Limit number of string format elements to compile.

Reported by pwnhacker0x18. #1203

diff --git a/src/lj_ffrecord.c b/src/lj_ffrecord.c
index 923824d9c697df71582ab5b34971ee8cfc75e89b..b298d3f77600984bc846b8c663846417b6e0505d 100644 (file)
--- a/src/lj_ffrecord.c
+++ b/src/lj_ffrecord.c
@@ -1005,6 +1005,7 @@ static void recff_format(jit_State *J, RecordFFData *rd, TRef hdr, int sbufx)
   GCstr *fmt = argv2str(J, &rd->argv[arg]);
   FormatState fs;
   SFormat sf;
+  int nfmt = 0;
   /* Specialize to the format string. */
   emitir(IRTG(IR_EQ, IRT_STR), trfmt, lj_ir_kstr(J, fmt));
   lj_strfmt_init(&fs, strdata(fmt), fmt->len);
@@ -1082,6 +1083,7 @@ static void recff_format(jit_State *J, RecordFFData *rd, TRef hdr, int sbufx)
       recff_nyiu(J, rd);
       return;
     }
+    if (++nfmt > 100) lj_trace_err(J, LJ_TRERR_TRACEOV);
   }
   if (sbufx) {
     emitir(IRT(IR_USE, IRT_NIL), tr, 0);