search

dibyendumajumdar / ravi

Ravi is a dialect of Lua, featuring limited optional static typing, JIT and AOT compilers
http://ravilang.github.io/
Other
1.16k stars 60 forks source link

Integer Overflow in raviH_new_integer_array #208

Open XmiliaH opened 3 years ago

XmiliaH commented 3 years ago

There is an integer overflow in raviH_new_integer_array at https://github.com/dibyendumajumdar/ravi/blob/56a59a1f3117a8bc88206305b94398678de1bdff/src/ltable.c#L893 When the requested array size is 0xFFFFFFFF the array being allocated is of size 0 but the initialization will segfault as can be seen from running table.intarray(0xFFFFFFFF).

The same holds for the raviH_new_number_array function.

dibyendumajumdar commented 3 years ago

Thank you for the report