bug: lua_checkstack may have arithmetic overflow for large 'size'

This commit is contained in:
Roberto Ierusalimschy 2008-02-14 14:02:58 -02:00
parent f86f4116c8
commit 6d182faab6
1 changed files with 4 additions and 5 deletions

9
lapi.c
View File

@ -1,5 +1,5 @@
/*
** $Id: lapi.c,v 2.63 2008/01/25 13:42:12 roberto Exp roberto $
** $Id: lapi.c,v 2.64 2008/02/12 13:34:12 roberto Exp roberto $
** Lua API
** See Copyright Notice in lua.h
*/
@ -84,15 +84,14 @@ static Table *getcurrenv (lua_State *L) {
LUA_API int lua_checkstack (lua_State *L, int size) {
int res;
int res = 1;
lua_lock(L);
if ((L->top - L->base + size) > LUAI_MAXCSTACK)
if (size > LUAI_MAXCSTACK || (L->top - L->base + size) > LUAI_MAXCSTACK)
res = 0; /* stack overflow */
else {
else if (size > 0) {
luaD_checkstack(L, size);
if (L->ci->top < L->top + size)
L->ci->top = L->top + size;
res = 1;
}
lua_unlock(L);
return res;