Skip to content
Browse files

Applied fixes to the following lua bugs:

 * 5.1.3#3
 * 5.1.3#4
 * 5.1.2#10
 * 5.1.2#11

See http://www.lua.org/bugs.html


git-svn-id: http://infon.googlecode.com/svn/trunk@263 8171fb75-e542-0410-96e4-03d5dd800671
  • Loading branch information...
1 parent 43fe2ef commit db26dfc233b2952b9187768c6bea0dc37e33f2a4 @dividuum committed
Showing with 11 additions and 9 deletions.
  1. +4 −5 lua-5.1.2/src/lapi.c
  2. +5 −3 lua-5.1.2/src/lbaselib.c
  3. +2 −1 lua-5.1.2/src/ltablib.c
View
9 lua-5.1.2/src/lapi.c
@@ -93,15 +93,14 @@ void luaA_pushobject (lua_State *L, const TValue *o) {
LUA_API int lua_checkstack (lua_State *L, int size) {
- int res;
+ int res = 1;
lua_lock(L);
- if ((L->top - L->base + size) > LUAI_MAXCSTACK)
+ if (size > LUAI_MAXCSTACK || (L->top - L->base + size) > LUAI_MAXCSTACK)
res = 0; /* stack overflow */
- else {
+ else if (size > 0) {
luaD_checkstack(L, size);
if (L->ci->top < L->top + size)
L->ci->top = L->top + size;
- res = 1;
}
lua_unlock(L);
return res;
@@ -782,7 +781,7 @@ LUA_API int lua_setfenv (lua_State *L, int idx) {
res = 0;
break;
}
- luaC_objbarrier(L, gcvalue(o), hvalue(L->top - 1));
+ if (res) luaC_objbarrier(L, gcvalue(o), hvalue(L->top - 1));
L->top--;
lua_unlock(L);
return res;
View
8 lua-5.1.2/src/lbaselib.c
@@ -350,10 +350,12 @@ static int luaB_unpack (lua_State *L) {
luaL_checktype(L, 1, LUA_TTABLE);
i = luaL_optint(L, 2, 1);
e = luaL_opt(L, luaL_checkint, 3, luaL_getn(L, 1));
+ if (i > e) return 0; /* empty range */
n = e - i + 1; /* number of elements */
- if (n <= 0) return 0; /* empty range */
- luaL_checkstack(L, n, "table too big to unpack");
- for (; i<=e; i++) /* push arg[i...e] */
+ if (n <= 0 || !lua_checkstack(L, n)) /* n <= 0 means arith. overflow */
+ return luaL_error(L, "too many results to unpack");
+ lua_rawgeti(L, 1, i); /* push arg[i] (avoiding overflow problems) */
+ while (i++ < e) /* push arg[i + 1...e] */
lua_rawgeti(L, 1, i);
return n;
}
View
3 lua-5.1.2/src/ltablib.c
@@ -128,7 +128,8 @@ static int tinsert (lua_State *L) {
static int tremove (lua_State *L) {
int e = aux_getn(L, 1);
int pos = luaL_optint(L, 2, e);
- if (e == 0) return 0; /* table is `empty' */
+ if (!(1 <= pos && pos <= e)) /* position is outside bounds? */
+ return 0; /* nothing to remove */
luaL_setn(L, 1, e - 1); /* t.n = n-1 */
lua_rawgeti(L, 1, pos); /* result = t[pos] */
for ( ;pos<e; pos++) {

0 comments on commit db26dfc

Please sign in to comment.
Something went wrong with that request. Please try again.