From a546138d158d79d44b2c5b42630be00d306f4e7c Mon Sep 17 00:00:00 2001 From: Roberto Ierusalimschy Date: Thu, 18 Jul 2024 14:44:40 -0300 Subject: Explicit limit for number of results in a call The parameter 'nresults' in 'lua_call' and similar functions has a limit of 250. It already had an undocumented (and unchecked) limit of SHRT_MAX, but it is seldom larger than 2. --- lapi.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'lapi.c') diff --git a/lapi.c b/lapi.c index f00bd53f..dbd291d7 100644 --- a/lapi.c +++ b/lapi.c @@ -1022,10 +1022,15 @@ LUA_API int lua_setiuservalue (lua_State *L, int idx, int n) { */ +#define MAXRESULTS 250 + + #define checkresults(L,na,nr) \ - api_check(L, (nr) == LUA_MULTRET \ + (api_check(L, (nr) == LUA_MULTRET \ || (L->ci->top.p - L->top.p >= (nr) - (na)), \ - "results from function overflow current stack size") + "results from function overflow current stack size"), \ + api_check(L, LUA_MULTRET <= (nr) && (nr) <= MAXRESULTS, \ + "invalid number of results")) LUA_API void lua_callk (lua_State *L, int nargs, int nresults, -- cgit v1.2.3-55-g6feb