From 2abd8b3134bf578e42b064159d42430b87dd9352 Mon Sep 17 00:00:00 2001 From: payonel Date: Sat, 16 Sep 2017 08:40:48 +0200 Subject: [PATCH] closes #2507 /bin/less and /bin/more were able to lock up the system if they call string.gsub(string, function) on a very large string (~144k chars long). The machine layer intercepts expensive strings calls by checking the length of the string, but it does not intercept gsub calls when the replace action is a function The fix is to intercept all long string actions, not just non-function replacement gsub calls Note that /bin/more is now more efficient and doesn't call string.gsub, but this is still the right fix to keep the sandbox from being able to lock up the system with string methods --- src/main/resources/assets/opencomputers/lua/machine.lua | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/resources/assets/opencomputers/lua/machine.lua b/src/main/resources/assets/opencomputers/lua/machine.lua index cb0069831..06f07a70f 100644 --- a/src/main/resources/assets/opencomputers/lua/machine.lua +++ b/src/main/resources/assets/opencomputers/lua/machine.lua @@ -577,7 +577,7 @@ do checkArg(3, repl, "number", "string", "function", "table") checkArg(4, n, "number", "nil") - if #s < SHORT_STRING or type(repl) == "function" then + if #s < SHORT_STRING then return string_gsub(s, pattern, repl, n) end