diff --git a/ltablib.c b/ltablib.c index 53fdec80..5bf2806d 100644 --- a/ltablib.c +++ b/ltablib.c @@ -1,5 +1,5 @@ /* -** $Id: ltablib.c,v 1.78 2014/10/25 11:50:46 roberto Exp roberto $ +** $Id: ltablib.c,v 1.79 2014/11/02 19:19:04 roberto Exp roberto $ ** Library for Table Manipulation ** See Copyright Notice in lua.h */ @@ -124,8 +124,6 @@ static int tmove (lua_State *L) { lua_Integer e = luaL_checkinteger(L, 3); lua_Integer t = luaL_checkinteger(L, 4); int tt = !lua_isnoneornil(L, 5) ? 5 : 1; /* destination table */ - /* the following restriction avoids several problems with overflows */ - luaL_argcheck(L, f > 0, 2, "initial position must be positive"); if (e >= f) { /* otherwise, nothing to move */ lua_Integer n, i; ta.geti = (luaL_getmetafield(L, 1, "__index") == LUA_TNIL) @@ -134,7 +132,11 @@ static int tmove (lua_State *L) { ta.seti = (luaL_getmetafield(L, tt, "__newindex") == LUA_TNIL) ? (luaL_checktype(L, tt, LUA_TTABLE), lua_rawseti) : lua_seti; + luaL_argcheck(L, f > 0 || e < LUA_MAXINTEGER + f, 3, + "too many elements to move"); n = e - f + 1; /* number of elements to move */ + luaL_argcheck(L, t <= LUA_MAXINTEGER - n + 1, 4, + "destination wrap around"); if (t > f) { for (i = n - 1; i >= 0; i--) { (*ta.geti)(L, 1, f + i);