From f6a81dbe9770f0e64d04b4e7be17c826d53253aa Mon Sep 17 00:00:00 2001
From: Roberto Ierusalimschy <roberto@inf.puc-rio.br>
Date: Tue, 31 Jul 2007 16:39:52 -0300
Subject: BUG: too many variables in an assignment may cause a C stack overflow

---
 bugs | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

(limited to 'bugs')

diff --git a/bugs b/bugs
index f1af3721..d58e92f4 100644
--- a/bugs
+++ b/bugs
@@ -1382,6 +1382,11 @@ patch = [[remove the '#include "lobject.h" and use
 'lua_pushfstring' instead of 'luaO_pushfstring']],
 }
 
+
+
+-----------------------------------------------------------------
+-- Lua 5.1.2
+
 Bug{
 what = [[Lua may close standard files,
 which then may be used by C]],
@@ -1492,6 +1497,29 @@ ltable.c:
 ]],
 }
 
+Bug{
+what = [[Too many variables in an assignment may cause a
+C stack overflow]],
+report = [[Mike Pall, on 07/2007]],
+since = [[5.0]],
+example = [[
+$ ulimit -s 1024       # Reduce C stack to 1MB for quicker results
+$ lua -e 'local s = "a,"; for i=1,18 do s = s..s end print(loadstring("local a "..s.."a=nil", ""))'
+]],
+patch = [[
+lparser.c:
+@@ -938,6 +938,8 @@
+     primaryexp(ls, &nv.v);
+     if (nv.v.k == VLOCAL)
+       check_conflict(ls, lh, &nv.v);
++    luaY_checklimit(ls->fs, nvars, LUAI_MAXCCALLS - ls->L->nCcalls,
++                    "variable names");
+     assignment(ls, &nv, nvars+1);
+   }
+   else {  /* assignment -> `=' explist1 */
+]],
+}
+
 Bug{
 what = [[ ]],
 report = [[ , on ]],
-- 
cgit v1.2.3-55-g6feb