Scarfski/lua
1
0
Fork 0
mirror of https://github.com/lua/lua.git synced 2026-08-09 22:59:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Bug: shift overflow in utf-8 decode

Browse Source 
An initial byte \xFF will ask for 7 continuation bytes, and then the
shift by (count * 5) will try to shift 35 bits.
This commit is contained in:
Roberto I
2026-07-22 15:07:52 -03:00
parent 8511e90b7d
commit af19891bce
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
lutf8lib.c
View File

@@ -65,6 +65,8 @@ static const char *utf8_decode (const char *s, utfint *val, int strict) {
utfint res = 0; /* final result */
if (c < 0x80) /* ascii? */
res = c;
else if (c >= 0xfe) /* c >= 1111 1110b ? */
return NULL; /* would need six or more continuation bytes */
else {
int count = 0; /* to count number of continuation bytes */
for (; c & 0x40; c <<= 1) { /* while it needs continuation bytes... */
@@ -74,7 +76,7 @@ static const char *utf8_decode (const char *s, utfint *val, int strict) {
res = (res << 6) | (cc & 0x3F); /* add lower 6 bits from cont. byte */
}
res |= ((utfint)(c & 0x7F) << (count * 5)); /* add first byte */
if (count > 5 || res > MAXUTF || res < limits[count])
if (res > MAXUTF || res < limits[count])
return NULL; /* invalid byte sequence */
s += count; /* skip continuation bytes read */
}