From ae27be40c97635e2a191848d3180668ccd65ce80 Mon Sep 17 00:00:00 2001
From: Roberto Ierusalimschy <roberto@inf.puc-rio.br>
Date: Tue, 13 Jan 2015 14:27:29 -0200
Subject: better check for overflows in 'table.move' (removes restriction that
 initial position should be positive)

---
 ltablib.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

(limited to 'ltablib.c')

diff --git a/ltablib.c b/ltablib.c
index 53fdec80..5bf2806d 100644
--- a/ltablib.c
+++ b/ltablib.c
@@ -1,5 +1,5 @@
 /*
-** $Id: ltablib.c,v 1.78 2014/10/25 11:50:46 roberto Exp roberto $
+** $Id: ltablib.c,v 1.79 2014/11/02 19:19:04 roberto Exp roberto $
 ** Library for Table Manipulation
 ** See Copyright Notice in lua.h
 */
@@ -124,8 +124,6 @@ static int tmove (lua_State *L) {
   lua_Integer e = luaL_checkinteger(L, 3);
   lua_Integer t = luaL_checkinteger(L, 4);
   int tt = !lua_isnoneornil(L, 5) ? 5 : 1;  /* destination table */
-  /* the following restriction avoids several problems with overflows */
-  luaL_argcheck(L, f > 0, 2, "initial position must be positive");
   if (e >= f) {  /* otherwise, nothing to move */
     lua_Integer n, i;
     ta.geti = (luaL_getmetafield(L, 1, "__index") == LUA_TNIL)
@@ -134,7 +132,11 @@ static int tmove (lua_State *L) {
     ta.seti = (luaL_getmetafield(L, tt, "__newindex") == LUA_TNIL)
       ? (luaL_checktype(L, tt, LUA_TTABLE), lua_rawseti)
       : lua_seti;
+    luaL_argcheck(L, f > 0 || e < LUA_MAXINTEGER + f, 3,
+                  "too many elements to move");
     n = e - f + 1;  /* number of elements to move */
+    luaL_argcheck(L, t <= LUA_MAXINTEGER - n + 1, 4,
+                  "destination wrap around");
     if (t > f) {
       for (i = n - 1; i >= 0; i--) {
         (*ta.geti)(L, 1, f + i);
-- 
cgit v1.2.3-55-g6feb