29 lines
1 KiB
Markdown
29 lines
1 KiB
Markdown
# Lua — CWE-407 Diamond Recursion Scan: CLEAN
|
|
|
|
## Scan Date
|
|
2026-03-29
|
|
|
|
## Targets Checked
|
|
|
|
### 1. Metamethod dispatch (`__index` / `__newindex` chains, `lvm.c`)
|
|
- **File:** `lvm.c`, line 50: `#define MAXTAGLOOP 2000`
|
|
- **Mechanism:** Tag-method chains are bounded by `MAXTAGLOOP` counter (2000 steps).
|
|
Any `__index` chain exceeding this triggers `luaG_runerror("'__index' chain too long")`.
|
|
- No recursive graph traversal — iterative loop with hard cap.
|
|
- **Result:** CLEAN (bounded by counter).
|
|
|
|
### 2. Type system
|
|
- Lua is dynamically typed. There is no compile-time type hierarchy, no module
|
|
inclusion graph, and no type inference pass.
|
|
- No concept of module diamonds exists at the language level.
|
|
- **Result:** CLEAN (not applicable).
|
|
|
|
### 3. Parser (`lparser.c`)
|
|
- Block/scope tracking uses a linked list of `BlockCnt` structs — O(depth) stack.
|
|
No graph traversal.
|
|
- **Result:** CLEAN.
|
|
|
|
## Conclusion
|
|
|
|
No CWE-407 diamond recursion defects found in Lua. The language has no compile-time
|
|
type graph; runtime metamethod chains are bounded by `MAXTAGLOOP`.
|