Charles Reiss

The lock parsing/evaluation/unparsing code is recursive and the only limits on the number of levels are based on what can be fit in a (~8KB) lock string. It might be...

(C) stack overflow from array_compare and nested arrays and array_pin

3

The MUF program ``` : main { 1 2 3 }list ARRAY_PIN var! x { 4 5 6 }list ARRAY_PIN var! y x @ y @ 0 ARRAY_SETITEM POP y...

memory leak from nested arrays and array_pin

4

Nested arrays and array_pin can leak memory. For example, the MUF program: ``` : main { }dict ARRAY_PIN DUP 0 ARRAY_SETITEM DUP DUP ARRAY_SETITEM ; ``` leaks memory (AddressSanitizer report):...

MUF arithmetic operations `+`,` -`, `bitshift` allow overflow/underflow to happen or bitshifts which are larger than the size of an integer. For `+` and `-`, they detect when this produces...

Something like `2147483647 1 +` can overflow without making `err_ibounds?` true when the `optimize_muf` `@tune` is set. This is because the constant folding performed in `OptimizeIntermediate` does not check for...

array_tree_compare tries to compare floats using a margin of DBL_EPSILON, but this means that its comparison is not transitive. It also uses division by one of the values being compared...