Skip to content

Commit 925e4c9

Browse files
committed
Fix signed integer overflow
A cast of the unsigned value 2^32-1 to `int` has implementation defined behavior, see n1256, 6.3.1.3.3). Sketch: ``` lua_pop(L, <uint32_t> 0) --(macro expansion)-- lua_settop(L, (int)<uint32_t> -0-1) --(constant folding)-- lua_settop(L, (int)<uint32_t> 2^32-1) --(UB cast to int)-- lua_settop(L, <int>implementation defined value, usually -1) ``` See all the details in tarantool/tarantool#8453
1 parent 7494b96 commit 925e4c9

File tree

2 files changed

+12
-2
lines changed

2 files changed

+12
-2
lines changed

src/merger/merger.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -312,6 +312,7 @@ luaT_merger_new_parse_sources(struct lua_State *L, int idx,
312312
}
313313

314314
/* Save all sources. */
315+
int top = lua_gettop(L);
315316
for (uint32_t i = 0; i < source_count; ++i) {
316317
lua_pushinteger(L, i + 1);
317318
lua_gettable(L, idx);
@@ -325,7 +326,7 @@ luaT_merger_new_parse_sources(struct lua_State *L, int idx,
325326
}
326327
sources[i] = source;
327328
}
328-
lua_pop(L, source_count);
329+
lua_settop(L, top);
329330

330331
*source_count_ptr = source_count;
331332
return sources;

test/merger-test.lua

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -530,7 +530,7 @@ end
530530

531531
local test = tap.test('merger')
532532
test:plan(#bad_source_new_calls + #bad_chunks + #bad_merger_new_calls +
533-
#bad_merger_select_calls + 7 + #schemas * 48)
533+
#bad_merger_select_calls + 8 + #schemas * 48)
534534

535535
-- For collations.
536536
box.cfg{}
@@ -757,4 +757,13 @@ test:test('no _G.tuple', function(test)
757757
test:ok(rawget(_G, 'tuple') == nil, '_G.tuple is nil')
758758
end)
759759

760+
-- merger.new(kd, {}) -- pass zero amount of sources.
761+
test:test('no sources', function(test)
762+
test:plan(1)
763+
764+
local m = merger.new(key_def, {})
765+
local res = m:select()
766+
test:is_deeply(res, {})
767+
end)
768+
760769
os.exit(test:check() and 0 or 1)

0 commit comments

Comments
 (0)