Re: luaO_pushvfstring reads past end of format string on trailing %

ASan also reproduces and confirms this issue (and apologies for any
formatting issues):

└> clang -fsanitize=address -g -fno-omit-frame-pointer -I. -O2 test.c
liblua.a -lm

└> ./a.out
=================================================================
==11287==ERROR: AddressSanitizer: global-buffer-overflow on address
0xb0e37d0fe3ee at pc 0xb0e37cfa9514 bp 0xffffcdc30ba0 sp 0xffffcdc30390
READ of size 1 at 0xb0e37d0fe3ee thread T0
     #0 0xb0e37cfa9510 in strchr (lua/a.out+0x59510) (BuildId:
f0de703ce44ff651f9cc906f255d8322f8543c58)
     #1 0xb0e37d09f638 in luaO_pushvfstring lua/lobject.c:600:15
     #2 0xb0e37d07cf04 in lua_pushfstring lua/lapi.c:602:3
     #3 0xb0e37d078010 in main lua/test.c:8:5
     #4 0xf7c3f9e02f18 in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:59:16
     #5 0xf7c3f9e03058 in __libc_start_main csu/../csu/libc-start.c:360:3
     #6 0xb0e37cf8d0ec in _start (lua/a.out+0x3d0ec) (BuildId:
f0de703ce44ff651f9cc906f255d8322f8543c58)

0xb0e37d0fe3ee is located 18 bytes before global variable '.str.1'
defined in 'lua/test.c:10' (0xb0e37d0fe400) of size 9
   '.str.1' is ascii string 'len: %d
'
0xb0e37d0fe3ee is located 0 bytes after global variable '.str' defined
in 'lua/test.c:8' (0xb0e37d0fe3e0) of size 14
   '.str' is ascii string 'hello %d end%'
SUMMARY: AddressSanitizer: global-buffer-overflow (lua/a.out+0x59510)
(BuildId: f0de703ce44ff651f9cc906f255d8322f8543c58) in strchr


On 8/10/2026 7:15 PM, Payo Nel wrote:
> Repro:
>
> #include <stdio.h>
> #include "lua.h"
> #include "lualib.h"
> #include "lauxlib.h"
>
> int main(void) {
>      lua_State *L = luaL_newstate();
>      lua_pushfstring(L, "hello %d end%", 42);
>      /* result contains embedded NUL: "hello 42 end%\0" with #s == 14 */
>      printf("len: %d\n", (int)lua_rawlen(L, -1));  /* prints 14, not 13 */
>      lua_close(L);
>      return 0;
> }

-- 
You received this message because you are subscribed to the Google Groups "lua-l" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/d/msgid/lua-l/CALhS-%2BEGvO%2BSyQAtus1U3nhmCa167kGeRQGbvVFtv98xr6fGmg%40mail.gmail.com.