fix(receive): guard numeric pattern against size_t overflow on cast

Same class of bug as the maxsize cast: a double larger than
SIZE_MAX cast to size_t is undefined behavior. Bound-check the
numeric receive pattern before the cast, and cover it with a test.

1 files changed, 2 insertions, 1 deletions

diff --git a/src/buffer.c b/src/buffer.c
index 5f06fc1..3d48a09 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -125,7 +125,8 @@ int buffer_meth_receive(lua_State *L, p_buffer buf) {
     /* ---- validation: must precede timeout_markstart() and any I/O ---- */
     if (numeric) {
         double n = lua_tonumber(L, 2);
-        luaL_argcheck(L, n >= 0, 2, "invalid receive pattern");
+        luaL_argcheck(L, n >= 0 && n < (lua_Number) ((size_t) -1), 2,
+            "invalid receive pattern");
         wanted = (size_t) n;
     } else {
         const char *p = luaL_optstring(L, 2, "*l");