dibyendumajumdar/ravi

Integer Overflow in raviH_new_integer_array

XmiliaH opened this issue · 1 comments

XmiliaH commented

There is an integer overflow in raviH_new_integer_array at

ravi/src/ltable.c

Line 893 in 56a59a1

ravi_resize_array(L, t, len + 1, 0);

When the requested array size is 0xFFFFFFFF the array being allocated is of size 0 but the initialization will segfault as can be seen from running table.intarray(0xFFFFFFFF).

The same holds for the raviH_new_number_array function.

dibyendumajumdar commented

Thank you for the report