Bug: Constructors with nils can overflow counters

This commit is contained in:
Roberto Ierusalimschy
2025-08-27 14:58:02 -03:00
parent 9ac9d23f41
commit 934fdd481c

View File

@@ -940,6 +940,8 @@ static void constructor (LexState *ls, expdesc *t) {
if (ls->t.token == '}') break;
closelistfield(fs, &cc);
field(ls, &cc);
checklimit(fs, cc.tostore + cc.na + cc.nh, INT_MAX/2,
"items in a constructor");
} while (testnext(ls, ',') || testnext(ls, ';'));
check_match(ls, '}', '{', line);
lastlistfield(fs, &cc);