[Date Prev][Date Next][Thread Prev][Thread Next]
[Date Index]
[Thread Index]
- Subject: Why does LoadString return NULL for zero-length strings?
- From: "Peter Cawley" <lua@...>
- Date: Mon, 1 Sep 2008 15:15:19 +0100
LoadString from lundump.c in Lua 5.1.4 is defined as:
static TString* LoadString(LoadState* S)
{
size_t size;
LoadVar(S,size);
if (size==0)
return NULL;
else
{
char* s=luaZ_openspace(S->L,S->b,size);
LoadBlock(S,s,size);
return luaS_newlstr(S->L,s,size-1); /* remove trailing '\0' */
}
}
Obviously, the only time there should be a string constant in a binary
chunk of length 0 is when someone is being malicious, as the constant
should include the trailing \0 and therefore be at least length 1. I
believe that the if statement in the above code should be:
IF (size==0, "bad string");
As it stands, putting a zero length string constant into a binary
chunk causes a segfault: (http://codepad.org/N9ecIeIB)
loadstring(('').dump(function()X''end):gsub('\2%z%z%zX','\0\0\0'))()