From c1dc08e8e8e22af9902a6341b4a9a9a7811954cc Mon Sep 17 00:00:00 2001 From: Roberto Ierusalimschy Date: Mon, 24 Jun 2024 12:03:59 -0300 Subject: Length of external strings must fit in Lua integer (As the length of any string in Lua.) --- lauxlib.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'lauxlib.c') diff --git a/lauxlib.c b/lauxlib.c index 99a63092..5aeec55f 100644 --- a/lauxlib.c +++ b/lauxlib.c @@ -538,10 +538,12 @@ static void newbox (lua_State *L) { */ static size_t newbuffsize (luaL_Buffer *B, size_t sz) { size_t newsize = (B->size / 2) * 3; /* buffer size * 1.5 */ - if (l_unlikely(MAX_SIZET - sz - 1 < B->n)) /* overflow in (B->n + sz + 1)? */ - return luaL_error(B->L, "buffer too large"); - if (newsize < B->n + sz + 1) /* not big enough? */ + if (l_unlikely(sz > MAX_SIZE - B->n - 1)) + return luaL_error(B->L, "resulting string too large"); + if (newsize < B->n + sz + 1 || newsize > MAX_SIZE) { + /* newsize was not big enough or too big */ newsize = B->n + sz + 1; + } return newsize; } -- cgit v1.2.3-55-g6feb