arithmetic overflow, leading
+to a buffer overflow]],
+
+report = [[Rici Lake, 20/05/2004]],
+
+example = [[
+longs = string.rep("\0", 2^25)
+function catter(i)
+ return assert(loadstring(
+ string.format("return function(a) return a%s end",
+ string.rep("..a", i-1))))()
+end
+rep129 = catter(129)
+rep129(longs)
+]],
+
+patch = [[
+* lvm.c:
+329c329,331
+< tl += tsvalue(top-n-1)->tsv.len;
+---
+> size_t l = tsvalue(top-n-1)->tsv.len;
+> if (l >= MAX_SIZET - tl) luaG_runerror(L, "string length overflow");
+> tl += l;
+332d333
+< if (tl > MAX_SIZET) luaG_runerror(L, "string size overflow");
+]]
+}
+
--
cgit v1.2.3-55-g6feb