Bug in error message for table.concat

classic Classic list List threaded Threaded
5 messages Options
Reply | Threaded
Open this post in threaded view
|

Bug in error message for table.concat

Andrew Gierth
The addfield() subroutine of table.concat is (in 5.3.x and 5.4.x):

static void addfield (lua_State *L, luaL_Buffer *b, lua_Integer i) {
  lua_geti(L, 1, i);
  if (!lua_isstring(L, -1))
    luaL_error(L, "invalid value (%s) at index %d in table for 'concat'",
                  luaL_typename(L, -1), i);
  luaL_addvalue(b);
}

But this error message is wrong, because %d expects an "int" value, not
a lua_Integer.

This shows up most clearly on 32-bit ARM (which is what the IRC user who
reported it was using); under the rules for that platform, a 64-bit int
as the 4th arg after 3 pointers ends up on the stack, because register
alignment rules prevent it going into r3; but pushvfstring is looking
for it in the place where r3 would have been stored since it thinks it
is only 32 bits. So on that platform I get, for example:

> table.concat({{}, {}}, ',')
stdin:1: invalid value (table) at index 539390232 in table for 'concat'

It wouldn't surprise me if there were other format-string errors of this
kind, though I've not checked yet.

(Original report on the freenode #lua IRC channel by "no-n", analysis is
mine.)

--
Andrew.
Reply | Threaded
Open this post in threaded view
|

Re: Bug in error message for table.concat

Gavin Wraith
In message <[hidden email]>
          Andrew Gierth <[hidden email]> wrote:

>The addfield() subroutine of table.concat is (in 5.3.x and 5.4.x):
>
>static void addfield (lua_State *L, luaL_Buffer *b, lua_Integer i) {
>  lua_geti(L, 1, i);
>  if (!lua_isstring(L, -1))
>    luaL_error(L, "invalid value (%s) at index %d in table for 'concat'",
>                  luaL_typename(L, -1), i);
>  luaL_addvalue(b);
>}
>
>But this error message is wrong, because %d expects an "int" value, not
>a lua_Integer.
>
>This shows up most clearly on 32-bit ARM (which is what the IRC user who
>reported it was using); under the rules for that platform, a 64-bit int
>as the 4th arg after 3 pointers ends up on the stack, because register
>alignment rules prevent it going into r3; but pushvfstring is looking
>for it in the place where r3 would have been stored since it thinks it
>is only 32 bits. So on that platform I get, for example:
>
>> table.concat({{}, {}}, ',')
>stdin:1: invalid value (table) at index 539390232 in table for 'concat'

I get this error too, with Lua 5.4.2 using 64-bit numbers on a Raspberry Pi3B+
under RISC OS.

--
Gavin Wraith ([hidden email])
Home page: http://www.wra1th.plus.com/
Reply | Threaded
Open this post in threaded view
|

Re: Bug in error message for table.concat

Roberto Ierusalimschy
In reply to this post by Andrew Gierth
> The addfield() subroutine of table.concat is (in 5.3.x and 5.4.x):
>
> [...]
>
> But this error message is wrong, because %d expects an "int" value, not
> a lua_Integer.

Thanks for the report.


> It wouldn't surprise me if there were other format-string errors of this
> kind, though I've not checked yet.

I looked for the pattern '%[fIdc]' in the source and could not find
any other case.

-- Roberto
Reply | Threaded
Open this post in threaded view
|

Re: Bug in error message for table.concat

Roberto Ierusalimschy
> > It wouldn't surprise me if there were other format-string errors of this
> > kind, though I've not checked yet.
>
> I looked for the pattern '%[fIdc]' in the source and could not find
> any other case.

(Of the error, not of the pattern.)

-- Roberto
Reply | Threaded
Open this post in threaded view
|

Re: Bug in error message for table.concat

Roberto Ierusalimschy
In reply to this post by Andrew Gierth
> This shows up most clearly on 32-bit ARM (which is what the IRC user who
> reported it was using); [...]
>
> > table.concat({{}, {}}, ',')
> stdin:1: invalid value (table) at index 539390232 in table for 'concat'

A more portable example:

> table.concat({}, "", math.maxinteger, math.maxinteger)
stdin:1: invalid value (nil) at index -1 in table for 'concat'

-- Roberto