浏览代码

Bug: Negation in 'luaV_shiftr' may overflow

Negation of an unchecked lua_Integer overflows with mininteger.
Roberto Ierusalimschy 4 年之前
父节点
当前提交
62fb934427
共有 2 个文件被更改,包括 6 次插入1 次删除
  1. 1 1
      lvm.c
  2. 5 0
      testes/bitwise.lua

+ 1 - 1
lvm.c

@@ -766,7 +766,7 @@ lua_Number luaV_modf (lua_State *L, lua_Number m, lua_Number n) {
 /*
 ** Shift left operation. (Shift right just negates 'y'.)
 */
-#define luaV_shiftr(x,y)	luaV_shiftl(x,-(y))
+#define luaV_shiftr(x,y)	luaV_shiftl(x,intop(-, 0, y))
 
 lua_Integer luaV_shiftl (lua_Integer x, lua_Integer y) {
   if (y < 0) {  /* shift right? */

+ 5 - 0
testes/bitwise.lua

@@ -45,6 +45,11 @@ assert(-1 >> numbits == 0 and
        -1 << numbits == 0 and
        -1 << -numbits == 0)
 
+assert(1 >> math.mininteger == 0)
+assert(1 >> math.maxinteger == 0)
+assert(1 << math.mininteger == 0)
+assert(1 << math.maxinteger == 0)
+
 assert((2^30 - 1) << 2^30 == 0)
 assert((2^30 - 1) >> 2^30 == 0)