Lua — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

One compile-time O(n²) defect in the Lua 5.x parser. searchupvalue() in lparser.c:360 performs an O(N) linear scan over upvalue names for every upvalue reference during compilation, causing O(N²) total for functions with many upvalues. Patch ready for upstream review.

The Defects

lua-0001 (PATCHED — HIGH): lparser.c:360

/* searchupvalue() — per variable reference at compile time: */
static int searchupvalue(FuncState *fs, TString *name) {
    int i;
    Upvaldesc *up = fs->f->upvalues;
    for (i = 0; i < fs->nups; i++) {  /* O(N) scan per reference */
        if (eqstr(up[i].name, name))
            return i;
    }
    return -1;
}

Linear scan over all N upvalues per reference. Every variable reference in an inner function that might be an upvalue calls searchupvalue(). For N upvalues and R references: O(R × N) compile-time cost.

Complexity Proof

For N upvalues in a closure:

Per variable reference: O(N) scan
Total: O(R × N) — scales with upvalue count and reference count
Fixed: fixed-size hash table in FuncState for O(1) per reference

Impact

All Lua code with closures that capture many variables from enclosing scopes. Lua is the most widely embedded scripting language — used in game engines (LÖVE, Roblox, World of Warcraft), web servers (nginx/OpenResty), embedded systems, and configuration systems. Large closure-heavy Lua programs (game scripts, configuration DSLs) compile faster with the fix. The defect is compile-time only — no runtime overhead.

The Fix

Add a fixed-size hash table in FuncState for O(1) upvalue lookup:

/* Before */
/* O(N) linear scan per variable reference */
static int searchupvalue(FuncState *fs, TString *name) {
    for (int i = 0; i < fs->nups; i++) {
        if (eqstr(fs->f->upvalues[i].name, name)) return i;
    }
    return -1;
}

/* After */
/* CWE-407 fix: fixed-size hash table in FuncState for O(1) upvalue lookup. */
static int searchupvalue(FuncState *fs, TString *name) {
    /* hash(name->hash % UPVALUE_HASH_SIZE) → index */
    return upvalue_hash_lookup(&fs->upvalue_hash, name);
}

Patch

defects/lua/patch/lua-0001-parser-upvalue-hashtable.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your parser and compiler test suite.
Assess CVE eligibility — compile-time overhead for closure-heavy Lua programs.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.7 KiB Raw Blame History Unescape Escape