Re: Specially crafted binary chunks can cause Lua to crash

[Luiz Henrique de Figueiredo <lhf@...>]

> Depending on a boolean being true or false  [...]

Sure, you're right of course. And we'll probably fix this but my point is
that the program itself is not in too bad a shape, In the example program
at the end of the message, "maybe" is true in boolean expressions, it's
just not equal to either true or false, just like numbers and anything else
except nil. (of course what seems disturbing is that the type of maybe
is boolean.)

> Allowing programmers to do hackish things through bytecode which the
> language itself doesn't allow strikes me as all sorts of a bad thing.

Sure, and we strive for that, despite the recent bugs found in the bytecode
checker. The goal of the bytecode checker is to make sure that you cannot
crash the host by feeding malicious bytecode to Lua. The goal is not (and
indeed cannot be) to make sure that the scripts do sensible things. In the
case in point, I don't think you can crash Lua by having a boolean that is
not equal to true or false. If you can, then that'll be serious.

The program below prints "maybe is true".

maybe = loadstring(string.dump(function() return ({[true]=true})[true] end):gsub('\1\1','\1\2'))()
print(type(maybe))
print(maybe==true, maybe==false)

if maybe then
	print"maybe is true"
else
	print"maybe is false"
end

--lhf