Skip to content

Commit 41114a2

Browse files
yegappanbrammool
authored andcommitted
patch 8.2.3244: Lua 5.3 print() with a long string crashes
Problem: Lua 5.3 print() with a long string crashes. Solution: Use a growarray instead of a Lua buffer. (Yegappan Lakshmanan, closes #8655)
1 parent 83cd015 commit 41114a2

4 files changed

Lines changed: 34 additions & 8 deletions

File tree

src/if_lua.c

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1720,11 +1720,12 @@ static const luaL_Reg luaV_Window_mt[] = {
17201720
static int
17211721
luaV_print(lua_State *L)
17221722
{
1723-
int i, n = lua_gettop(L); // nargs
1724-
const char *s;
1725-
size_t l;
1726-
luaL_Buffer b;
1727-
luaL_buffinit(L, &b);
1723+
int i, n = lua_gettop(L); // nargs
1724+
const char *s;
1725+
size_t l;
1726+
garray_T msg_ga;
1727+
1728+
ga_init2(&msg_ga, 1, 128);
17281729
lua_getglobal(L, "tostring");
17291730
for (i = 1; i <= n; i++)
17301731
{
@@ -1735,13 +1736,19 @@ luaV_print(lua_State *L)
17351736
if (s == NULL)
17361737
return luaL_error(L, "cannot convert to string");
17371738
if (i > 1)
1738-
luaL_addchar(&b, ' '); // use space instead of tab
1739-
luaV_addlstring(&b, s, l, 0);
1739+
ga_append(&msg_ga, ' '); // use space instead of tab
1740+
ga_concat_len(&msg_ga, (char_u *)s, l);
17401741
lua_pop(L, 1);
17411742
}
1742-
luaL_pushresult(&b);
1743+
// Replace any "\n" with "\0"
1744+
for (i = 0; i < msg_ga.ga_len; i++)
1745+
if (((char *)msg_ga.ga_data)[i] == '\n')
1746+
((char *)msg_ga.ga_data)[i] = '\0';
1747+
lua_pushlstring(L, msg_ga.ga_data, msg_ga.ga_len);
17431748
if (!got_int)
17441749
luaV_msg(L);
1750+
1751+
ga_clear(&msg_ga);
17451752
return 0;
17461753
}
17471754

src/misc2.c

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1565,6 +1565,22 @@ ga_concat(garray_T *gap, char_u *s)
15651565
}
15661566
}
15671567

1568+
/*
1569+
* Concatenate 'len' bytes from string 's' to a growarray.
1570+
* When "s" is NULL does not do anything.
1571+
*/
1572+
void
1573+
ga_concat_len(garray_T *gap, char_u *s, size_t len)
1574+
{
1575+
if (s == NULL || *s == NUL)
1576+
return;
1577+
if (ga_grow(gap, len) == OK)
1578+
{
1579+
mch_memmove((char *)gap->ga_data + gap->ga_len, s, (size_t)len);
1580+
gap->ga_len += len;
1581+
}
1582+
}
1583+
15681584
/*
15691585
* Append one byte to a growarray which contains bytes.
15701586
*/

src/proto/misc2.pro

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ int ga_grow_inner(garray_T *gap, int n);
4545
char_u *ga_concat_strings(garray_T *gap, char *sep);
4646
int ga_add_string(garray_T *gap, char_u *p);
4747
void ga_concat(garray_T *gap, char_u *s);
48+
void ga_concat_len(garray_T *gap, char_u *s, size_t len);
4849
void ga_append(garray_T *gap, int c);
4950
void append_ga_line(garray_T *gap);
5051
int simplify_key(int key, int *modifiers);

src/version.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -755,6 +755,8 @@ static char *(features[]) =
755755

756756
static int included_patches[] =
757757
{ /* Add new patch number below this line */
758+
/**/
759+
3244,
758760
/**/
759761
3243,
760762
/**/

0 commit comments

Comments
 (0)