Selaa lähdekoodia

bug: 'io.lines' does not check maximum number of options

Roberto Ierusalimschy 10 vuotta sitten
vanhempi
commit
b5dc2f9b0c
1 muutettua tiedostoa jossa 35 lisäystä ja 0 poistoa
  1. 35 0
      bugs

+ 35 - 0
bugs

@@ -3458,6 +3458,41 @@ patch = [[
 }
 
 
+--[=[
+Bug{
+what = [['io.lines' does not check maximum number of options]],
+report = [[Patrick Donnell, 2015/07/10]],
+since = [[3.0]],
+fix = nil,
+example = [[
+-- can segfault in some machines
+t ={}; for i = 1, 253 do t[i] = 1 end
+io.lines("someexistingfile", table.unpack(t))()
+]],
+patch = [[
+--- liolib.c	2015/07/07 17:03:34	2.146
++++ liolib.c	2015/07/15 14:40:28	2.147
+@@ -318,8 +318,15 @@
+ static int io_readline (lua_State *L);
+ 
+ 
++/*
++** maximum number of arguments to 'f:lines'/'io.lines' (it + 3 must fit
++** in the limit for upvalues of a closure)
++*/
++#define MAXARGLINE	250
++
+ static void aux_lines (lua_State *L, int toclose) {
+   int n = lua_gettop(L) - 1;  /* number of arguments to read */
++  luaL_argcheck(L, n <= MAXARGLINE, MAXARGLINE + 2, "too many arguments");
+   lua_pushinteger(L, n);  /* number of arguments to read */
+   lua_pushboolean(L, toclose);  /* close/not close file when finished */
+   lua_rotate(L, 2, 2);  /* move 'n' and 'toclose' to their positions */
+]]
+}
+]=]
+
+
 --[=[
 Bug{
 what = [[ ]],