Check that there is space in local variable array

Browse Source 
Otherwise it can overflow due to for loop's hidden
variables.

Fix #561
This commit is contained in:
Aleksi Salmela 2018-06-13 00:31:28 +03:00
parent 40c927f440
commit e7b1bade1a
2 changed files with 188 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/vm/wren_compiler.c
View File

@ -2906,6 +2906,16 @@ static void forStatement(Compiler* compiler)
// The space in the variable name ensures it won't collide with a user-defined
// variable.
expression(compiler);
// Verify that there is space to hidden local variables.
// Note that we expect only two addLocal calls next to each other in the
// following code.
if (compiler->numLocals + 2 > MAX_LOCALS)
{
error(compiler, "Cannot declare more than %d variables in one scope. (Not enough space for for-loops internal variables)",
MAX_LOCALS);
return;
}
int seqSlot = addLocal(compiler, "seq ", 4);
// Create another hidden local for the iterator object.

178
test/regression/561.wren Normal file
View File

@ -0,0 +1,178 @@
// This test caused an array oveflow in local variable array due to hidden
// variables of for loop
// expect error line 91
var z = []
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
for (x in z) {
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}