ilusha/lua
1
0
Fork 0
mirror of https://github.com/lua/lua synced 2026-09-27 00:28:25 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

BUG: shift overflow in utf-8 decode

Browse source 
An initial byte \xFF will ask for 7 continuation bytes, and then the
shift by (count * 5) will try to shift 35 bits.
This commit is contained in:
Roberto I 2026-02-18 13:24:04 -03:00
parent 7c40c5edb2
commit 10eb89d114
3 changed files with 18 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
lutf8lib.c
View file

@ -56,6 +56,8 @@ static const char *utf8_decode (const char *s, l_uint32 *val, int strict) {
l_uint32 res = 0; /* final result */
if (c < 0x80) /* ASCII? */
res = c;
else if (c >= 0xfe) /* c >= 1111 1110b ? */
return NULL; /* would need six or more continuation bytes */
else {
int count = 0; /* to count number of continuation bytes */
for (; c & 0x40; c <<= 1) { /* while it needs continuation bytes... */
@ -64,8 +66,9 @@ static const char *utf8_decode (const char *s, l_uint32 *val, int strict) {
return NULL; /* invalid byte sequence */
res = (res << 6) | (cc & 0x3F); /* add lower 6 bits from cont. byte */
}
lua_assert(count <= 5);
res |= ((l_uint32)(c & 0x7F) << (count * 5)); /* add first byte */
if (count > 5 || res > MAXUTF || res < limits[count])
if (res > MAXUTF || res < limits[count])
return NULL; /* invalid byte sequence */
s += count; /* skip continuation bytes read */
}