rusefi
/
lua
mirror of https://github.com/rusefi/lua.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

more secure way to compute final string length

This commit is contained in:
Roberto Ierusalimschy 2004-10-28 14:45:51 -03:00
parent 3e1a1f2836
commit cfb79b1751
1 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lvm.c
View File

@ -1,5 +1,5 @@
/* /*
** $Id: lvm.c,v 2.14 2004/09/15 20:39:42 roberto Exp $ ** $Id: lvm.c,v 2.15 2004/10/04 19:01:53 roberto Exp roberto $
** Lua virtual machine ** Lua virtual machine
** See Copyright Notice in lua.h ** See Copyright Notice in lua.h
*/ */
@ -303,15 +303,14 @@ void luaV_concat (lua_State *L, int total, int last) {
luaG_concaterror(L, top-2, top-1); luaG_concaterror(L, top-2, top-1);
} else if (tsvalue(top-1)->len > 0) { /* if len=0, do nothing */ } else if (tsvalue(top-1)->len > 0) { /* if len=0, do nothing */
/* at least two string values; get as many as possible */ /* at least two string values; get as many as possible */
lu_mem tl = cast(lu_mem, tsvalue(top-1)->len) + size_t tl = tsvalue(top-1)->len;
cast(lu_mem, tsvalue(top-2)->len);
char *buffer; char *buffer;
int i; int i;
while (n < total && tostring(L, top-n-1)) { /* collect total length */ /* collect total length */
for (n = 1; n < total && tostring(L, top-n-1); n++) {
size_t l = tsvalue(top-n-1)->len; size_t l = tsvalue(top-n-1)->len;
if (l >= MAX_SIZET - tl) luaG_runerror(L, "string length overflow"); if (l >= MAX_SIZET - tl) luaG_runerror(L, "string length overflow");
tl += l; tl += l;
n++;
} }
buffer = luaZ_openspace(L, &G(L)->buff, tl); buffer = luaZ_openspace(L, &G(L)->buff, tl);
tl = 0; tl = 0;