From 62fb93442753cbfb828335cd172e71471dffd536 Mon Sep 17 00:00:00 2001 From: Roberto Ierusalimschy Date: Thu, 22 Jul 2021 13:44:53 -0300 Subject: [PATCH] Bug: Negation in 'luaV_shiftr' may overflow Negation of an unchecked lua_Integer overflows with mininteger. --- lvm.c | 2 +- testes/bitwise.lua | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/lvm.c b/lvm.c index ec83f415..c84a665f 100644 --- a/lvm.c +++ b/lvm.c @@ -766,7 +766,7 @@ lua_Number luaV_modf (lua_State *L, lua_Number m, lua_Number n) { /* ** Shift left operation. (Shift right just negates 'y'.) */ -#define luaV_shiftr(x,y) luaV_shiftl(x,-(y)) +#define luaV_shiftr(x,y) luaV_shiftl(x,intop(-, 0, y)) lua_Integer luaV_shiftl (lua_Integer x, lua_Integer y) { if (y < 0) { /* shift right? */ diff --git a/testes/bitwise.lua b/testes/bitwise.lua index 59781f5d..9509f7f0 100644 --- a/testes/bitwise.lua +++ b/testes/bitwise.lua @@ -45,6 +45,11 @@ assert(-1 >> numbits == 0 and -1 << numbits == 0 and -1 << -numbits == 0) +assert(1 >> math.mininteger == 0) +assert(1 >> math.maxinteger == 0) +assert(1 << math.mininteger == 0) +assert(1 << math.maxinteger == 0) + assert((2^30 - 1) << 2^30 == 0) assert((2^30 - 1) >> 2^30 == 0)