Skip to content

Integer overflow caused by incorrect operation in struct file. #3692

@quart27219

Description

@quart27219

It seems like b_unpack function in app/modules/struct.c has an integer overflow vulnerability.
size_t pos = luaL_optinteger(L, 3, 1) - 1; statement cause integer overflow leading to out-of-bounds access.

It might be triggered with following script: return struct.unpack('f', "xxxxxxxxxxxxx",-3)

please check the PR for this issue.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions