lua: fix integer overflow in LNUM patch

Safely detect integer overflow in try_addint() and try_subint().
Old code relied on undefined behavior, and recent versions of GCC on x86
optimized away the if-statements.
This caused integer overflow in Lua code instead of falling back to
floating-point numbers.

Signed-off-by: Adam Bailey <aebailey@gmail.com>
(cherry picked from commit 3a2e7c30d3e6a187ba1df740cdb24c8ad84dfe48)

diff --git a/package/utils/lua/patches-host/010-lua-5.1.3-lnum-full-260308.patch b/package/utils/lua/patches-host/010-lua-5.1.3-lnum-full-260308.patch
index 4530edd18126db89c70b910716ec3635ad268267..fd398c28d1188c36fb1040dd1013d1f0ad68f12c 100644 (file)
--- a/package/utils/lua/patches-host/010-lua-5.1.3-lnum-full-260308.patch
+++ b/package/utils/lua/patches-host/010-lua-5.1.3-lnum-full-260308.patch
@@ -1600,18 +1600,18 @@
 + * (and doing them).
 + */
 +int try_addint( lua_Integer *r, lua_Integer ib, lua_Integer ic ) {
-+  lua_Integer v= ib+ic; /* may overflow */
-+  if (ib>0 && ic>0)      { if (v < 0) return 0; /*overflow, use floats*/ }
-+  else if (ib<0 && ic<0) { if (v >= 0) return 0; }
-+  *r= v;
++  /* Signed int overflow is undefined behavior, so catch it without causing it. */
++  if (ic>0)  { if (ib > LUA_INTEGER_MAX - ic) return 0; /*overflow, use floats*/ }
++  else       { if (ib < LUA_INTEGER_MIN - ic) return 0; }
++  *r = ib + ic;
 +  return 1;
 +}
 +
 +int try_subint( lua_Integer *r, lua_Integer ib, lua_Integer ic ) {
-+  lua_Integer v= ib-ic; /* may overflow */
-+  if (ib>=0 && ic<0)     { if (v < 0) return 0; /*overflow, use floats*/ }
-+  else if (ib<0 && ic>0) { if (v >= 0) return 0; }
-+  *r= v;
++  /* Signed int overflow is undefined behavior, so catch it without causing it. */
++  if (ic>0)  { if (ib < LUA_INTEGER_MIN + ic) return 0; /*overflow, use floats*/ }
++  else       { if (ib > LUA_INTEGER_MAX + ic) return 0; }
++  *r = ib - ic;
 +  return 1;
 +}
 +

diff --git a/package/utils/lua/patches/010-lua-5.1.3-lnum-full-260308.patch b/package/utils/lua/patches/010-lua-5.1.3-lnum-full-260308.patch
index ac0722c7073265ebd38a7bc029890747b16c63a3..58cc894e1c8ee8e2270745b84baf8b2300bb9151 100644 (file)
--- a/package/utils/lua/patches/010-lua-5.1.3-lnum-full-260308.patch
+++ b/package/utils/lua/patches/010-lua-5.1.3-lnum-full-260308.patch
@@ -1589,18 +1589,18 @@
 + * (and doing them).
 + */
 +int try_addint( lua_Integer *r, lua_Integer ib, lua_Integer ic ) {
-+  lua_Integer v= ib+ic; /* may overflow */
-+  if (ib>0 && ic>0)      { if (v < 0) return 0; /*overflow, use floats*/ }
-+  else if (ib<0 && ic<0) { if (v >= 0) return 0; }
-+  *r= v;
++  /* Signed int overflow is undefined behavior, so catch it without causing it. */
++  if (ic>0)  { if (ib > LUA_INTEGER_MAX - ic) return 0; /*overflow, use floats*/ }
++  else       { if (ib < LUA_INTEGER_MIN - ic) return 0; }
++  *r = ib + ic;
 +  return 1;
 +}
 +
 +int try_subint( lua_Integer *r, lua_Integer ib, lua_Integer ic ) {
-+  lua_Integer v= ib-ic; /* may overflow */
-+  if (ib>=0 && ic<0)     { if (v < 0) return 0; /*overflow, use floats*/ }
-+  else if (ib<0 && ic>0) { if (v >= 0) return 0; }
-+  *r= v;
++  /* Signed int overflow is undefined behavior, so catch it without causing it. */
++  if (ic>0)  { if (ib < LUA_INTEGER_MIN + ic) return 0; /*overflow, use floats*/ }
++  else       { if (ib > LUA_INTEGER_MAX + ic) return 0; }
++  *r = ib - ic;
 +  return 1;
 +}
 +