Integer overflow (leading to stack-based buffer overflow) in embedded lua_struct.c
Author: Crispy-fried-chickenCreated Feb 3, 2024Updated Nov 28, 2024
`getnum` in `app/modules/struct.c` potentially has an integer overflow if `fmt` is set too large. It might be triggered by running such lua statement: `EVAL "struct.pack('>I2147483648', '10')" 0` It can be easily avoid by adding a bound check in `getnum`, and I'd like to open a PR for that if necessary.
Source: nodemcu/nodemcu-firmware