• Icon: Bug Bug
    • Resolution: Duplicate
    • Icon: Major Major
    • None
    • rhel-10.0
    • lua
    • None
    • None
    • rhel-sst-cs-software-management
    • ssg_core_services
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • Red Hat Enterprise Linux
    • None
    • None
    • None
    • None

      Findings from https://issues.redhat.com/browse/RHEL-34401

      "Error: INTEGER_OVERFLOW (CWE-190):
      lua-5.4.6/src/lvm.c:661:9: ineffective_check: The check ""l >= 9223372036854775807UL - tl"", which appears to be a guard against integer overflow, is not a useful guard because ""tl"" is wider than ""9223372036854775807UL"". This taints ""tl"".
      lua-5.4.6/src/lvm.c:665:9: overflow: The tainted expression ""tl"" is used in an arithmetic operation. The expression ""tl"" is considered to have possibly overflowed.
      lua-5.4.6/src/lvm.c:661:9: ineffective_check: The check ""l >= 9223372036854775807UL - tl"", which appears to be a guard against integer overflow, is not a useful guard because ""tl"" is wider than ""9223372036854775807UL"". This taints ""tl"".
      lua-5.4.6/src/lvm.c:665:9: overflow: The tainted expression ""tl"" is used in an arithmetic operation. The expression ""tl"" is considered to have possibly overflowed.
      lua-5.4.6/src/lvm.c:661:9: ineffective_check: The check ""l >= 9223372036854775807UL - tl"", which appears to be a guard against integer overflow, is not a useful guard because ""tl"" is wider than ""9223372036854775807UL"". This taints ""tl"".
      lua-5.4.6/src/lvm.c:665:9: overflow: The tainted expression ""tl"" is used in an arithmetic operation. The expression ""tl"" is considered to have possibly overflowed.
      lua-5.4.6/src/lvm.c:673:9: overflow_sink: ""tl"", which might have overflowed, is passed to ""luaS_createlngstrobj(L, tl)"".
      #  671|         }
      #  672|         else {  /* long string; copy strings directly to final result */
      #  673|->         ts = luaS_createlngstrobj(L, tl);
      #  674|           copy2buff(top, n, getstr(ts));
      #  675|         }"
      

      This seems to have a patch upstream:
      https://github.com/lua/lua/commit/5853c37a83ec66ccb45094f9aeac23dfdbcde671

              mdomonko@redhat.com Michal Domonkos
              mdomonko@redhat.com Michal Domonkos
              packaging-team-maint packaging-team-maint
              bot rhel-cs-apps-subsystem-qe bot rhel-cs-apps-subsystem-qe
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: