skynet.timeout 傳進去 number 範圍內的數值但是會溢出,
調查發現 skynet.timeout 調用的是 c 的方法:
c.intcommand("TIMEOUT",ti)
對應的C方法中會把傳入的 number 轉換成 int32:
static int
lintcommand(lua_State *L) {
struct skynet_context * context = lua_touserdata(L, lua_upvalueindex(1));
const char * cmd = luaL_checkstring(L,1);
const char * result;
const char * parm = NULL;
char tmp[64]; // for integer parm
if (lua_gettop(L) == 2) {
if (lua_isnumber(L, 2)) {
int32_t n = (int32_t)luaL_checkinteger(L,2);
sprintf(tmp, "%d", n);
parm = tmp;
} else {
parm = luaL_checkstring(L,2);
}
}
result = skynet_command(context, cmd, parm);
if (result) {
char *endptr = NULL;
lua_Integer r = strtoll(result, &endptr, 0);
if (endptr == NULL || *endptr != '\0') {
// may be real number
double n = strtod(result, &endptr);
if (endptr == NULL || *endptr != '\0') {
return luaL_error(L, "Invalid result %s", result);
} else {
lua_pushnumber(L, n);
}
} else {
lua_pushinteger(L, r);
}
return 1;
}
return 0;
}
所以傳入數字不再 2^31 ~ -2^31 的值都將會溢出,然後就導致bug產生。