From 827ae20771d34912a8f79b50dc68e6430945b9eb Mon Sep 17 00:00:00 2001 From: Thijs Schreijer Date: Sat, 29 Aug 2026 17:19:19 +0200 Subject: fix(receive): guard numeric pattern against size_t overflow on cast Same class of bug as the maxsize cast: a double larger than SIZE_MAX cast to size_t is undefined behavior. Bound-check the numeric receive pattern before the cast, and cover it with a test. --- src/buffer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src/buffer.c') diff --git a/src/buffer.c b/src/buffer.c index 5f06fc1..3d48a09 100644 --- a/src/buffer.c +++ b/src/buffer.c @@ -125,7 +125,8 @@ int buffer_meth_receive(lua_State *L, p_buffer buf) { /* ---- validation: must precede timeout_markstart() and any I/O ---- */ if (numeric) { double n = lua_tonumber(L, 2); - luaL_argcheck(L, n >= 0, 2, "invalid receive pattern"); + luaL_argcheck(L, n >= 0 && n < (lua_Number) ((size_t) -1), 2, + "invalid receive pattern"); wanted = (size_t) n; } else { const char *p = luaL_optstring(L, 2, "*l"); -- cgit v1.2.3-55-g6feb