Re: luaO_pushvfstring reads past end of format string on trailing %

On Tue, 11 Aug 2026 at 10:55, 'Sainan' via lua-l <[email protected]> wrote:
> Interesting edge case in theory, but are we sure this isn't a hallucination? Doesn't reproduce for me at all:
> print(string.format("%f%", 100)) -- bad argument #3 to 'format' (no value)
> print(string.format("%f%", 100, 0)) -- invalid conversion '%' to 'format'

I think string.format does not use luaO_pushvfstring, like
push(v)fstring do. Those two are much more restricted on what they
accept.

Reproduction might also be fickle. It seems it copies the %\0 and
increments pointer just past the null, but if you have another null
just after it  will not crash, just do the observed "adding %\0".

Anyway, feeding %\0 is "forbidden" : "Every occurrence of '%' in the
string fmt must form a valid conversion specifier. " and any C
programmer can SEGV with minimum effort, but a case for '\0' may be
useful, specially since the default behaviour is adding unknown
formats .

If I read the source right I think changing the while to

  while (  ((e = strchr(fmt, '%')) != NULL) && *(e+1) ) {

Captures more faitfhfully the intention of "Set e to a format
specification, a two char sequence starting with %" by finding the %
and then insuring it points to an at-least two chars C substring.



Francisco Olarte.

-- 
You received this message because you are subscribed to the Google Groups "lua-l" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/d/msgid/lua-l/CA%2BbJJbxGap6k_s_KpdWL-_o4Nuy7%2BTV9fMm4rPpyORtYawuTUg%40mail.gmail.com.