lua-users home
lua-l archive

[Date Prev][Date Next][Thread Prev][Thread Next] [Date Index] [Thread Index]


LoadString from lundump.c in Lua 5.1.4 is defined as:
static TString* LoadString(LoadState* S)
{
 size_t size;
 LoadVar(S,size);
 if (size==0)
  return NULL;
 else
 {
  char* s=luaZ_openspace(S->L,S->b,size);
  LoadBlock(S,s,size);
  return luaS_newlstr(S->L,s,size-1);		/* remove trailing '\0' */
 }
}

Obviously, the only time there should be a string constant in a binary
chunk of length 0 is when someone is being malicious, as the constant
should include the trailing \0 and therefore be at least length 1. I
believe that the if statement in the above code should be:
IF (size==0, "bad string");

As it stands, putting a zero length string constant into a binary
chunk causes a segfault: (http://codepad.org/N9ecIeIB)
loadstring(('').dump(function()X''end):gsub('\2%z%z%zX','\0\0\0'))()