Re: unpack segfault

["Patrick Donnelly" <batrick.donnelly@...>]

Anyway, this has got to be the coolest bug I've ever seen. Here is a
patch that I think squashes it for good:

--- lbaselib.c.old      2008-02-12 17:06:51.000000000 -0700
+++ lbaselib.c  2008-02-12 22:03:28.000000000 -0700
@@ -344,10 +344,18 @@
   luaL_checktype(L, 1, LUA_TTABLE);
   i = luaL_optint(L, 2, 1);
   e = luaL_opt(L, luaL_checkint, 3, luaL_getn(L, 1));
+  if (i == e) {
+    lua_rawgeti(L, 1, i);
+    return 1;
+  } else if (i > e) {
+    return 0; /* empty range */
+  }
   n = e - i + 1;  /* number of elements */
-  if (n <= 0) return 0;  /* empty range */
+  if (e - n > i) /* overflow */
+    luaL_error(L, "table too big to unpack");
   luaL_checkstack(L, n, "table too big to unpack");
-  for (; i<=e; i++)  /* push arg[i...e] */
+  lua_rawgeti(L, 1, i);
+  for (; (i++)<e;)  /* push arg[i...e] */
     lua_rawgeti(L, 1, i);
   return n;
 }



-- 
-Patrick Donnelly

"One of the lessons of history is that nothing is often a good thing
to do and always a clever thing to say."

-Will Durant