Skip to content

Integer overflow (leading to stack-based buffer overflow) in embedded lua_struct.c  #3626

@Crispy-fried-chicken

Description

@Crispy-fried-chicken

getnum in app/modules/struct.c potentially has an integer overflow if fmt is set too large. It might be triggered by running such lua statement: EVAL "struct.pack('>I2147483648', '10')" 0 It can be easily avoid by adding a bound check in getnum, and I'd like to open a PR for that if necessary.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions