diff options
| author | Mike Pall <mike> | 2019-12-08 19:35:25 +0100 |
|---|---|---|
| committer | Mike Pall <mike> | 2019-12-08 19:35:25 +0100 |
| commit | 16e5605eec2e3882d709c6b123a644f6a8023945 (patch) | |
| tree | f48838fc68c88f698583838e83afd39b41cb2671 | |
| parent | e0388e6c00866c9ee1c7c9aab8a3ba9e15186b5c (diff) | |
| download | luajit-16e5605eec2e3882d709c6b123a644f6a8023945.tar.gz luajit-16e5605eec2e3882d709c6b123a644f6a8023945.tar.bz2 luajit-16e5605eec2e3882d709c6b123a644f6a8023945.zip | |
Prevent integer overflow while parsing long strings.
| -rw-r--r-- | src/lj_lex.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/lj_lex.c b/src/lj_lex.c index 36603168..1d063f8f 100644 --- a/src/lj_lex.c +++ b/src/lj_lex.c | |||
| @@ -140,7 +140,7 @@ static int skip_sep(LexState *ls) | |||
| 140 | int s = ls->current; | 140 | int s = ls->current; |
| 141 | lua_assert(s == '[' || s == ']'); | 141 | lua_assert(s == '[' || s == ']'); |
| 142 | save_and_next(ls); | 142 | save_and_next(ls); |
| 143 | while (ls->current == '=') { | 143 | while (ls->current == '=' && count < 0x20000000) { |
| 144 | save_and_next(ls); | 144 | save_and_next(ls); |
| 145 | count++; | 145 | count++; |
| 146 | } | 146 | } |