commit ae27be40c97635e2a191848d3180668ccd65ce80
parent cdd26700e8305677adf8790906a5082724ff4469
Author: Roberto Ierusalimschy <roberto@inf.puc-rio.br>
Date: Tue, 13 Jan 2015 14:27:04 -0200
better check for overflows in 'table.move' (removes restriction that
initial position should be positive)
Diffstat:
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/ltablib.c b/ltablib.c
@@ -1,5 +1,5 @@
/*
-** $Id: ltablib.c,v 1.78 2014/10/25 11:50:46 roberto Exp roberto $
+** $Id: ltablib.c,v 1.79 2014/11/02 19:19:04 roberto Exp roberto $
** Library for Table Manipulation
** See Copyright Notice in lua.h
*/
@@ -124,8 +124,6 @@ static int tmove (lua_State *L) {
lua_Integer e = luaL_checkinteger(L, 3);
lua_Integer t = luaL_checkinteger(L, 4);
int tt = !lua_isnoneornil(L, 5) ? 5 : 1; /* destination table */
- /* the following restriction avoids several problems with overflows */
- luaL_argcheck(L, f > 0, 2, "initial position must be positive");
if (e >= f) { /* otherwise, nothing to move */
lua_Integer n, i;
ta.geti = (luaL_getmetafield(L, 1, "__index") == LUA_TNIL)
@@ -134,7 +132,11 @@ static int tmove (lua_State *L) {
ta.seti = (luaL_getmetafield(L, tt, "__newindex") == LUA_TNIL)
? (luaL_checktype(L, tt, LUA_TTABLE), lua_rawseti)
: lua_seti;
+ luaL_argcheck(L, f > 0 || e < LUA_MAXINTEGER + f, 3,
+ "too many elements to move");
n = e - f + 1; /* number of elements to move */
+ luaL_argcheck(L, t <= LUA_MAXINTEGER - n + 1, 4,
+ "destination wrap around");
if (t > f) {
for (i = n - 1; i >= 0; i--) {
(*ta.geti)(L, 1, f + i);