# Lua — CWE-407 Diamond Recursion Scan: CLEAN

## Scan Date
2026-03-29

## Targets Checked

### 1. Metamethod dispatch (`__index` / `__newindex` chains, `lvm.c`)
- **File:** `lvm.c`, line 50: `#define MAXTAGLOOP 2000`
- **Mechanism:** Tag-method chains are bounded by `MAXTAGLOOP` counter (2000 steps).
  Any `__index` chain exceeding this triggers `luaG_runerror("'__index' chain too long")`.
- No recursive graph traversal — iterative loop with hard cap.
- **Result:** CLEAN (bounded by counter).

### 2. Type system
- Lua is dynamically typed. There is no compile-time type hierarchy, no module
  inclusion graph, and no type inference pass.
- No concept of module diamonds exists at the language level.
- **Result:** CLEAN (not applicable).

### 3. Parser (`lparser.c`)
- Block/scope tracking uses a linked list of `BlockCnt` structs — O(depth) stack.
  No graph traversal.
- **Result:** CLEAN.

## Conclusion

No CWE-407 diamond recursion defects found in Lua. The language has no compile-time
type graph; runtime metamethod chains are bounded by `MAXTAGLOOP`.