search

dibyendumajumdar / ravi

Ravi is a dialect of Lua, featuring limited optional static typing, JIT and AOT compilers
http://ravilang.github.io/
Other
1.16k stars 60 forks source link

Integer Overflow in ravi_create_slice #207

Open XmiliaH opened 3 years ago

XmiliaH commented 3 years ago

There is an integer overflow in ravi_create_slice at: https://github.com/dibyendumajumdar/ravi/blob/56a59a1f3117a8bc88206305b94398678de1bdff/src/lapi.c#L903 This can result in slices with a length or index that exceeds that of the parent as can be seen in the following sample that segfaults.

local t = table.intarray(3)
local slice = table.slice(t, 2, 0xFFFFFFFE)
slice[0xFFFFFFF] = 1
dibyendumajumdar commented 3 years ago

Thank you for the report