lua-users home
lua-l archive

[Date Prev][Date Next][Thread Prev][Thread Next] [Date Index] [Thread Index]


Carlos wrote:

Well, i do not understand why, but if you modify the putinteger function:

static void putinteger (lua_State *L, luaL_Buffer *b, int arg, int endian, int size)
{
  //unsigned char buff[sizeof(long)];  <--- replace
  unsigned char buff[2*sizeof(long)]; <--- with

there is no more crash.

It's because there was a buffer overflow a few lines below.
Meanwhile (till the official fix), I'm using the following
change:

--- struct.c.orig	Mon Apr 14 14:03:16 2008
+++ struct.c	Mon Apr 14 18:04:22 2008
@@ -108,11 +108,14 @@

 static void putinteger (lua_State *L, luaL_Buffer *b, int arg, int endian,
                         int size) {
-  unsigned char buff[sizeof(long)];
+  unsigned char buff[128];
   lua_Number n = luaL_checknumber(L, arg);
   unsigned long value;
   unsigned char *s;
   int inc, i;
+  if (size > (int)sizeof(buff))
+    luaL_error(L, "size of integer must not be greater than %d bytes",
+      (int)sizeof(buff));
   if (n < 0) {
     value = (unsigned long)(-n);
     value = (~value) + 1;  /* 2's complement */

--
Shmuel