From ab859fe59b464a038a45552921cb2b23892343af Mon Sep 17 00:00:00 2001 From: Roberto Ierusalimschy Date: Fri, 17 Mar 2023 15:52:09 -0300 Subject: Bug: Loading a corrupted binary file can segfault The size of the list of upvalue names are stored separated from the size of the list of upvalues, but they share the same array. --- ldump.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'ldump.c') diff --git a/ldump.c b/ldump.c index f848b669..f231691b 100644 --- a/ldump.c +++ b/ldump.c @@ -10,6 +10,7 @@ #include "lprefix.h" +#include #include #include "lua.h" @@ -55,8 +56,11 @@ static void dumpByte (DumpState *D, int y) { } -/* dumpInt Buff Size */ -#define DIBS ((sizeof(size_t) * 8 / 7) + 1) +/* +** 'dumpSize' buffer size: each byte can store up to 7 bits. (The "+6" +** rounds up the division.) +*/ +#define DIBS ((sizeof(size_t) * CHAR_BIT + 6) / 7) static void dumpSize (DumpState *D, size_t x) { lu_byte buff[DIBS]; -- cgit v1.2.3-55-g6feb