fix(receive): guard numeric pattern against size_t overflow on cast

Same class of bug as the maxsize cast: a double larger than
SIZE_MAX cast to size_t is undefined behavior. Bound-check the
numeric receive pattern before the cast, and cover it with a test.

2 files changed, 6 insertions, 3 deletions

diff --git a/src/buffer.c b/src/buffer.c
index 5f06fc1..3d48a09 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -125,7 +125,8 @@ int buffer_meth_receive(lua_State *L, p_buffer buf) {
     /* ---- validation: must precede timeout_markstart() and any I/O ---- */
     if (numeric) {
         double n = lua_tonumber(L, 2);
-        luaL_argcheck(L, n >= 0, 2, "invalid receive pattern");
+        luaL_argcheck(L, n >= 0 && n < (lua_Number) ((size_t) -1), 2,
+            "invalid receive pattern");
         wanted = (size_t) n;
     } else {
         const char *p = luaL_optstring(L, 2, "*l");
diff --git a/test/testclnt.lua b/test/testclnt.lua
index ec154ea..ee64d3a 100644
--- a/test/testclnt.lua
+++ b/test/testclnt.lua
@@ -642,14 +642,16 @@ function test_maxsize()
     assert(not ok, "A6 failed: wanted > maxsize should raise")
     ok = pcall(data.receive, data, "*l", nil, math.huge)
     assert(not ok, "A7 failed: maxsize=math.huge should raise (size_t overflow)")
+    ok = pcall(data.receive, data, math.huge)
+    assert(not ok, "A8 failed: wanted=math.huge should raise (size_t overflow)")
     data:settimeout(0.1)
     ok = pcall(data.receive, data, 50, nil, 100)
-    assert(ok, "A8 failed: wanted <= maxsize should not raise")
+    assert(ok, "A9 failed: wanted <= maxsize should not raise")
     data:settimeout(-1)
     remote [[ data:send('intact\n') ]]
     local line, err = data:receive("*l", nil, 100)
     assert(line == "intact",
-        "A9 failed: socket touched by a failed argcheck (err=" ..
+        "A10 failed: socket touched by a failed argcheck (err=" ..
         tostring(err) .. ")")
     pass("ok")