lua

commit 62fb93442753cbfb828335cd172e71471dffd536
parent 8a32e0aa4afdfd575c329ce62baaf7a14888ed3b
Author: Roberto Ierusalimschy <roberto@inf.puc-rio.br>
Date:   Thu, 22 Jul 2021 13:44:26 -0300

Bug: Negation in 'luaV_shiftr' may overflow

Negation of an unchecked lua_Integer overflows with mininteger.

Diffstat:
M
lvm.c
 | 
2
+-
M
testes/bitwise.lua
 | 
5
+++++

2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/lvm.c b/lvm.c
@@ -766,7 +766,7 @@ lua_Number luaV_modf (lua_State *L, lua_Number m, lua_Number n) {
 /*
 ** Shift left operation. (Shift right just negates 'y'.)
 */
-#define luaV_shiftr(x,y)	luaV_shiftl(x,-(y))
+#define luaV_shiftr(x,y)	luaV_shiftl(x,intop(-, 0, y))
 
 lua_Integer luaV_shiftl (lua_Integer x, lua_Integer y) {
   if (y < 0) {  /* shift right? */
diff --git a/testes/bitwise.lua b/testes/bitwise.lua
@@ -45,6 +45,11 @@ assert(-1 >> numbits == 0 and
        -1 << numbits == 0 and
        -1 << -numbits == 0)
 
+assert(1 >> math.mininteger == 0)
+assert(1 >> math.maxinteger == 0)
+assert(1 << math.mininteger == 0)
+assert(1 << math.maxinteger == 0)
+
 assert((2^30 - 1) << 2^30 == 0)
 assert((2^30 - 1) >> 2^30 == 0)