@@ -309,21 +309,27 @@ static const char *generic_reader (lua_State *L, void *ud, size_t *size) {
309309}
310310
311311
312+ /*
313+ ** Loads a chunk and pushes an executer function to the stack. If the loading
314+ ** resulted in an error, pushes nil and an error string. Standard Lua 5.2 allows
315+ ** loading strings containing either Lua code or precompiled bytecode, but
316+ ** bytecode loading has been removed due to it being the entry point for many
317+ ** security vulnerabilities.
318+ */
312319static int luaB_load (lua_State * L ) {
313320 int status ;
314321 size_t l ;
315322 const char * s = lua_tolstring (L , 1 , & l );
316- const char * mode = luaL_optstring (L , 3 , "bt" );
317323 int env = (!lua_isnone (L , 4 ) ? 4 : 0 ); /* 'env' index or 0 if no 'env' */
318324 if (s != NULL ) { /* loading a string? */
319325 const char * chunkname = luaL_optstring (L , 2 , s );
320- status = luaL_loadbufferx (L , s , l , chunkname , mode );
326+ status = luaL_loadbufferx (L , s , l , chunkname , "t" ); /* always text mode */
321327 }
322328 else { /* loading from a reader function */
323329 const char * chunkname = luaL_optstring (L , 2 , "=(load)" );
324330 luaL_checktype (L , 1 , LUA_TFUNCTION );
325331 lua_settop (L , RESERVEDSLOT ); /* create reserved slot */
326- status = lua_load (L , generic_reader , NULL , chunkname , mode );
332+ status = lua_load (L , generic_reader , NULL , chunkname , "t" ); /* always text mode */
327333 }
328334 return load_aux (L , status , env );
329335}
0 commit comments