lua-users home
lua-l archive

[Date Prev][Date Next][Thread Prev][Thread Next] [Date Index] [Thread Index]

On 13/12/2018 00.08, Daurnimator wrote:> I have had this sitting in my drafts for over a year, I think this is
the same bug?:

The overflow is in
Generate test file:

local f = assert("bug.lua", "w"))
local step = 1<<20
local eq = string.rep("=", step)
for i=1, 2<<31, step do

_Maybe_, although long comments didn't cause problems in my tests (as in
it properly skipped the comment and ASAN didn't complain.)  And I think
it's the computation in read_long_string just below where it goes

seminfo->ts = luaX_newstring(ls, luaZ_buffer(ls->buff) + (2 + sep),
                                 luaZ_bufflen(ls->buff) - 2*(2 + sep));

because it's only ++'ing in skip_sep and 0x3ffffffe still fits (tho
yours doesn't).