Randomness added to table length computation

A bad actor could fill only a few entries in a table (power of twos in
decreasing order, see tests) and produce a small table with a huge
length. If your program builds a table with external data and iterates
over its length, this behavior could be an issue.
This commit is contained in:
Roberto Ierusalimschy
2025-07-18 16:18:30 -03:00
parent ccb8b307f1
commit 303f415559
6 changed files with 48 additions and 23 deletions

View File

@@ -345,6 +345,18 @@ do
end
end
do print("testing attack on table length")
local t = {}
local lim = math.floor(math.log(math.maxinteger, 2)) - 1
for i = lim, 0, -1 do
t[2^i] = true
end
assert(t[1 << lim])
-- next loop should not take forever
for i = 1, #t do end
end
local nofind = {}