luaO_pushvfstring reads past end of format string on trailing %

Hi Roberto,
I found a bug in luaO_pushvfstring (lobject.c) where a format string ending in a lone % causes an out-of-bounds read.
The problem

while ((e = strchr(fmt, '%')) != NULL) {
    ...
    switch (*(e + 1)) {   /* reads the byte after '%' */
    ...
    default: {
        addstr2buff(&buff, e, 2);  /* copies 2 bytes: '%' + the NUL terminator */
        break;
    }
    }
    fmt = e + 2;  /* points one byte past the NUL terminator */
}

uding the NUL into the result, embedding a '\0' in the output Lua string.

Repro:

#include <stdio.h>
#include "lua.h"
#include "lualib.h"
#include "lauxlib.h"

int main(void) {
    lua_State *L = luaL_newstate();
    lua_pushfstring(L, "hello %d end%", 42);
    /* result contains embedded NUL: "hello 42 end%\0" with #s == 14 */
    printf("len: %d\n", (int)lua_rawlen(L, -1));  /* prints 14, not 13 */
    lua_close(L);
    return 0;
}

A solution

if (*(e + 1) == '\0') {   /* lone '%' at end of string */
    addstr2buff(&buff, e, 1);  /* emit just the '%' */
    break;                      /* done — no more format to scan */
}

Best Regards
Payo

-- 
You received this message because you are subscribed to the Google Groups "lua-l" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/d/msgid/lua-l/DM3PR84MB346815F0263F6C2C36D01CB4AFDE2%40DM3PR84MB3468.NAMPRD84.PROD.OUTLOOK.COM.