commit 58c3aa8b5f51194980a9abf463a2648bb1413925
parent c1f78ff3d32298fbae950bf655bdca11179343ce
Author: Roberto Ierusalimschy <roberto@inf.puc-rio.br>
Date: Mon, 27 Apr 2009 17:10:47 -0300
malicious zero-length string in binary code may segfault Lua +
wrong code generation for some particular boolean expressions
Diffstat:
M | bugs | | | 32 | ++++++++++++++++++++++++++++++-- |
1 file changed, 30 insertions(+), 2 deletions(-)
diff --git a/bugs b/bugs
@@ -1880,8 +1880,8 @@ patch = [[
+++ lundump.c 2008/04/04 19:51:41 2.7.1.4
@@ -1,5 +1,5 @@
/*
--** $Id: bugs,v 1.97 2008/07/11 17:27:41 roberto Exp roberto $
-+** $Id: bugs,v 1.97 2008/07/11 17:27:41 roberto Exp roberto $
+-** $Id: bugs,v 1.98 2008/08/06 13:32:45 roberto Exp roberto $
++** $Id: bugs,v 1.98 2008/08/06 13:32:45 roberto Exp roberto $
** load precompiled Lua chunks
** See Copyright Notice in lua.h
*/
@@ -2077,3 +2077,31 @@ patch = [[
]],
}
+
+-----------------------------------------------------------------
+-- Lua 5.1.4
+
+Bug{
+what = [[malicious zero-length string in binary code may segfault Lua]],
+report = [["Peter Cawley, on 2008/09/01]],
+since = [[5.1]],
+example = [[
+loadstring(('').dump(function()X''end):gsub('\2%z%z%zX','\0\0\0'))()
+]],
+patch = [[
+]],
+}
+
+
+Bug{
+what = [[wrong code generation for some particular boolean expressions]],
+report = [["Brian Kelley, on 2009/04/15]],
+since = [[5.0]],
+example = [[
+print(((1 or false) and true) or false) --> 1
+-- should be 'true'
+]],
+patch = [[
+]],
+}
+