Findings from https://issues.redhat.com/browse/RHEL-34401
"Error: INTEGER_OVERFLOW (CWE-190): lua-5.4.6/src/lvm.c:661:9: ineffective_check: The check ""l >= 9223372036854775807UL - tl"", which appears to be a guard against integer overflow, is not a useful guard because ""tl"" is wider than ""9223372036854775807UL"". This taints ""tl"". lua-5.4.6/src/lvm.c:665:9: overflow: The tainted expression ""tl"" is used in an arithmetic operation. The expression ""tl"" is considered to have possibly overflowed. lua-5.4.6/src/lvm.c:661:9: ineffective_check: The check ""l >= 9223372036854775807UL - tl"", which appears to be a guard against integer overflow, is not a useful guard because ""tl"" is wider than ""9223372036854775807UL"". This taints ""tl"". lua-5.4.6/src/lvm.c:665:9: overflow: The tainted expression ""tl"" is used in an arithmetic operation. The expression ""tl"" is considered to have possibly overflowed. lua-5.4.6/src/lvm.c:661:9: ineffective_check: The check ""l >= 9223372036854775807UL - tl"", which appears to be a guard against integer overflow, is not a useful guard because ""tl"" is wider than ""9223372036854775807UL"". This taints ""tl"". lua-5.4.6/src/lvm.c:665:9: overflow: The tainted expression ""tl"" is used in an arithmetic operation. The expression ""tl"" is considered to have possibly overflowed. lua-5.4.6/src/lvm.c:673:9: overflow_sink: ""tl"", which might have overflowed, is passed to ""luaS_createlngstrobj(L, tl)"". # 671| } # 672| else { /* long string; copy strings directly to final result */ # 673|-> ts = luaS_createlngstrobj(L, tl); # 674| copy2buff(top, n, getstr(ts)); # 675| }"
This seems to have a patch upstream:
https://github.com/lua/lua/commit/5853c37a83ec66ccb45094f9aeac23dfdbcde671