lua

A copy of the Lua development repository
Log | Files | Refs | README

commit cfb79b17513d42d58846b34e071409795c51f604
parent 3e1a1f28362d53104a6ef09fadd902e91657f8ce
Author: Roberto Ierusalimschy <roberto@inf.puc-rio.br>
Date:   Thu, 28 Oct 2004 14:45:29 -0300

more secure way to compute final string length

Diffstat:
Mlvm.c | 9++++-----
1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/lvm.c b/lvm.c @@ -1,5 +1,5 @@ /* -** $Id: lvm.c,v 2.14 2004/09/15 20:39:42 roberto Exp $ +** $Id: lvm.c,v 2.15 2004/10/04 19:01:53 roberto Exp roberto $ ** Lua virtual machine ** See Copyright Notice in lua.h */ @@ -303,15 +303,14 @@ void luaV_concat (lua_State *L, int total, int last) { luaG_concaterror(L, top-2, top-1); } else if (tsvalue(top-1)->len > 0) { /* if len=0, do nothing */ /* at least two string values; get as many as possible */ - lu_mem tl = cast(lu_mem, tsvalue(top-1)->len) + - cast(lu_mem, tsvalue(top-2)->len); + size_t tl = tsvalue(top-1)->len; char *buffer; int i; - while (n < total && tostring(L, top-n-1)) { /* collect total length */ + /* collect total length */ + for (n = 1; n < total && tostring(L, top-n-1); n++) { size_t l = tsvalue(top-n-1)->len; if (l >= MAX_SIZET - tl) luaG_runerror(L, "string length overflow"); tl += l; - n++; } buffer = luaZ_openspace(L, &G(L)->buff, tl); tl = 0;