mirrors/lua
1
0
Fork 0
mirror of https://github.com/lua/lua.git synced 2025-07-24 04:32:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Bug: check for constructor overflow in [exp] fields

Browse source 
The check for constructor overflow was considering only fields with
explicit names, ignoring fields with syntax '[exp]=exp'.
This commit is contained in:
Roberto Ierusalimschy 2025-05-20 17:50:56 -03:00
commit c15543b9af
2 changed files with 5 additions and 6 deletions

6
lopcodes.h
View file

@ -254,7 +254,7 @@ OP_SETTABLE,/* A B C R[A][R[B]] := RK(C) */
OP_SETI,/* A B C R[A][B] := RK(C) */ OP_SETI,/* A B C R[A][B] := RK(C) */
OP_SETFIELD,/* A B C R[A][K[B]:shortstring] := RK(C) */ OP_SETFIELD,/* A B C R[A][K[B]:shortstring] := RK(C) */
OP_NEWTABLE,/* A B C k R[A] := {} */ OP_NEWTABLE,/* A vB vC k R[A] := {} */
OP_SELF,/* A B C R[A+1] := R[B]; R[A] := R[B][K[C]:shortstring] */ OP_SELF,/* A B C R[A+1] := R[B]; R[A] := R[B][K[C]:shortstring] */
@ -378,9 +378,9 @@ OP_EXTRAARG/* Ax extra (larger) argument for previous opcode */
real C = EXTRAARG _ C (the bits of EXTRAARG concatenated with the real C = EXTRAARG _ C (the bits of EXTRAARG concatenated with the
bits of C). bits of C).
(*) In OP_NEWTABLE, B is log2 of the hash size (which is always a (*) In OP_NEWTABLE, vB is log2 of the hash size (which is always a
power of 2) plus 1, or zero for size zero. If not k, the array size power of 2) plus 1, or zero for size zero. If not k, the array size
is C. Otherwise, the array size is EXTRAARG _ C. is vC. Otherwise, the array size is EXTRAARG _ vC.
(*) For comparisons, k specifies what condition the test should accept (*) For comparisons, k specifies what condition the test should accept
(true or false). (true or false).

5
lparser.c
View file

@ -904,12 +904,11 @@ static void recfield (LexState *ls, ConsControl *cc) {
FuncState *fs = ls->fs; FuncState *fs = ls->fs;
lu_byte reg = ls->fs->freereg; lu_byte reg = ls->fs->freereg;
expdesc tab, key, val; expdesc tab, key, val;
if (ls->t.token == TK_NAME) { if (ls->t.token == TK_NAME)
luaY_checklimit(fs, cc->nh, INT_MAX / 2, "items in a constructor");
codename(ls, &key); codename(ls, &key);
}
else /* ls->t.token == '[' */ else /* ls->t.token == '[' */
yindex(ls, &key); yindex(ls, &key);
luaY_checklimit(fs, cc->nh, INT_MAX / 2, "items in a constructor");
cc->nh++; cc->nh++;
checknext(ls, '='); checknext(ls, '=');
tab = *cc->t; tab = *cc->t;