Bug: Constructors with nils can overflow counters

2026-06-08 15:34:49 +00:00 · 2025-08-27 14:58:02 -03:00
parent 9ac9d23f41
commit 934fdd481c
1 changed files with 2 additions and 0 deletions
@@ -940,6 +940,8 @@ static void constructor (LexState *ls, expdesc *t) {
    if (ls->t.token == '}') break;
    closelistfield(fs, &cc);
    field(ls, &cc);
+    checklimit(fs, cc.tostore + cc.na + cc.nh, INT_MAX/2,
+               "items in a constructor");
  } while (testnext(ls, ',') || testnext(ls, ';'));
  check_match(ls, '}', '{', line);
  lastlistfield(fs, &cc);