dibyendumajumdar/ravi

Integer Overflow in ravi_create_slice

XmiliaH opened this issue · 1 comments

There is an integer overflow in ravi_create_slice at:

ravi/src/lapi.c

Line 903 in 56a59a1

if (start < 1 || start + len > orig->len) {
This can result in slices with a length or index that exceeds that of the parent as can be seen in the following sample that segfaults.

local t = table.intarray(3)
local slice = table.slice(t, 2, 0xFFFFFFFE)
slice[0xFFFFFFF] = 1

Thank you for the report