From 4cccf8c6b2c2b1af0afafef52bc87477ba7f817a Mon Sep 17 00:00:00 2001 From: Benoit Giannangeli Date: Fri, 12 May 2017 08:20:15 +0200 Subject: luaV_concat: 'total' should not be used inside the loop If there's a table in the concat sequence, we ended up with a toconcat array with undefined slots. --- src/lvm.js | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) (limited to 'src') diff --git a/src/lvm.js b/src/lvm.js index d86b783..542dd61 100644 --- a/src/lvm.js +++ b/src/lvm.js @@ -973,14 +973,13 @@ const luaV_concat = function(L, total) { delete L.stack[top - 1]; } else { /* at least two non-empty string values; get as many as possible */ - let toconcat = new Array(total); - toconcat[total-1] = L.stack[top-1].svalue(); + let concatenated = L.stack[top-1].svalue(); delete L.stack[top - 1]; for (n = 1; n < total && tostring(L, top - n - 1); n++) { - toconcat[total-n-1] = L.stack[top - n - 1].svalue(); + concatenated = L.stack[top - n - 1].svalue().concat(concatenated); delete L.stack[top - n - 1]; } - let ts = lstring.luaS_bless(L, Array.prototype.concat.apply([], toconcat)); + let ts = lstring.luaS_bless(L, concatenated); L.stack[top - n] = new lobject.TValue(CT.LUA_TLNGSTR, ts); } total -= n - 1; /* got 'n' strings to create 1 new */ -- cgit v1.2.3-70-g09d2