Re: [ANN] lbcv 0.2 - A bytecode verifier for Lua 5.2

[Mike Pall <mikelu-1012@...>]

Peter Cawley wrote:
> From my experience of trying to abuse Lua bytecode, I've decided to
> attack the other side of the problem, and attempt to write a module
> which verifies Lua 5.2 bytecode as non-malicious.

I tried it on a few moderately complex Lua files and the result is
a bit depressing ...

Ok, so loading (unverified) bytecode is substantially faster than
parsing Lua source code (around 6x). But the verifier seriously
slows things down: verifying + loading bytecode is only about 20%
faster than parsing Lua source code.

[For comparison: the LuaJIT parser is about 50% faster than the
Lua parser for the same Lua source code.]

<blasphemy>
Maybe Java and Flash should have used faster parsers rather than
trying to fix their bytecode verifiers for the last 15 years? ;-)
</blasphemy>

--Mike