[Date Prev][Date Next][Thread Prev][Thread Next]
[Date Index]
[Thread Index]
- Subject: Re: writing to binary files
 
- From: Shmuel Zeigerman <shmuz@...>
 
- Date: Mon, 14 Apr 2008 18:17:48 +0300
 
Carlos wrote:
Well, i do not understand why, but if you modify the putinteger function:
static void putinteger (lua_State *L, luaL_Buffer *b, int arg, int endian, 
int size)
{
  //unsigned char buff[sizeof(long)];  <--- replace
  unsigned char buff[2*sizeof(long)]; <--- with
there is no more crash.
It's because there was a buffer overflow a few lines below.
Meanwhile (till the official fix), I'm using the following
change:
--- struct.c.orig	Mon Apr 14 14:03:16 2008
+++ struct.c	Mon Apr 14 18:04:22 2008
@@ -108,11 +108,14 @@
 static void putinteger (lua_State *L, luaL_Buffer *b, int arg, int endian,
                         int size) {
-  unsigned char buff[sizeof(long)];
+  unsigned char buff[128];
   lua_Number n = luaL_checknumber(L, arg);
   unsigned long value;
   unsigned char *s;
   int inc, i;
+  if (size > (int)sizeof(buff))
+    luaL_error(L, "size of integer must not be greater than %d bytes",
+      (int)sizeof(buff));
   if (n < 0) {
     value = (unsigned long)(-n);
     value = (~value) + 1;  /* 2's complement */
--
Shmuel