retoor/wren
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: guard against local variable array overflow from for-loop hidden variables

Browse Source 
Add a bounds check in `forStatement` to ensure there is space for the two hidden local variables (sequence slot and iterator) before calling `addLocal`. Without this check, deeply nested for-loops could overflow the `locals` array, causing a buffer overrun. The fix emits a clear compiler error when `numLocals + 2` exceeds `MAX_LOCALS`, and includes a regression test with 85 nested for-loops that previously triggered the overflow.
This commit is contained in:
Aleksi Salmela
2018-06-12 21:31:28 +00:00
parent 52d65d48df
commit 5268170c89
2 changed files with 188 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/regression/561.wren
+178
View File
@@ -0,0 +1,178 @@
// This test caused an array oveflow in local variable array due to hidden
// variables of for loop
// expect error line 91
var z = []
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}