0012-fix-loop-parser.patch 815 B

12345678910111213141516171819202122232425262728293031
  1. Expression list with four or more expressions in a 'for' loop can crash the interpreter.
  2. Fetch from: https://www.lua.org/bugs.html#5.3.3-1
  3. Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
  4. --- a/src/lparser.c
  5. +++ b/src/lparser.c
  6. @@ -323,6 +323,8 @@
  7. luaK_nil(fs, reg, extra);
  8. }
  9. }
  10. + if (nexps > nvars)
  11. + ls->fs->freereg -= nexps - nvars; /* remove extra values */
  12. }
  13. @@ -1160,11 +1162,8 @@
  14. int nexps;
  15. checknext(ls, '=');
  16. nexps = explist(ls, &e);
  17. - if (nexps != nvars) {
  18. + if (nexps != nvars)
  19. adjust_assign(ls, nvars, nexps, &e);
  20. - if (nexps > nvars)
  21. - ls->fs->freereg -= nexps - nvars; /* remove extra values */
  22. - }
  23. else {
  24. luaK_setoneret(ls->fs, &e); /* close last expression */
  25. luaK_storevar(ls->fs, &lh->v, &e);
  26. --